Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Prebuilt rules with missing base version are marked as customized on edit #201632

Closed
Tracked by #201502
xcrzx opened this issue Nov 25, 2024 · 3 comments · Fixed by #201825
Closed
Tracked by #201502
Assignees
Labels
8.17 candidate bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.16.2 v8.17.0 v8.18.0 v9.0.0

Comments

@xcrzx
Copy link
Contributor

xcrzx commented Nov 25, 2024

Summary

Currently, any rule update, such as adding or editing rule actions, causes the rule to be marked as customized if its base version is missing. Due to the current package size limit, this is a relatively common situation and is already affecting 8.16 with the feature flag disabled.

Steps to Reproduce

  1. Ensure the rule customization feature flag is disabled.
  2. Open any prebuilt rule that doesn’t have a base version in the rules package.
  3. Edit the rule (e.g., add or modify its actions).
  4. Save the rule.

Expected Result

The rule is not marked as customized after saving, as actions do not count toward customizations.

Actual Result

The rule is erroneously marked as customized.

Mitigation

When the rule customizaiton feature flag is disabled, we should always return isCustomized: false regardless of changes introduced to a rule.

@xcrzx xcrzx added bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team v8.16.2 v8.17.0 v8.18.0 v9.0.0 labels Nov 25, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@xcrzx xcrzx self-assigned this Nov 25, 2024
@banderror banderror added 8.17 candidate impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. labels Nov 25, 2024
xcrzx added a commit that referenced this issue Dec 3, 2024
…ag is off (#201825)

**Resolves: #201632

## Summary  

When the rule customization feature flag is disabled, we should always
return `isCustomized: false`, regardless of any changes introduced to a
rule. This ensures that we do not accidentally mark prebuilt rules as
customized in 8.16 with the feature flag off. For more details, refer to
the related issue: #201632

### Main Changes  

- The primary change in this PR is encapsulated in the
`calculateIsCustomized` function
- Other changes involve passing the feature flag to this function
- Added integration tests to cover all API CRUD operations that can be
performed with rules
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Dec 3, 2024
…ag is off (elastic#201825)

**Resolves: elastic#201632

## Summary

When the rule customization feature flag is disabled, we should always
return `isCustomized: false`, regardless of any changes introduced to a
rule. This ensures that we do not accidentally mark prebuilt rules as
customized in 8.16 with the feature flag off. For more details, refer to
the related issue: elastic#201632

### Main Changes

- The primary change in this PR is encapsulated in the
`calculateIsCustomized` function
- Other changes involve passing the feature flag to this function
- Added integration tests to cover all API CRUD operations that can be
performed with rules

(cherry picked from commit 22911c1)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Dec 3, 2024
…ag is off (elastic#201825)

**Resolves: elastic#201632

## Summary

When the rule customization feature flag is disabled, we should always
return `isCustomized: false`, regardless of any changes introduced to a
rule. This ensures that we do not accidentally mark prebuilt rules as
customized in 8.16 with the feature flag off. For more details, refer to
the related issue: elastic#201632

### Main Changes

- The primary change in this PR is encapsulated in the
`calculateIsCustomized` function
- Other changes involve passing the feature flag to this function
- Added integration tests to cover all API CRUD operations that can be
performed with rules

(cherry picked from commit 22911c1)
xcrzx added a commit to xcrzx/kibana that referenced this issue Dec 3, 2024
…ag is off (elastic#201825)

**Resolves: elastic#201632

## Summary

When the rule customization feature flag is disabled, we should always
return `isCustomized: false`, regardless of any changes introduced to a
rule. This ensures that we do not accidentally mark prebuilt rules as
customized in 8.16 with the feature flag off. For more details, refer to
the related issue: elastic#201632

### Main Changes

- The primary change in this PR is encapsulated in the
`calculateIsCustomized` function
- Other changes involve passing the feature flag to this function
- Added integration tests to cover all API CRUD operations that can be
performed with rules

(cherry picked from commit 22911c1)

