Skip to content

Expand definition of jupiterone_rule.operations #139

Description

@asaba-hashi

Problem to Solve

Operations are currently represented in the HCL as a single JSON document that is marshalled into complex types. This combined with ids that are generated on creation make it difficult to keep the state consistent with values read from the serer which can result in spurious differences being reported.

Proposed Changed

Add operations as it's own list such that it each operation can be specified itself, but still support copy/paste from the J1 UI using jsonencode.

  operations = [
    {
      when = jsonencode({
        "type" : "FILTER",
        "specVersion" : 1,
        "condition" : [
          "AND",
          [
            "queries.query0.total",
            "<",
            1000
          ]
        ]
      }),
      actions = [
        jsonencode({
          "targetValue" : "INFO",
          "type" : "SET_PROPERTY",
          "targetProperty" : "alertLevel"
        }),
        jsonencode({
          "type" : "CREATE_ALERT"
        })
      ]
    }
  ]

This will be a breaking change from 0.5.0:

  1. JSON strings/heredocs must be changed to jsonencode blocks.
  2. Likely some other smaller changes will be necessary for the current alert schema.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions