-
Notifications
You must be signed in to change notification settings - Fork 0
Description
Story (Outcome/Output) (Required)
As a Sigma rule repository has more and more converted and deployed rules, the conversion and deployment folders will quickly grow to an extent that they are hard to effectively navigate, as the converter and integrator currently only write their output files directly into them. We should provide an option to nest these folders in a sensible way.
Context
When originally developing the actions, for simplicity, we designed them with the assumption both the conversion and deployment folder would not be nested. However, now we have reached a more mature state, allowing nested folders seems appropriate.
Definition of Done (Required)
An appropriate nesting structure for the conversion and deployment folder is identified, which doesn't break if a single Sigma rule file is converted multiple times, and can be migrated to with a simple configuration flag in the config.
Implementation Plan
Splitting the conversion output by conversion config, and the integrator output by rule group could be a reasonable approach, as it would avoid issues with Sigma rules being involved in multiple conversions.
Testing Plan
Significant testing with changes to the Sigma files will be necessary, given our previous assumptions about the folder structure.
Dependencies (Required)
None