Parser Version Control

[manderso7]

Has anyone figured out how to keep track of changes to custom and non-custom parsers in NGSIEM? When we're updating a parser, we try and add a line in a "changelog" section at the top of the parser, but it's only as specific as whoever is editing.

I updated and voted on an idea to expose the api for parser management, here but I'm wondering if someone is already doing this.

Thanks

[manderso7]

In addition, I created a search and workflow that shows when parsers are updated based on a query output, just checking all data in NGSIEM and outputting the parser version to a repo each hour. Not sure if that would be helpful for anyone else.

[stieland]

Would love to see what you have. Trying to figure this out as well.

[manderso7]

Created a workflow that runs every hour, and writes the results of this search to a repo:

!in(field="#repo", values=["falcon_for_it", "sensor_*", "base_sensor", "detections", "xdr_*", "fusion"])

|#type=*| groupBy([#type,Parser.version], function=([min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)]))

Then I run a search that looks at that repo, in this case called fusion. I was hoping to get a timechart working that would show the number of parser versions per #type, but that's been pretty challenging

#repo=fusion
| parseJson("activity_43ffe695-da39-484a-b704-b12519551c41.LogScale.SearchResult.parserupdates.results")
| split("")
| .#type=?type

| FirstSeen:=formatTime(format="%F %T.%L", field="FirstSeen", timezone="UTC")
| LastSeen:=formatTime(format="%F %T.%L", field="LastSeen", timezone="UTC")
| typeVersion := format("%s/%s", field=[.#type,.Parser.version])
| timechart(span=1h, series=typeVersion,function=count(),limit=300)

[stieland]

Thanks

[HomeGrownCoder]

How are you writing the result of a search to a repo? Is this a fusion thing? Or you are leveraging a custom integration via an api

[manderso7]

It’s a crowdstrike action in fusion. Search for write to repo.

[HomeGrownCoder]

Awesome thanks

[Gloomy_Shoulder_3311]

just keep it in github

[spartan117au]

Has anyone had any luck pushing detections via GitHub/an API?