Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Users can Customize Prebuilt Detection Rules: Milestone 3 #174168

Open
64 of 80 tasks
banderror opened this issue Jan 3, 2024 · 7 comments
Open
64 of 80 tasks

[Security Solution] Users can Customize Prebuilt Detection Rules: Milestone 3 #174168

banderror opened this issue Jan 3, 2024 · 7 comments
Assignees
@rylnd @xcrzx @e40pud @maximpn @jpdjere @banderror @nikitaindik @dplumlee @jkelas
Labels
8.18 candidate Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Meta Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.14.0 v8.15.0 v8.16.0 v8.17.0 v8.18.0

Comments

@banderror
Copy link
Contributor

banderror commented Jan 3, 2024 •
edited
Loading

Epic: https://github.com/elastic/security-team/issues/1974 (internal)
Milestones: << • >>

Status: In development.

Summary

Milestone 3: Add support for customizing prebuilt rules. Extend the rule upgrade workflow with full support for 3-way diffs and conflict resolution. Allow users to:

  • Edit and customize prebuilt rules
  • Export and import prebuilt rules, including customized ones
  • Upgrade prebuilt rules while keeping the user customizations whenever possible

User stories

Prebuilt rule customization workflow:

  • User can edit a single prebuilt rule
    • User can click "edit" button for prebuilt rules and customize (almost) any field on the Rule Editing page, just like it's possible to do with custom rules
    • User can't edit the Author and License fields
  • User can bulk edit multiple prebuilt rules via bulk actions
  • User can see if the rule is customized on the Rule Details page
  • User can see which rules are customized on the Rule Management page

Prebuilt rule upgrade workflow:

  • User can upgrade a single prebuilt rule to its latest version with previewing the incoming updates
    • User can preview updates from Elastic, for each rule field that has an update from Elastic
    • User can preview their customizations, for each rule field that was customized
    • User can compare their customizations with updates from Elastic and see if there are any conflicts between them, per each rule field
    • User can manually resolve conflicts between their customizations and updates from Elastic, per each rule field
    • User can edit the final field values before submitting the update
    • User can upgrade a rule if its type has been changed by Elastic in the latest version, but can only accept the incoming changes
  • User can upgrade a single prebuilt rule to its latest version without previewing the incoming updates
  • User can bulk upgrade multiple prebuilt rules to their latest versions

Prebuilt rule export/import workflow:

  • User can export a single prebuilt rule
    • Pages: Rule Details, Rule Management
    • It can be a prebuilt non-customized or prebuilt customized rule
  • User can bulk export multiple prebuilt rules via bulk actions
    • Pages: Rule Management
    • We support exporting prebuilt non-customized, prebuilt customized, and custom rules in any combination
  • User can bulk import multiple prebuilt rules
    • Pages: Rule Management
    • We support importing prebuilt non-customized, prebuilt customized, and custom rules - in any combination

Useful info

Design

Technical design
Preview Give feedback
  1. [Security Solution] Write an RFC for customizing prebuilt rules #171309
    8.14 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp
    jpdjere
  2. [Security Solution] Discuss rule fields in the context of the prebuilt rule upgrade workflow #147239
    8.14 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp discuss
    approksiu banderror
    jpdjere
  3. [Security Solution] Discuss rule field diffs and conflicts to handle in the UI #148913
    Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp discuss release_note:skip skip-ci
    banderror

UI/UX design
Preview Give feedback
  1. [Security Solution] Discuss UI/UX designs for customizing prebuilt rules #178211
    8.14 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp design

Preparatory changes

Preparatory changes is something we can work on before starting to hide functionality behind a feature flag. This will reduce the overall complexity introduced by feature toggling.

Missing UI for editing certain rule fields
Preview Give feedback
  1. [Security Solution] Allow users to edit setup field for custom rules #173626
    8.14 candidate Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.14.0
    dplumlee
  2. [Security Solution] Allow users to edit max_signals field for custom rules #173593
    8.15 candidate Feature:Rule Creation Feature:Rule Details Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0
    ARWNightingale dplumlee
  3. [Security Solution] Allow users to edit related_integrations field for custom rules #173595
    8.15 candidate Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0
    ARWNightingale maximpn
  4. [Security Solution] Allow users to edit required_fields field for custom rules #173594
    8.15 candidate Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0
    ARWNightingale nikitaindik

