Skip to content

Conversation

@rabbitstack
Copy link
Owner

What is the purpose of this PR / why it is needed?

Introduce a new rule formatting style for better
readability and standardization. Generally, the event type is the first condition in the rule, and it almost always appears as an isolated condition on the first line. All binary operators appear at the end of a line, except the unary not operator.

What type of change does this PR introduce?


Uncomment one or more /kind <> lines:

/kind feature (non-breaking change which adds functionality)

/kind bug-fix (non-breaking change which fixes an issue)

/kind refactor (non-breaking change that restructures the code, while not changing the original functionality)

/kind breaking (fix or feature that would cause existing functionality to not work as expected

/kind cleanup

/kind improvement

/kind design

/kind documentation

/kind other (change that doesn't pertain to any of the above categories)

Any specific area of the project related to this PR?


Uncomment one or more /area <> lines:

/area instrumentation

/area telemetry

/area rule-engine

/area filters

/area yara

/area event

/area captures

/area alertsenders

/area outputs

/area rules

/area filaments

/area config

/area cli

/area tests

/area ci

/area build

/area docs

/area deps

/area evasion

/area other

Special notes for the reviewer


Does this PR introduce a user-facing change?


@rabbitstack rabbitstack force-pushed the condensed-rules-formatting branch from 09a769c to 11ab687 Compare December 25, 2025 20:00
@rabbitstack rabbitstack reopened this Dec 25, 2025
@rabbitstack rabbitstack force-pushed the condensed-rules-formatting branch 3 times, most recently from 96a977c to 57e4337 Compare December 26, 2025 11:35
Introduce a new rule formatting style for better
readability and standardization. Generally, the
event type is the first condition in the rule, and
almost always appearing as an isolated condition
on the first line. All binary operators appear at the
end of line, expect the unary not operator.
@rabbitstack rabbitstack merged commit cc7973d into master Dec 26, 2025
10 of 11 checks passed
@rabbitstack rabbitstack deleted the condensed-rules-formatting branch December 26, 2025 14:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants