elasticctl 0.7.4

Operate Elastic Security as code with a safety-first CLI for security engineers.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106

use crate::cli::{AlertsAction, Cli};
use crate::cmd;
use crate::context::Context;
use elasticctl_api::alerts::AlertStatus;
use elasticctl_core::Error;
use serde_json::Value;

pub(crate) async fn alerts(args: &Cli, action: &AlertsAction) -> Result<Value, Error> {
    match action {
        AlertsAction::List {
            status,
            severity,
            rule,
            tag,
            assignee,
            since,
            search,
            limit,
            with_meta,
        } => match Context::build(&args.global) {
            Ok(ctx) => {
                cmd::alerts::list(
                    &ctx,
                    status.as_deref(),
                    severity.as_deref(),
                    rule.as_deref(),
                    tag.as_deref(),
                    assignee.as_deref(),
                    since.as_deref(),
                    search.as_deref(),
                    *limit,
                    *with_meta,
                )
                .await
            }
            Err(e) => Err(e),
        },
        AlertsAction::Get { alert_id } => match Context::build(&args.global) {
            Ok(ctx) => cmd::alerts::get(&ctx, alert_id).await,
            Err(e) => Err(e),
        },
        AlertsAction::Ack { alert_ids, query } => match Context::build(&args.global) {
            Ok(ctx) => {
                cmd::alerts::transition(
                    &ctx,
                    alert_ids,
                    query.as_deref(),
                    AlertStatus::Acknowledged,
                    None,
                    None,
                )
                .await
            }
            Err(e) => Err(e),
        },
        AlertsAction::Open { alert_ids, query } => match Context::build(&args.global) {
            Ok(ctx) => {
                cmd::alerts::transition(
                    &ctx,
                    alert_ids,
                    query.as_deref(),
                    AlertStatus::Open,
                    None,
                    None,
                )
                .await
            }
            Err(e) => Err(e),
        },
        AlertsAction::Close {
            alert_ids,
            query,
            reason,
            conflicts,
        } => match Context::build(&args.global) {
            Ok(ctx) => {
                cmd::alerts::transition(
                    &ctx,
                    alert_ids,
                    query.as_deref(),
                    AlertStatus::Closed,
                    reason.as_deref(),
                    conflicts.as_deref(),
                )
                .await
            }
            Err(e) => Err(e),
        },
        AlertsAction::Tag {
            alert_ids,
            add,
            remove,
        } => match Context::build(&args.global) {
            Ok(ctx) => cmd::alerts::tag(&ctx, alert_ids, add, remove).await,
            Err(e) => Err(e),
        },
        AlertsAction::Assign {
            alert_ids,
            add,
            remove,
        } => match Context::build(&args.global) {
            Ok(ctx) => cmd::alerts::assign(&ctx, alert_ids, add, remove).await,
            Err(e) => Err(e),
        },
    }
}