diff --git a/backend/routers/coverage.py b/backend/routers/coverage.py index 1f34757..ddf104a 100644 --- a/backend/routers/coverage.py +++ b/backend/routers/coverage.py @@ -40,13 +40,19 @@ def _star_query_texts(rule: dict) -> list[str]: @router.post("/load-star-rules") -async def load_star_rules(db: Session = Depends(get_db)): - """Fetch STAR rules from SentinelOne and index their fields.""" +async def load_star_rules(library_only: bool = True, db: Session = Depends(get_db)): + """Fetch STAR rules from SentinelOne and index their fields. + By default loads only Library rules (creator @sentinelone.com). + Pass library_only=false to include custom tenant rules as well. + """ try: rules = await s1_client.get_star_rules() except Exception as e: raise HTTPException(502, f"S1 API error: {e}") + if library_only: + rules = [r for r in rules if str(r.get("creator", "")).lower().endswith("@sentinelone.com")] + # Replace all existing STAR rules cleanly to avoid duplicate key errors db.query(ParsedRule).filter_by(rule_type="star").delete() db.flush() diff --git a/frontend/index.html b/frontend/index.html index b3ccc90..84d0d7c 100644 --- a/frontend/index.html +++ b/frontend/index.html @@ -151,7 +151,7 @@ function renderCoverage() {
- + @@ -187,7 +187,7 @@ async function loadStar() { document.getElementById('cv-err').innerHTML = '' try { await apiPost('/api/coverage/load-star-rules', {}); cvLoad() } catch(e) { document.getElementById('cv-err').innerHTML = errBox(e.message) } - finally { setBtn('btn-star', false, 'Load STAR Rules') } + finally { setBtn('btn-star', false, 'Load Library STAR Rules') } } async function cvUploadSigma(files) {