From 83b26afd6c3558be8c1ee8ab1beb91b747bd9909 Mon Sep 17 00:00:00 2001 From: Nikita Indik Date: Wed, 12 Mar 2025 14:28:48 +0100 Subject: [PATCH 1/2] Use "target" strategy for "references" field when the base version is missing --- .../logic/diff/calculation/calculate_rule_fields_diff.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/calculate_rule_fields_diff.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/calculate_rule_fields_diff.ts index e00306dbf6233..41625af391bd2 100644 --- a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/calculate_rule_fields_diff.ts +++ b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/calculate_rule_fields_diff.ts @@ -227,7 +227,7 @@ const commonFieldsDiffAlgorithms: FieldsDiffAlgorithmsFor risk_score: numberDiffAlgorithm, risk_score_mapping: simpleDiffAlgorithm, references: createScalarArrayDiffAlgorithm({ - missingBaseVersionStrategy: ScalarArrayDiffMissingBaseVersionStrategy.Merge, + missingBaseVersionStrategy: ScalarArrayDiffMissingBaseVersionStrategy.UseTarget, }), false_positives: simpleDiffAlgorithm, threat: simpleDiffAlgorithm, From 9080599540f6f658a934c6af31e578f41005892e Mon Sep 17 00:00:00 2001 From: Nikita Indik Date: Wed, 12 Mar 2025 16:55:07 +0100 Subject: [PATCH 2/2] Update API integration test --- .../diffable_rule_fields/common_fields/references.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/diffable_rule_fields/common_fields/references.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/diffable_rule_fields/common_fields/references.ts index fc50342ac1786..532c49e6e5710 100644 --- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/diffable_rule_fields/common_fields/references.ts +++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/diffable_rule_fields/common_fields/references.ts @@ -297,11 +297,11 @@ export function referencesField({ getService }: FtrProviderContext): void { ruleUpgradeAssets, diffableRuleFieldName: 'references', expectedDiffOutcome: ThreeWayDiffOutcome.MissingBaseCanUpdate, - isMergableField: true, + isMergableField: false, expectedFieldDiffValues: { current: ['http://url-3'], target: ['http://url-1', 'http://url-2'], - merged: ['http://url-3', 'http://url-1', 'http://url-2'], + merged: ['http://url-1', 'http://url-2'], }, }, getService