Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Disables author and license fields in rule edit form for prebuilt rule types #201887

Merged
merged 6 commits into from
Dec 4, 2024
Merged

[Security Solution] Disables author and license fields in rule edit form for prebuilt rule types #201887

merged 6 commits into from
Dec 4, 2024
+64 −25

Conversation

dplumlee
Copy link
Contributor

@dplumlee dplumlee commented Nov 26, 2024 •
edited by kibanamachine
Loading

Summary

Fixes #200251

Note

This bug/related fix is only visible with the prebuiltRulesCustomizationEnabled feature flag turned on.

Disables author and license fields in rule edit form for prebuilt rule types as we throw API errors when they are changed from the existing rule value if the rule source is external.

Screenshots - the same prebuilt rule in the Rule edit form

Before
Screenshot 2024-11-26 at 5 32 00 PM

After
Screenshot 2024-12-03 at 3 22 34 PM

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

@dplumlee dplumlee added bug Fixes for quality problems that affect the customer experience release_note:skip Skip the PR/issue when compiling release notes v9.0.0 Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area v8.17.0 v8.18.0 labels Nov 26, 2024
@dplumlee dplumlee self-assigned this Nov 26, 2024
@dplumlee dplumlee requested a review from a team as a code owner November 26, 2024 23:33
@dplumlee dplumlee requested a review from dhurley14 November 26, 2024 23:33
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@dplumlee dplumlee added the backport:version Backport to applied version labels label Nov 26, 2024
@maximpn maximpn self-requested a review November 27, 2024 09:06
maximpn
maximpn reviewed Nov 27, 2024
View reviewed changes
Copy link
Contributor

@maximpn maximpn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dplumlee Did you think about hiding the author and license fields for prebuilt rules? There is nothing users can do to unlock them.

...urity_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.tsx Outdated Show resolved Hide resolved
@dplumlee
Copy link
Contributor Author

@maximpn I did it this way so the user could still see the info when they were editing the prebuilt rule if the context was needed but I guess I don't feel too strongly about it one way or the other. @ARWNightingale is there a preferred way to show/not show fields like these that can't be edited for prebuilt rules?

@banderror
Copy link
Contributor

banderror commented Nov 29, 2024 •
edited
Loading

@maximpn Not sure I understand, why would we want to hide these fields instead of disabling? I think by keeping these fields disabled we let the user know that they exist, have certain values, but are not editable.

@ARWNightingale @approksiu do you have any opinion? We'd like to merge the PR early next week.

@banderror
Copy link
Contributor

@elasticmachine merge upstream

@maximpn
Copy link
Contributor

maximpn commented Nov 29, 2024

Not sure I understand, why would we want to hide these fields instead of disabling? I think by keeping these fields disabled we let the user know that they exist, have certain values, but are not editable.

@banderror,

It's a bit weird UX showing disabled fields to users when there is no way to unlock them. In that case we should display an explanation tooltip. On the other hand it's just simpler to hide them. Maybe @ARWNightingale and @approksiu have another opinion.

@ARWNightingale
Copy link

@maximpn I think we should still show them disabled, it feels like the current consistent behaviour to do. I am working with platform to establish clear behaviour for disabled and hidden interactions but I dont have anything yet.

@maximpn
Copy link
Contributor

maximpn commented Dec 2, 2024

I think we should still show them disabled, it feels like the current consistent behaviour to do. I am working with platform to establish clear behaviour for disabled and hidden interactions but I dont have anything yet.

@ARWNightingale

Got your point. Do you think we need to display a tooltip explaining why the fields disabled?

@dplumlee dplumlee force-pushed the rule-edit-form-prebuilt-validation-bugs branch from 4464f4c to 6ba0e5c Compare December 2, 2024 20:31
@ARWNightingale
Copy link

@maximpn, sorry yes absolutely for the tooltip, maybe something like
"Author is not editable for Elastic rules"

@dplumlee dplumlee requested a review from maximpn December 3, 2024 20:23
maximpn
maximpn approved these changes Dec 4, 2024
View reviewed changes
Copy link
Contributor

@maximpn maximpn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The form with a tooltip looks much better. Testing didn't reveal issues. Thanks @dplumlee 🙏

I left a minor comment.

