Skip to content

Allow action output to be nested into folders #219

@kelnage

Description

@kelnage

Story (Outcome/Output) (Required)

As a Sigma rule repository has more and more converted and deployed rules, the conversion and deployment folders will quickly grow to an extent that they are hard to effectively navigate, as the converter and integrator currently only write their output files directly into them. We should provide an option to nest these folders in a sensible way.

Context

When originally developing the actions, for simplicity, we designed them with the assumption both the conversion and deployment folder would not be nested. However, now we have reached a more mature state, allowing nested folders seems appropriate.

Definition of Done (Required)

An appropriate nesting structure for the conversion and deployment folder is identified, which doesn't break if a single Sigma rule file is converted multiple times, and can be migrated to with a simple configuration flag in the config.

Implementation Plan

Splitting the conversion output by conversion config, and the integrator output by rule group could be a reasonable approach, as it would avoid issues with Sigma rules being involved in multiple conversions.

Testing Plan

Significant testing with changes to the Sigma files will be necessary, given our previous assumptions about the folder structure.

Dependencies (Required)

None

Metadata

Metadata

Assignees

No one assigned

    Labels

    converterIssues related to the conversion of Sigma rulesintegratorIssues related to the integration of queries

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions