From e1e0e4ad9cf771d5a450a17e741c06c9657ab578 Mon Sep 17 00:00:00 2001
From: Hari Krishna <hari.100.hks@outlook.com>
Date: Fri, 14 Jun 2024 05:04:24 +0000
Subject: [PATCH] made the sigma rule disable logic better and simple

---
 functions/onprem/orborus/orborus.go | 67 ++++++-----------------------
 1 file changed, 12 insertions(+), 55 deletions(-)

diff --git a/functions/onprem/orborus/orborus.go b/functions/onprem/orborus/orborus.go
index 2eef9435..71c9955d 100755
--- a/functions/onprem/orborus/orborus.go
+++ b/functions/onprem/orborus/orborus.go
@@ -2033,7 +2033,7 @@ func main() {
 
 			    } else if incRequest.Type == "DISABLE_SIGMA_FILE" {
 					  fileName := incRequest.ExecutionArgument
-					  err = disableSigmaRule(fileName)
+					  err = removeFile(fileName)
 					  if err != nil {
 						log.Printf("[ERROR] Failed to disable the sigma file %s, reason: %s", fileName, err)
 					}
@@ -2041,18 +2041,11 @@ func main() {
 					  toBeRemoved.Data = append(toBeRemoved.Data, incRequest)
 
 				} else if incRequest.Type == "DISABLE_SIGMA_RULES" {
-					err := manageSigmaFolder("disable")
+					err := removeAllFiles()
 					if err != nil {
 					 log.Printf("[ERROR] Failed to disable the sigma rules: %s", err)
 					}
 
-					toBeRemoved.Data = append(toBeRemoved.Data, incRequest)
-			    } else if incRequest.Type == "ENABLE_SIGMA_RULES" {
-					err := manageSigmaFolder("enable")
-					if err != nil {
-					 log.Printf("[ERROR] Failed to enable the sigma rules: %s", err)
-					}
-
 					toBeRemoved.Data = append(toBeRemoved.Data, incRequest)
 			    } else {
 					newrequests = append(newrequests, incRequest)
@@ -3029,7 +3022,7 @@ func copyToTenzir(srcPath, destPath string) error {
 	return nil
 }
 
-func disableSigmaRule(fileName string) error {
+func removeFile(fileName string) error {
 	containerName := "tenzir-node"
 	srcPath := fmt.Sprintf("/var/lib/tenzir/sigma_rules/%s", fileName)
 
@@ -3038,57 +3031,21 @@ func disableSigmaRule(fileName string) error {
 		return fmt.Errorf("source file does not exist: %v", err)
 	}
 
-	rmCmd := exec.Command("docker", "exec", "-u", "root", containerName, "rm", srcPath)
-	if err := rmCmd.Run(); err != nil {
-		return fmt.Errorf("error removing file: %v", err)
-	}
-
-	return nil
+	return removePath(containerName, srcPath)
 }
 
-func manageSigmaFolder(action string) error {
+func removeAllFiles() error {
 	containerName := "tenzir-node"
-	sigmaPath := "/var/lib/tenzir/sigma_rules"
+	sigmaPath := "/var/lib/tenzir/sigma_rules/*"
 
-	if action == "disable" {
+	return removePath(containerName, sigmaPath)
+}
 
-		checkSigmaCmd := exec.Command("docker", "exec", containerName, "test", "-d", sigmaPath)
-		if err := checkSigmaCmd.Run(); err != nil {
-			return fmt.Errorf("sigma_files directory does not exist: %v", err)
-		}
-
-		// Rename sigma_files to disabled_sigma
-		renameCmd := exec.Command("docker", "exec", "-u", "root", containerName, "mv", sigmaPath, disabledPath)
-		if err := renameCmd.Run(); err != nil {
-			return fmt.Errorf("error renaming sigma_files to disabled_sigma: %v", err)
-		}
-
-		// Create a new sigma_files directory
-		createCmd := exec.Command("docker", "exec", "-u", "root", containerName, "mkdir", sigmaPath)
-		if err := createCmd.Run(); err != nil {
-			return fmt.Errorf("error creating new sigma_files directory: %v", err)
-		}
-	} else if action == "enable" {
-		
-		checkDisabledCmd := exec.Command("docker", "exec", containerName, "test", "-d", disabledPath)
-		if err := checkDisabledCmd.Run(); err != nil {
-			return fmt.Errorf("disabled_sigma directory does not exist: %v", err)
-		}
-
-		removeCmd := exec.Command("docker", "exec", "-u", "root", containerName, "rm", "-rf", sigmaPath)
-		if err := removeCmd.Run(); err != nil {
-			return fmt.Errorf("error removing existing sigma_files directory: %v", err)
-		}
-
-		// Rename disabled_sigma back to sigma_files
-		renameBackCmd := exec.Command("docker", "exec", "-u", "root", containerName, "mv", disabledPath, sigmaPath)
-		if err := renameBackCmd.Run(); err != nil {
-			return fmt.Errorf("error renaming disabled_sigma back to sigma_files: %v", err)
-		}
-	} else {
-		return fmt.Errorf("invalid action: %s", action)
+func removePath(containerName, path string) error {
+	rmCmd := exec.Command("docker", "exec", "-u", "root", containerName, "rm", "-r", path)
+	if err := rmCmd.Run(); err != nil {
+		return fmt.Errorf("error removing path: %v", err)
 	}
-
 	return nil
 }