[Security Solution] Adds `customized_fields` and `has_base_version` fields to internal rule schema by dplumlee · Pull Request #235394 · elastic/kibana

dplumlee · 2025-09-17T15:22:13Z

Summary

Precursor to #234793

Must go into serverless before that PR is merged in

Adds new fields related to customized rule alert telemetry to the internal rule schema, an addition that must be done before adding them to the security rule schemas (e.g. RuleResponse, etc.)

elasticmachine · 2025-09-17T15:26:43Z

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine · 2025-09-17T15:26:44Z

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine · 2025-09-17T15:26:46Z

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

jkelas

LGTM.
Done some basic exploratory testing to make sure that our features work correctly.
Approving.

…-field-internal-schema

vitaliidm · 2025-09-19T08:23:24Z

...rity/plugins/security_solution/server/lib/detection_engine/rule_schema/model/rule_schemas.ts

  z.object({
    type: z.literal('external'),
    isCustomized: IsExternalRuleCustomized,
+    customizedFields: z


do we need to add new parameter to external schemas too?

That's what this PR is doing. We need to add it to the internal rule schemas first due to our intermediate release practice with rule schema modifications

kibanamachine · 2025-09-20T19:10:06Z

Starting backport for target branches: 9.1

https://github.com/elastic/kibana/actions/runs/17883771345

elasticmachine · 2025-09-20T19:10:34Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 68905e8

Failed CI Steps

FTR Configs #1

Metrics [docs]

Saved Objects .kibana field count

Every field in each saved object type adds overhead to Elasticsearch. Kibana needs to keep the total field count below Elasticsearch's default limit of 1000 fields. Only specify field mappings for the fields you wish to search on or query. See https://www.elastic.co/guide/en/kibana/master/saved-objects-service.html#_mappings

id	before	after	diff
`_data_stream_timestamp`	1	-	-1
`_doc_count`	1	-	-1
`_ignored_source`	1	-	-1
`_index_mode`	1	-	-1
`_inference_fields`	1	-	-1
`_tier`	1	-	-1
`apm-custom-dashboards`	5	-	-5
`apm-server-schema`	2	-	-2
`apm-service-group`	5	-	-5
`application_usage_daily`	2	-	-2
`config`	2	-	-2
`config-global`	2	-	-2
`coreMigrationVersion`	1	-	-1
`created_at`	1	-	-1
`created_by`	1	-	-1
`entity-definition`	9	-	-9
`entity-discovery-api-key`	2	-	-2
`event_loop_delays_daily`	2	-	-2
`favorites`	4	-	-4
`file`	11	-	-11
`file-upload-usage-collection-telemetry`	3	-	-3
`fileShare`	5	-	-5
`infra-custom-dashboards`	4	-	-4
`infrastructure-monitoring-log-view`	2	-	-2
`intercept_trigger_record`	5	-	-5
`legacy-url-alias`	7	-	-7
`managed`	1	-	-1
`ml-job`	6	-	-6
`ml-module`	13	-	-13
`ml-trained-model`	7	-	-7
`monitoring-telemetry`	2	-	-2
`namespace`	1	-	-1
`namespaces`	1	-	-1
`observability-onboarding-state`	2	-	-2
`originId`	1	-	-1
`product-doc-install-status`	7	-	-7
`references`	4	-	-4
`sample-data-telemetry`	3	-	-3
`security-ai-prompt`	8	-	-8
`slo`	11	-	-11
`space`	5	-	-5
`synthetics-monitor`	34	-	-34
`synthetics-monitor-multi-space`	34	-	-34
`tag`	4	-	-4
`type`	1	-	-1
`typeMigrationVersion`	1	-	-1
`ui-metric`	2	-	-2
`updated_at`	1	-	-1
`updated_by`	1	-	-1
`upgrade-assistant-ml-upgrade-operation`	3	-	-3
`upgrade-assistant-reindex-operation`	3	-	-3
`uptime-synthetics-api-key`	2	-	-2
`url`	5	-	-5
`usage-counters`	2	-	-2
total			-246

History

💔 Build #340555 failed 1c823ad
💔 Build #340459 failed 7e6d0f0

cc @dplumlee

…ields to internal rule schema (elastic#235394) ## Summary Precursor to elastic#234793 **Must go into serverless before that PR is merged in** Adds new fields related to [customized rule alert telemetry](elastic#230856) to the internal rule schema, an addition that must be done before adding them to the security rule schemas (e.g. `RuleResponse`, etc.) (cherry picked from commit a15e334)

kibanamachine · 2025-09-20T19:17:19Z

💚 All backports created successfully

Status	Branch	Result
✅	9.1

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…35922) Adds the missing props added by #235394 to the registered rule types schema snapshot.

…astic#235922) Adds the missing props added by elastic#235394 to the registered rule types schema snapshot. (cherry picked from commit fa205bc)

…ion` fields to internal rule schema (#235394) (#235897) # Backport This will backport the following commits from `main` to `9.1`: - [[Security Solution] Adds `customized_fields` and `has_base_version` fields to internal rule schema (#235394)](#235394)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  --------- Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com> Co-authored-by: Davis Plumlee <davis.plumlee@elastic.co>

…ields to internal rule schema (elastic#235394) ## Summary Precursor to elastic#234793 **Must go into serverless before that PR is merged in** Adds new fields related to [customized rule alert telemetry](elastic#230856) to the internal rule schema, an addition that must be done before adding them to the security rule schemas (e.g. `RuleResponse`, etc.)

