Create an Issue in Kibana for MITRE Updates #10

	name: Check MITRE ATT&CK Version Updates Are Synced

	on:
	pull_request:
	paths:
	- 'detection_rules/etc/attack-v*.json.gz'

	jobs:
	create_issue:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Get MITRE Attack changed files
	id: changed-attack-files
	uses: tj-actions/changed-files@v44
	with:
	files: detection_rules/etc/attack-v*.json.gz

	- name: Extract version from file name
	id: extract_version
	if: steps.changed-attack-files.outputs.any_changed == 'true'
	env:
	ADDED_FILE: ${{ steps.changed-attack-files.outputs.added_files }}
	run: \|
	VERSION=$(echo $ADDED_FILE[0] \| grep -o 'v[^json]*')
	echo "::set-output name=version::$VERSION"

	- name: Create issue in elastic/kibana repository
	run: \|
	ISSUE_TITLE="Update MITRE ATT&CK to ${{ steps.extract_version.outputs.version }}"
	ISSUE_BODY="The detection rules MITRE ATT&CK version has been updated to ${{ steps.extract_version.outputs.version }}. Please update the MITRE ATT&CK version in Kibana accordingly."

	curl -X POST \
	-H "Authorization: token ${{ secrets.PROTECTIONS_MACHINE_TOKEN }}" \
	-H "Accept: application/vnd.github.v3+json" \
	https://api.github.com/repos/elastic/detection-rules/issues \
	-d '{
	"title": "'"$ISSUE_TITLE"'",
	"body": "'"$ISSUE_BODY"'"
	}'

	env:
	GITHUB_TOKEN: ${{ secrets.PROTECTIONS_MACHINE_TOKEN }}

Provide feedback