# Conflicts:
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/detection_rules_client.import_rules.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/methods/import_rule.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_for_import.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_for_import.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_from_asset.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_from_asset.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/rule_source_importer/rule_source_importer.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/rule_source_importer/rule_source_importer.ts
#	x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/import_rules.ts
#	x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/index.ts
xcrzx added a commit to xcrzx/kibana that referenced this issue Dec 3, 2024
…ag is off (elastic#201825)

**Resolves: elastic#201632

## Summary

When the rule customization feature flag is disabled, we should always
return `isCustomized: false`, regardless of any changes introduced to a
rule. This ensures that we do not accidentally mark prebuilt rules as
customized in 8.16 with the feature flag off. For more details, refer to
the related issue: elastic#201632

### Main Changes

- The primary change in this PR is encapsulated in the
`calculateIsCustomized` function
- Other changes involve passing the feature flag to this function
- Added integration tests to cover all API CRUD operations that can be
performed with rules

(cherry picked from commit 22911c1)

# Conflicts:
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/detection_rules_client.import_rules.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/methods/import_rule.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_for_import.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_for_import.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_from_asset.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_from_asset.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/rule_source_importer/rule_source_importer.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/rule_source_importer/rule_source_importer.ts
#	x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/import_rules.ts
#	x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/index.ts
xcrzx added a commit to xcrzx/kibana that referenced this issue Dec 4, 2024
…ag is off (elastic#201825)

**Resolves: elastic#201632

## Summary

When the rule customization feature flag is disabled, we should always
return `isCustomized: false`, regardless of any changes introduced to a
rule. This ensures that we do not accidentally mark prebuilt rules as
customized in 8.16 with the feature flag off. For more details, refer to
the related issue: elastic#201632

### Main Changes

- The primary change in this PR is encapsulated in the
`calculateIsCustomized` function
- Other changes involve passing the feature flag to this function
- Added integration tests to cover all API CRUD operations that can be
performed with rules

(cherry picked from commit 22911c1)

# Conflicts:
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/detection_rules_client.import_rules.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/methods/import_rule.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_for_import.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_for_import.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_from_asset.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/calculate_rule_source_from_asset.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/rule_source_importer/rule_source_importer.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/import/rule_source_importer/rule_source_importer.ts
#	x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/import_rules.ts
#	x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/index.ts
xcrzx added a commit that referenced this issue Dec 4, 2024
…ture flag is off (#201825) (#202751)

# Backport

This will backport the following commits from `main` to `8.16`:
- [[Security Solution] Skip isCustomized calculation when the feature
flag is off (#201825)](#201825)

