diff --git a/x-pack/solutions/security/plugins/security_solution/common/constants.ts b/x-pack/solutions/security/plugins/security_solution/common/constants.ts index 80300227b0ae7..3581de4994e48 100644 --- a/x-pack/solutions/security/plugins/security_solution/common/constants.ts +++ b/x-pack/solutions/security/plugins/security_solution/common/constants.ts @@ -516,4 +516,7 @@ export const JEST_ENVIRONMENT = typeof jest !== 'undefined'; /* * The tag to mark promotion rules that are related to the AI for SOC integrations */ -export const PROMOTION_RULE_TAG = 'Promotion'; +export const PROMOTION_RULE_TAGS = [ + 'Promotion', // This is the legacy tag for promotion rules and can be safely removed once promotion rules go live + 'Promotion: External Alerts', +]; diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/integrations/install_promotion_rules.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/integrations/install_promotion_rules.ts index 5c0d56e083909..c40c2b99ac173 100644 --- a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/integrations/install_promotion_rules.ts +++ b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/integrations/install_promotion_rules.ts @@ -18,7 +18,8 @@ import type { } from '../../../../../../common/api/detection_engine/prebuilt_rules/bootstrap_prebuilt_rules/bootstrap_prebuilt_rules.gen'; import { getErrorMessage } from '../../../../../utils/error_helpers'; import type { EndpointInternalFleetServicesInterface } from '../../../../../endpoint/services/fleet'; -import { PROMOTION_RULE_TAG } from '../../../../../../common/constants'; +import { PROMOTION_RULE_TAGS } from '../../../../../../common/constants'; +import type { PrebuiltRuleAsset } from '../../model/rule_assets/prebuilt_rule_asset'; interface InstallPromotionRulesParams { rulesClient: RulesClient; @@ -70,7 +71,7 @@ export async function installPromotionRules({ const latestPromotionRules = latestRuleAssets.filter((rule) => { // Rule should be tagged as 'Promotion' and should be related to an enabled integration return ( - (rule.tags ?? []).includes(PROMOTION_RULE_TAG) && + isPromotionRule(rule) && rule.related_integrations?.some((integration) => installedIntegrations.has(integration.package) ) @@ -146,3 +147,7 @@ export async function installPromotionRules({ errors: allErrors.size > 0 ? Array.from(allErrors.values()) : [], }; } + +function isPromotionRule(rule: PrebuiltRuleAsset): boolean { + return (rule.tags ?? []).some((tag) => PROMOTION_RULE_TAGS.includes(tag)); +}