Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor(rule-engine): Revamp rule engine #452

Merged
merged 2 commits into from
Feb 26, 2025
Merged

Conversation

rabbitstack
Copy link
Owner

@rabbitstack rabbitstack commented Feb 25, 2025

What is the purpose of this PR / why it is needed?

Refactor the rule engine code by moving it into a separate package and segregating the main building blocks into distinct source files. Along the way, shift the state machine states from expression names to simple integer indices representing sequence IDs.
As a side effect of the refactoring, a new config flag is introduced to designate if the rule engine match all strategy is enabled. If this strategy is enabled, a single event can trigger multiple rules, both simple and sequence rules.

What type of change does this PR introduce?


Uncomment one or more /kind <> lines:

/kind feature (non-breaking change which adds functionality)

/kind bug-fix (non-breaking change which fixes an issue)

/kind refactor (non-breaking change that restructures the code, while not changing the original functionality)

/kind breaking (fix or feature that would cause existing functionality to not work as expected

/kind cleanup

/kind improvement

/kind design

/kind documentation

/kind other (change that doesn't pertain to any of the above categories)

Any specific area of the project related to this PR?


Uncomment one or more /area <> lines:

/area instrumentation

/area telemetry

/area rule-engine

/area filters

/area yara

/area event

/area captures

/area alertsenders

/area outputs

/area rules

/area filaments

/area config

/area cli

/area tests

/area ci

/area build

/area docs

/area deps

/area other

Special notes for the reviewer


Does this PR introduce a user-facing change?


Convey the new rule engine match strategy and highlight that the match all strategy is enabled by default.

@rabbitstack rabbitstack added the rule-engine Anything related to the rule engine label Feb 25, 2025
@rabbitstack rabbitstack force-pushed the refactor-rule-engine branch 2 times, most recently from b090181 to 9117275 Compare February 26, 2025 17:30
Refactor the rule engine code by moving it into a
separate package and segregating the main building
blocks into distinct source files. Along the way,
shift the state machine states from expression names
to simple integer indices representing sequence ids.
The match all rule engine strategy permits
a single event to trigger multiple rules.
@rabbitstack rabbitstack merged commit b0dabe0 into master Feb 26, 2025
9 checks passed
@rabbitstack rabbitstack deleted the refactor-rule-engine branch February 26, 2025 19:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
rule-engine Anything related to the rule engine
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant