Use the new JSON object editor for RulesRepos config entries

This commit is contained in:
Corey Ogburn
2025-05-19 15:37:33 -06:00
parent 11fb33fdeb
commit 39f74fe547

View File

@@ -344,6 +344,23 @@ soc:
advanced: True
forcedType: "[]{}"
helpLink: sigma.html
syntax: json
uiElements:
- field: rulesetName
label: Ruleset Name
- field: repo
label: Repo URL
required: True
- field: branch
label: Branch
- field: license
label: License
required: True
- field: folder
label: Folder
- field: community
label: Community
forcedType: bool
airgap: *eerulesRepos
sigmaRulePackages:
description: 'Defines the Sigma Community Ruleset you want to run. One of these (core | core+ | core++ | all ) as well as an optional Add-on (emerging_threats_addon). Once you have changed the ruleset here, the new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections --> Options dropdown menu --> Elastalert --> Full Update. WARNING! Changing the ruleset will remove all existing non-overlapping Sigma rules of the previous ruleset and their associated overrides. This removal cannot be undone.'
@@ -459,6 +476,23 @@ soc:
advanced: True
forcedType: "[]{}"
helpLink: yara.html
syntax: json
uiElements:
- field: rulesetName
label: Ruleset Name
- field: repo
label: Repo URL
required: True
- field: branch
label: Branch
- field: license
label: License
required: True
- field: folder
label: Folder
- field: community
label: Community
forcedType: bool
airgap: *serulesRepos
suricataengine:
aiRepoUrl:
@@ -592,7 +626,7 @@ soc:
label: Query
required: True
- field: showSubtitle
label: Show Query in Dropdown.
label: Show Query in Dropdown.
forcedType: bool
queryToggleFilters:
description: Customize togglable query filters that apply to all queries. Exclusive toggles will invert the filter if toggled off rather than omitting the filter from the query.