elasticctl-api 0.9.4

Typed detection-rule model and endpoint wrappers for Elastic Security.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

//! Rule mutation plans with observed state.

use super::*;
use crate::observe::{Observed, Preconditions};

/// Plan enabled changes and return the rule state read for each target.
pub async fn plan_set_enabled_observed(
    t: &Transport,
    selectors: &[String],
    enable: bool,
) -> Result<(MutationPlan, Preconditions)> {
    let resolved = resolve_targets(t, selectors).await?;
    let seen = Preconditions(
        resolved
            .iter()
            .map(|(id, rule)| Observed {
                object: "rule",
                id: id.clone(),
                state: Some(normalize::canonical(rule).into_value()),
            })
            .collect(),
    );
    let preview_details = resolved
        .iter()
        .map(|(id, r)| {
            let from = if r.enabled() { "enabled" } else { "disabled" };
            let to = if enable { "enabled" } else { "disabled" };
            format!("{id}  {}  {from} -> {to}", r.name())
        })
        .collect();
    let verb = if enable { "Enable" } else { "Disable" };
    Ok((
        MutationPlan {
            preview_action: format!("{verb} {} rule(s)", resolved.len()),
            preview_details,
            targets: resolved.into_iter().map(|(id, _)| id).collect(),
        },
        seen,
    ))
}