<!--- Backport version: 8.9.8 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Dmitrii
Shevchenko","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-12-03T12:11:24Z","message":"[Security
Solution] Skip isCustomized calculation when the feature flag is off
(#201825)\n\n**Resolves:
https://github.com/elastic/kibana/issues/201632**\r\n\r\n## Summary
\r\n\r\nWhen the rule customization feature flag is disabled, we should
always\r\nreturn `isCustomized: false`, regardless of any changes
introduced to a\r\nrule. This ensures that we do not accidentally mark
prebuilt rules as\r\ncustomized in 8.16 with the feature flag off. For
more details, refer to\r\nthe related issue:
https://github.com/elastic/kibana/issues/201632\r\n\r\n### Main Changes
\r\n\r\n- The primary change in this PR is encapsulated in
the\r\n`calculateIsCustomized` function\r\n- Other changes involve
passing the feature flag to this function\r\n- Added integration tests
to cover all API CRUD operations that can be\r\nperformed with
rules","sha":"22911c1828f40160cf3a2935300aec18c11b56e9","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.17.0","v8.18.0","v8.16.2"],"number":201825,"url":"https://github.com/elastic/kibana/pull/201825","mergeCommit":{"message":"[Security
Solution] Skip isCustomized calculation when the feature flag is off
(#201825)\n\n**Resolves:
https://github.com/elastic/kibana/issues/201632**\r\n\r\n## Summary
\r\n\r\nWhen the rule customization feature flag is disabled, we should
always\r\nreturn `isCustomized: false`, regardless of any changes
introduced to a\r\nrule. This ensures that we do not accidentally mark
prebuilt rules as\r\ncustomized in 8.16 with the feature flag off. For
more details, refer to\r\nthe related issue:
https://github.com/elastic/kibana/issues/201632\r\n\r\n### Main Changes
\r\n\r\n- The primary change in this PR is encapsulated in
the\r\n`calculateIsCustomized` function\r\n- Other changes involve
passing the feature flag to this function\r\n- Added integration tests
to cover all API CRUD operations that can be\r\nperformed with
rules","sha":"22911c1828f40160cf3a2935300aec18c11b56e9"}},"sourceBranch":"main","suggestedTargetBranches":["8.16"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","labelRegex":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/201825","number":201825,"mergeCommit":{"message":"[Security
Solution] Skip isCustomized calculation when the feature flag is off
(#201825)\n\n**Resolves:
https://github.com/elastic/kibana/issues/201632**\r\n\r\n## Summary
\r\n\r\nWhen the rule customization feature flag is disabled, we should
always\r\nreturn `isCustomized: false`, regardless of any changes
introduced to a\r\nrule. This ensures that we do not accidentally mark
prebuilt rules as\r\ncustomized in 8.16 with the feature flag off. For
more details, refer to\r\nthe related issue:
https://github.com/elastic/kibana/issues/201632\r\n\r\n### Main Changes
\r\n\r\n- The primary change in this PR is encapsulated in
the\r\n`calculateIsCustomized` function\r\n- Other changes involve
passing the feature flag to this function\r\n- Added integration tests
to cover all API CRUD operations that can be\r\nperformed with
rules","sha":"22911c1828f40160cf3a2935300aec18c11b56e9"}},{"branch":"8.17","label":"v8.17.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/202696","number":202696,"state":"MERGED","mergeCommit":{"sha":"487149e077e61341f81c871b74f36a9e20df67c0","message":"[8.17]
[Security Solution] Skip isCustomized calculation when the feature flag
is off (#201825) (#202696)\n\n# Backport\n\nThis will backport the
following commits from `main` to `8.17`:\n- [[Security Solution] Skip
isCustomized calculation when the feature\nflag is off
(#201825)](https://github.com/elastic/kibana/pull/201825)\n\n<!---
Backport version: 9.4.3 -->\n\n### Questions ?\nPlease refer to the
[Backport
tool\ndocumentation](https://github.com/sqren/backport)\n\n<!--BACKPORT
[{\"author\":{\"name\":\"Dmitrii\nShevchenko\",\"email\":\"[email protected]\"},\"sourceCommit\":{\"committedDate\":\"2024-12-03T12:11:24Z\",\"message\":\"[Security\nSolution]
Skip isCustomized calculation when the feature flag is
off\n(#201825)\\n\\n**Resolves:\nhttps://github.com//issues/201632**\\r\\n\\r\\n##
Summary\n\\r\\n\\r\\nWhen the rule customization feature flag is
disabled, we should\nalways\\r\\nreturn `isCustomized: false`,
regardless of any changes\nintroduced to a\\r\\nrule. This ensures that
we do not accidentally mark\nprebuilt rules as\\r\\ncustomized in 8.16
