Skip to content

[Security Solution] Fix inconsistent rule's modified status after applying bulk actions#214115

Merged
maximpn merged 2 commits intoelastic:mainfrom
maximpn:fix-inconsistent-modified-status-after-bulk-action
Mar 12, 2025
Merged

[Security Solution] Fix inconsistent rule's modified status after applying bulk actions#214115
maximpn merged 2 commits intoelastic:mainfrom
maximpn:fix-inconsistent-modified-status-after-bulk-action

Conversation

@maximpn
Copy link
Contributor

@maximpn maximpn commented Mar 12, 2025

Summary

Fixes a problem Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version. discovered while smoke testing after enabling Prebuilt Rules Customization FF.

Details

The problems manifests as some rules have Modified badge missing after modifying tags via bulk actions.

The root cause is that current bulk actions implementation expects unmodified rule's data in paramsModifier() callback. But Alerting Framework's Rules Client invokes paramsModifier() providing already modified rule. Alerting Framework managed fields like rule.tags have modified values.

The fix makes sure rule customizartion state is calculated by using unmodified rule data.

Screenshots

Before:

Screen.Recording.2025-03-12.at.12.42.33.mov

After:

Screen.Recording.2025-03-12.at.12.11.29.mov

@maximpn maximpn added bug Fixes for quality problems that affect the customer experience release_note:skip Skip the PR/issue when compiling release notes impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. v9.0.0 Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area backport:version Backport to applied version labels v8.18.0 v9.1.0 v8.19.0 labels Mar 12, 2025
@maximpn maximpn self-assigned this Mar 12, 2025
@maximpn maximpn force-pushed the fix-inconsistent-modified-status-after-bulk-action branch from 2b700ee to bc9276c Compare March 12, 2025 11:25
@maximpn maximpn marked this pull request as ready for review March 12, 2025 11:43
@maximpn maximpn requested a review from a team as a code owner March 12, 2025 11:43
@maximpn maximpn requested a review from xcrzx March 12, 2025 11:43
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@maximpn maximpn added impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. and removed impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. labels Mar 12, 2025
Copy link
Contributor

@xcrzx xcrzx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified the fix locally, all works as expected. Thanks for the quick fix, @maximpn 👍

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 8.9MB 8.9MB -1.0B

cc @maximpn

@maximpn maximpn merged commit 6b87869 into elastic:main Mar 12, 2025
12 checks passed
@maximpn maximpn deleted the fix-inconsistent-modified-status-after-bulk-action branch March 12, 2025 13:10
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.18, 8.x, 9.0

https://github.com/elastic/kibana/actions/runs/13812181561

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 12, 2025
…lying bulk actions (elastic#214115)

## Summary

Fixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](elastic#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF.

## Details

The problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions.

The root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values.

The fix makes sure rule customizartion state is calculated by using unmodified rule data.

## Screenshots

Before:

https://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e

After:

https://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9
(cherry picked from commit 6b87869)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 12, 2025
…lying bulk actions (elastic#214115)

## Summary

Fixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](elastic#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF.

## Details

The problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions.

The root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values.

The fix makes sure rule customizartion state is calculated by using unmodified rule data.

## Screenshots

Before:

https://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e

After:

https://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9
(cherry picked from commit 6b87869)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 12, 2025
…lying bulk actions (elastic#214115)

## Summary

Fixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](elastic#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF.

## Details

The problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions.

The root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values.

The fix makes sure rule customizartion state is calculated by using unmodified rule data.

## Screenshots

Before:

https://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e

After:

https://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9
(cherry picked from commit 6b87869)
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
8.18
8.x
9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Mar 12, 2025
…er applying bulk actions (#214115) (#214152)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution] Fix inconsistent rule's modified status after
applying bulk actions
(#214115)](#214115)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-03-12T13:10:38Z","message":"[Security
Solution] Fix inconsistent rule's modified status after applying bulk
actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to
rules marks some rules as customized and doesn't mark other rules as
customized. It looks like it depends on the existence of the base
version.`](#212761 (review))
discovered while smoke testing after enabling Prebuilt Rules
Customization FF.\n\n## Details\n\nThe problems manifests as some rules
have `Modified` badge missing after modifying tags via bulk
actions.\n\nThe root cause is that current bulk actions implementation
expects unmodified rule's data in `paramsModifier()` callback. But
Alerting Framework's Rules Client invokes `paramsModifier()` providing
already modified rule. Alerting Framework managed fields like
`rule.tags` have modified values.\n\nThe fix makes sure rule
customizartion state is calculated by using unmodified rule data.\n\n##
Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","impact:high","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Fix inconsistent rule's modified status after applying bulk
actions","number":214115,"url":"https://github.com/elastic/kibana/pull/214115","mergeCommit":{"message":"[Security
Solution] Fix inconsistent rule's modified status after applying bulk
actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to
rules marks some rules as customized and doesn't mark other rules as
customized. It looks like it depends on the existence of the base
version.`](#212761 (review))
discovered while smoke testing after enabling Prebuilt Rules
Customization FF.\n\n## Details\n\nThe problems manifests as some rules
have `Modified` badge missing after modifying tags via bulk
actions.\n\nThe root cause is that current bulk actions implementation
expects unmodified rule's data in `paramsModifier()` callback. But
Alerting Framework's Rules Client invokes `paramsModifier()` providing
already modified rule. Alerting Framework managed fields like
`rule.tags` have modified values.\n\nThe fix makes sure rule
customizartion state is calculated by using unmodified rule data.\n\n##
Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214115","number":214115,"mergeCommit":{"message":"[Security
Solution] Fix inconsistent rule's modified status after applying bulk
actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to
rules marks some rules as customized and doesn't mark other rules as
customized. It looks like it depends on the existence of the base
version.`](#212761 (review))
discovered while smoke testing after enabling Prebuilt Rules
Customization FF.\n\n## Details\n\nThe problems manifests as some rules
have `Modified` badge missing after modifying tags via bulk
actions.\n\nThe root cause is that current bulk actions implementation
expects unmodified rule's data in `paramsModifier()` callback. But
Alerting Framework's Rules Client invokes `paramsModifier()` providing
already modified rule. Alerting Framework managed fields like
`rule.tags` have modified values.\n\nThe fix makes sure rule
customizartion state is calculated by using unmodified rule data.\n\n##
Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
kibanamachine added a commit that referenced this pull request Mar 12, 2025
…ter applying bulk actions (#214115) (#214151)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Fix inconsistent rule's modified status after
applying bulk actions
(#214115)](#214115)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-03-12T13:10:38Z","message":"[Security
Solution] Fix inconsistent rule's modified status after applying bulk
actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to
rules marks some rules as customized and doesn't mark other rules as
customized. It looks like it depends on the existence of the base
version.`](#212761 (review))
discovered while smoke testing after enabling Prebuilt Rules
Customization FF.\n\n## Details\n\nThe problems manifests as some rules
have `Modified` badge missing after modifying tags via bulk
actions.\n\nThe root cause is that current bulk actions implementation
expects unmodified rule's data in `paramsModifier()` callback. But
Alerting Framework's Rules Client invokes `paramsModifier()` providing
already modified rule. Alerting Framework managed fields like
`rule.tags` have modified values.\n\nThe fix makes sure rule
customizartion state is calculated by using unmodified rule data.\n\n##
Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","impact:high","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Fix inconsistent rule's modified status after applying bulk
actions","number":214115,"url":"https://github.com/elastic/kibana/pull/214115","mergeCommit":{"message":"[Security
Solution] Fix inconsistent rule's modified status after applying bulk
actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to
rules marks some rules as customized and doesn't mark other rules as
customized. It looks like it depends on the existence of the base
version.`](#212761 (review))
discovered while smoke testing after enabling Prebuilt Rules
Customization FF.\n\n## Details\n\nThe problems manifests as some rules
have `Modified` badge missing after modifying tags via bulk
actions.\n\nThe root cause is that current bulk actions implementation
