-
Notifications
You must be signed in to change notification settings - Fork 8.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Security Solution] Prebuilt rules with missing base version are marked as customized on edit #201632
Closed
Tracked by
#201502
Labels
8.17 candidate
bug
Fixes for quality problems that affect the customer experience
Feature:Prebuilt Detection Rules
Security Solution Prebuilt Detection Rules area
impact:high
Addressing this issue will have a high level of impact on the quality/strength of our product.
Team:Detection Rule Management
Security Detection Rule Management Team
Team:Detections and Resp
Security Detection Response Team
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
v8.16.2
v8.17.0
v8.18.0
v9.0.0
Comments
xcrzx
added
bug
Fixes for quality problems that affect the customer experience
Feature:Prebuilt Detection Rules
Security Solution Prebuilt Detection Rules area
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Team:Detection Rule Management
Security Detection Rule Management Team
Team:Detections and Resp
Security Detection Response Team
v8.16.2
v8.17.0
v8.18.0
v9.0.0
labels
Nov 25, 2024
Pinging @elastic/security-solution (Team: SecuritySolution) |
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management) |
banderror
added
8.17 candidate
impact:high
Addressing this issue will have a high level of impact on the quality/strength of our product.
labels
Nov 25, 2024
5 tasks
xcrzx
added a commit
that referenced
this issue
Dec 3, 2024
…ag is off (#201825) **Resolves: #201632 ## Summary When the rule customization feature flag is disabled, we should always return `isCustomized: false`, regardless of any changes introduced to a rule. This ensures that we do not accidentally mark prebuilt rules as customized in 8.16 with the feature flag off. For more details, refer to the related issue: #201632 ### Main Changes - The primary change in this PR is encapsulated in the `calculateIsCustomized` function - Other changes involve passing the feature flag to this function - Added integration tests to cover all API CRUD operations that can be performed with rules
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this issue
Dec 3, 2024
…ag is off (elastic#201825) **Resolves: elastic#201632 ## Summary When the rule customization feature flag is disabled, we should always return `isCustomized: false`, regardless of any changes introduced to a rule. This ensures that we do not accidentally mark prebuilt rules as customized in 8.16 with the feature flag off. For more details, refer to the related issue: elastic#201632 ### Main Changes - The primary change in this PR is encapsulated in the `calculateIsCustomized` function - Other changes involve passing the feature flag to this function - Added integration tests to cover all API CRUD operations that can be performed with rules (cherry picked from commit 22911c1)
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this issue
Dec 3, 2024
…ag is off (elastic#201825) **Resolves: elastic#201632 ## Summary When the rule customization feature flag is disabled, we should always return `isCustomized: false`, regardless of any changes introduced to a rule. This ensures that we do not accidentally mark prebuilt rules as customized in 8.16 with the feature flag off. For more details, refer to the related issue: elastic#201632 ### Main Changes - The primary change in this PR is encapsulated in the `calculateIsCustomized` function - Other changes involve passing the feature flag to this function - Added integration tests to cover all API CRUD operations that can be performed with rules (cherry picked from commit 22911c1)
xcrzx
added a commit
to xcrzx/kibana
that referenced
this issue
Dec 3, 2024
…ag is off (elastic#201825) **Resolves: elastic#201632 ## Summary When the rule customization feature flag is disabled, we should always return `isCustomized: false`, regardless of any changes introduced to a rule. This ensures that we do not accidentally mark prebuilt rules as customized in 8.16 with the feature flag off. For more details, refer to the related issue: elastic#201632 ### Main Changes - The primary change in this PR is encapsulated in the `calculateIsCustomized` function - Other changes involve passing the feature flag to this function - Added integration tests to cover all API CRUD operations that can be performed with rules (cherry picked from commit 22911c1) # Conflicts: # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/detection_rules_client.import_rules.test.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/methods/import_rule.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_for_import.test.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_for_import.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_from_asset.test.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_from_asset.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/rule_source_importer/rule_source_importer.test.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/rule_source_importer/rule_source_importer.ts # x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/import_rules.ts # x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/index.ts
xcrzx
added a commit
to xcrzx/kibana
that referenced
this issue
Dec 3, 2024
…ag is off (elastic#201825) **Resolves: elastic#201632 ## Summary When the rule customization feature flag is disabled, we should always return `isCustomized: false`, regardless of any changes introduced to a rule. This ensures that we do not accidentally mark prebuilt rules as customized in 8.16 with the feature flag off. For more details, refer to the related issue: elastic#201632 ### Main Changes - The primary change in this PR is encapsulated in the `calculateIsCustomized` function - Other changes involve passing the feature flag to this function - Added integration tests to cover all API CRUD operations that can be performed with rules (cherry picked from commit 22911c1) # Conflicts: # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/detection_rules_client.import_rules.test.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/methods/import_rule.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_for_import.test.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_for_import.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_from_asset.test.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_from_asset.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/rule_source_importer/rule_source_importer.test.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/rule_source_importer/rule_source_importer.ts # x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/import_rules.ts # x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/index.ts
xcrzx
added a commit
to xcrzx/kibana
that referenced
this issue
Dec 4, 2024
…ag is off (elastic#201825) **Resolves: elastic#201632 ## Summary When the rule customization feature flag is disabled, we should always return `isCustomized: false`, regardless of any changes introduced to a rule. This ensures that we do not accidentally mark prebuilt rules as customized in 8.16 with the feature flag off. For more details, refer to the related issue: elastic#201632 ### Main Changes - The primary change in this PR is encapsulated in the `calculateIsCustomized` function - Other changes involve passing the feature flag to this function - Added integration tests to cover all API CRUD operations that can be performed with rules (cherry picked from commit 22911c1) # Conflicts: # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/detection_rules_client.import_rules.test.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/methods/import_rule.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_for_import.test.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_for_import.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_from_asset.test.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_from_asset.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/rule_source_importer/rule_source_importer.test.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/rule_source_importer/rule_source_importer.ts # x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/import_rules.ts # x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/index.ts
xcrzx
added a commit
that referenced
this issue
Dec 4, 2024
…ture flag is off (#201825) (#202751) # Backport This will backport the following commits from `main` to `8.16`: - [[Security Solution] Skip isCustomized calculation when the feature flag is off (#201825)](#201825) <!--- Backport version: 8.9.8 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Dmitrii Shevchenko","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-12-03T12:11:24Z","message":"[Security Solution] Skip isCustomized calculation when the feature flag is off (#201825)\n\n**Resolves: https://github.com/elastic/kibana/issues/201632**\r\n\r\n## Summary \r\n\r\nWhen the rule customization feature flag is disabled, we should always\r\nreturn `isCustomized: false`, regardless of any changes introduced to a\r\nrule. This ensures that we do not accidentally mark prebuilt rules as\r\ncustomized in 8.16 with the feature flag off. For more details, refer to\r\nthe related issue: https://github.com/elastic/kibana/issues/201632\r\n\r\n### Main Changes \r\n\r\n- The primary change in this PR is encapsulated in the\r\n`calculateIsCustomized` function\r\n- Other changes involve passing the feature flag to this function\r\n- Added integration tests to cover all API CRUD operations that can be\r\nperformed with rules","sha":"22911c1828f40160cf3a2935300aec18c11b56e9","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","v9.0.0","Team:Detections and Resp","Team: SecuritySolution","Team:Detection Rule Management","Feature:Prebuilt Detection Rules","backport:version","v8.17.0","v8.18.0","v8.16.2"],"number":201825,"url":"https://github.com/elastic/kibana/pull/201825","mergeCommit":{"message":"[Security Solution] Skip isCustomized calculation when the feature flag is off (#201825)\n\n**Resolves: https://github.com/elastic/kibana/issues/201632**\r\n\r\n## Summary \r\n\r\nWhen the rule customization feature flag is disabled, we should always\r\nreturn `isCustomized: false`, regardless of any changes introduced to a\r\nrule. This ensures that we do not accidentally mark prebuilt rules as\r\ncustomized in 8.16 with the feature flag off. For more details, refer to\r\nthe related issue: https://github.com/elastic/kibana/issues/201632\r\n\r\n### Main Changes \r\n\r\n- The primary change in this PR is encapsulated in the\r\n`calculateIsCustomized` function\r\n- Other changes involve passing the feature flag to this function\r\n- Added integration tests to cover all API CRUD operations that can be\r\nperformed with rules","sha":"22911c1828f40160cf3a2935300aec18c11b56e9"}},"sourceBranch":"main","suggestedTargetBranches":["8.16"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","labelRegex":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/201825","number":201825,"mergeCommit":{"message":"[Security Solution] Skip isCustomized calculation when the feature flag is off (#201825)\n\n**Resolves: https://github.com/elastic/kibana/issues/201632**\r\n\r\n## Summary \r\n\r\nWhen the rule customization feature flag is disabled, we should always\r\nreturn `isCustomized: false`, regardless of any changes introduced to a\r\nrule. This ensures that we do not accidentally mark prebuilt rules as\r\ncustomized in 8.16 with the feature flag off. For more details, refer to\r\nthe related issue: https://github.com/elastic/kibana/issues/201632\r\n\r\n### Main Changes \r\n\r\n- The primary change in this PR is encapsulated in the\r\n`calculateIsCustomized` function\r\n- Other changes involve passing the feature flag to this function\r\n- Added integration tests to cover all API CRUD operations that can be\r\nperformed with rules","sha":"22911c1828f40160cf3a2935300aec18c11b56e9"}},{"branch":"8.17","label":"v8.17.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/202696","number":202696,"state":"MERGED","mergeCommit":{"sha":"487149e077e61341f81c871b74f36a9e20df67c0","message":"[8.17] [Security Solution] Skip isCustomized calculation when the feature flag is off (#201825) (#202696)\n\n# Backport\n\nThis will backport the following commits from `main` to `8.17`:\n- [[Security Solution] Skip isCustomized calculation when the feature\nflag is off (#201825)](https://github.com/elastic/kibana/pull/201825)\n\n<!--- Backport version: 9.4.3 -->\n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n<!