with the feature flag off. For\nmore details, refer to\\r\\nthe related
issue:\nhttps://github.com//issues/201632\\r\\n\\r\\n###
Main Changes\n\\r\\n\\r\\n- The primary change in this PR is
encapsulated in\nthe\\r\\n`calculateIsCustomized` function\\r\\n- Other
changes involve\npassing the feature flag to this function\\r\\n- Added
integration tests\nto cover all API CRUD operations that can
be\\r\\nperformed
with\nrules\",\"sha\":\"22911c1828f40160cf3a2935300aec18c11b56e9\",\"branchLabelMapping\":{\"^v9.0.0$\":\"main\",\"^v8.18.0$\":\"8.x\",\"^v(\\\\d+).(\\\\d+).\\\\d+$\":\"$1.$2\"}},\"sourcePullRequest\":{\"labels\":[\"bug\",\"release_note:skip\",\"v9.0.0\",\"Team:Detections\nand
Resp\",\"Team: SecuritySolution\",\"Team:Detection
Rule\nManagement\",\"Feature:Prebuilt
Detection\nRules\",\"backport:version\",\"v8.17.0\",\"v8.18.0\",\"v8.16.2\"],\"title\":\"[Security\nSolution]
Skip isCustomized calculation when the feature flag
is\noff\",\"number\":201825,\"url\":\"https://github.com/elastic/kibana/pull/201825\",\"mergeCommit\":{\"message\":\"[Security\nSolution]
Skip isCustomized calculation when the feature flag is
off\n(#201825)\\n\\n**Resolves:\nhttps://github.com//issues/201632**\\r\\n\\r\\n##
Summary\n\\r\\n\\r\\nWhen the rule customization feature flag is
disabled, we should\nalways\\r\\nreturn `isCustomized: false`,
regardless of any changes\nintroduced to a\\r\\nrule. This ensures that
we do not accidentally mark\nprebuilt rules as\\r\\ncustomized in 8.16
with the feature flag off. For\nmore details, refer to\\r\\nthe related
issue:\nhttps://github.com//issues/201632\\r\\n\\r\\n###
Main Changes\n\\r\\n\\r\\n- The primary change in this PR is
encapsulated in\nthe\\r\\n`calculateIsCustomized` function\\r\\n- Other
changes involve\npassing the feature flag to this function\\r\\n- Added
integration tests\nto cover all API CRUD operations that can
be\\r\\nperformed
with\nrules\",\"sha\":\"22911c1828f40160cf3a2935300aec18c11b56e9\"}},\"sourceBranch\":\"main\",\"suggestedTargetBranches\":[\"8.17\",\"8.x\",\"8.16\"],\"targetPullRequestStates\":[{\"branch\":\"main\",\"label\":\"v9.0.0\",\"branchLabelMappingKey\":\"^v9.0.0$\",\"isSourceBranch\":true,\"state\":\"MERGED\",\"url\":\"https://github.com/elastic/kibana/pull/201825\",\"number\":201825,\"mergeCommit\":{\"message\":\"[Security\nSolution]
Skip isCustomized calculation when the feature flag is
off\n(#201825)\\n\\n**Resolves:\nhttps://github.com//issues/201632**\\r\\n\\r\\n##
Summary\n\\r\\n\\r\\nWhen the rule customization feature flag is
disabled, we should\nalways\\r\\nreturn `isCustomized: false`,
regardless of any changes\nintroduced to a\\r\\nrule. This ensures that
we do not accidentally mark\nprebuilt rules as\\r\\ncustomized in 8.16
with the feature flag off. For\nmore details, refer to\\r\\nthe related
issue:\nhttps://github.com//issues/201632\\r\\n\\r\\n###
Main Changes\n\\r\\n\\r\\n- The primary change in this PR is
encapsulated in\nthe\\r\\n`calculateIsCustomized` function\\r\\n- Other
changes involve\npassing the feature flag to this function\\r\\n- Added
integration tests\nto cover all API CRUD operations that can
be\\r\\nperformed
with\nrules\",\"sha\":\"22911c1828f40160cf3a2935300aec18c11b56e9\"}},{\"branch\":\"8.17\",\"label\":\"v8.17.0\",\"branchLabelMappingKey\":\"^v(\\\\d+).(\\\\d+).\\\\d+$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"},{\"branch\":\"8.x\",\"label\":\"v8.18.0\",\"branchLabelMappingKey\":\"^v8.18.0$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"},{\"branch\":\"8.16\",\"label\":\"v8.16.2\",\"branchLabelMappingKey\":\"^v(\\\\d+).(\\\\d+).\\\\d+$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"}]}]\nBACKPORT-->\n\nCo-authored-by:
Dmitrii Shevchenko
<[email protected]>"}},{"branch":"8.x","label":"v8.18.0","labelRegex":"^v8.18.0$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/202697","number":202697,"state":"MERGED","mergeCommit":{"sha":"8c9181aa48796a8467e38ad1431238ebaa78de7e","message":"[8.x]
[Security Solution] Skip isCustomized calculation when the feature flag
is off (#201825) (#202697)\n\n# Backport\n\nThis will backport the
following commits from `main` to `8.x`:\n- [[Security Solution] Skip
isCustomized calculation when the feature\nflag is off
(#201825)](https://github.com/elastic/kibana/pull/201825)\n\n<!---
Backport version: 9.4.3 -->\n\n### Questions ?\nPlease refer to the
[Backport
tool\ndocumentation](https://github.com/sqren/backport)\n\n<!--BACKPORT
