[Security Solution] Fix inconsistent rule's modified status after applying bulk actions#214115
Merged
maximpn merged 2 commits intoelastic:mainfrom Mar 12, 2025
Conversation
2b700ee to
bc9276c
Compare
Contributor
|
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
Contributor
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
Contributor
|
Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management) |
Contributor
Contributor
|
Starting backport for target branches: 8.18, 8.x, 9.0 https://github.com/elastic/kibana/actions/runs/13812181561 |
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Mar 12, 2025
…lying bulk actions (elastic#214115) ## Summary Fixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](elastic#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF. ## Details The problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions. The root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values. The fix makes sure rule customizartion state is calculated by using unmodified rule data. ## Screenshots Before: https://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e After: https://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9 (cherry picked from commit 6b87869)
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Mar 12, 2025
…lying bulk actions (elastic#214115) ## Summary Fixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](elastic#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF. ## Details The problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions. The root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values. The fix makes sure rule customizartion state is calculated by using unmodified rule data. ## Screenshots Before: https://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e After: https://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9 (cherry picked from commit 6b87869)
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Mar 12, 2025
…lying bulk actions (elastic#214115) ## Summary Fixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](elastic#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF. ## Details The problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions. The root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values. The fix makes sure rule customizartion state is calculated by using unmodified rule data. ## Screenshots Before: https://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e After: https://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9 (cherry picked from commit 6b87869)
Contributor
💚 All backports created successfully
Note: Successful backport PRs will be merged automatically after passing CI. Questions ?Please refer to the Backport tool documentation |
kibanamachine
added a commit
that referenced
this pull request
Mar 12, 2025
…er applying bulk actions (#214115) (#214152) # Backport This will backport the following commits from `main` to `8.x`: - [[Security Solution] Fix inconsistent rule's modified status after applying bulk actions (#214115)](#214115) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Maxim Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-03-12T13:10:38Z","message":"[Security Solution] Fix inconsistent rule's modified status after applying bulk actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF.\n\n## Details\n\nThe problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions.\n\nThe root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values.\n\nThe fix makes sure rule customizartion state is calculated by using unmodified rule data.\n\n## Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","impact:high","v9.0.0","Team:Detections and Resp","Team: SecuritySolution","Team:Detection Rule Management","Feature:Prebuilt Detection Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security Solution] Fix inconsistent rule's modified status after applying bulk actions","number":214115,"url":"https://github.com/elastic/kibana/pull/214115","mergeCommit":{"message":"[Security Solution] Fix inconsistent rule's modified status after applying bulk actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF.\n\n## Details\n\nThe problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions.\n\nThe root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values.\n\nThe fix makes sure rule customizartion state is calculated by using unmodified rule data.\n\n## Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214115","number":214115,"mergeCommit":{"message":"[Security Solution] Fix inconsistent rule's modified status after applying bulk actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF.\n\n## Details\n\nThe problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions.\n\nThe root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values.\n\nThe fix makes sure rule customizartion state is calculated by using unmodified rule data.\n\n## Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
kibanamachine
added a commit
that referenced
this pull request
Mar 12, 2025
…ter applying bulk actions (#214115) (#214151) # Backport This will backport the following commits from `main` to `8.18`: - [[Security Solution] Fix inconsistent rule's modified status after applying bulk actions (#214115)](#214115) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Maxim Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-03-12T13:10:38Z","message":"[Security Solution] Fix inconsistent rule's modified status after applying bulk actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF.\n\n## Details\n\nThe problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions.\n\nThe root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values.\n\nThe fix makes sure rule customizartion state is calculated by using unmodified rule data.\n\n## Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","impact:high","v9.0.0","Team:Detections and Resp","Team: SecuritySolution","Team:Detection Rule Management","Feature:Prebuilt Detection Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security Solution] Fix inconsistent rule's modified status after applying bulk actions","number":214115,"url":"https://github.com/elastic/kibana/pull/214115","mergeCommit":{"message":"[Security Solution] Fix inconsistent rule's modified status after applying bulk actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF.\n\n## Details\n\nThe problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions.\n\nThe root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values.\n\nThe fix makes sure rule customizartion state is calculated by using unmodified rule data.\n\n## Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214115","number":214115,"mergeCommit":{"message":"[Security Solution] Fix inconsistent rule's modified status after applying bulk actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF.\n\n## Details\n\nThe problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions.\n\nThe root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values.\n\nThe fix makes sure rule customizartion state is calculated by using unmodified rule data.\n\n## Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
kibanamachine
added a commit
that referenced
this pull request
Mar 12, 2025
…er applying bulk actions (#214115) (#214153) # Backport This will backport the following commits from `main` to `9.0`: - [[Security Solution] Fix inconsistent rule's modified status after applying bulk actions (#214115)](#214115) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Maxim Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-03-12T13:10:38Z","message":"[Security Solution] Fix inconsistent rule's modified status after applying bulk actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF.\n\n## Details\n\nThe problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions.\n\nThe root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values.\n\nThe fix makes sure rule customizartion state is calculated by using unmodified rule data.\n\n## Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","impact:high","v9.0.0","Team:Detections and Resp","Team: SecuritySolution","Team:Detection Rule Management","Feature:Prebuilt Detection Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security Solution] Fix inconsistent rule's modified status after applying bulk actions","number":214115,"url":"https://github.com/elastic/kibana/pull/214115","mergeCommit":{"message":"[Security Solution] Fix inconsistent rule's modified status after applying bulk actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF.\n\n## Details\n\nThe problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions.\n\nThe root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values.\n\nThe fix makes sure rule customizartion state is calculated by using unmodified rule data.\n\n## Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214115","number":214115,"mergeCommit":{"message":"[Security Solution] Fix inconsistent rule's modified status after applying bulk actions (#214115)\n\n## Summary\n\nFixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF.\n\n## Details\n\nThe problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions.\n\nThe root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values.\n\nThe fix makes sure rule customizartion state is calculated by using unmodified rule data.\n\n## Screenshots\n\nBefore:\n\nhttps://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e\n\nAfter:\n\nhttps://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9","sha":"6b87869dc07a531f62523d1e3c1c81bf269d25ae"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
CAWilson94
pushed a commit
to CAWilson94/kibana
that referenced
this pull request
Mar 22, 2025
…lying bulk actions (elastic#214115) ## Summary Fixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](elastic#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF. ## Details The problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions. The root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values. The fix makes sure rule customizartion state is calculated by using unmodified rule data. ## Screenshots Before: https://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e After: https://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes a problem
Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.discovered while smoke testing after enabling Prebuilt Rules Customization FF.Details
The problems manifests as some rules have
Modifiedbadge missing after modifying tags via bulk actions.The root cause is that current bulk actions implementation expects unmodified rule's data in
paramsModifier()callback. But Alerting Framework's Rules Client invokesparamsModifier()providing already modified rule. Alerting Framework managed fields likerule.tagshave modified values.The fix makes sure rule customizartion state is calculated by using unmodified rule data.
Screenshots
Before:
Screen.Recording.2025-03-12.at.12.42.33.mov
After:
Screen.Recording.2025-03-12.at.12.11.29.mov