--BACKPORT [{\"author\":{\"name\":\"Dmitrii\nShevchenko\",\"email\":\"[email protected]\"},\"sourceCommit\":{\"committedDate\":\"2024-12-03T12:11:24Z\",\"message\":\"[Security\nSolution] Skip isCustomized calculation when the feature flag is off\n(#201825)\\n\\n**Resolves:\nhttps://github.com//issues/201632**\\r\\n\\r\\n## Summary\n\\r\\n\\r\\nWhen the rule customization feature flag is disabled, we should\nalways\\r\\nreturn `isCustomized: false`, regardless of any changes\nintroduced to a\\r\\nrule. This ensures that we do not accidentally mark\nprebuilt rules as\\r\\ncustomized in 8.16 with the feature flag off. For\nmore details, refer to\\r\\nthe related issue:\nhttps://github.com//issues/201632\\r\\n\\r\\n### Main Changes\n\\r\\n\\r\\n- The primary change in this PR is encapsulated in\nthe\\r\\n`calculateIsCustomized` function\\r\\n- Other changes involve\npassing the feature flag to this function\\r\\n- Added integration tests\nto cover all API CRUD operations that can be\\r\\nperformed with\nrules\",\"sha\":\"22911c1828f40160cf3a2935300aec18c11b56e9\",\"branchLabelMapping\":{\"^v9.0.0$\":\"main\",\"^v8.18.0$\":\"8.x\",\"^v(\\\\d+).(\\\\d+).\\\\d+$\":\"$1.$2\"}},\"sourcePullRequest\":{\"labels\":[\"bug\",\"release_note:skip\",\"v9.0.0\",\"Team:Detections\nand Resp\",\"Team: SecuritySolution\",\"Team:Detection Rule\nManagement\",\"Feature:Prebuilt Detection\nRules\",\"backport:version\",\"v8.17.0\",\"v8.18.0\",\"v8.16.2\"],\"title\":\"[Security\nSolution] Skip isCustomized calculation when the feature flag is\noff\",\"number\":201825,\"url\":\"https://github.com/elastic/kibana/pull/201825\",\"mergeCommit\":{\"message\":\"[Security\nSolution] Skip isCustomized calculation when the feature flag is off\n(#201825)\\n\\n**Resolves:\nhttps://github.com//issues/201632**\\r\\n\\r\\n## Summary\n\\r\\n\\r\\nWhen the rule customization feature flag is disabled, we should\nalways\\r\\nreturn `isCustomized: false`, regardless of any changes\nintroduced to a\\r\\nrule. This ensures that we do not accidentally mark\nprebuilt rules as\\r\\ncustomized in 8.16 with the feature flag off. For\nmore details, refer to\\r\\nthe related issue:\nhttps://github.com//issues/201632\\r\\n\\r\\n### Main Changes\n\\r\\n\\r\\n- The primary change in this PR is encapsulated in\nthe\\r\\n`calculateIsCustomized` function\\r\\n- Other changes involve\npassing the feature flag to this function\\r\\n- Added integration tests\nto cover all API CRUD operations that can be\\r\\nperformed with\nrules\",\"sha\":\"22911c1828f40160cf3a2935300aec18c11b56e9\"}},\"sourceBranch\":\"main\",\"suggestedTargetBranches\":[\"8.17\",\"8.x\",\"8.16\"],\"targetPullRequestStates\":[{\"branch\":\"main\",\"label\":\"v9.0.0\",\"branchLabelMappingKey\":\"^v9.0.0$\",\"isSourceBranch\":true,\"state\":\"MERGED\",\"url\":\"https://github.com/elastic/kibana/pull/201825\",\"number\":201825,\"mergeCommit\":{\"message\":\"[Security\nSolution] Skip isCustomized calculation when the feature flag is off\n(#201825)\\n\\n**Resolves:\nhttps://github.com//issues/201632**\\r\\n\\r\\n## Summary\n\\r\\n\\r\\nWhen the rule customization feature flag is disabled, we should\nalways\\r\\nreturn `isCustomized: false`, regardless of any changes\nintroduced to a\\r\\nrule. This ensures that we do not accidentally mark\nprebuilt rules as\\r\\ncustomized in 8.16 with the feature flag off. For\nmore details, refer to\\r\\nthe related issue:\nhttps://github.com//issues/201632\\r\\n\\r\\n### Main Changes\n\\r\\n\\r\\n- The primary change in this PR is encapsulated in\nthe\\r\\n`calculateIsCustomized` function\\r\\n- Other changes involve\npassing the feature flag to this function\\r\\n- Added integration tests\nto cover all API CRUD operations that can be\\r\\nperformed with\nrules\",\"sha\":\"22911c1828f40160cf3a2935300aec18c11b56e9\"}},{\"branch\":\"8.17\",\"label\":\"v8.17.0\",\"branchLabelMappingKey\":\"^v(\\\\d+).(\\\\d+).\\\\d+$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"},{\"branch\":\"8.x\",\"label\":\"v8.18.0\",\"branchLabelMappingKey\":\"^v8.18.0$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"},{\"branch\":\"8.16\",\"label\":\"v8.16.2\",\"branchLabelMappingKey\":\"^v(\\\\d+).(\\\\d+).