Missing UI for editing certain rule fields (docs)
Preview Give feedback
  1. Edit setup guide field for custom rules in UI and API security-docs#4917
    3 of 3
    Docset: ESS Docset: Serverless Feature: Rules Team: Detections/Response v8.14.0
    joepeeples
  2. Edit max_signals field for custom rules in UI and API security-docs#5029
    3 of 3
    Docset: ESS Docset: Serverless Feature: Rules Team: Detections/Response v8.15.0
    joepeeples
  3. Edit related_integrations field for custom rules in UI and API security-docs#5099
    3 of 3
    Docset: ESS Docset: Serverless Feature: Rules Team: Detections/Response v8.15.0
    joepeeples
  4. Edit required_fields field for custom rules in UI and API security-docs#5131
    3 of 3
    Docset: ESS Docset: Serverless Feature: Rules Team: Detections/Response v8.15.0
    joepeeples

Schema-related changes
Preview Give feedback
  1. [Security Solution] Add rule_source to the API schema #180122
    8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.15.0
    xcrzx
  2. [Security Solution] Make changes in the internal rule schema #180124
    8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.15.0
    xcrzx
  3. [Security Solution] Replaced the incorrect runtime type used for ruleSource #184004
    Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp backport:skip bug impact:critical release_note:skip v8.15.0
    xcrzx
  4. [Security Solution] Write the rule_source field together with immutable #180141
    8.15 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.15.0
    xcrzx
  5. [Security Solution] RulesManagementClient refactoring. Part 1 #180128
    8.15 candidate Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp refactoring v8.15.0
    jpdjere
  6. [Security Solution] DetectionRulesClient refactoring. Part 2 #184364
    8.16 candidate Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp refactoring v8.15.0 v8.16.0
    nikitaindik xcrzx
  7. [Security Solution] Implement normalization on read for rule_source and immutable fields #180140
    8.16 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    jpdjere

Rule customization, API changes
Preview Give feedback
  1. [Security Solution] Calculate and save ruleSource.isCustomized in API endpoint handlers #180145
    8.16 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    xcrzx
  2. [Security Solution] Calculate and save ruleSource.isCustomized in bulk edit API #187706
    8.16 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    xcrzx
  3. [Security Solution] Make rule_source field required in RuleResponse #180270
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    dplumlee
  4. [Security Solution] Prevent from updating "non-customizable" fields in prebuilt rules #180273
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    dplumlee

Rule upgrade, API changes
Preview Give feedback
  1. [Security Solution] Return user-customized fields from the POST /prebuilt_rules/upgrade/_review API endpoint even if they haven't been updated by Elastic in the target version #180154
    8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.15.0
    dplumlee
  2. [Security Solution] Extend the POST /upgrade/_review API endpoint's contract and functionality #180153
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    jpdjere
  3. [Security Solution] Handle specific fields in /upgrade/_review upgrade workflow #180393
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    jpdjere
  4. [Security Solution] Substitute MissingVersion symbol in the ThreeWayDiff object with a boolean #188277
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp refactoring
    jpdjere
  5. [Security Solution] Extend the POST /upgrade/_perform API endpoint's contract and functionality #166376
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0
    jpdjere
  6. [Security Solution] Handle specific fields in /upgrade/_perform endpoint upgrade workflow #186544
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    jpdjere
  7. [Security Solution] Add InvestigationFields and AlertSuppression fields to the upgrade workflow #190597
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp
    jpdjere
  8. [Security Solution] Remove exceptions_list, author and license from Diffable Rule #196213
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    jpdjere

Rule upgrade, diff algorithms
Preview Give feedback
  1. [Security Solution] Implement number diff algorithm #180160
    8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0
    dplumlee
  2. [Security Solution] Implement single-line string diff algorithm #180158
    8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0
    dplumlee
  3. [Security Solution] Implement multi-line string diff algorithm #180159
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0
    dplumlee
  4. [Security Solution] Implement array of scalar values diff algorithm #180162
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0
    dplumlee
  5. [Security Solution] Implement data source fields diff algorithm #187659
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0
    dplumlee
  6. [Security Solution] Implement query fields diff algorithms #187658
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0
    dplumlee
  7. [Security Solution] Implement concurrent_searches and items_per_search fields diff algorithms #188061
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement
    dplumlee
  8. [Security Solution] Implement rule type diff algorithm #190482
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0
    dplumlee

Fleet package with prebuilt rules
Preview Give feedback
  1. [Security Solution] OOMs during prebuilt rules package installation #187969
    3 of 3
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet v8.16.0
    xcrzx
  2. [Fleet] All package SOs are being read into memory during package upgrade or force installation #187975
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet technical debt
    xcrzx
  3. [Fleet] Split bulk delete into chunks to avoid high memory consumption #188208
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet technical debt
    xcrzx
  4. [Fleet] Split asset installation into chunks to avoid high memory pressure #189043
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet
    xcrzx
  5. [Security Solution] API endpoint for the package with prebuilt rules #187647
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    xcrzx
  6. [Fleet] Stream-based programmatic API for installing packages #187646
    Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet
    kpollich
  7. [Security Solution] Stream-based installation of the package with prebuilt rules #192350
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet performance v8.17.0
    xcrzx
  8. [Security Solution] Smart limits for the package with prebuilt rules #187645
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.17.0 v8.18.0
    approksiu xcrzx

Changes hidden behind the feature flag

These are changes that will need to be hidden behind the prebuiltRulesCustomizationEnabled feature flag.

