SigmaHQ
Enhancement on rule promotions
Following a discussion in #5420, actions to be done after merge:
- [x] ~add promoted rules to PR~
- [ ] build artifacts (#5420)
@phantinuss, anything else?
Welcome @ariel-anieli :wave:
It looks like this is your first issue on the Sigma rules repository!
The following repository accepts issues related to false positives or 'rule ideas'.
If you're reporting an issue related to the pySigma library please consider submitting it here
If you're reporting an issue related to the deprecated sigmac library please consider submitting it here
Thanks for taking the time to open this issue, and welcome to the Sigma community! :smiley:
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
These were just open questions. I don't know how much need for it there actually is. (i.e. Me personally: If I want to get a list of changed files, I would just use git log. In the PR there also is a list of changed files. But if someone builds a pipeline around this monthly PR, then I can imagine them making use of a json file.) I was asking you as the PR came from you. If you are having fun doing these things, I won't stop you as it might be useful to someone. But I don't see or know that, yet.
Most useful probably would be build artefacts. I wouldn't even add the list to the body text of the PR.
These were just open questions. I don't know how much need for it there actually is. (i.e. Me personally: If I want to get a list of changed files, I would just use git log. In the PR there also is a list of changed files. But if someone builds a pipeline around this monthly PR, then I can imagine them making use of a json file.) I was asking you as the PR came from you. If you are having fun doing these things, I won't stop you as it might be useful to someone. But I don't see or know that, yet.
Most useful probably would be build artefacts. I wouldn't even add the list to the body text of the PR.
Thanks for your honest feedback, @phantinuss; it's much appreciated. I have singled out that one task.