\\\\d+$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"}]}]\nBACKPORT-->\n\nCo-authored-by: Dmitrii Shevchenko <[email protected]>"}},{"branch":"8.x","label":"v8.18.0","labelRegex":"^v8.18.0$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/202697","number":202697,"state":"MERGED","mergeCommit":{"sha":"8c9181aa48796a8467e38ad1431238ebaa78de7e","message":"[8.x] [Security Solution] Skip isCustomized calculation when the feature flag is off (#201825) (#202697)\n\n# Backport\n\nThis will backport the following commits from `main` to `8.x`:\n- [[Security Solution] Skip isCustomized calculation when the feature\nflag is off (#201825)](https://github.com/elastic/kibana/pull/201825)\n\n<!--- Backport version: 9.4.3 -->\n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n<!--BACKPORT [{\"author\":{\"name\":\"Dmitrii\nShevchenko\",\"email\":\"[email protected]\"},\"sourceCommit\":{\"committedDate\":\"2024-12-03T12:11:24Z\",\"message\":\"[Security\nSolution] Skip isCustomized calculation when the feature flag is off\n(#201825)\\n\\n**Resolves:\nhttps://github.com//issues/201632**\\r\\n\\r\\n## Summary\n\\r\\n\\r\\nWhen the rule customization feature flag is disabled, we should\nalways\\r\\nreturn `isCustomized: false`, regardless of any changes\nintroduced to a\\r\\nrule. This ensures that we do not accidentally mark\nprebuilt rules as\\r\\ncustomized in 8.16 with the feature flag off. For\nmore details, refer to\\r\\nthe related issue:\nhttps://github.com//issues/201632\\r\\n\\r\\n### Main Changes\n\\r\\n\\r\\n- The primary change in this PR is encapsulated in\nthe\\r\\n`calculateIsCustomized` function\\r\\n- Other changes involve\npassing the feature flag to this function\\r\\n- Added integration tests\nto cover all API CRUD operations that can be\\r\\nperformed with\nrules\",\"sha\":\"22911c1828f40160cf3a2935300aec18c11b56e9\",\"branchLabelMapping\":{\"^v9.0.0$\":\"main\",\"^v8.18.0$\":\"8.x\",\"^v(\\\\d+).(\\\\d+).\\\\d+$\":\"$1.$2\"}},\"sourcePullRequest\":{\"labels\":[\"bug\",\"release_note:skip\",\"v9.0.0\",\"Team:Detections\nand Resp\",\"Team: SecuritySolution\",\"Team:Detection Rule\nManagement\",\"Feature:Prebuilt Detection\nRules\",\"backport:version\",\"v8.17.0\",\"v8.18.0\",\"v8.16.2\"],\"title\":\"[Security\nSolution] Skip isCustomized calculation when the feature flag is\noff\",\"number\":201825,\"url\":\"https://github.com/elastic/kibana/pull/201825\",\"mergeCommit\":{\"message\":\"[Security\nSolution] Skip isCustomized calculation when the feature flag is off\n(#201825)\\n\\n**Resolves:\nhttps://github.com//issues/201632**\\r\\n\\r\\n## Summary\n\\r\\n\\r\\nWhen the rule customization feature flag is disabled, we should\nalways\\r\\nreturn `isCustomized: false`, regardless of any changes\nintroduced to a\\r\\nrule. This ensures that we do not accidentally mark\nprebuilt rules as\\r\\ncustomized in 8.16 with the feature flag off. For\nmore details, refer to\\r\\nthe related issue:\nhttps://github.com//issues/201632\\r\\n\\r\\n### Main Changes\n\\r\\n\\r\\n- The primary change in this PR is encapsulated in\nthe\\r\\n`calculateIsCustomized` function\\r\\n- Other changes involve\npassing the feature flag to this function\\r\\n- Added integration tests\nto cover all API CRUD operations that can be\\r\\nperformed with\nrules\",\"sha\":\"22911c1828f40160cf3a2935300aec18c11b56e9\"}},\"sourceBranch\":\"main\",\"suggestedTargetBranches\":[\"8.17\",\"8.x\",\"8.16\"],\"targetPullRequestStates\":[{\"branch\":\"main\",\"label\":\"v9.0.0\",\"branchLabelMappingKey\":\"^v9.0.0$\",\"isSourceBranch\":true,\"state\":\"MERGED\",\"url\":\"https://github.com/elastic/kibana/pull/201825\",\"number\":201825,\"mergeCommit\":{\"message\":\"[Security\nSolution] Skip isCustomized calculation when the feature flag is off\n(#201825)\\n\\n**Resolves:\nhttps://github.com//issues/201632**\\r\\n\\r\\n## Summary\n\\r\\n\\r\\nWhen the rule customization feature flag is disabled, we should\nalways\\r\\nreturn `isCustomized: false`, regardless of any changes\nintroduced to a\\r\\nrule. This ensures that we do not accidentally mark\nprebuilt rules as\\r\\ncustomized in 8.16 with the feature flag off. For\nmore details, refer to\\r\\nthe related issue:\nhttps://github.com//issues/201632\\r\\n\\r\\n### Main Changes\n\\r\\n\\r\\n- The primary change in this PR is encapsulated in\nthe\\r\\n`calculateIsCustomized` function\\r\\n- Other changes involve\npassing the feature flag to this function\\r\\n- Added integration tests\nto cover all API CRUD operations that can be\\r\\nperformed with\nrules\",\"sha\":\"22911c1828f40160cf3a2935300aec18c11b56e9\"}},{\"branch\":\"8.17\",\"label\":\"v8.17.0\",\"branchLabelMappingKey\":\"^v(\\\\d+).(\\\\d+).\\\\d+$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"},{\"branch\":\"8.x\",\"label\":\"v8.18.0\",\"branchLabelMappingKey\":\"^v8.18.0$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"},{\"branch\":\"8.16\",\"label\":\"v8.16.2\",\"branchLabelMappingKey\":\"^v(\\\\d+).(\\\\d+).\\\\d+$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"}]}]\nBACKPORT-->\n\nCo-authored-by: Dmitrii Shevchenko <[email protected]>"}},{"branch":"8.16","label":"v8.16.2","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT-->
hop-dev
pushed a commit
to hop-dev/kibana
that referenced
this issue
Dec 5, 2024
…ag is off (elastic#201825) **Resolves: elastic#201632 ## Summary When the rule customization feature flag is disabled, we should always return `isCustomized: false`, regardless of any changes introduced to a rule. This ensures that we do not accidentally mark prebuilt rules as customized in 8.16 with the feature flag off. For more details, refer to the related issue: elastic#201632 ### Main Changes - The primary change in this PR is encapsulated in the `calculateIsCustomized` function - Other changes involve passing the feature flag to this function - Added integration tests to cover all API CRUD operations that can be performed with rules
CAWilson94
pushed a commit
to CAWilson94/kibana
that referenced
this issue
Dec 9, 2024
…ag is off (elastic#201825) **Resolves: elastic#201632 ## Summary When the rule customization feature flag is disabled, we should always return `isCustomized: false`, regardless of any changes introduced to a rule. This ensures that we do not accidentally mark prebuilt rules as customized in 8.16 with the feature flag off. For more details, refer to the related issue: elastic#201632 ### Main Changes - The primary change in this PR is encapsulated in the `calculateIsCustomized` function - Other changes involve passing the feature flag to this function - Added integration tests to cover all API CRUD operations that can be performed with rules
CAWilson94
pushed a commit
to CAWilson94/kibana
that referenced
this issue
Dec 12, 2024
…ag is off (elastic#201825) **Resolves: elastic#201632 ## Summary When the rule customization feature flag is disabled, we should always return `isCustomized: false`, regardless of any changes introduced to a rule. This ensures that we do not accidentally mark prebuilt rules as customized in 8.16 with the feature flag off. For more details, refer to the related issue: elastic#201632 ### Main Changes - The primary change in this PR is encapsulated in the `calculateIsCustomized` function - Other changes involve passing the feature flag to this function - Added integration tests to cover all API CRUD operations that can be performed with rules
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
8.17 candidate
bug
Fixes for quality problems that affect the customer experience
Feature:Prebuilt Detection Rules
Security Solution Prebuilt Detection Rules area
impact:high
Addressing this issue will have a high level of impact on the quality/strength of our product.
Team:Detection Rule Management
Security Detection Rule Management Team
Team:Detections and Resp
Security Detection Response Team
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
v8.16.2
v8.17.0
v8.18.0
v9.0.0
Summary
Currently, any rule update, such as adding or editing rule actions, causes the rule to be marked as customized if its base version is missing. Due to the current package size limit, this is a relatively common situation and is already affecting 8.16 with the feature flag disabled.
Steps to Reproduce
Expected Result
The rule is not marked as customized after saving, as actions do not count toward customizations.
Actual Result
The rule is erroneously marked as customized.
Mitigation
When the rule customizaiton feature flag is disabled, we should always return
isCustomized: false
regardless of changes introduced to a rule.The text was updated successfully, but these errors were encountered: