From b9b4a7d21eddefc792aaba1550d77c572bb42db8 Mon Sep 17 00:00:00 2001 From: Davis Plumlee <56367316+dplumlee@users.noreply.github.com> Date: Sat, 20 Sep 2025 15:09:45 -0400 Subject: [PATCH 1/2] [Security Solution] Adds `customized_fields` and `has_base_version` fields to internal rule schema (#235394) ## Summary Precursor to https://github.com/elastic/kibana/pull/234793 **Must go into serverless before that PR is merged in** Adds new fields related to [customized rule alert telemetry](https://github.com/elastic/kibana/pull/230856) to the internal rule schema, an addition that must be done before adding them to the security rule schemas (e.g. `RuleResponse`, etc.) (cherry picked from commit a15e3345fe5c7cc7171112710d27b555f517acaa) --- .../detection_engine/rule_schema/model/rule_schemas.ts | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_schema/model/rule_schemas.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_schema/model/rule_schemas.ts index c1192e9a75fd1..ae9faa8bb006a 100644 --- a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_schema/model/rule_schemas.ts +++ b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_schema/model/rule_schemas.ts @@ -104,6 +104,14 @@ export const RuleSourceCamelCased = z.discriminatedUnion('type', [ z.object({ type: z.literal('external'), isCustomized: IsExternalRuleCustomized, + customizedFields: z + .array( + z.object({ + fieldName: z.string(), + }) + ) + .optional(), + hasBaseVersion: z.boolean().optional(), }), z.object({ type: z.literal('internal'), From 05cf95cf63a60b8d6cab97dd66dd46ffc32e16a8 Mon Sep 17 00:00:00 2001 From: Davis Plumlee Date: Tue, 23 Sep 2025 00:24:05 -0400 Subject: [PATCH 2/2] updates snapshot tests --- ...s_upgrade_and_rollback_checks.test.ts.snap | 126 ++++++++++++++++++ 1 file changed, 126 insertions(+) diff --git a/x-pack/platform/plugins/shared/alerting/server/integration_tests/__snapshots__/serverless_upgrade_and_rollback_checks.test.ts.snap b/x-pack/platform/plugins/shared/alerting/server/integration_tests/__snapshots__/serverless_upgrade_and_rollback_checks.test.ts.snap index be93556deb7d6..719dcd917211c 100644 --- a/x-pack/platform/plugins/shared/alerting/server/integration_tests/__snapshots__/serverless_upgrade_and_rollback_checks.test.ts.snap +++ b/x-pack/platform/plugins/shared/alerting/server/integration_tests/__snapshots__/serverless_upgrade_and_rollback_checks.test.ts.snap @@ -6097,6 +6097,24 @@ Object { Object { "additionalProperties": false, "properties": Object { + "customizedFields": Object { + "items": Object { + "additionalProperties": false, + "properties": Object { + "fieldName": Object { + "type": "string", + }, + }, + "required": Array [ + "fieldName", + ], + "type": "object", + }, + "type": "array", + }, + "hasBaseVersion": Object { + "type": "boolean", + }, "isCustomized": Object { "type": "boolean", }, @@ -6768,6 +6786,24 @@ Object { Object { "additionalProperties": false, "properties": Object { + "customizedFields": Object { + "items": Object { + "additionalProperties": false, + "properties": Object { + "fieldName": Object { + "type": "string", + }, + }, + "required": Array [ + "fieldName", + ], + "type": "object", + }, + "type": "array", + }, + "hasBaseVersion": Object { + "type": "boolean", + }, "isCustomized": Object { "type": "boolean", }, @@ -7502,6 +7538,24 @@ Object { Object { "additionalProperties": false, "properties": Object { + "customizedFields": Object { + "items": Object { + "additionalProperties": false, + "properties": Object { + "fieldName": Object { + "type": "string", + }, + }, + "required": Array [ + "fieldName", + ], + "type": "object", + }, + "type": "array", + }, + "hasBaseVersion": Object { + "type": "boolean", + }, "isCustomized": Object { "type": "boolean", }, @@ -8154,6 +8208,24 @@ Object { Object { "additionalProperties": false, "properties": Object { + "customizedFields": Object { + "items": Object { + "additionalProperties": false, + "properties": Object { + "fieldName": Object { + "type": "string", + }, + }, + "required": Array [ + "fieldName", + ], + "type": "object", + }, + "type": "array", + }, + "hasBaseVersion": Object { + "type": "boolean", + }, "isCustomized": Object { "type": "boolean", }, @@ -8862,6 +8934,24 @@ Object { Object { "additionalProperties": false, "properties": Object { + "customizedFields": Object { + "items": Object { + "additionalProperties": false, + "properties": Object { + "fieldName": Object { + "type": "string", + }, + }, + "required": Array [ + "fieldName", + ], + "type": "object", + }, + "type": "array", + }, + "hasBaseVersion": Object { + "type": "boolean", + }, "isCustomized": Object { "type": "boolean", }, @@ -9571,6 +9661,24 @@ Object { Object { "additionalProperties": false, "properties": Object { + "customizedFields": Object { + "items": Object { + "additionalProperties": false, + "properties": Object { + "fieldName": Object { + "type": "string", + }, + }, + "required": Array [ + "fieldName", + ], + "type": "object", + }, + "type": "array", + }, + "hasBaseVersion": Object { + "type": "boolean", + }, "isCustomized": Object { "type": "boolean", }, @@ -10280,6 +10388,24 @@ Object { Object { "additionalProperties": false, "properties": Object { + "customizedFields": Object { + "items": Object { + "additionalProperties": false, + "properties": Object { + "fieldName": Object { + "type": "string", + }, + }, + "required": Array [ + "fieldName", + ], + "type": "object", + }, + "type": "array", + }, + "hasBaseVersion": Object { + "type": "boolean", + }, "isCustomized": Object { "type": "boolean", },