diff --git a/crates/rsigma-cli/src/commands/convert.rs b/crates/rsigma-cli/src/commands/convert.rs index 7fad2aa..6d092c3 100644 --- a/crates/rsigma-cli/src/commands/convert.rs +++ b/crates/rsigma-cli/src/commands/convert.rs @@ -38,6 +38,14 @@ pub(crate) fn cmd_convert( let collection = load_collection_multi(&rules); let pipelines = crate::load_pipelines(&pipeline_paths); + if pipelines.iter().any(|p| p.is_dynamic()) { + eprintln!( + " note: dynamic sources are not resolved by `rsigma convert`. \ + Use `rsigma resolve` to inspect sources or `rsigma daemon` to evaluate \ + events with dynamic pipelines." + ); + } + let options: std::collections::HashMap = backend_options .iter() .filter_map(|opt| { diff --git a/crates/rsigma-cli/src/commands/eval.rs b/crates/rsigma-cli/src/commands/eval.rs index f9be003..6544d6a 100644 --- a/crates/rsigma-cli/src/commands/eval.rs +++ b/crates/rsigma-cli/src/commands/eval.rs @@ -67,6 +67,15 @@ pub(crate) fn cmd_eval( ) -> bool { let collection = crate::load_collection(&rules_path); let pipelines = crate::load_pipelines(&pipeline_paths); + + if pipelines.iter().any(|p| p.is_dynamic()) { + eprintln!( + " note: dynamic sources are not resolved by `rsigma eval`. \ + Use `rsigma resolve` to inspect sources or `rsigma daemon` to evaluate \ + events with dynamic pipelines." + ); + } + let has_correlations = !collection.correlations.is_empty(); let event_filter = crate::build_event_filter(jq, jsonpath); diff --git a/crates/rsigma-cli/src/commands/fields.rs b/crates/rsigma-cli/src/commands/fields.rs index b3111c5..bfaa1dd 100644 --- a/crates/rsigma-cli/src/commands/fields.rs +++ b/crates/rsigma-cli/src/commands/fields.rs @@ -21,6 +21,14 @@ pub(crate) fn cmd_fields( let collection = crate::load_collection(&path); let pipelines = crate::load_pipelines(&pipeline_paths); + if pipelines.iter().any(|p| p.is_dynamic()) { + eprintln!( + " note: dynamic sources are not resolved by `rsigma fields`. \ + Use `rsigma resolve` to inspect sources or `rsigma daemon` to evaluate \ + events with dynamic pipelines." + ); + } + let report = build_report(&collection, &pipelines, no_filters); if json { diff --git a/crates/rsigma-cli/src/main.rs b/crates/rsigma-cli/src/main.rs index 3d84b77..35a5f82 100644 --- a/crates/rsigma-cli/src/main.rs +++ b/crates/rsigma-cli/src/main.rs @@ -917,13 +917,7 @@ pub(crate) fn load_pipelines(paths: &[PathBuf]) -> Vec { if p.is_dynamic() { let source_ids: Vec<&str> = p.sources.iter().map(|s| s.id.as_str()).collect(); - eprintln!( - " warn: pipeline '{}' has {} dynamic source(s) ({}) \ - -- source resolution not yet supported", - p.name, - p.sources.len(), - source_ids.join(", ") - ); + eprintln!(" dynamic source(s): {}", source_ids.join(", ")); } pipelines.push(p); }