Rule customization, UI changes
Preview Give feedback
  1. [Security Solution] Add a new feature flag prebuiltRulesCustomizationEnabled #180130
    8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.15.0
    nikitaindik
  2. [Security Solution] Show if a rule is customized on the Rule Details page #180170
    8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0
    nikitaindik
  3. [Security Solution] Support filtering by "Modified rules" and "Unmodified rules" #180169
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement
    dplumlee
  4. [Security Solution] Add support for editing prebuilt rules to the Rule Management and Rule Details pages #180171
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp
    dplumlee
  5. [Security Solution] Add support for editing prebuilt rules to the Rule Editing page #180172
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp
    dplumlee

Rule upgrade, UI changes
Preview Give feedback
  1. [Security Solution] Handle conflicting rules in the Rule Upgrade table #180589
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp needs design
    ARWNightingale jpdjere
    xcrzx
  2. [Security Solution] Rework Update flyout to display all field updates and build Three-Way-Diff field component #171520
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0 v8.17.0 v8.18.0
    maximpn nikitaindik
  3. [Security Solution] Handle specific fields in the upgrade workflow's UI #188065
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.18.0
    maximpn nikitaindik
  4. [Security Solution] Implement UI for updating prebuilt rule to a new rule type (MVP) #180395
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.18.0
    xcrzx
  5. [Security Solution] Show Modified badge for fields customized by users #203718
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement
    maximpn

Rule export and import, API and UI changes
Preview Give feedback
  1. [Security Solution] Allow exporting prebuilt rules at the API level #180167
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement
    rylnd
  2. [Security Solution] Allow importing prebuilt rules at the API level #180168
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement
    rylnd
  3. [Security Solution] Support exporting prebuilt rules from the Rule Management page #180173
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp
    dplumlee
  4. [Security Solution] Support exporting prebuilt rules from the Rule Details page #180176
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp
    dplumlee
  5. [Security Solution] Benchmark performance of importing a large number of prebuilt rules #195632
    8.18 candidate Feature:Prebuilt Detection Rules Feature:Rule Import/Export Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.18.0
    rylnd

Licensing
Preview Give feedback

Telemetry
Preview Give feedback
  1. [Security Solution] Collect usage statistics for prebuilt rule customization #140369
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp needs product telemetry
    xcrzx

Before release

Bugs
Preview Give feedback
  1. [Security Solution] Users can Customize Prebuilt Detection Rules: Milestone 3 bugs #201502
    35 of 60
    8.18 candidate Feature:Prebuilt Detection Rules Meta Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0 v8.17.0 v8.18.0
    banderror dplumlee
    jkelas jpdjere maximpn nikitaindik xcrzx

Testing
Preview Give feedback
  1. [Security Solution] Write tests for "Customized Elastic rule" badge on the Rule Details page #186916
    8.18 candidate Feature:Prebuilt Detection Rules Feature:Rule Details Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp technical debt test-coverage v8.18.0
    dplumlee nikitaindik
  2. [Security Solution] Tests for prebuilt rule customization workflow #202068
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp test test-coverage test-plan v8.18.0
    dplumlee
  3. [Security Solution] Tests for prebuilt rule upgrade workflow #202078
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp test test-coverage test-plan v8.18.0
    jpdjere maximpn
  4. [Security Solution] Tests for prebuilt rule import/export workflow #202079
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp test test-coverage test-plan v8.18.0
    dplumlee
  5. [Security Solution] Acceptance testing of prebuilt rule customization workflows #180397
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.18.0
    ARWNightingale approksiu
  6. [Security Solution] Exploratory testing of prebuilt rule customization workflows #180398
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.18.0
    MadameSheema pborgonovi

Documentation
Preview Give feedback
  1. [Request] Prebuilt rule customization and upgrade workflows (DRAFT) security-docs#5061
    v8.18.0
    nastasha-solomon
  2. [Request] Document new rule_source property for rules in the API schema (DRAFT) security-docs#5063
    v8.18.0
    joepeeples

Release
Preview Give feedback
  1. [Security Solution] Release prebuilt rule customization feature #180267
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.18.0

