[Security Solution] Calculate and save ruleSource.isCustomized
in bulk edit API
#187706
Labels
8.16 candidate
Feature:Prebuilt Detection Rules
Security Solution Prebuilt Detection Rules area
Feature:Rule Management
Security Solution Detection Rule Management area
Team:Detection Rule Management
Security Detection Rule Management Team
Team:Detections and Resp
Security Detection Response Team
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
v8.16.0
Epics: https://github.com/elastic/security-team/issues/1974 (internal), #174168
Follow-up to: #180145
Summary
Implement calculation of
ruleSource.isCustomized
in all necessary endpoints that write theruleSource
field to prebuilt rules, and where fields can be customized, diverging from the base version from the Rule Asset.The calculation and saving of the field should be done in the following endpoints:
POST /rules/_bulk_action
: with action Edit rules actionBackground
Context from the Rule Customization RFC:
isCustomized
field - see table with scenarios for calculation ofisCustomized
isCustomized
during bulk editing rulesisCustomized
when importing rules - see table with import scenarios and their respectiveisCustomized
calculationskibana/x-pack/plugins/security_solution/docs/rfcs/detection_response/prebuilt_rules_customization.md
Lines 559 to 584 in 269649a
kibana/x-pack/plugins/security_solution/docs/rfcs/detection_response/prebuilt_rules_customization.md
Lines 817 to 821 in b6e0f87
The text was updated successfully, but these errors were encountered: