Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Side effects of no-content version bumps in prebuilt rules #130576

Closed
Tracked by #174167
spong opened this issue Apr 19, 2022 · 4 comments
Closed
Tracked by #174167

[Security Solution] Side effects of no-content version bumps in prebuilt rules #130576

spong opened this issue Apr 19, 2022 · 4 comments
Assignees
@xcrzx
Labels
8.9 candidate bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.

Comments

@spong
Copy link
Member

spong commented Apr 19, 2022 •
edited
Loading

Surfaced in the 8.2 Prebuilt Rules PR (though probably started occurring ~8.0), there are instances where there can be no-content version bumps (i.e. no rule content changes between releases other than the version being incremented). Opening this issue to describe the side effects to UX within the Security Solution app & docs as a result of these changes.

For details about how & why this can happen, please see this detection-rules issue on forking rules, and the above comment from the 8.2 Prebuilt Rules PR, but gist is that since we don't have version blocks (e.g. rule version 10-20 is reserved for the 7.14.x stack release), anytime a rule is updated in an earlier release (via OOB package deployment), the current version of the rule must also be incremented (even if there aren't content changes) to ensure that it has the highest version and will be installed when users upgrade their stack.

As a result of these no-content version bumps, there are three main touch points that will affect the user:

  1. Incorrect updated rules count in Security Solution UI

  1. Incorrect list of updated rules per release on the documentation page (Note: these scripts are currently owned by the detection-rules repo folks)

  1. In the planned work for the merge rule upgrade ux, (internal issue) we would be including these no-content rules in this flow automatically (showing up with no field deltas) if we don't make additional logic changes.
@spong spong added bug Fixes for quality problems that affect the customer experience triage_needed Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules labels Apr 19, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@banderror banderror mentioned this issue Apr 19, 2022
Closed
@banderror banderror added the impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. label Dec 29, 2022
@banderror banderror changed the title [Security Solution][Detections] Side effects of no-content version bumps in prebuilt rules [Security Solution] Side effects of no-content version bumps in prebuilt rules Dec 29, 2022
@banderror banderror mentioned this issue Jan 19, 2023
Closed
@terrancedejesus
Copy link
Contributor

@jpdjere Apologies for the late response.

We should be good with this. Around 8.1 - 8.3 we had some bugs with our versioning logic. References are below. It is possible that these were missed in the releases but then found later upstream resulting in this issue.

At the moment, we only release OOB and have since fixed these bugs. The last ~30 packages we have released via OOB have not included unnecessary version bumps that we identified.

@jpdjere
Copy link
Contributor

jpdjere commented Jun 22, 2023

Thanks @terrancedejesus!

Confident now that this won't cause any issues for now. Closing the ticket.

@jpdjere jpdjere closed this as completed Jun 22, 2023
@banderror banderror mentioned this issue Jan 3, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@xcrzx xcrzx

Labels
8.9 candidate bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@xcrzx @spong @jpdjere @banderror @elasticmachine @terrancedejesus