Generate event rule documentation

This commit is contained in:
Luna 2026-06-15 18:52:28 -07:00
parent e43d7689a0
commit 7f4d5b42fd
8 changed files with 378 additions and 5 deletions

View file

@ -62,9 +62,9 @@ def main(argv: list[str] | None = None) -> int:
sub.add_parser("baseline", help="rebuild listener/SUID baselines")
sub.add_parser("list-detectors", help="list available detectors")
rules = sub.add_parser("rules",
help="list/show/test built-in and configured rules")
help="list/show/test/docs built-in and configured rules")
rules.add_argument("action", nargs="?", default="list",
choices=["list", "show", "test"],
choices=["list", "show", "test", "docs"],
help="rule action (default: list)")
rules.add_argument("target", nargs="?",
help="sid for show, event JSON path for test, or '-'")
@ -170,6 +170,10 @@ def _cmd_rules(cfg: Config, action: str, target: str | None,
from . import ruleops
if action == "docs":
print(ruleops.render_markdown(cfg), end="")
return 0
if action == "list":
rules = ruleops.list_rules(cfg)
if as_json: