Skip to content

[Security Solution] Force upgrading to target version for "Reference URLs" when base version is missing#214161

Merged
nikitaindik merged 2 commits intoelastic:mainfrom
nikitaindik:force-reference-upgrade-to-target
Mar 12, 2025
Merged

[Security Solution] Force upgrading to target version for "Reference URLs" when base version is missing#214161
nikitaindik merged 2 commits intoelastic:mainfrom
nikitaindik:force-reference-upgrade-to-target

Conversation

@nikitaindik
Copy link
Contributor

@nikitaindik nikitaindik commented Mar 12, 2025

Resolves: #214171

Summary

This PR fixes an issue with "references" field in -AB situations. When the base version is missing we try to merge current and target arrays which leads to old and potentially broken URLs from the current version ending up in the result.

Now the behaviour is changed to always force merged version to be equal to target (which always has correct URLs).

@nikitaindik nikitaindik added bug Fixes for quality problems that affect the customer experience release_note:skip Skip the PR/issue when compiling release notes v9.0.0 Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team backport:version Backport to applied version labels v8.18.0 v9.1.0 v8.19.0 labels Mar 12, 2025
@nikitaindik nikitaindik self-assigned this Mar 12, 2025
@nikitaindik nikitaindik requested a review from a team as a code owner March 12, 2025 13:42
@nikitaindik nikitaindik requested a review from dplumlee March 12, 2025 13:42
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@nikitaindik nikitaindik requested review from maximpn and removed request for dplumlee March 12, 2025 13:42
Copy link
Contributor

@maximpn maximpn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes are trivial. LGTM

@maximpn maximpn added Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. labels Mar 12, 2025
@maximpn maximpn changed the title [Security Solution] Fix incorrect merged version calculation for "Reference URLs" when base version is missing [Security Solution] Force upgrading to target version for "Reference URLs" when base version is missing Mar 12, 2025
@nikitaindik nikitaindik enabled auto-merge (squash) March 12, 2025 14:09
@nikitaindik nikitaindik force-pushed the force-reference-upgrade-to-target branch from dc0cfcf to 9080599 Compare March 12, 2025 15:55
@nikitaindik nikitaindik merged commit 0701281 into elastic:main Mar 12, 2025
9 checks passed
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.18, 8.x, 9.0

https://github.com/elastic/kibana/actions/runs/13817984899

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

cc @nikitaindik

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 12, 2025
…URLs" when base version is missing (elastic#214161)

**Resolves: elastic#214171

## Summary

This PR fixes an issue with "references" field in -AB situations. When
the base version is missing we try to merge current and target arrays
which leads to old and potentially broken URLs from the current version
ending up in the result.

Now the behaviour is changed to always force merged version to be equal
to target (which always has correct URLs).

(cherry picked from commit 0701281)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 12, 2025
…URLs" when base version is missing (elastic#214161)

**Resolves: elastic#214171

## Summary

This PR fixes an issue with "references" field in -AB situations. When
the base version is missing we try to merge current and target arrays
which leads to old and potentially broken URLs from the current version
ending up in the result.

Now the behaviour is changed to always force merged version to be equal
to target (which always has correct URLs).

(cherry picked from commit 0701281)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 12, 2025
…URLs" when base version is missing (elastic#214161)

**Resolves: elastic#214171

## Summary

This PR fixes an issue with "references" field in -AB situations. When
the base version is missing we try to merge current and target arrays
which leads to old and potentially broken URLs from the current version
ending up in the result.

Now the behaviour is changed to always force merged version to be equal
to target (which always has correct URLs).

