Conversation
of fields in new dumped rba object json
| "nes_fields": self.nes_fields, | ||
| "rba": self.rba, | ||
| } | ||
| if self.rba is not None: |
There was a problem hiding this comment.
Since these are encoded in individual risk_objects, I do not believe they should be included at a high-level for the entire RBA section anymore.
| RiskScoreValue_Type = Annotated[int, Field(ge=1, le=100)] | ||
|
|
||
|
|
||
| def risk_score_to_severity(num: int) -> RiskSeverity: |
There was a problem hiding this comment.
If risk_severity needs to exist both for individual risk_objects AND at a high level for the entire RBA section, then this should be broken out here so it can be re-used.
It is also used in the savedsearches.conf dump logic here:
Is this a required field that MUST still be present in savedsearches.conf?
| "id", | ||
| "description", | ||
| "tags", | ||
| "rba", |
There was a problem hiding this comment.
Make sure that the RBA field is written when a detection is dumped to JSON.
|
After discussing with relevant team(s), this PR will likely be closed out in favor of another that implements the relevant changes. |
|
This PR has been closed. New work will be focused on the following PR, which supersedes this one: |
1 participant
Make sure that relevant/required fields are included in the detections.json API object