feat: allow pre-detector to copy extra fields from log to detection event

logprep/processor/base/rule.py

@@ -290,9 +290,9 @@ def metrics(self):
         return self.Metrics(labels=self.metric_labels)
 
     def __eq__(self, other: object) -> bool:
-        return isinstance(other, Rule) and all(
-            [other.filter == self._filter, other._config == self._config]
-        )
+        if not isinstance(other, Rule):
+            return NotImplemented
+        return all([other.filter == self._filter, other._config == self._config])
 
     def __hash__(self) -> int:
         return id(self)

logprep/processor/pre_detector/rule.py

@@ -122,7 +122,7 @@
 
 from functools import cached_property
 from types import MappingProxyType
-from typing import Optional, Union
+from typing import cast
 from zoneinfo import ZoneInfo
 
 from attrs import asdict, define, field, fields, validators
@@ -181,11 +181,11 @@ class Config(Rule.Config):  # pylint: disable=too-many-instance-attributes
         which can be configured in the pipeline for the pre_detector.
         If this field was specified, then the rule will *only* trigger in case one of
         the IPs from the list is also available in the specified fields."""
-        sigma_fields: Union[list, bool] = field(
+        sigma_fields: list | bool = field(
             validator=validators.instance_of((list, bool)), factory=list
         )
         """tbd"""
-        link: Optional[str] = field(
+        link: str | None = field(
             validator=validators.optional(validators.instance_of(str)), default=None
         )
         """A link to the rule if applicable."""
@@ -229,7 +229,7 @@ class Config(Rule.Config):  # pylint: disable=too-many-instance-attributes
     @property
     def config(self) -> Config:
         """Provides the properly typed rule configuration object"""
-        return self._config
+        return cast("PreDetectorRule.Config", self._config)
 
     def __eq__(self, other: object) -> bool:
         if not isinstance(other, PreDetectorRule):

logprep/util/helper.py

@@ -86,7 +86,7 @@ def _add_and_not_overwrite_key(sub_dict, key):
 def _add_field_to(
     event: dict,
     field: tuple,
-    rule: "Rule",
+    rule: "Rule" | None,
     merge_with_target: bool = False,
     overwrite_target: bool = False,
 ) -> None:
@@ -179,7 +179,7 @@ def _add_field_to_silent_fail(*args, **kwargs) -> None | str:
 def add_fields_to(
     event: dict,
     fields: dict,
-    rule: "Rule" = None,
+    rule: "Rule" | None = None,
     merge_with_target: bool = False,
     overwrite_target: bool = False,
     skip_none: bool = True,
@@ -525,7 +525,7 @@ def copy_fields_to_event(
     skip_missing: bool = True,
     merge_with_target: bool = False,
     overwrite_target: bool = False,
-    rule: "Rule" = None,
+    rule: "Rule" | None = None,
 ) -> None:
     """
     Copies fields from source_event to target_event.