…astic#235922) Adds the missing props added by elastic#235394 to the registered rule types schema snapshot.

…ields to internal rule schema (#235394) ## Summary Precursor to #234793 **Must go into serverless before that PR is merged in** Adds new fields related to [customized rule alert telemetry](#230856) to the internal rule schema, an addition that must be done before adding them to the security rule schemas (e.g. `RuleResponse`, etc.)

…35922) Adds the missing props added by #235394 to the registered rule types schema snapshot.

…ields to internal rule schema (elastic#235394) ## Summary Precursor to elastic#234793 **Must go into serverless before that PR is merged in** Adds new fields related to [customized rule alert telemetry](elastic#230856) to the internal rule schema, an addition that must be done before adding them to the security rule schemas (e.g. `RuleResponse`, etc.)

…astic#235922) Adds the missing props added by elastic#235394 to the registered rule types schema snapshot.

adds fields as optional to internal schema

7e6d0f0

dplumlee self-assigned this Sep 17, 2025

dplumlee marked this pull request as ready for review September 17, 2025 15:26

dplumlee requested review from a team as code owners September 17, 2025 15:26

dplumlee requested review from nikitaindik and vitaliidm September 17, 2025 15:26

dplumlee mentioned this pull request Sep 17, 2025

[Security Solution] Adds customized_fields and has_base_version fields to rule_source object schema #234793

Merged

4 tasks

jkelas requested review from jkelas and removed request for nikitaindik September 17, 2025 15:39

jkelas approved these changes Sep 17, 2025

View reviewed changes

dplumlee added 2 commits September 17, 2025 16:12

Merge remote-tracking branch 'upstream/main' into rule-customizations…

1c823ad

…-field-internal-schema

Merge remote-tracking branch 'upstream/main' into rule-customizations…

a90217a

…-field-internal-schema

vitaliidm reviewed Sep 19, 2025

View reviewed changes

Merge branch 'main' into rule-customizations-field-internal-schema

68905e8

dplumlee enabled auto-merge (squash) September 20, 2025 15:31

dplumlee merged commit a15e334 into elastic:main Sep 20, 2025
12 checks passed

kibanamachine mentioned this pull request Sep 20, 2025

[9.1] [Security Solution] Adds customized_fields and has_base_version fields to internal rule schema (#235394) #235897

Merged

ersin-erdal mentioned this pull request Sep 22, 2025

Update registered rule types test snapshot with the missing props #235922

Merged

delanni pushed a commit that referenced this pull request Sep 22, 2025

Update registered rule types test snapshot with the missing props (#2…

fa205bc

…35922) Adds the missing props added by #235394 to the registered rule types schema snapshot.

dplumlee deleted the rule-customizations-field-internal-schema branch September 22, 2025 13:04

CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Sep 24, 2025

Update registered rule types test snapshot with the missing props (el…

9ba3ef2

…astic#235922) Adds the missing props added by elastic#235394 to the registered rule types schema snapshot.

niros1 pushed a commit that referenced this pull request Sep 30, 2025

Update registered rule types test snapshot with the missing props (#2…

f674feb

…35922) Adds the missing props added by #235394 to the registered rule types schema snapshot.

banderror added release_note:skip Skip the PR/issue when compiling release notes and removed release_note:enhancement labels Oct 6, 2025

rylnd pushed a commit to rylnd/kibana that referenced this pull request Oct 17, 2025

Update registered rule types test snapshot with the missing props (el…

1dca29c

…astic#235922) Adds the missing props added by elastic#235394 to the registered rule types schema snapshot.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Adds `customized_fields` and `has_base_version` fields to internal rule schema#235394

[Security Solution] Adds `customized_fields` and `has_base_version` fields to internal rule schema#235394
dplumlee merged 4 commits intoelastic:mainfrom
dplumlee:rule-customizations-field-internal-schema

dplumlee commented Sep 17, 2025 •

edited by kibanamachine

Loading

Uh oh!

elasticmachine commented Sep 17, 2025

Uh oh!

elasticmachine commented Sep 17, 2025

Uh oh!

elasticmachine commented Sep 17, 2025

Uh oh!

jkelas left a comment

Uh oh!

vitaliidm Sep 19, 2025

Uh oh!

dplumlee Sep 19, 2025

Uh oh!

Uh oh!

kibanamachine commented Sep 20, 2025

Uh oh!

elasticmachine commented Sep 20, 2025

Uh oh!

kibanamachine commented Sep 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

dplumlee commented Sep 17, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

elasticmachine commented Sep 17, 2025

Uh oh!

elasticmachine commented Sep 17, 2025

Uh oh!

elasticmachine commented Sep 17, 2025

Uh oh!

jkelas left a comment

Choose a reason for hiding this comment

Uh oh!

vitaliidm Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

dplumlee Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kibanamachine commented Sep 20, 2025

Uh oh!

elasticmachine commented Sep 20, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Saved Objects .kibana field count

History

Uh oh!

kibanamachine commented Sep 20, 2025

💚 All backports created successfully

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

dplumlee commented Sep 17, 2025 •

edited by kibanamachine

Loading