After release

Last changes after releasing the feature
Preview Give feedback
  1. [Security Solution] Exploratory testing of prebuilt rule customization workflows in production #180399
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.18.0
    pborgonovi
  2. [Security Solution] Remove the prebuiltRulesCustomizationEnabled feature flag #180272
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp
@banderror banderror added Meta Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area labels Jan 3, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

This was referenced Jan 12, 2024
Open
Open
This was referenced Jan 26, 2024
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
@banderror banderror mentioned this issue Feb 6, 2024
Open
This was referenced Feb 23, 2024
Open
Open
@banderror
Copy link
Contributor Author

banderror commented Feb 23, 2024 •
edited
Loading

Draft plan for Milestone 3

UPD: the plan has been moved to the ticket description.

This was referenced Mar 6, 2024
Closed
Closed
Closed
@banderror banderror mentioned this issue Mar 7, 2024
Closed
13 tasks
@banderror banderror mentioned this issue Sep 26, 2024
Merged
maximpn added a commit that referenced this issue Sep 27, 2024
@maximpn
[Security Solution] Integrate state and components for Prebuilt Rule …
878ba13 
…Update Workflow (#193531)

**Epic:** #174168
**Addresses:** #171520

## Summary

This PR introduces a new `Update` tab allowing users to resolve rule upgrade conflicts. It's a result of combination of read-only components implemented in #193261 and rule upgrade state implemented in #191721.

## Details

The goal of this PR is to provide intermediate integration between rule upgrade state ([PR](#191721)) and components displaying the diff and read-only state ([PR](#193261)). It will facilitate further development of rule field editable components and streamline rule upgrade functionality developing.

## How to test?

The functionality is hidden under `prebuiltRulesCustomizationEnabled` feature flag. Add the following to your Kibana config

```yaml
xpack.securitySolution.enableExperimental:
  - prebuiltRulesCustomizationEnabled
```

When the above feature flag enabled the new `Update` tab is displayed instead of the old one.

## Screenshots

Suggested components design 
![image](https://github.com/user-attachments/assets/b5aaf571-286a-4595-9bd4-fdaf9a423b03)

New `Update` tab
<img width="1718" alt="image" src="https://github.com/user-attachments/assets/28aa6bb3-f805-4109-a808-d67e58c7c5b8">
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Sep 27, 2024
@maximpn
[Security Solution] Integrate state and components for Prebuilt Rule …
ecd3f19 
…Update Workflow (elastic#193531)

**Epic:** elastic#174168
**Addresses:** elastic#171520

## Summary

This PR introduces a new `Update` tab allowing users to resolve rule upgrade conflicts. It's a result of combination of read-only components implemented in elastic#193261 and rule upgrade state implemented in elastic#191721.

## Details

The goal of this PR is to provide intermediate integration between rule upgrade state ([PR](elastic#191721)) and components displaying the diff and read-only state ([PR](elastic#193261)). It will facilitate further development of rule field editable components and streamline rule upgrade functionality developing.

## How to test?

The functionality is hidden under `prebuiltRulesCustomizationEnabled` feature flag. Add the following to your Kibana config

```yaml
xpack.securitySolution.enableExperimental:
  - prebuiltRulesCustomizationEnabled
```

When the above feature flag enabled the new `Update` tab is displayed instead of the old one.

## Screenshots

Suggested components design
![image](https://github.com/user-attachments/assets/b5aaf571-286a-4595-9bd4-fdaf9a423b03)

New `Update` tab
<img width="1718" alt="image" src="https://github.com/user-attachments/assets/28aa6bb3-f805-4109-a808-d67e58c7c5b8">

(cherry picked from commit 878ba13)
@jpdjere jpdjere mentioned this issue Sep 30, 2024
Open
This was referenced Oct 9, 2024
Closed
Open
@jpdjere jpdjere mentioned this issue Oct 15, 2024
Closed
This was referenced Nov 23, 2024
Open
Closed
Closed
Open
This was referenced Nov 27, 2024
Open
Open
Open
@maximpn maximpn mentioned this issue Dec 11, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rylnd rylnd

@xcrzx xcrzx

@e40pud e40pud

@maximpn maximpn

@jpdjere jpdjere

@banderror banderror

@nikitaindik nikitaindik

@dplumlee dplumlee

@jkelas jkelas

Labels
8.18 candidate Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Meta Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.14.0 v8.15.0 v8.16.0 v8.17.0 v8.18.0
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
10 participants
@rylnd @xcrzx @e40pud @maximpn @jpdjere @banderror @elasticmachine @nikitaindik @dplumlee @jkelas