[Security Solution] Adds ability to revert prebuilt rules to their base version by dplumlee · Pull Request #223301 · elastic/kibana

dplumlee · 2025-06-10T20:21:32Z

Summary

Adds ability to revert prebuilt rules to their base version.

Implements following endpoints:

GET /internal/detection_engine/prebuilt_rules/base_version
POST /internal/detection_engine/prebuilt_rules/revert

Allows users to revert their customized prebuilt rules to the original Elastic versions. This also implements a rule diff flyout on the rule details page so users can see which fields are customized and would be changed on reversion.

Screenshots

Rule base version flyout

Disabled when cannot find base version

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios

…sion

kibanamachine · 2025-06-13T15:19:24Z

Cloud deployments require a Github label, please add ci:cloud-deploy or ci:cloud-redeploy and trigger the job through the checkbox again.

…sion

dplumlee · 2025-06-18T04:55:48Z

...ion_engine/rule_management/components/rule_details/base_version_diff/base_version_flyout.tsx

+        <TabContentPadding>
+          <PerFieldRuleDiffTab
+            header={headerCallout}
+            ruleDiff={diff}


This is the reason I ended up returning the diff field in the GetPrebuiltRuleBaseVersionResponseBody type from the new /base_version endpoint. We can pass it directly to the existing <PerFieldRuleDiffTab /> component without any modification and have it work.

elasticmachine · 2025-06-18T05:01:14Z

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine · 2025-06-18T05:01:15Z

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine · 2025-06-18T05:01:16Z

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

maximpn · 2025-06-25T10:48:59Z

...engine/prebuilt_rules/get_prebuilt_rule_base_version/get_prebuilt_rule_base_version_route.ts

+  current_version: RuleResponse;
+
+  /** The resulting diff between the base and current versions of the rule */
+  diff: PartialRuleDiff;


As an improvement you could return fieldsDiff: Partial<RuleFieldsDiff> and add the necessary fallback fields for example in x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/base_version_diff/base_version_flyout.tsx or in the upstream data fetching hook.

maximpn · 2025-06-25T11:30:28Z

...ion_engine/rule_management/components/rule_details/base_version_diff/base_version_flyout.tsx

+    } catch {
+      // Error is handled by the mutation's onError callback, so no need to do anything here
+    } finally {
+      closeFlyout();


Having closeFlyout(); closes the flyout upon errors but it's also a suboptimal UX in case of concurrency control.

The flyout should be closed automatically only in the following cases

successful prebuilt rule customizations reverting

base version has disappeared after installing a new prebuilt rules package (the best approach is showing a warning message and disabling the Revert button)

In case either revision or version or both don't match to the expected values users should see a warning message but the flyout shouldn't be closed automatically.

On top of that the diff may update after React query cache expires and it fetches the fresh base version. That base version may be a new one so the diff will be updated. The same happens when someone else edits the rule concurrently.

Implementation like in prebuilt rules upgrade workflow could be used as the reference https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/use_prebuilt_rules_upgrade_state.ts#L74-L120.

maximpn

@dplumlee I tested the PR using multiple scenarios

✅ reverting prebuilt rule customizations
✅ exception lists, actions, non-customizable and runtime fields stay unchanged after customizations have been reverted
✅ reverting prebuilt rule customizations works after upgrading the rule
✅ "Revert rule" button isn't shown after successful reverting
✅ reverting under low-tier license where Prebuilt Rules Customiation is disabled
⚠️ concurrency control
- flyout closes automatically after an attempt to revert the customizations when a new prebuilt rules package was installed concurrently
- flyout closes automatically after an attempt to revert the customizations when revision doesn't match
- flyout closes automatically after an attempt to revert the customizations when version doesn't match
- flyout diff updates happen silently, no notifications are shown

Besides that I left a few comments.

Let's fix the concurrency UI issues then this PR should be good to go.

dplumlee · 2025-06-25T19:39:52Z

@maximpn pushed up the changes, I think in the #207172 implementation follow-up, I might switch to a static viewing experience to simplify some of these concurrency edge cases. Loading in the initial data and then displaying that it's outdated and letting the user refresh the page themselves seems like a good way to handle it, similar to how its done in github's ui

maximpn

@dplumlee Thanks for diligently addressing my comments 🙏

As we agreed some of the comments will be addressed in a follow up PR.

I've retested the PR and pushed a little change to auto-close the flyout upon base version disappearing. React Query retains stale data in case of failed requests. Besides that the functionality works fine.

elasticmachine · 2025-06-26T10:26:14Z

⏳ Build in-progress

Buildkite Build
Commit: 32bb30d
Cloud Deployment
Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-223301-32bb30dca910
Security Deployment

History

💚 Build #312921 succeeded 20f5c26
💔 Build #312866 failed f2beeea
💚 Build #312826 succeeded 0174558
💛 Build #312446 was flaky 917c65c

cc @dplumlee

kibanamachine · 2025-06-26T11:48:57Z

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/15901009398

kibanamachine · 2025-06-26T11:56:13Z

💔 All backports failed

Status	Branch	Result
❌	8.19	Backport failed because of merge conflicts You might need to backport the following PRs to 8.19: - Remapping `iInCircle` and `questionInCircle` and deprecating `help` icon (#223142) - [Lens] Add internal CRUD api routes (#223296) - [Query Rules] Query rules telemetry (#225146) - [ska] relocate x-pack/test/cases_api_integration (#225056) - [Discover][Oblt] Enable Attributes tab by default (#224894) - [follow up] small ui refactoring (#225234) - Adds missing model Claude 3.7 to accepted models (#224943)

Manual backport

To create the backport manually run:

node scripts/backport --pr 223301

Questions ?