(cherry picked from commit 0701281)
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
8.18
8.x
9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Mar 12, 2025
…rence URLs" when base version is missing (#214161) (#214255)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security Solution] Force upgrading to target version for "Reference
URLs" when base version is missing
(#214161)](#214161)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Nikita
Indik","email":"nikita.indik@elastic.co"},"sourceCommit":{"committedDate":"2025-03-12T17:41:32Z","message":"[Security
Solution] Force upgrading to target version for \"Reference URLs\" when
base version is missing (#214161)\n\n**Resolves:
https://github.com/elastic/kibana/issues/214171**\n\n## Summary\n\nThis
PR fixes an issue with \"references\" field in -AB situations. When\nthe
base version is missing we try to merge current and target arrays\nwhich
leads to old and potentially broken URLs from the current
version\nending up in the result.\n\nNow the behaviour is changed to
always force merged version to be equal\nto target (which always has
correct
URLs).","sha":"07012811b29b487a3b4a664469c7a198355e44bf","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","impact:medium","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Force upgrading to target version for \"Reference URLs\" when
base version is
missing","number":214161,"url":"https://github.com/elastic/kibana/pull/214161","mergeCommit":{"message":"[Security
Solution] Force upgrading to target version for \"Reference URLs\" when
base version is missing (#214161)\n\n**Resolves:
https://github.com/elastic/kibana/issues/214171**\n\n## Summary\n\nThis
PR fixes an issue with \"references\" field in -AB situations. When\nthe
base version is missing we try to merge current and target arrays\nwhich
leads to old and potentially broken URLs from the current
version\nending up in the result.\n\nNow the behaviour is changed to
always force merged version to be equal\nto target (which always has
correct
URLs).","sha":"07012811b29b487a3b4a664469c7a198355e44bf"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214161","number":214161,"mergeCommit":{"message":"[Security
Solution] Force upgrading to target version for \"Reference URLs\" when
base version is missing (#214161)\n\n**Resolves:
https://github.com/elastic/kibana/issues/214171**\n\n## Summary\n\nThis
PR fixes an issue with \"references\" field in -AB situations. When\nthe
base version is missing we try to merge current and target arrays\nwhich
leads to old and potentially broken URLs from the current
version\nending up in the result.\n\nNow the behaviour is changed to
always force merged version to be equal\nto target (which always has
correct
URLs).","sha":"07012811b29b487a3b4a664469c7a198355e44bf"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Nikita Indik <nikita.indik@elastic.co>
kibanamachine added a commit that referenced this pull request Mar 12, 2025
…rence URLs" when base version is missing (#214161) (#214254)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution] Force upgrading to target version for "Reference
URLs" when base version is missing
(#214161)](#214161)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Nikita
Indik","email":"nikita.indik@elastic.co"},"sourceCommit":{"committedDate":"2025-03-12T17:41:32Z","message":"[Security
Solution] Force upgrading to target version for \"Reference URLs\" when
base version is missing (#214161)\n\n**Resolves:
https://github.com/elastic/kibana/issues/214171**\n\n## Summary\n\nThis
PR fixes an issue with \"references\" field in -AB situations. When\nthe
base version is missing we try to merge current and target arrays\nwhich
leads to old and potentially broken URLs from the current
version\nending up in the result.\n\nNow the behaviour is changed to
always force merged version to be equal\nto target (which always has
correct
URLs).","sha":"07012811b29b487a3b4a664469c7a198355e44bf","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","impact:medium","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Force upgrading to target version for \"Reference URLs\" when
base version is
missing","number":214161,"url":"https://github.com/elastic/kibana/pull/214161","mergeCommit":{"message":"[Security
Solution] Force upgrading to target version for \"Reference URLs\" when
base version is missing (#214161)\n\n**Resolves:
https://github.com/elastic/kibana/issues/214171**\n\n## Summary\n\nThis
PR fixes an issue with \"references\" field in -AB situations. When\nthe
base version is missing we try to merge current and target arrays\nwhich
leads to old and potentially broken URLs from the current
version\nending up in the result.\n\nNow the behaviour is changed to
always force merged version to be equal\nto target (which always has
correct
URLs).","sha":"07012811b29b487a3b4a664469c7a198355e44bf"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214161","number":214161,"mergeCommit":{"message":"[Security
Solution] Force upgrading to target version for \"Reference URLs\" when
base version is missing (#214161)\n\n**Resolves:
https://github.com/elastic/kibana/issues/214171**\n\n## Summary\n\nThis
PR fixes an issue with \"references\" field in -AB situations. When\nthe
base version is missing we try to merge current and target arrays\nwhich
leads to old and potentially broken URLs from the current
version\nending up in the result.\n\nNow the behaviour is changed to
always force merged version to be equal\nto target (which always has
correct
URLs).","sha":"07012811b29b487a3b4a664469c7a198355e44bf"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Nikita Indik <nikita.indik@elastic.co>
kibanamachine added a commit that referenced this pull request Mar 12, 2025
…erence URLs" when base version is missing (#214161) (#214252)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Force upgrading to target version for "Reference
URLs" when base version is missing
(#214161)](#214161)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Nikita
Indik","email":"nikita.indik@elastic.co"},"sourceCommit":{"committedDate":"2025-03-12T17:41:32Z","message":"[Security
Solution] Force upgrading to target version for \"Reference URLs\" when
base version is missing (#214161)\n\n**Resolves:
https://github.com/elastic/kibana/issues/214171**\n\n## Summary\n\nThis
PR fixes an issue with \"references\" field in -AB situations. When\nthe
base version is missing we try to merge current and target arrays\nwhich
leads to old and potentially broken URLs from the current
version\nending up in the result.\n\nNow the behaviour is changed to
always force merged version to be equal\nto target (which always has
correct
URLs).","sha":"07012811b29b487a3b4a664469c7a198355e44bf","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","impact:medium","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Force upgrading to target version for \"Reference URLs\" when
base version is
missing","number":214161,"url":"https://github.com/elastic/kibana/pull/214161","mergeCommit":{"message":"[Security
Solution] Force upgrading to target version for \"Reference URLs\" when
base version is missing (#214161)\n\n**Resolves:
https://github.com/elastic/kibana/issues/214171**\n\n## Summary\n\nThis
PR fixes an issue with \"references\" field in -AB situations. When\nthe
base version is missing we try to merge current and target arrays\nwhich
leads to old and potentially broken URLs from the current
version\nending up in the result.\n\nNow the behaviour is changed to
always force merged version to be equal\nto target (which always has
correct
URLs).","sha":"07012811b29b487a3b4a664469c7a198355e44bf"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214161","number":214161,"mergeCommit":{"message":"[Security
Solution] Force upgrading to target version for \"Reference URLs\" when
base version is missing (#214161)\n\n**Resolves:
https://github.com/elastic/kibana/issues/214171**\n\n## Summary\n\nThis
PR fixes an issue with \"references\" field in -AB situations. When\nthe
base version is missing we try to merge current and target arrays\nwhich
leads to old and potentially broken URLs from the current
version\nending up in the result.\n\nNow the behaviour is changed to
always force merged version to be equal\nto target (which always has
correct
URLs).","sha":"07012811b29b487a3b4a664469c7a198355e44bf"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Nikita Indik <nikita.indik@elastic.co>
banderror added a commit that referenced this pull request Mar 14, 2025
…turn Target version when base version is missing (#214287)

## Summary

Originally we had intended to have the prebuilt rule diff algorithms
merge non-functional fields when the field's base version was missing
and a rule was marked as customized as described in
#210358

> - When the rule has a missing base version and is marked as
customized:
> - We should attempt to merge all non-functional mergeable fields (any
field that doesn't have consequences with how the rule runs e.g. tags)
and return them as SOLVABLE_CONFLICT

We ended up changing this logic to return the `Target` version for every
field that fit that description
(#214161 and
#213757) besides `tags` and in
order to support consistency rather than a very minor edge case, we now
just return the target version for every field with a missing base
version and let users sort it out on their end

This PR reverts the changes made to accommodate this edge case and
updates related tests to account for the new logic

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 14, 2025
…turn Target version when base version is missing (elastic#214287)

## Summary

Originally we had intended to have the prebuilt rule diff algorithms
merge non-functional fields when the field's base version was missing
and a rule was marked as customized as described in
elastic#210358

> - When the rule has a missing base version and is marked as
customized:
> - We should attempt to merge all non-functional mergeable fields (any
field that doesn't have consequences with how the rule runs e.g. tags)
and return them as SOLVABLE_CONFLICT

We ended up changing this logic to return the `Target` version for every
field that fit that description
(elastic#214161 and
elastic#213757) besides `tags` and in
order to support consistency rather than a very minor edge case, we now
just return the target version for every field with a missing base
version and let users sort it out on their end

This PR reverts the changes made to accommodate this edge case and
updates related tests to account for the new logic

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
(cherry picked from commit a2d2054)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 14, 2025
…turn Target version when base version is missing (elastic#214287)

## Summary

Originally we had intended to have the prebuilt rule diff algorithms
merge non-functional fields when the field's base version was missing
and a rule was marked as customized as described in
elastic#210358

> - When the rule has a missing base version and is marked as
customized:
> - We should attempt to merge all non-functional mergeable fields (any
field that doesn't have consequences with how the rule runs e.g. tags)
and return them as SOLVABLE_CONFLICT

We ended up changing this logic to return the `Target` version for every
field that fit that description
(elastic#214161 and
elastic#213757) besides `tags` and in
order to support consistency rather than a very minor edge case, we now
just return the target version for every field with a missing base
version and let users sort it out on their end

This PR reverts the changes made to accommodate this edge case and
updates related tests to account for the new logic

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
(cherry picked from commit a2d2054)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 14, 2025
…turn Target version when base version is missing (elastic#214287)