[{\"author\":{\"name\":\"Dmitrii\nShevchenko\",\"email\":\"[email protected]\"},\"sourceCommit\":{\"committedDate\":\"2024-12-03T12:11:24Z\",\"message\":\"[Security\nSolution]
Skip isCustomized calculation when the feature flag is
off\n(#201825)\\n\\n**Resolves:\nhttps://github.com//issues/201632**\\r\\n\\r\\n##
Summary\n\\r\\n\\r\\nWhen the rule customization feature flag is
disabled, we should\nalways\\r\\nreturn `isCustomized: false`,
regardless of any changes\nintroduced to a\\r\\nrule. This ensures that
we do not accidentally mark\nprebuilt rules as\\r\\ncustomized in 8.16
with the feature flag off. For\nmore details, refer to\\r\\nthe related
issue:\nhttps://github.com//issues/201632\\r\\n\\r\\n###
Main Changes\n\\r\\n\\r\\n- The primary change in this PR is
encapsulated in\nthe\\r\\n`calculateIsCustomized` function\\r\\n- Other
changes involve\npassing the feature flag to this function\\r\\n- Added
integration tests\nto cover all API CRUD operations that can
be\\r\\nperformed
with\nrules\",\"sha\":\"22911c1828f40160cf3a2935300aec18c11b56e9\",\"branchLabelMapping\":{\"^v9.0.0$\":\"main\",\"^v8.18.0$\":\"8.x\",\"^v(\\\\d+).(\\\\d+).\\\\d+$\":\"$1.$2\"}},\"sourcePullRequest\":{\"labels\":[\"bug\",\"release_note:skip\",\"v9.0.0\",\"Team:Detections\nand
Resp\",\"Team: SecuritySolution\",\"Team:Detection
Rule\nManagement\",\"Feature:Prebuilt
Detection\nRules\",\"backport:version\",\"v8.17.0\",\"v8.18.0\",\"v8.16.2\"],\"title\":\"[Security\nSolution]
Skip isCustomized calculation when the feature flag
is\noff\",\"number\":201825,\"url\":\"https://github.com/elastic/kibana/pull/201825\",\"mergeCommit\":{\"message\":\"[Security\nSolution]
Skip isCustomized calculation when the feature flag is
off\n(#201825)\\n\\n**Resolves:\nhttps://github.com//issues/201632**\\r\\n\\r\\n##
Summary\n\\r\\n\\r\\nWhen the rule customization feature flag is
disabled, we should\nalways\\r\\nreturn `isCustomized: false`,
regardless of any changes\nintroduced to a\\r\\nrule. This ensures that
we do not accidentally mark\nprebuilt rules as\\r\\ncustomized in 8.16
with the feature flag off. For\nmore details, refer to\\r\\nthe related
issue:\nhttps://github.com//issues/201632\\r\\n\\r\\n###
Main Changes\n\\r\\n\\r\\n- The primary change in this PR is
encapsulated in\nthe\\r\\n`calculateIsCustomized` function\\r\\n- Other
changes involve\npassing the feature flag to this function\\r\\n- Added
integration tests\nto cover all API CRUD operations that can
be\\r\\nperformed
with\nrules\",\"sha\":\"22911c1828f40160cf3a2935300aec18c11b56e9\"}},\"sourceBranch\":\"main\",\"suggestedTargetBranches\":[\"8.17\",\"8.x\",\"8.16\"],\"targetPullRequestStates\":[{\"branch\":\"main\",\"label\":\"v9.0.0\",\"branchLabelMappingKey\":\"^v9.0.0$\",\"isSourceBranch\":true,\"state\":\"MERGED\",\"url\":\"https://github.com/elastic/kibana/pull/201825\",\"number\":201825,\"mergeCommit\":{\"message\":\"[Security\nSolution]
Skip isCustomized calculation when the feature flag is
off\n(#201825)\\n\\n**Resolves:\nhttps://github.com//issues/201632**\\r\\n\\r\\n##
Summary\n\\r\\n\\r\\nWhen the rule customization feature flag is
disabled, we should\nalways\\r\\nreturn `isCustomized: false`,
regardless of any changes\nintroduced to a\\r\\nrule. This ensures that
we do not accidentally mark\nprebuilt rules as\\r\\ncustomized in 8.16
with the feature flag off. For\nmore details, refer to\\r\\nthe related
issue:\nhttps://github.com//issues/201632\\r\\n\\r\\n###
Main Changes\n\\r\\n\\r\\n- The primary change in this PR is
encapsulated in\nthe\\r\\n`calculateIsCustomized` function\\r\\n- Other
changes involve\npassing the feature flag to this function\\r\\n- Added
integration tests\nto cover all API CRUD operations that can
be\\r\\nperformed
with\nrules\",\"sha\":\"22911c1828f40160cf3a2935300aec18c11b56e9\"}},{\"branch\":\"8.17\",\"label\":\"v8.17.0\",\"branchLabelMappingKey\":\"^v(\\\\d+).(\\\\d+).\\\\d+$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"},{\"branch\":\"8.x\",\"label\":\"v8.18.0\",\"branchLabelMappingKey\":\"^v8.18.0$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"},{\"branch\":\"8.16\",\"label\":\"v8.16.2\",\"branchLabelMappingKey\":\"^v(\\\\d+).(\\\\d+).\\\\d+$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"}]}]\nBACKPORT-->\n\nCo-authored-by:
Dmitrii Shevchenko
<[email protected]>"}},{"branch":"8.16","label":"v8.16.2","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->
hop-dev pushed a commit to hop-dev/kibana that referenced this issue Dec 5, 2024
…ag is off (elastic#201825)

