Skip to content

[9.0] [Security Solution] Fix inconsistent rule's modified status after applying bulk actions (#214115)#214153

Merged
kibanamachine merged 2 commits intoelastic:9.0from
kibanamachine:backport/9.0/pr-214115
Mar 12, 2025
Merged

[9.0] [Security Solution] Fix inconsistent rule's modified status after applying bulk actions (#214115)#214153
kibanamachine merged 2 commits intoelastic:9.0from
kibanamachine:backport/9.0/pr-214115

Conversation

@kibanamachine
Copy link
Contributor

Backport

This will backport the following commits from main to 9.0:

Questions ?

Please refer to the Backport tool documentation

…lying bulk actions (elastic#214115)

## Summary

Fixes a problem [`Bulk adding tags to rules marks some rules as customized and doesn't mark other rules as customized. It looks like it depends on the existence of the base version.`](elastic#212761 (review)) discovered while smoke testing after enabling Prebuilt Rules Customization FF.

## Details

The problems manifests as some rules have `Modified` badge missing after modifying tags via bulk actions.

The root cause is that current bulk actions implementation expects unmodified rule's data in `paramsModifier()` callback. But Alerting Framework's Rules Client invokes `paramsModifier()` providing already modified rule. Alerting Framework managed fields like `rule.tags` have modified values.

The fix makes sure rule customizartion state is calculated by using unmodified rule data.

## Screenshots

Before:

https://github.com/user-attachments/assets/eeb65b18-c51f-4c5e-b0e6-6552e442994e

After:

https://github.com/user-attachments/assets/d18d8765-4f40-4513-95a1-2cd84ac2a0a9
(cherry picked from commit 6b87869)
@elasticmachine
Copy link
Contributor

elasticmachine commented Mar 12, 2025

@kibanamachine kibanamachine merged commit 57aad9b into elastic:9.0 Mar 12, 2025
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants