Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Correlation query typing phase, query expressions #206

Merged
merged 7 commits into from
Mar 26, 2024
Merged

Correlation query typing phase, query expressions #206

merged 7 commits into from
Mar 26, 2024

Conversation

thomaspatzke
Copy link
Member

  • Added typing phase to correlation query generation.
  • Added query expressions that allow to generate further query parts around the generated query, e.g. specification of the data source like from <source> | <query>
  • Added possibility to pass arbitrary parameters to convert_correlation_search that are passed to the string format context.
  • Correlation multi-rule search query and typing query postprocessing.
  • Fix: missing aliasing in backend correlation support only raises errors if aliases appear in rule.

@thomaspatzke
Added typing phase to correlation query expression template
38bd0ef
@thomaspatzke
Query expressions
b03bafe
@thomaspatzke
Removed pipeline state from query expression
e9fdde0 
It's not needed because the conversion state is initialized with the pipeine state.
@thomaspatzke
Storing final conversion state into rule object
2b3a1a6
@thomaspatzke
Fixed type annotation
154b320
@thomaspatzke
Renamed get_conversion_state
8fdbffc
@thomaspatzke
Various correlation query improvements
de73540 
* Added possibility to pass arbitrary parameters to convert_correlation_search that are passed to the string format context.
* Correlation multi-rule search query and typing query postprocessing.
* Fix: missing aliasing in backend correlation support only raises errors if aliases appear in rule.
@thomaspatzke thomaspatzke merged commit 2c29ae1 into main Mar 26, 2024
24 checks passed
@thomaspatzke thomaspatzke deleted the query_expressions branch March 26, 2024 23:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@thomaspatzke