...urity_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.tsx Outdated Show resolved Hide resolved
@dplumlee dplumlee enabled auto-merge (squash) December 4, 2024 15:09
@dplumlee
Copy link
Contributor Author

dplumlee commented Dec 4, 2024

@elasticmachine merge upstream

@dplumlee dplumlee merged commit 13fa525 into elastic:main Dec 4, 2024
8 checks passed
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.17, 8.x

https://github.com/elastic/kibana/actions/runs/12165858860

@elasticmachine
Copy link
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #53 / EQL execution logic API @ess @serverless Alert Suppression for EQL rules @skipInServerless sequence queries with suppression duration does not suppress alerts outside of duration

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 14.6MB 14.6MB +802.0B

History

cc @dplumlee

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Dec 4, 2024
@dplumlee
[Security Solution] Disables author and license fields in rule ed…
2e7fe0a 
…it form for prebuilt rule types (elastic#201887)

## Summary

Fixes elastic#200251

> [!NOTE]
> This bug/related fix is only visible with the
`prebuiltRulesCustomizationEnabled` feature flag turned on.

Disables `author` and `license` fields in rule edit form for prebuilt
rule types as we throw API errors when they are changed from the
existing rule value if the rule source is external.

### Screenshots - the same prebuilt rule in the Rule edit form
**Before**
<img width="738" alt="Screenshot 2024-11-26 at 5 32 00 PM"
src="https://github.com/user-attachments/assets/6262cdb2-750a-47fb-b6b8-ec07f4acd8aa">

**After**
![Screenshot 2024-12-03 at 3 22
34 PM](https://github.com/user-attachments/assets/bfb4c468-3ea2-4fa0-bd36-a90c32eacce4)

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

(cherry picked from commit 13fa525)
@kibanamachine kibanamachine mentioned this pull request Dec 4, 2024
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Dec 4, 2024
@dplumlee
[Security Solution] Disables author and license fields in rule ed…
16fe015 
…it form for prebuilt rule types (elastic#201887)

## Summary

Fixes elastic#200251

> [!NOTE]
> This bug/related fix is only visible with the
`prebuiltRulesCustomizationEnabled` feature flag turned on.

Disables `author` and `license` fields in rule edit form for prebuilt
rule types as we throw API errors when they are changed from the
existing rule value if the rule source is external.

### Screenshots - the same prebuilt rule in the Rule edit form
**Before**
<img width="738" alt="Screenshot 2024-11-26 at 5 32 00 PM"
src="https://github.com/user-attachments/assets/6262cdb2-750a-47fb-b6b8-ec07f4acd8aa">

**After**
![Screenshot 2024-12-03 at 3 22
34 PM](https://github.com/user-attachments/assets/bfb4c468-3ea2-4fa0-bd36-a90c32eacce4)

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

(cherry picked from commit 13fa525)
@kibanamachine kibanamachine mentioned this pull request Dec 4, 2024
Merged
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
✅ 8.17
✅ 8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

@dplumlee dplumlee deleted the rule-edit-form-prebuilt-validation-bugs branch December 4, 2024 19:41
kibanamachine added a commit that referenced this pull request Dec 5, 2024
@kibanamachine @dplumlee @elasticmachine
[8.x] [Security Solution] Disables &#x60;author&#x60; and &#x60;licen…
aaf6e4f 
…se&#x60; fields in rule edit form for prebuilt rule types (#201887) (#203001)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution] Disables &#x60;author&#x60; and
&#x60;license&#x60; fields in rule edit form for prebuilt rule types
(#201887)](#201887)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-12-04T18:17:55Z","message":"[Security
Solution] Disables `author` and `license` fields in rule edit form for
prebuilt rule types (#201887)\n\n## Summary\r\n\r\nFixes
https://github.com/elastic/kibana/issues/200251\r\n\r\n> [!NOTE] \r\n>
This bug/related fix is only visible with
the\r\n`prebuiltRulesCustomizationEnabled` feature flag turned
on.\r\n\r\nDisables `author` and `license` fields in rule edit form for
prebuilt\r\nrule types as we throw API errors when they are changed from
the\r\nexisting rule value if the rule source is
external.\r\n\r\n\r\n### Screenshots - the same prebuilt rule in the
Rule edit form\r\n**Before**\r\n<img width=\"738\" alt=\"Screenshot
2024-11-26 at 5 32
00 PM\"\r\nsrc=\"https://github.com/user-attachments/assets/6262cdb2-750a-47fb-b6b8-ec07f4acd8aa\">\r\n\r\n\r\n**After**\r\n![Screenshot
2024-12-03 at 3
22\r\n34 PM](https://github.com/user-attachments/assets/bfb4c468-3ea2-4fa0-bd36-a90c32eacce4)\r\n\r\n###
Checklist\r\n\r\nCheck the PR satisfies following conditions.
\r\n\r\nReviewers should verify this PR satisfies this list as
well.\r\n\r\n- [ ] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"13fa5259c8df89ff5a27fe0a8214b2eb01d7ed52","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.17.0","v8.18.0"],"title":"[Security
Solution] Disables `author` and `license` fields in rule edit form for
prebuilt rule
types","number":201887,"url":"https://github.com/elastic/kibana/pull/201887","mergeCommit":{"message":"[Security
Solution] Disables `author` and `license` fields in rule edit form for
prebuilt rule types (#201887)\n\n## Summary\r\n\r\nFixes
https://github.com/elastic/kibana/issues/200251\r\n\r\n> [!NOTE] \r\n>
This bug/related fix is only visible with
the\r\n`prebuiltRulesCustomizationEnabled` feature flag turned
on.\r\n\r\nDisables `author` and `license` fields in rule edit form for
prebuilt\r\nrule types as we throw API errors when they are changed from
the\r\nexisting rule value if the rule source is
external.\r\n\r\n\r\n### Screenshots - the same prebuilt rule in the
Rule edit form\r\n**Before**\r\n<img width=\"738\" alt=\"Screenshot
2024-11-26 at 5 32
00 PM\"\r\nsrc=\"https://github.com/user-attachments/assets/6262cdb2-750a-47fb-b6b8-ec07f4acd8aa\">\r\n\r\n\r\n**After**\r\n![Screenshot
2024-12-03 at 3
22\r\n34 PM](https://github.com/user-attachments/assets/bfb4c468-3ea2-4fa0-bd36-a90c32eacce4)\r\n\r\n###
Checklist\r\n\r\nCheck the PR satisfies following conditions.
\r\n\r\nReviewers should verify this PR satisfies this list as
well.\r\n\r\n- [ ] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"13fa5259c8df89ff5a27fe0a8214b2eb01d7ed52"}},"sourceBranch":"main","suggestedTargetBranches":["8.17","8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/201887","number":201887,"mergeCommit":{"message":"[Security
Solution] Disables `author` and `license` fields in rule edit form for
prebuilt rule types (#201887)\n\n## Summary\r\n\r\nFixes
https://github.com/elastic/kibana/issues/200251\r\n\r\n> [!NOTE] \r\n>
This bug/related fix is only visible with
the\r\n`prebuiltRulesCustomizationEnabled` feature flag turned
on.\r\n\r\nDisables `author` and `license` fields in rule edit form for
prebuilt\r\nrule types as we throw API errors when they are changed from
the\r\nexisting rule value if the rule source is
external.\r\n\r\n\r\n### Screenshots - the same prebuilt rule in the
Rule edit form\r\n**Before**\r\n<img width=\"738\" alt=\"Screenshot
2024-11-26 at 5 32
00 PM\"\r\nsrc=\"https://github.com/user-attachments/assets/6262cdb2-750a-47fb-b6b8-ec07f4acd8aa\">\r\n\r\n\r\n**After**\r\n![Screenshot
2024-12-03 at 3
22\r\n34 PM](https://github.com/user-attachments/assets/bfb4c468-3ea2-4fa0-bd36-a90c32eacce4)\r\n\r\n###
Checklist\r\n\r\nCheck the PR satisfies following conditions.
\r\n\r\nReviewers should verify this PR satisfies this list as
well.\r\n\r\n- [ ] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"13fa5259c8df89ff5a27fe0a8214b2eb01d7ed52"}},{"branch":"8.17","label":"v8.17.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Davis Plumlee <[email protected]>
Co-authored-by: Elastic Machine <[email protected]>
kibanamachine added a commit that referenced this pull request Dec 5, 2024
@kibanamachine @dplumlee
[8.17] [Security Solution] Disables &#x60;author&#x60; and &#x60;lice…
b4432ec 
…nse&#x60; fields in rule edit form for prebuilt rule types (#201887) (#203000)

# Backport

This will backport the following commits from `main` to `8.17`:
- [[Security Solution] Disables &#x60;author&#x60; and
&#x60;license&#x60; fields in rule edit form for prebuilt rule types
(#201887)](#201887)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-12-04T18:17:55Z","message":"[Security
Solution] Disables `author` and `license` fields in rule edit form for
prebuilt rule types (#201887)\n\n## Summary\r\n\r\nFixes
https://github.com/elastic/kibana/issues/200251\r\n\r\n> [!NOTE] \r\n>
This bug/related fix is only visible with
the\r\n`prebuiltRulesCustomizationEnabled` feature flag turned
on.\r\n\r\nDisables `author` and `license` fields in rule edit form for
prebuilt\r\nrule types as we throw API errors when they are changed from
the\r\nexisting rule value if the rule source is
external.\r\n\r\n\r\n### Screenshots - the same prebuilt rule in the
Rule edit form\r\n**Before**\r\n<img width=\"738\" alt=\"Screenshot
2024-11-26 at 5 32
00 PM\"\r\nsrc=\"https://github.com/user-attachments/assets/6262cdb2-750a-47fb-b6b8-ec07f4acd8aa\">\r\n\r\n\r\n**After**\r\n![Screenshot
2024-12-03 at 3
22\r\n34 PM](https://github.com/user-attachments/assets/bfb4c468-3ea2-4fa0-bd36-a90c32eacce4)\r\n\r\n###
Checklist\r\n\r\nCheck the PR satisfies following conditions.
\r\n\r\nReviewers should verify this PR satisfies this list as
well.\r\n\r\n- [ ] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"13fa5259c8df89ff5a27fe0a8214b2eb01d7ed52","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.17.0","v8.18.0"],"title":"[Security
Solution] Disables `author` and `license` fields in rule edit form for
prebuilt rule
types","number":201887,"url":"https://github.com/elastic/kibana/pull/201887","mergeCommit":{"message":"[Security
Solution] Disables `author` and `license` fields in rule edit form for
prebuilt rule types (#201887)\n\n## Summary\r\n\r\nFixes
https://github.com/elastic/kibana/issues/200251\r\n\r\n> [!NOTE] \r\n>
This bug/related fix is only visible with
the\r\n`prebuiltRulesCustomizationEnabled` feature flag turned
on.\r\n\r\nDisables `author` and `license` fields in rule edit form for
prebuilt\r\nrule types as we throw API errors when they are changed from
the\r\nexisting rule value if the rule source is
external.\r\n\r\n\r\n### Screenshots - the same prebuilt rule in the
Rule edit form\r\n**Before**\r\n<img width=\"738\" alt=\"Screenshot
2024-11-26 at 5 32
00 PM\"\r\nsrc=\"https://github.com/user-attachments/assets/6262cdb2-750a-47fb-b6b8-ec07f4acd8aa\">\r\n\r\n\r\n**After**\r\n![Screenshot
2024-12-03 at 3
22\r\n34 PM](https://github.com/user-attachments/assets/bfb4c468-3ea2-4fa0-bd36-a90c32eacce4)\r\n\r\n###
Checklist\r\n\r\nCheck the PR satisfies following conditions.
\r\n\r\nReviewers should verify this PR satisfies this list as
well.\r\n\r\n- [ ] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"13fa5259c8df89ff5a27fe0a8214b2eb01d7ed52"}},"sourceBranch":"main","suggestedTargetBranches":["8.17","8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/201887","number":201887,"mergeCommit":{"message":"[Security
Solution] Disables `author` and `license` fields in rule edit form for
prebuilt rule types (#201887)\n\n## Summary\r\n\r\nFixes
https://github.com/elastic/kibana/issues/200251\r\n\r\n> [!NOTE] \r\n>
This bug/related fix is only visible with
the\r\n`prebuiltRulesCustomizationEnabled` feature flag turned
on.\r\n\r\nDisables `author` and `license` fields in rule edit form for
prebuilt\r\nrule types as we throw API errors when they are changed from
the\r\nexisting rule value if the rule source is
external.\r\n\r\n\r\n### Screenshots - the same prebuilt rule in the
Rule edit form\r\n**Before**\r\n<img width=\"738\" alt=\"Screenshot
2024-11-26 at 5 32
00 PM\"\r\nsrc=\"https://github.com/user-attachments/assets/6262cdb2-750a-47fb-b6b8-ec07f4acd8aa\">\r\n\r\n\r\n**After**\r\n![Screenshot
2024-12-03 at 3
22\r\n34 PM](https://github.com/user-attachments/assets/bfb4c468-3ea2-4fa0-bd36-a90c32eacce4)\r\n\r\n###
Checklist\r\n\r\nCheck the PR satisfies following conditions.
\r\n\r\nReviewers should verify this PR satisfies this list as
well.\r\n\r\n- [ ] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"13fa5259c8df89ff5a27fe0a8214b2eb01d7ed52"}},{"branch":"8.17","label":"v8.17.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Davis Plumlee <[email protected]>
SoniaSanzV pushed a commit to SoniaSanzV/kibana that referenced this pull request Dec 9, 2024
@dplumlee @SoniaSanzV
[Security Solution] Disables author and license fields in rule ed…
391021b 
…it form for prebuilt rule types (elastic#201887)

