Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution][Detection Engine] adds alert suppression to Indicator Match rule #174241

Merged
merged 56 commits into from
Feb 5, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
56 commits
Select commit Hold shift + click to select a range
dc6c976
move alert suppression schema to common (#174240)
vitaliidm Jan 4, 2024
7b4b182
Suppression/add schema to im eql (#174244)
vitaliidm Jan 4, 2024
89df703
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 4, 2024
4f36323
Update rule_schemas.gen.ts
vitaliidm Jan 4, 2024
cc0ae5c
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 4, 2024
918ed28
introduce feature flags (#174293)
vitaliidm Jan 4, 2024
2dfa47c
Update rule_definition_section.tsx
vitaliidm Jan 5, 2024
1c07513
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 5, 2024
72dd1c0
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 8, 2024
483f190
[Security Solution][Detection Engine][Feature branch] adds Cypress te…
vitaliidm Jan 8, 2024
2273589
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 8, 2024
88fb535
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 8, 2024
912bc02
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 8, 2024
8861a8b
Update mappings.json
vitaliidm Jan 10, 2024
54a698b
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 10, 2024
b929e9d
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 12, 2024
8a14d4f
add use-callback (#174702)
vitaliidm Jan 12, 2024
5a6624c
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 12, 2024
0def0da
Update indicator_match_rule.cy.ts
vitaliidm Jan 16, 2024
e6c2518
remove eql from suppression PR (#175001)
vitaliidm Jan 17, 2024
48334dd
Update schema.tsx
vitaliidm Jan 17, 2024
c2713f0
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 17, 2024
951da77
[Security Solution][Detection Engine] adds FTR tests for IM suppressi…
vitaliidm Jan 17, 2024
d0e65b3
[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…
kibanamachine Jan 17, 2024
b5ccd91
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 23, 2024
a22b633
Merge branch 'security/alert-suppression-im-eql' of https://github.co…
vitaliidm Jan 23, 2024
e8f2ba1
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 23, 2024
9a34144
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 24, 2024
86320f0
Update indicator_match_alert_suppression.ts
vitaliidm Jan 24, 2024
1d6c6af
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 25, 2024
11a7d69
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 26, 2024
3f55974
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 26, 2024
a7a4281
[Security Solution][Detection Engine] adds backend implementation for…
vitaliidm Jan 26, 2024
e826b56
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 26, 2024
adf1030
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 29, 2024
e738750
PR review (#175784)
vitaliidm Jan 29, 2024
bb86f93
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 29, 2024
91d40d7
test changes
vitaliidm Jan 30, 2024
538e63a
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 30, 2024
f591ed6
[Security Solution][Detection Engine] Refactor Alert Suppression FE (…
WafaaNasr Jan 30, 2024
cd6be83
Update threat_match_alert_suppression.ts
vitaliidm Jan 30, 2024
b608483
rewrite flaky tests
vitaliidm Jan 30, 2024
4bfa2f5
Merge branch 'security/alert-suppression-im-eql' of https://github.co…
vitaliidm Jan 30, 2024
e53d544
follow constants naming convention
vitaliidm Jan 30, 2024
ee91214
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Jan 30, 2024
3ccd2f8
PR feedback
vitaliidm Feb 1, 2024
cd5bddc
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Feb 1, 2024
faa4ddb
Merge branch 'security/alert-suppression-im-eql' of https://github.co…
vitaliidm Feb 1, 2024
3aa86a6
PR feedback
vitaliidm Feb 1, 2024
f0ad4f2
address PR feedback
vitaliidm Feb 2, 2024
55dde08
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Feb 2, 2024
c3e6fb9
Update x-pack/plugins/rule_registry/common/schemas/8.13.0/index.ts
vitaliidm Feb 2, 2024
73d482c
Update x-pack/plugins/rule_registry/common/schemas/8.13.0/index.ts
vitaliidm Feb 2, 2024
e4239b6
PR feedback
vitaliidm Feb 2, 2024
a0122e9
PR feedback
vitaliidm Feb 2, 2024
ffbd021
Merge branch 'main' into security/alert-suppression-im-eql
vitaliidm Feb 5, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions x-pack/plugins/rule_registry/common/schemas/8.13.0/index.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/

import { ALERT_SUPPRESSION_TERMS } from '@kbn/rule-data-utils';
import { AlertWithCommonFields880 } from '../8.8.0';

import { SuppressionFields870 } from '../8.7.0';

/* DO NOT MODIFY THIS SCHEMA TO ADD NEW FIELDS. These types represent the alerts that shipped in 8.13.0.
Any changes to these types should be bug fixes so the types more accurately represent the alerts from 8.13.0.

If you are adding new fields for a new release of Kibana, create a new sibling folder to this one
for the version to be released and add the field(s) to the schema in that folder.

Then, update `../index.ts` to import from the new folder that has the latest schemas, add the
new schemas to the union of all alert schemas, and re-export the new schemas as the `*Latest` schemas.
*/

export interface SuppressionFields8130
extends Omit<SuppressionFields870, typeof ALERT_SUPPRESSION_TERMS> {
[ALERT_SUPPRESSION_TERMS]: Array<{
field: string;
value: string | number | null | string[] | number[];
}>;
}

export type AlertWithSuppressionFields8130<T> = AlertWithCommonFields880<T> & SuppressionFields8130;
12 changes: 5 additions & 7 deletions x-pack/plugins/rule_registry/common/schemas/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -5,21 +5,19 @@
* 2.0.
*/

import type {
AlertWithSuppressionFields870,
SuppressionFields870,
CommonAlertIdFieldName870,
} from './8.7.0';
import type { CommonAlertIdFieldName870 } from './8.7.0';

import type {
AlertWithCommonFields880,
CommonAlertFieldName880,
CommonAlertFields880,
} from './8.8.0';

import type { AlertWithSuppressionFields8130, SuppressionFields8130 } from './8.13.0';

export type {
AlertWithSuppressionFields870 as AlertWithSuppressionFieldsLatest,
SuppressionFields870 as SuppressionFieldsLatest,
AlertWithSuppressionFields8130 as AlertWithSuppressionFieldsLatest,
SuppressionFields8130 as SuppressionFieldsLatest,
CommonAlertFieldName880 as CommonAlertFieldNameLatest,
CommonAlertIdFieldName870 as CommonAlertIdFieldNameLatest,
CommonAlertFields880 as CommonAlertFieldsLatest,
Expand Down
Loading