Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Implement rule type diff algorithm #190482

Closed
8 tasks done
Tracked by #174168
xcrzx opened this issue Aug 14, 2024 · 4 comments
Closed
8 tasks done
Tracked by #174168

[Security Solution] Implement rule type diff algorithm #190482

xcrzx opened this issue Aug 14, 2024 · 4 comments
Assignees
@dplumlee
Labels
8.16 candidate enhancement New value added to drive a business result Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.16.0

Comments

@xcrzx
Copy link
Contributor

xcrzx commented Aug 14, 2024 •
edited by dplumlee
Loading

Epics: https://github.com/elastic/security-team/issues/1974 (internal), #174168
Related to: #180395

Summary

Implement an algorithm for diffing the type field of detection rules. Requirements:

  • The algorithm should always return the target version as the merged one.
  • Any change to the rule type (i.e. current version != target version) should yield an unsolvable conflict.
  • In the upgrade/_review API response such rules should be marked as having unsolvable conflicts.
  • Users should not be able to upgrade the type to any version other than the target. This should be implemented under the hood in the upgrade/_perform endpoint in [Security Solution] Extend the POST /upgrade/_perform API endpoint's contract and functionality #166376. The type field shouldn't be part of upgradeable fields that can be passed in the request body -- FYI @jpdjere

Context from the Rule Customization RFC:

To do
@xcrzx xcrzx added triage_needed Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules 8.16 candidate labels Aug 14, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@xcrzx xcrzx mentioned this issue Aug 14, 2024
Open
@xcrzx xcrzx mentioned this issue Aug 14, 2024
Open
@banderror banderror changed the title [Security Solution] Diff algorithm for rule type change [Security Solution] Implement rule type diff algorithm Aug 14, 2024
@banderror banderror mentioned this issue Aug 14, 2024
Closed
4 tasks
@banderror banderror added enhancement New value added to drive a business result v8.16.0 labels Sep 17, 2024
This was referenced Sep 18, 2024
Merged
Merged
Merged
dplumlee added a commit that referenced this issue Sep 30, 2024
@dplumlee
[Security Solution] Test plan for rule type field diff algorithm (#…
fefa59f 
…193372)

## Summary

Related ticket: #190482

Adds test plan for diff algorithm for `type` field diff algorithm
implemented here: #193369


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Sep 30, 2024
@dplumlee
[Security Solution] Test plan for rule type field diff algorithm (e…
13abaf7 
…lastic#193372)

## Summary

Related ticket: elastic#190482

Adds test plan for diff algorithm for `type` field diff algorithm
implemented here: elastic#193369

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

(cherry picked from commit fefa59f)
dplumlee added a commit that referenced this issue Sep 30, 2024
@dplumlee
[Security Solution] Rule type field diff algorithm (#193369)
18465e7 
## Summary

Addresses #190482

Adds the diff algorithm implementation for the prebuilt rule `type`
field. Returns `target_version` and a `NON_SOLVABLE` conflict for every
outcome that changes the field.

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Sep 30, 2024
@dplumlee
[Security Solution] Rule type field diff algorithm (elastic#193369)
14cec3a 
## Summary

Addresses elastic#190482

Adds the diff algorithm implementation for the prebuilt rule `type`
field. Returns `target_version` and a `NON_SOLVABLE` conflict for every
outcome that changes the field.

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

(cherry picked from commit 18465e7)
dplumlee added a commit that referenced this issue Oct 8, 2024
@dplumlee
[Security Solution] Integration tests for rule type field diff algo…
e119d83 
…rithms (#193375)

## Summary

Completes #190482


Switches rule `type` field to use the implemented diff algorithms
assigned to them in #193369


Adds integration tests in accordance to
#193372 for the `upgrade/_review`
API endpoint for the rule `type` field diff algorithm.

Also fixes some nested bracket misalignment that occurred in earlier PRs
with some test files

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Oct 8, 2024
@dplumlee
[Security Solution] Integration tests for rule type field diff algo…
c601cdd 
…rithms (elastic#193375)

## Summary

Completes elastic#190482

Switches rule `type` field to use the implemented diff algorithms
assigned to them in elastic#193369

Adds integration tests in accordance to
elastic#193372 for the `upgrade/_review`
API endpoint for the rule `type` field diff algorithm.

Also fixes some nested bracket misalignment that occurred in earlier PRs
with some test files

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

(cherry picked from commit e119d83)
@dplumlee
Copy link
Contributor

dplumlee commented Oct 9, 2024

Completed by:

@dplumlee dplumlee closed this as completed Oct 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@dplumlee dplumlee

Labels
8.16 candidate enhancement New value added to drive a business result Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.16.0
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@xcrzx @banderror @elasticmachine @dplumlee