[Security Solution] Users can Customize Prebuilt Detection Rules: Milestone 3 bugs

[banderror]

Epic: https://github.com/elastic/security-team/issues/1974 (internal)
Milestones: << • >>
Milestone 3: #174168

Status: In development.

Summary

This is a part of Milestone 3 epic and was extracted from it because there were too many issues that started to cause glitches.

Please find the rest of Milestone 3 issues in #174168.

Bugs

Bugs: rule editing and customization

Preview Give feedback

1. [Security Solution] Rule's EQL query validation fails unexpectedly when fields missing #178611
   8.16 candidate Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug fixed impact:medium v8.16.0 +10
   
2. [Security Solution] Rules mistakenly marked as customized #199629
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.16.1 v8.17.0 v9.0.0 +10
   
3. [Security Solution] Required fields are getting erased on rule PATCH #199665
   8.17 candidate Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium v8.16.1 v8.17.0 v9.0.0 +10
   
4. [Security Solution] Prebuilt rules with missing base version are marked as customized on edit #201632
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.16.2 v8.17.0 v8.18.0 v9.0.0 +11
   
5. [Security Solution] “Author” and “License” Fields Are Editable in UI but Result in Errors When Updated #200251
   8.18 candidate Feature:Prebuilt Detection Rules Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug fixed impact:medium v8.17.0 v8.18.0 +11
   
6. [Security Solution] Validation for Invalid Field Inputs in Advanced Settings Is Bypassed #200830
   8.18 candidate Feature:Prebuilt Detection Rules Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium v8.18.0 +9
   
7. [Security Solution] Prebuilt rules marked as customized after applying updates #201631
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.17.1 v8.18.0 v9.0.0 +10
   
8. [Security Solution] Prebuilt rules marked as customized on upgrade when updating the package from 8.16.2-beta.1 to 8.16.2 #202575
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug fixed impact:high v8.17.1 v8.18.0 v9.0.0 +11
   
9. [Security Solution] is_customized Flag is Set to True When Reverting Changes to Prebuilt Rules #203151
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug fixed impact:high v8.17.1 v8.18.0 v9.0.0 +11
   
10. [Security Solution] Prebuilt Rule Marked as Customized By Just Clicking "Edit rule settings" And Clicking Save Without Any Changes #203315
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.17.1 v8.18.0 v9.0.0 +10
    
11. [Security Solution] Prebuilt Rule Incorrectly Marked as Customized After Adding a Rule Exception #203011
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.17.1 v8.18.0 v9.0.0 +10
    
12. [Security Solution] Adding Actions to Prebuilt Rules Incorrectly Marks Them as Customized #203484
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.18.0 +8
    
13. [Security Solution] Incorrect is_customized Value on Re-Import of Non-Customized Prebuilt Rule #202613
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.17.1 v8.18.0 v9.0.0 +10
    
14. [Security Solution] Bulk action confirmation dialog should not mention "custom" rules #203149
    8.18 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:low v8.18.0 v9.0.0 +10
    
15. [Security Solution] Custom Query field overflows the viewport and cannot be completely visualized or edited when the query is too long #178615
    8.18 candidate Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium v8.17.1 v8.18.0 +10
    
16. https://github.com/elastic/security-team/issues/10215
17. [Security Solution] Add validation error description on prebuilt rule editing #191832
    8.18 candidate Feature:Rule Edit Team: SecuritySolution Team:Detection Engine Team:Detection Rule Management Team:Detections and Resp needs design needs product v8.18.0 +9
    
18. [Security Solution] Editing rules independently of source data #180407
    2 of 5
    8.18 candidate Feature:Prebuilt Detection Rules Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Engine Team:Detection Rule Management Team:Detections and Resp +8

Bugs: rule installation

Preview Give feedback

1. [Security Solution] Infinite loading state on the rule install page when user doesn't have write privileges #161543
   8.14 candidate Feature:Detection Alerts/Rules RBAC Feature:Prebuilt Detection Rules QA:Validated Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug fixed impact:medium v8.12.2 v8.13.0 v8.14.0 +13
   
2. [Security Solution] Install All button on Add Elastic Rules page gets re-enabled when user revisit the page while rules are loading. #180660
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.16.2 v8.17.0 +9
   
3. [Security Solution] Fix load rules callout copy #200521
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp UX Debt bug impact:low ui-copy v8.17.0 +10
   

Bugs: rule upgrade general issues

Preview Give feedback

1. [Security Solution] Error Unable to load page is shown for Rules Page after updating Rules. #180120
   8.14 candidate Feature:Prebuilt Detection Rules QA:Validated Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high +8
2. [Security Solution] Prebuilt rule flyout: Fix the delay that occurs when a user tries to open a flyout #166166
   Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:low performance +7
   
3. [Security Solution] Replace PATCH logic with PUT when upgrading rules #180195
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium v8.16.0 +8
   
4. [Security Solution] 'Update rule' button is disabled when there are prebuilt rules updates available #198155
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug fixed impact:high v8.16.0 +9
   