expects unmodified rule's data in `paramsModifier()` callback. But
Alerting Framework's Rules Client invokes `paramsModifier()` providing
already modified rule. Alerting Framework managed fields like
`rule.tags` have modified values.\n\nThe fix makes sure rule
customizartion state is calculated by using unmodified rule data.\n\n##
Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214115","number":214115,"mergeCommit":{"message":"[Security
Solution] Fix inconsistent rule's modified status after applying bulk
actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to
rules marks some rules as customized and doesn't mark other rules as
customized. It looks like it depends on the existence of the base
version.`](#212761 (review))
discovered while smoke testing after enabling Prebuilt Rules
Customization FF.\n\n## Details\n\nThe problems manifests as some rules
have `Modified` badge missing after modifying tags via bulk
actions.\n\nThe root cause is that current bulk actions implementation
expects unmodified rule's data in `paramsModifier()` callback. But
Alerting Framework's Rules Client invokes `paramsModifier()` providing
already modified rule. Alerting Framework managed fields like
`rule.tags` have modified values.\n\nThe fix makes sure rule
customizartion state is calculated by using unmodified rule data.\n\n##
Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
kibanamachine added a commit that referenced this pull request Mar 12, 2025
…er applying bulk actions (#214115) (#214153)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security Solution] Fix inconsistent rule's modified status after
applying bulk actions
(#214115)](#214115)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-03-12T13:10:38Z","message":"[Security
Solution] Fix inconsistent rule's modified status after applying bulk
actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to
rules marks some rules as customized and doesn't mark other rules as
customized. It looks like it depends on the existence of the base
version.`](#212761 (review))
discovered while smoke testing after enabling Prebuilt Rules
Customization FF.\n\n## Details\n\nThe problems manifests as some rules
have `Modified` badge missing after modifying tags via bulk
actions.\n\nThe root cause is that current bulk actions implementation
expects unmodified rule's data in `paramsModifier()` callback. But
Alerting Framework's Rules Client invokes `paramsModifier()` providing
already modified rule. Alerting Framework managed fields like
`rule.tags` have modified values.\n\nThe fix makes sure rule
customizartion state is calculated by using unmodified rule data.\n\n##
Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","impact:high","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Fix inconsistent rule's modified status after applying bulk
actions","number":214115,"url":"https://github.com/elastic/kibana/pull/214115","mergeCommit":{"message":"[Security
Solution] Fix inconsistent rule's modified status after applying bulk
actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to
rules marks some rules as customized and doesn't mark other rules as
customized. It looks like it depends on the existence of the base
version.`](#212761 (review))
discovered while smoke testing after enabling Prebuilt Rules
Customization FF.\n\n## Details\n\nThe problems manifests as some rules
have `Modified` badge missing after modifying tags via bulk
actions.\n\nThe root cause is that current bulk actions implementation
expects unmodified rule's data in `paramsModifier()` callback. But
Alerting Framework's Rules Client invokes `paramsModifier()` providing
already modified rule. Alerting Framework managed fields like
`rule.tags` have modified values.\n\nThe fix makes sure rule
customizartion state is calculated by using unmodified rule data.\n\n##
Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214115","number":214115,"mergeCommit":{"message":"[Security
Solution] Fix inconsistent rule's modified status after applying bulk
actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to
rules marks some rules as customized and doesn't mark other rules as
customized. It looks like it depends on the existence of the base
version.`](#212761 (review))
discovered while smoke testing after enabling Prebuilt Rules
Customization FF.\n\n## Details\n\nThe problems manifests as some rules
have `Modified` badge missing after modifying tags via bulk
actions.\n\nThe root cause is that current bulk actions implementation
expects unmodified rule's data in `paramsModifier()` callback. But
Alerting Framework's Rules Client invokes `paramsModifier()` providing
already modified rule. Alerting Framework managed fields like
`rule.tags` have modified values.\n\nThe fix makes sure rule
customizartion state is calculated by using unmodified rule data.\n\n##
Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Mar 22, 2025
…lying bulk actions (elastic#214115)

## Summary

Fixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](elastic#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF.

## Details

The problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions.

The root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values.

The fix makes sure rule customizartion state is calculated by using unmodified rule data.

## Screenshots

Before:

https://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e

After:

https://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:version Backport to applied version labels bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. release_note:skip Skip the PR/issue when compiling release notes Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.18.0 v8.19.0 v9.0.0 v9.1.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants