Merge pull request #52 from SpecterOps/noseyparker-rules-folder

Get NoseyParker rules from folder

cmd/enrichment/enrichment/lib/helpers.py

@@ -1311,8 +1311,8 @@ def run_noseyparker(path: str) -> Optional[pb.NoseyParker]:
             "scan",
             "--datastore",
             temp_dir,
-            "--rules",
-            "/opt/noseyparker/noseyparker.rules",
+            "--rules-path",
+            "/opt/noseyparker-rules",
             path,
         ],
         stdout=subprocess.PIPE,

helm/nemesis/templates/enrichment.yaml

@@ -286,8 +286,7 @@ spec:
             - name: noseyparker
               mountPath: /opt/noseyparker/
             - name: noseyparker-rules
-              mountPath: /opt/noseyparker/noseyparker.rules
-              subPath: noseyparker.rules
+              mountPath: /opt/noseyparker-rules
               readOnly: true
             - name: yara-rules
               mountPath: /app/cmd/enrichment/enrichment/lib/public_yara/extrarules

helm/nemesis/templates/noseyparker.yml

@@ -3,5 +3,13 @@ kind: ConfigMap
 metadata:
   name: noseyparker-rules
 data:
-  noseyparker.rules: |
-    {{.Files.Get "files/noseyparker/noseyparker.yaml" | nindent 4}}
+  {{- $files := .Files.Glob "files/noseyparker/*.yaml" }}
+  {{- if $files }}
+  {{- range $path, $_ := $files }}
+    {{ $path | base | trimSuffix ".yaml" | printf "%s.rules" }}: |
+    {{- $.Files.Get $path | nindent 6 }}
+  {{- end }}
+  {{- else }}
+    noseyparker.rules: |
+      # Placeholder
+  {{- end }}