5. [Security Solution] upgrade/_review blocks main thread #199290
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:critical performance v8.16.1 v8.17.0 v9.0.0 +11
   
6. [Security Solution] Unable to upgrade rules with missing base version #200904
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.16.2 v8.17.0 v8.18.0 +10
   
7. [Security Solution] Inconsistent conflict state messaging in Rule Upgrade flyout #200811
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug fixed impact:high v8.18.0 +9
   
8. [Security Solution] Incorrect field count in Rule Upgrade flyout #200286
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug fixed impact:low v8.18.0 +9
   
9. [Security Solution] Unable to upgrade Threat Match prebuilt rules #203365
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high +7
   
10. [Security Solution] Stale rule data is displayed in the upgrade flyout #202779
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug v8.18.0 +7
    
11. [Security Solution] Prebuilt rule customization is lost on upgrade when Base version is missing #201500
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.18.0 +8
    
12. [Security Solution] Unable to unset field value upon rules upgrade #203634
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.18.0 +8
    
13. [Security Solution] Rule upgrade fails due to Failed to parse date-math expression #203476
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.18.0 +8
    
14. [Security Solution] Rule upgrade flyout crashes on a rule with negative lookback time #202715
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.18.0 +8
    
15. [Security Solution] Negative lookback is not handled properly during upgrade #204714
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.18.0 +8
    
16. [Security Solution] Implement rule upgrade concurrency control #200134
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.18.0 +8
    
17. [Security Solution] Update Button Enabled While Field is in Edit Mode #203912
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.18.0 +8
    
18. [Security Solution] Auto-merge ignores incoming rule changes for rule query fields #202185
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.18.0 +8
    
19. [Security Solution] Diff view incorrectly highlights changes in multiline strings #202016
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium v8.18.0 +8
    
20. [Bug] Package v8.16.2 contains new rule versions without updates detection-rules#4276
    Team: TRADE bug +2
    

    
21. [Security Solution] Users can't upgrade rules without customizations when rule type changed #202967
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug triage_needed +7
22. [Security Solution] Upgrading a prebuilt rule with exceptions succeeds on the 2nd attempt #203012
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium v8.17.1 v8.18.0 v9.0.0 +10

Bugs: rule upgrade field-specific issues

Preview Give feedback

1. [Security Solution] Show count field on Rule details page for threshold rules #161576
   8.17 candidate Feature:Rule Details Feature:Threshold Rule Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug enhancement sdh-linked v8.16.2 v8.17.0 +11
   
2. [Security Solution] Wrapping of default data view index not done on Rule Details page (Firefox) #140156
   8.17 candidate Feature:Rule Details Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:low v8.16.2 v8.17.0 +9
   
3. [Security Solution] Warnings in rule filters on the Rule Details page: "Field does not exist in current view" #178908
   8.18 candidate Feature:Rule Details Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium v8.16.3 v8.17.1 v8.18.0 +10
   
4. [Security Solution] Warning is shown for updated Prebuilt rule with filter containing "AND" or "OR" condition #203615
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium +7
5. [Security Solution] Warning flashes when editing rule index patterns #203600
   8.18 candidate Feature:Rule Edit Team: SecuritySolution Team:Detection Engine Team:Detection Rule Management Team:Detections and Resp bug impact:low +8
6. [Security Solution] ML jobs are missing on rule details/editing/update pages #202700
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium v8.18.0 +8
   
7. [Security Solution] ESQL editor inserts random values on Enter in upgrade flyout #202206
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium +7
   
8. [Security Solution] ES|QL Query bar's tooltip is rendered in wrong place #203305
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium +7
   
9. [Security Solution] KQL query isn't visible in edit more #203523
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium v8.18.0 +8
   
10. [Security Solution] KQL/Lucene Query bar filters generate diff when saved without changes in Prebuilt Rule Customization workflow #202966
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium v8.18.0 +8
    
11. [Security Solution] Severity override checkbox is not clickable in the rule upgrade flyout #203643
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:low v8.18.0 +8
    

Bugs: rule import and export

Preview Give feedback

1. https://github.com/elastic/infosec/issues/15731
2. [Security Solution] Users can import custom rules with rule_id equal to that of a not-installed prebuilt rule #180198
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium +7

Bugs: misc

Preview Give feedback

1. [Security Solution] When duplicating a prebuilt rule, 'Related Integrations' and 'Required Fields' values are not inherited from the original rule #190628
   8.16 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug fixed impact:medium v8.15.1 v8.16.0 +11
   
2. [Security Solution] Unable to Save Edited ESQL Rule Due to Query Validation Error #203502
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug fixed impact:low +8
   
3. [Security Solution] The wrong endpoint package version is installed when prebuiltRulesPackageVersion config option is present #203471
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:low v8.18.0 +8
   
4. [Security Solution] Memory leak during prebuilt rule installation and upgrade #204800
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high performance v8.18.0 +9

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)