## Summary

Fixes elastic#200251

> [!NOTE]  
> This bug/related fix is only visible with the
`prebuiltRulesCustomizationEnabled` feature flag turned on.

Disables `author` and `license` fields in rule edit form for prebuilt
rule types as we throw API errors when they are changed from the
existing rule value if the rule source is external.


### Screenshots - the same prebuilt rule in the Rule edit form
**Before**
<img width="738" alt="Screenshot 2024-11-26 at 5 32 00 PM"
src="https://github.com/user-attachments/assets/6262cdb2-750a-47fb-b6b8-ec07f4acd8aa">


**After**
![Screenshot 2024-12-03 at 3 22
34 PM](https://github.com/user-attachments/assets/bfb4c468-3ea2-4fa0-bd36-a90c32eacce4)

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
SoniaSanzV pushed a commit to SoniaSanzV/kibana that referenced this pull request Dec 9, 2024
@dplumlee @SoniaSanzV
[Security Solution] Disables author and license fields in rule ed…
7001506 
…it form for prebuilt rule types (elastic#201887)

## Summary

Fixes elastic#200251

> [!NOTE]  
> This bug/related fix is only visible with the
`prebuiltRulesCustomizationEnabled` feature flag turned on.

Disables `author` and `license` fields in rule edit form for prebuilt
rule types as we throw API errors when they are changed from the
existing rule value if the rule source is external.


### Screenshots - the same prebuilt rule in the Rule edit form
**Before**
<img width="738" alt="Screenshot 2024-11-26 at 5 32 00 PM"
src="https://github.com/user-attachments/assets/6262cdb2-750a-47fb-b6b8-ec07f4acd8aa">


**After**
![Screenshot 2024-12-03 at 3 22
34 PM](https://github.com/user-attachments/assets/bfb4c468-3ea2-4fa0-bd36-a90c32eacce4)

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Dec 9, 2024
@dplumlee @CAWilson94
[Security Solution] Disables author and license fields in rule ed…
cd368ee 
…it form for prebuilt rule types (elastic#201887)

## Summary

Fixes elastic#200251

> [!NOTE]  
> This bug/related fix is only visible with the
`prebuiltRulesCustomizationEnabled` feature flag turned on.

Disables `author` and `license` fields in rule edit form for prebuilt
rule types as we throw API errors when they are changed from the
existing rule value if the rule source is external.


### Screenshots - the same prebuilt rule in the Rule edit form
**Before**
<img width="738" alt="Screenshot 2024-11-26 at 5 32 00 PM"
src="https://github.com/user-attachments/assets/6262cdb2-750a-47fb-b6b8-ec07f4acd8aa">


**After**
![Screenshot 2024-12-03 at 3 22
34 PM](https://github.com/user-attachments/assets/bfb4c468-3ea2-4fa0-bd36-a90c32eacce4)

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
Samiul-TheSoccerFan pushed a commit to Samiul-TheSoccerFan/kibana that referenced this pull request Dec 10, 2024
@dplumlee @Samiul-TheSoccerFan
[Security Solution] Disables author and license fields in rule ed…
f11911d 
…it form for prebuilt rule types (elastic#201887)

## Summary

Fixes elastic#200251

> [!NOTE]  
> This bug/related fix is only visible with the
`prebuiltRulesCustomizationEnabled` feature flag turned on.

Disables `author` and `license` fields in rule edit form for prebuilt
rule types as we throw API errors when they are changed from the
existing rule value if the rule source is external.


### Screenshots - the same prebuilt rule in the Rule edit form
**Before**
<img width="738" alt="Screenshot 2024-11-26 at 5 32 00 PM"
src="https://github.com/user-attachments/assets/6262cdb2-750a-47fb-b6b8-ec07f4acd8aa">


**After**
![Screenshot 2024-12-03 at 3 22
34 PM](https://github.com/user-attachments/assets/bfb4c468-3ea2-4fa0-bd36-a90c32eacce4)

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Dec 12, 2024
@dplumlee @CAWilson94
[Security Solution] Disables author and license fields in rule ed…
d8a7b28 
…it form for prebuilt rule types (elastic#201887)

## Summary

Fixes elastic#200251

> [!NOTE]  
> This bug/related fix is only visible with the
`prebuiltRulesCustomizationEnabled` feature flag turned on.

Disables `author` and `license` fields in rule edit form for prebuilt
rule types as we throw API errors when they are changed from the
existing rule value if the rule source is external.


### Screenshots - the same prebuilt rule in the Rule edit form
**Before**
<img width="738" alt="Screenshot 2024-11-26 at 5 32 00 PM"
src="https://github.com/user-attachments/assets/6262cdb2-750a-47fb-b6b8-ec07f4acd8aa">


**After**
![Screenshot 2024-12-03 at 3 22
34 PM](https://github.com/user-attachments/assets/bfb4c468-3ea2-4fa0-bd36-a90c32eacce4)

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@maximpn maximpn maximpn approved these changes

@dhurley14 dhurley14 dhurley14 approved these changes

Assignees

@dplumlee dplumlee

Labels
backport:version Backport to applied version labels bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area release_note:skip Skip the PR/issue when compiling release notes Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.17.0 v8.18.0 v9.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Security Solution] “Author” and “License” Fields Are Editable in UI but Result in Errors When Updated
7 participants
@dplumlee @elasticmachine @banderror @maximpn @ARWNightingale @kibanamachine @dhurley14