Update RBA API Output #379
Conversation
of fields in new dumped rba object json
| } | ||
| if self.rba is not None: |
There was a problem hiding this comment.
Since these are encoded in individual risk_objects, I do not believe they should be included at a high-level for the entire RBA section anymore.
| @@ -11,6 +11,23 @@ | |||
| RiskScoreValue_Type = Annotated[int, Field(ge=1, le=100)] | |||
|
|
|||
|
|
|||
| def risk_score_to_severity(num: int) -> RiskSeverity: | |||
There was a problem hiding this comment.
If risk_severity needs to exist both for individual risk_objects AND at a high level for the entire RBA section, then this should be broken out here so it can be re-used.
It is also used in the savedsearches.conf dump logic here:
Is this a required field that MUST still be present in savedsearches.conf?
| @@ -39,6 +40,7 @@ def writeDetections( | |||
| "id", | |||
| "description", | |||
| "tags", | |||
| "rba", | |||
There was a problem hiding this comment.
Make sure that the RBA field is written when a detection is dumped to JSON.
|
After discussing with relevant team(s), this PR will likely be closed out in favor of another that implements the relevant changes. |
Make sure that relevant/required fields are included in the detections.json API object