## Summary

Originally we had intended to have the prebuilt rule diff algorithms
merge non-functional fields when the field's base version was missing
and a rule was marked as customized as described in
elastic#210358

> - When the rule has a missing base version and is marked as
customized:
> - We should attempt to merge all non-functional mergeable fields (any
field that doesn't have consequences with how the rule runs e.g. tags)
and return them as SOLVABLE_CONFLICT

We ended up changing this logic to return the `Target` version for every
field that fit that description
(elastic#214161 and
elastic#213757) besides `tags` and in
order to support consistency rather than a very minor edge case, we now
just return the target version for every field with a missing base
version and let users sort it out on their end

This PR reverts the changes made to accommodate this edge case and
updates related tests to account for the new logic

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
(cherry picked from commit a2d2054)
kibanamachine added a commit that referenced this pull request Mar 14, 2025
… to return Target version when base version is missing (#214287) (#214517)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security Solution] Reverts all remaining diff algorithm fields to
return Target version when base version is missing
(#214287)](#214287)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"56367316+dplumlee@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-03-14T07:20:37Z","message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is
missing","number":214287,"url":"https://github.com/elastic/kibana/pull/214287","mergeCommit":{"message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214287","number":214287,"mergeCommit":{"message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>
kibanamachine added a commit that referenced this pull request Mar 14, 2025
…s to return Target version when base version is missing (#214287) (#214515)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Reverts all remaining diff algorithm fields to
return Target version when base version is missing
(#214287)](#214287)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"56367316+dplumlee@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-03-14T07:20:37Z","message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is
missing","number":214287,"url":"https://github.com/elastic/kibana/pull/214287","mergeCommit":{"message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214287","number":214287,"mergeCommit":{"message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>
kibanamachine added a commit that referenced this pull request Mar 14, 2025
… to return Target version when base version is missing (#214287) (#214516)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution] Reverts all remaining diff algorithm fields to
return Target version when base version is missing
(#214287)](#214287)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"56367316+dplumlee@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-03-14T07:20:37Z","message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is
missing","number":214287,"url":"https://github.com/elastic/kibana/pull/214287","mergeCommit":{"message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214287","number":214287,"mergeCommit":{"message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>
clintandrewhall pushed a commit to clintandrewhall/kibana that referenced this pull request Mar 20, 2025
…turn Target version when base version is missing (elastic#214287)

## Summary

Originally we had intended to have the prebuilt rule diff algorithms
merge non-functional fields when the field's base version was missing
and a rule was marked as customized as described in
elastic#210358

> - When the rule has a missing base version and is marked as
customized:
> - We should attempt to merge all non-functional mergeable fields (any
field that doesn't have consequences with how the rule runs e.g. tags)
and return them as SOLVABLE_CONFLICT

We ended up changing this logic to return the `Target` version for every
field that fit that description
(elastic#214161 and
elastic#213757) besides `tags` and in
order to support consistency rather than a very minor edge case, we now
just return the target version for every field with a missing base
version and let users sort it out on their end

This PR reverts the changes made to accommodate this edge case and
updates related tests to account for the new logic

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Mar 22, 2025
…URLs" when base version is missing (elastic#214161)

**Resolves: elastic#214171

## Summary

This PR fixes an issue with "references" field in -AB situations. When
the base version is missing we try to merge current and target arrays
which leads to old and potentially broken URLs from the current version
ending up in the result.

Now the behaviour is changed to always force merged version to be equal
to target (which always has correct URLs).
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Mar 22, 2025
…turn Target version when base version is missing (elastic#214287)

## Summary

Originally we had intended to have the prebuilt rule diff algorithms
merge non-functional fields when the field's base version was missing
and a rule was marked as customized as described in
elastic#210358

> - When the rule has a missing base version and is marked as
customized:
> - We should attempt to merge all non-functional mergeable fields (any
field that doesn't have consequences with how the rule runs e.g. tags)
and return them as SOLVABLE_CONFLICT

We ended up changing this logic to return the `Target` version for every
field that fit that description
(elastic#214161 and
elastic#213757) besides `tags` and in
order to support consistency rather than a very minor edge case, we now
just return the target version for every field with a missing base
version and let users sort it out on their end

This PR reverts the changes made to accommodate this edge case and
updates related tests to account for the new logic

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:version Backport to applied version labels bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. release_note:skip Skip the PR/issue when compiling release notes Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.18.0 v8.19.0 v9.0.0 v9.1.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security Solution] Incorrect merged version for Reference URLs in -AB scenarios

4 participants