**Resolves: elastic#201632

## Summary  

When the rule customization feature flag is disabled, we should always
return `isCustomized: false`, regardless of any changes introduced to a
rule. This ensures that we do not accidentally mark prebuilt rules as
customized in 8.16 with the feature flag off. For more details, refer to
the related issue: elastic#201632

### Main Changes  

- The primary change in this PR is encapsulated in the
`calculateIsCustomized` function
- Other changes involve passing the feature flag to this function
- Added integration tests to cover all API CRUD operations that can be
performed with rules
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this issue Dec 9, 2024
…ag is off (elastic#201825)

**Resolves: elastic#201632

## Summary  

When the rule customization feature flag is disabled, we should always
return `isCustomized: false`, regardless of any changes introduced to a
rule. This ensures that we do not accidentally mark prebuilt rules as
customized in 8.16 with the feature flag off. For more details, refer to
the related issue: elastic#201632

### Main Changes  

- The primary change in this PR is encapsulated in the
`calculateIsCustomized` function
- Other changes involve passing the feature flag to this function
- Added integration tests to cover all API CRUD operations that can be
performed with rules
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this issue Dec 12, 2024
…ag is off (elastic#201825)

**Resolves: elastic#201632

## Summary  

When the rule customization feature flag is disabled, we should always
return `isCustomized: false`, regardless of any changes introduced to a
rule. This ensures that we do not accidentally mark prebuilt rules as
customized in 8.16 with the feature flag off. For more details, refer to
the related issue: elastic#201632

### Main Changes  

- The primary change in this PR is encapsulated in the
`calculateIsCustomized` function
- Other changes involve passing the feature flag to this function
- Added integration tests to cover all API CRUD operations that can be
performed with rules
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
8.17 candidate bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.16.2 v8.17.0 v8.18.0 v9.0.0
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants