Skip to content

[Security Solution] Reverts all remaining diff algorithm fields to return Target version when base version is missing#214287

Merged
banderror merged 4 commits intoelastic:mainfrom
dplumlee:tags-missing-base-version-target
Mar 14, 2025
Merged

[Security Solution] Reverts all remaining diff algorithm fields to return Target version when base version is missing#214287
banderror merged 4 commits intoelastic:mainfrom
dplumlee:tags-missing-base-version-target

Conversation

@dplumlee
Copy link
Contributor

@dplumlee dplumlee commented Mar 12, 2025

Summary

Originally we had intended to have the prebuilt rule diff algorithms merge non-functional fields when the field's base version was missing and a rule was marked as customized as described in #210358

  • When the rule has a missing base version and is marked as customized:
    • We should attempt to merge all non-functional mergeable fields (any field that doesn't have consequences with how the rule runs e.g. tags) and return them as SOLVABLE_CONFLICT

We ended up changing this logic to return the Target version for every field that fit that description (#214161 and #213757) besides tags and in order to support consistency rather than a very minor edge case, we now just return the target version for every field with a missing base version and let users sort it out on their end

This PR reverts the changes made to accommodate this edge case and updates related tests to account for the new logic

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

@dplumlee dplumlee added release_note:skip Skip the PR/issue when compiling release notes v9.0.0 Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area backport:version Backport to applied version labels v8.18.0 v9.1.0 v8.19.0 labels Mar 12, 2025
@dplumlee dplumlee self-assigned this Mar 12, 2025
@dplumlee dplumlee marked this pull request as ready for review March 12, 2025 21:36
@dplumlee dplumlee requested a review from a team as a code owner March 12, 2025 21:36
@dplumlee dplumlee requested a review from jkelas March 12, 2025 21:36
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@dplumlee dplumlee requested review from maximpn and removed request for jkelas March 12, 2025 21:36
@banderror banderror requested review from banderror and removed request for maximpn March 13, 2025 11:22
@banderror banderror force-pushed the tags-missing-base-version-target branch from ec1ca3c to 0d1b99f Compare March 13, 2025 18:17
Copy link
Contributor

@banderror banderror left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dplumlee Thanks again for the idea. I just reverted the algorithm back to its prior code where we have the missing base versions strategy. This is to limit the changes we push to the last 8.18.0 BC. We can refactor this later.

I didn't test the resulting changes because they look trivial.

@dplumlee dplumlee force-pushed the tags-missing-base-version-target branch from 0d1b99f to 92ef68f Compare March 14, 2025 05:22
@banderror banderror merged commit a2d2054 into elastic:main Mar 14, 2025
9 checks passed
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.18, 8.x, 9.0

https://github.com/elastic/kibana/actions/runs/13851783767

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

cc @dplumlee

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 14, 2025
…turn Target version when base version is missing (elastic#214287)

## Summary

Originally we had intended to have the prebuilt rule diff algorithms
merge non-functional fields when the field's base version was missing
and a rule was marked as customized as described in
elastic#210358

> - When the rule has a missing base version and is marked as
customized:
> - We should attempt to merge all non-functional mergeable fields (any
field that doesn't have consequences with how the rule runs e.g. tags)
and return them as SOLVABLE_CONFLICT

We ended up changing this logic to return the `Target` version for every
field that fit that description
(elastic#214161 and
elastic#213757) besides `tags` and in
order to support consistency rather than a very minor edge case, we now
just return the target version for every field with a missing base
version and let users sort it out on their end

This PR reverts the changes made to accommodate this edge case and
updates related tests to account for the new logic

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
(cherry picked from commit a2d2054)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 14, 2025
…turn Target version when base version is missing (elastic#214287)

## Summary

Originally we had intended to have the prebuilt rule diff algorithms
merge non-functional fields when the field's base version was missing
and a rule was marked as customized as described in
elastic#210358

> - When the rule has a missing base version and is marked as
customized:
> - We should attempt to merge all non-functional mergeable fields (any
field that doesn't have consequences with how the rule runs e.g. tags)
and return them as SOLVABLE_CONFLICT

We ended up changing this logic to return the `Target` version for every
field that fit that description
(elastic#214161 and
elastic#213757) besides `tags` and in
order to support consistency rather than a very minor edge case, we now
just return the target version for every field with a missing base
version and let users sort it out on their end

This PR reverts the changes made to accommodate this edge case and
updates related tests to account for the new logic

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
(cherry picked from commit a2d2054)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 14, 2025
…turn Target version when base version is missing (elastic#214287)

## Summary

Originally we had intended to have the prebuilt rule diff algorithms
merge non-functional fields when the field's base version was missing
and a rule was marked as customized as described in
elastic#210358

> - When the rule has a missing base version and is marked as
customized:
> - We should attempt to merge all non-functional mergeable fields (any
field that doesn't have consequences with how the rule runs e.g. tags)
and return them as SOLVABLE_CONFLICT

We ended up changing this logic to return the `Target` version for every
field that fit that description
(elastic#214161 and
elastic#213757) besides `tags` and in
order to support consistency rather than a very minor edge case, we now
just return the target version for every field with a missing base
version and let users sort it out on their end

This PR reverts the changes made to accommodate this edge case and
updates related tests to account for the new logic

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
(cherry picked from commit a2d2054)
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
8.18
8.x
9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Mar 14, 2025
… to return Target version when base version is missing (#214287) (#214517)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security Solution] Reverts all remaining diff algorithm fields to
return Target version when base version is missing
(#214287)](#214287)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"56367316+dplumlee@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-03-14T07:20:37Z","message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is
missing","number":214287,"url":"https://github.com/elastic/kibana/pull/214287","mergeCommit":{"message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214287","number":214287,"mergeCommit":{"message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>
kibanamachine added a commit that referenced this pull request Mar 14, 2025
…s to return Target version when base version is missing (#214287) (#214515)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Reverts all remaining diff algorithm fields to
return Target version when base version is missing
(#214287)](#214287)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"56367316+dplumlee@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-03-14T07:20:37Z","message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is
missing","number":214287,"url":"https://github.com/elastic/kibana/pull/214287","mergeCommit":{"message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214287","number":214287,"mergeCommit":{"message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>
kibanamachine added a commit that referenced this pull request Mar 14, 2025
… to return Target version when base version is missing (#214287) (#214516)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution] Reverts all remaining diff algorithm fields to
return Target version when base version is missing
(#214287)](#214287)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"56367316+dplumlee@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-03-14T07:20:37Z","message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is
missing","number":214287,"url":"https://github.com/elastic/kibana/pull/214287","mergeCommit":{"message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214287","number":214287,"mergeCommit":{"message":"[Security
Solution] Reverts all remaining diff algorithm fields to return Target
version when base version is missing (#214287)\n\n##
Summary\n\nOriginally we had intended to have the prebuilt rule diff
algorithms\nmerge non-functional fields when the field's base version
was missing\nand a rule was marked as customized as described
in\nhttps://github.com//issues/210358\n\n> - When the rule
has a missing base version and is marked as\ncustomized:\n> - We should
attempt to merge all non-functional mergeable fields (any\nfield that
doesn't have consequences with how the rule runs e.g. tags)\nand return
them as SOLVABLE_CONFLICT\n\nWe ended up changing this logic to return
the `Target` version for every\nfield that fit that
description\n(#214161
and\nhttps://github.com//pull/213757) besides `tags` and
in\norder to support consistency rather than a very minor edge case, we
now\njust return the target version for every field with a missing
base\nversion and let users sort it out on their end\n\nThis PR reverts
the changes made to accommodate this edge case and\nupdates related
tests to account for the new logic\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios\n\n---------\n\nCo-authored-by: Georgii Gorbachev
<georgii.gorbachev@elastic.co>","sha":"a2d2054148b8cd7a062cfabd477338a3fd55428b"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>
@dplumlee dplumlee deleted the tags-missing-base-version-target branch March 14, 2025 14:21
clintandrewhall pushed a commit to clintandrewhall/kibana that referenced this pull request Mar 20, 2025
…turn Target version when base version is missing (elastic#214287)

## Summary

Originally we had intended to have the prebuilt rule diff algorithms
merge non-functional fields when the field's base version was missing
and a rule was marked as customized as described in
elastic#210358

> - When the rule has a missing base version and is marked as
customized:
> - We should attempt to merge all non-functional mergeable fields (any
field that doesn't have consequences with how the rule runs e.g. tags)
and return them as SOLVABLE_CONFLICT

We ended up changing this logic to return the `Target` version for every
field that fit that description
(elastic#214161 and
elastic#213757) besides `tags` and in
order to support consistency rather than a very minor edge case, we now
just return the target version for every field with a missing base
version and let users sort it out on their end

This PR reverts the changes made to accommodate this edge case and
updates related tests to account for the new logic

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Mar 22, 2025
…turn Target version when base version is missing (elastic#214287)

## Summary

Originally we had intended to have the prebuilt rule diff algorithms
merge non-functional fields when the field's base version was missing
and a rule was marked as customized as described in
elastic#210358

> - When the rule has a missing base version and is marked as
customized:
> - We should attempt to merge all non-functional mergeable fields (any
field that doesn't have consequences with how the rule runs e.g. tags)
and return them as SOLVABLE_CONFLICT

We ended up changing this logic to return the `Target` version for every
field that fit that description
(elastic#214161 and
elastic#213757) besides `tags` and in
order to support consistency rather than a very minor edge case, we now
just return the target version for every field with a missing base
version and let users sort it out on their end

This PR reverts the changes made to accommodate this edge case and
updates related tests to account for the new logic

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:version Backport to applied version labels Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area release_note:skip Skip the PR/issue when compiling release notes Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.18.0 v8.19.0 v9.0.0 v9.1.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants