Is there a way to completely change a ruleset?

[jumpsdefcon]

So, was doing some testing with an agent that is not using a sync server, and was looking to manual import the json rule list. I got the list to import fine, but when I try to import a different rule list I still see the full list of rules in the database. Do I need to script out a removal line by line and then re-import the new list or perhaps script removal and reinstall of the agent?

I would have expected the import to purge the current list and then import the rules in the new config file.

[russellhancox]

Is there a way to completely change a ruleset?

No, but there should be.

I would have expected the import to purge the current list and then import the rules in the new config file.

It doesn't do this so that you could import multiple sets of rules additively. We can add a --clean flag to clear out any existing rules and you could combine that with --import to have the replacement added at the same time.

[jumpsdefcon]

That would be great I don't see the clean flag currently except on the sync command section, which wouldn't help on a client without a sync server. so I assume this is something that would need to be added in a future release?

I'm mostly just doing testing with the agent right now and we plan to do an initial pilot using jamf to manage the agent. One of the things we were looking for is a way to remove all the rules in scenarios where a UAT tester was running into issues and we could just redact the ruleset for troubleshooting. Looks like in this case it will be easier to just script removal and reinstall with a blank ruleset until that is available.

[russellhancox]

so I assume this is something that would need to be added in a future release?

Correct. I've opened issue #1293 to implement this. We've already started the 2024.2 release train so it's likely this won't be available until 2024.3

we plan to do an initial pilot using jamf to manage the agent

You could have the rules deployed as StaticRules as part of your configuration profile. It won't be as easy to remove all the rules if a tester runs into issues but presumably JAMF has a way to selectively update/remove a profile for a host that you could utilize.

[jumpsdefcon]

ok thanks!