Please refer to the Backport tool documentation

dplumlee · 2025-06-27T15:08:30Z

💚 All backports created successfully

Status	Branch	Result
✅	8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…heir base version (#223301) (#225666) # Backport This will backport the following commits from `main` to `8.19`: - [[Security Solution] Adds ability to revert prebuilt rules to their base version (#223301)](#223301)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)

kibanamachine · 2025-07-02T09:11:31Z

Starting backport for target branches: 8.19, 9.1

https://github.com/elastic/kibana/actions/runs/16021022490

kibanamachine · 2025-07-02T09:17:52Z

💔 All backports failed

Status	Branch	Result
❌	8.19	Backport failed because of merge conflicts
❌	9.1	Cherrypick failed because the selected commit (`d532ff4`) is empty. Did you already backport this commit?

Manual backport

To create the backport manually run:

node scripts/backport --pr 223301

Questions ?

Please refer to the Backport tool documentation

adds feature

a71d337

dplumlee self-assigned this Jun 10, 2025

dplumlee added 2 commits June 10, 2025 18:29

Merge remote-tracking branch 'upstream/main' into prebuilt-rule-rever…

78348c1

…sion

Merge remote-tracking branch 'upstream/main' into prebuilt-rule-rever…

3229873

…sion

dplumlee added the ci:cloud-deploy Create or update a Cloud deployment label Jun 13, 2025

dplumlee added 2 commits June 13, 2025 17:19

fix types

44ff894

adds unit tests

e1cbace

dplumlee added the ci:project-deploy-security Create a Security Serverless Project label Jun 16, 2025

dplumlee added 3 commits June 16, 2025 11:30

Merge remote-tracking branch 'upstream/main' into prebuilt-rule-rever…

a1ae0e5

…sion

fix types

69e50af

adds tests

6d0a3de

dplumlee commented Jun 18, 2025

View reviewed changes

dplumlee marked this pull request as ready for review June 18, 2025 05:01

dplumlee requested review from a team as code owners June 18, 2025 05:01

dplumlee requested a review from nikitaindik June 18, 2025 05:01

dplumlee requested review from xcrzx and removed request for nikitaindik June 18, 2025 05:02

addresses non test comments

917c65c

dplumlee requested a review from maximpn June 25, 2025 04:18

maximpn reviewed Jun 25, 2025

View reviewed changes

adds concurrency controls

0174558

dplumlee requested a review from maximpn June 25, 2025 19:34

dplumlee and others added 3 commits June 25, 2025 18:06

adds tests

f2beeea

Merge branch 'main' into prebuilt-rule-reversion

20f5c26

auto-close revert prebuilt rule flyout upon base version disappearing

32bb30d

maximpn approved these changes Jun 26, 2025

View reviewed changes

maximpn merged commit d532ff4 into elastic:main Jun 26, 2025
10 checks passed

maximpn removed the request for review from xcrzx June 26, 2025 11:48

kibanamachine mentioned this pull request Jun 26, 2025

[Oblt Onboarding] Add more errors logging for Auto Detect flow #222948

Merged

This was referenced Jun 26, 2025

[Internal]: Security solution prebuilt rule reversion documentation elastic/docs-content#1940

Closed

[8.19] [Security Solution] Adds ability to revert prebuilt rules to their base version (#223301) #225666

Merged

dplumlee deleted the prebuilt-rule-reversion branch June 27, 2025 15:08

banderror mentioned this pull request Jul 1, 2025

[Security Solution] Rule Details page: allow to revert a customized prebuilt rule back to its base version #215506

Closed

15 tasks

banderror added the v9.2.0 label Jul 2, 2025

maximpn removed ci:cloud-deploy Create or update a Cloud deployment ci:project-deploy-security Create a Security Serverless Project labels Jul 3, 2025

banderror mentioned this pull request Jul 22, 2025

[Security] 9.1.0 release notes elastic/docs-content#2149

Merged

Comments

Conversation

dplumlee commented Jun 10, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Screenshots

Rule base version flyout

Disabled when cannot find base version

Checklist

Uh oh!

kibanamachine commented Jun 13, 2025

Uh oh!

dplumlee Jun 18, 2025

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Jun 18, 2025

Uh oh!

elasticmachine commented Jun 18, 2025

Uh oh!

elasticmachine commented Jun 18, 2025

Uh oh!

maximpn Jun 25, 2025

Choose a reason for hiding this comment

Uh oh!

maximpn Jun 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

maximpn left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dplumlee commented Jun 25, 2025

Uh oh!

maximpn left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Jun 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⏳ Build in-progress

History

Uh oh!

Uh oh!

kibanamachine commented Jun 26, 2025

Uh oh!

kibanamachine commented Jun 26, 2025

💔 All backports failed

Manual backport

Questions ?

Uh oh!

dplumlee commented Jun 27, 2025

💚 All backports created successfully

Questions ?

Uh oh!

kibanamachine commented Jul 2, 2025

Uh oh!

kibanamachine commented Jul 2, 2025

💔 All backports failed

Manual backport

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

dplumlee commented Jun 10, 2025 •

edited by kibanamachine

Loading

maximpn Jun 25, 2025 •

edited

Loading

maximpn left a comment •

edited

Loading

elasticmachine commented Jun 26, 2025 •

edited

Loading