[Security Solution] Users can Customize Prebuilt Detection Rules: Milestone 3

[banderror]

Epic: https://github.com/elastic/security-team/issues/1974 (internal)
Milestones: << • >>

Status: In development.

Summary

Milestone 3: Add support for customizing prebuilt rules. Extend the rule upgrade workflow with full support for 3-way diffs and conflict resolution.

This meta ticket is created to simplify tracking of various tickets related to the epic, and to make this public information so our users can track the progress.

User-facing outcomes:

• Users can click “edit” button for prebuilt rules and customise any field in the same editing interface as the custom rules
• User can filter rules in the rule management page by custom/customised/Elastic
• User can see if the rule was customised on the rule details page
• If the prebuilt rule is customised and update comes in:
  • User can see the current version and update and compare per field
  • They are able to edit the final field versions before finalising the update
  • If the rule type changes - they can only accept the incoming changes
• Prebuilt rules can be exported and imported

Useful info:

• RFC: Prebuilt Rules Customization - a new technical design document describing in detail how prebuilt rule customization should work and affect other existing features.
• Prebuilt Rules Customization Technical Design - an older document from Milestone 1.

Design

Technical design

Beta Give feedback

1. [Security Solution] Write an RFC for customizing prebuilt rules #171309
   8.14 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +5
   
2. [Security Solution] Discuss rule fields in the context of the prebuilt rule upgrade workflow #147239
   8.14 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp discuss +6
   

   
3. [Security Solution] Discuss rule field diffs and conflicts to handle in the UI #148913
   Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp discuss release_note:skip skip-ci +7
   

UI/UX design

Beta Give feedback

1. [Security Solution] Discuss UI/UX designs for customizing prebuilt rules #178211
   8.14 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp design +6
2. Design rule management changes (Rule Management and Details pages)
3. Design rule customization changes (Rule Management and Editing pages)
4. Design rule installation and upgrade changes (Add Rules page, Rule updates table, rule upgrade details flyout)
5. Design rule upgrade UI for rule type changes (implementation ticket)
6. [Security Solution] Editing rules independently of source data #180407
   2 of 5
   8.18 candidate Feature:Prebuilt Detection Rules Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Engine Team:Detection Rule Management Team:Detections and Resp +8

Preparatory changes

Preparatory changes is something we can work on before starting to hide functionality behind a feature flag. This will reduce the overall complexity introduced by feature toggling.

Missing UI for editing certain rule fields

Beta Give feedback

1. [Security Solution] Allow users to edit setup field for custom rules #173626
   8.14 candidate Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.14.0 +8
   
2. [Security Solution] Allow users to edit max_signals field for custom rules #173593
   8.15 candidate Feature:Rule Creation Feature:Rule Details Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0 +9
   
3. [Security Solution] Allow users to edit related_integrations field for custom rules #173595
   8.15 candidate Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0 +8
   
4. [Security Solution] Allow users to edit required_fields field for custom rules #173594
   8.15 candidate Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0 +8
   

Missing UI for editing certain rule fields (docs)

Beta Give feedback

1. Edit setup guide field for custom rules in UI and API security-docs#4917
   3 of 3
   Docset: ESS Docset: Serverless Feature: Rules Team: Detections/Response v8.14.0 +5
   
2. Edit max_signals field for custom rules in UI and API security-docs#5029
   3 of 3
   Docset: ESS Docset: Serverless Feature: Rules Team: Detections/Response v8.15.0 +5
   
3. Edit related_integrations field for custom rules in UI and API security-docs#5099
   3 of 3
   Docset: ESS Docset: Serverless Feature: Rules Team: Detections/Response v8.15.0 +5
   
4. Edit required_fields field for custom rules in UI and API security-docs#5131
   3 of 3
   Docset: ESS Docset: Serverless Feature: Rules Team: Detections/Response v8.15.0 +5
   

Schema-related changes

Beta Give feedback

1. [Security Solution] Add rule_source to the API schema #180122
   8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.15.0 +6
   
2. [Security Solution] Make changes in the internal rule schema #180124
   8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.15.0 +6
   
3. [Security Solution] Replaced the incorrect runtime type used for ruleSource #184004
   Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp backport:skip bug impact:critical release_note:skip v8.15.0 +9
   
4. [Security Solution] Write the rule_source field together with immutable #180141
   8.15 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.15.0 +7
   
5. [Security Solution] RulesManagementClient refactoring. Part 1 #180128
   8.15 candidate Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp refactoring v8.15.0 +7
   
6. [Security Solution] DetectionRulesClient refactoring. Part 2 #184364
   8.16 candidate Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp refactoring v8.15.0 v8.16.0 +8
   
7. [Security Solution] Implement normalization on read for rule_source and immutable fields #180140
   8.16 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0 +7
   

Rule customization, API changes

Beta Give feedback

1. [Security Solution] Calculate and save ruleSource.isCustomized in API endpoint handlers #180145
   8.16 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0 +7
   
2. [Security Solution] Calculate and save ruleSource.isCustomized in bulk edit API #187706
   8.16 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0 +7
   
3. [Security Solution] Make rule_source field required in RuleResponse #180270
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0 +6
   
4. [Security Solution] Prevent from updating "non-customizable" fields in prebuilt rules #180273
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0 +6
   

Rule upgrade, API changes

Beta Give feedback

1. [Security Solution] Return user-customized fields from the POST /prebuilt_rules/upgrade/_review API endpoint even if they haven't been updated by Elastic in the target version #180154
   8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.15.0 +6
   
2. [Security Solution] Extend the POST /upgrade/_review API endpoint's contract and functionality #180153
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0 +6
   
3. [Security Solution] Handle specific fields in /upgrade/_review upgrade workflow #180393
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0 +6
   
4. [Security Solution] Substitute MissingVersion symbol in the ThreeWayDiff object with a boolean #188277
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp refactoring +6
   
5. [Security Solution] Extend the POST /upgrade/_perform API endpoint's contract and functionality #166376
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0 +7
   
6. [Security Solution] Handle specific fields in /upgrade/_perform endpoint upgrade workflow #186544
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0 +6
   
7. [Security Solution] Add InvestigationFields and AlertSuppression fields to the upgrade workflow #190597
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +5
   
8. [Security Solution] Remove exceptions_list, author and license from Diffable Rule #196213
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0 +6
   
9. [Security Solution] Create types or tests to link Rule Schema and Diffable Rule schema #194484
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +5
   
10. [Security Solution] Apply same defaults values in extractDiffableCommonFields as in convertCreateAPIToInternalSchema #180165
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp refactoring +6
    

Rule upgrade, diff algorithms

Beta Give feedback

1. [Security Solution] Implement number diff algorithm #180160
   8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0 +7
   
2. [Security Solution] Implement single-line string diff algorithm #180158
   8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0 +7
   
3. [Security Solution] Implement multi-line string diff algorithm #180159
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0 +7
   
4. [Security Solution] Implement array of scalar values diff algorithm #180162
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0 +7
   
5. [Security Solution] Implement data source fields diff algorithm #187659
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0 +7
   
6. [Security Solution] Implement query fields diff algorithms #187658
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0 +7
   
7. [Security Solution] Implement concurrent_searches and items_per_search fields diff algorithms #188061
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement +6
   
8. [Security Solution] Implement rule type diff algorithm #190482
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0 +7
   

Fleet package with prebuilt rules

Beta Give feedback

1. [Security Solution] OOMs during prebuilt rules package installation #187969
   3 of 3
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet v8.16.0 +7
   
2. [Fleet] All package SOs are being read into memory during package upgrade or force installation #187975
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet technical debt +7
   
3. [Fleet] Split bulk delete into chunks to avoid high memory consumption #188208
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet technical debt +7
   
4. [Fleet] Split asset installation into chunks to avoid high memory pressure #189043
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet +6
   
5. [Security Solution] API endpoint for the package with prebuilt rules #187647
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0 +6
   
6. [Security Solution] Stream-based installation of the package with prebuilt rules #192350
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet performance v8.17.0 +8
   
7. [Security Solution] Smart limits for the package with prebuilt rules #187645
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.17.0 +6
   
8. [Security Solution] Implement reliable tests to catch OOMs during rules package installation #188090
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp technical debt +6

Changes hidden behind the feature flag

These are changes that will need to be hidden behind the prebuiltRulesCustomizationEnabled feature flag.

Rule customization, UI changes

Beta Give feedback

1. [Security Solution] Add a new feature flag prebuiltRulesCustomizationEnabled #180130
   8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.15.0 +6
   
2. [Security Solution] Show if a rule is customized on the Rule Details page #180170
   8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0 +7
   
3. [Security Solution] Support filtering by "Modified rules" and "Unmodified rules" #180169
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement +6
   
4. [Security Solution] Add support for editing prebuilt rules to the Rule Management and Rule Details pages #180171
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +5
   
5. [Security Solution] Add support for editing prebuilt rules to the Rule Editing page #180172
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +5
   

Rule upgrade, UI changes

Beta Give feedback

1. [Security Solution] Rework Update flyout to display all field updates and build Three-Way-Diff field component #171520
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0 +7
   
2. [Security Solution] Handle specific fields in the upgrade workflow's UI #188065
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +5
   
3. [Security Solution] Handle conflicting rules in the Rule Upgrade table #180589
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp needs design +6
   

   
4. [Security Solution] Implement UI for updating prebuilt rule to a new rule type (MVP) #180395
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +5
   

Rule export and import, API and UI changes

Beta Give feedback

1. [Security Solution] Allow exporting prebuilt rules at the API level #180167
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement +6
   
2. [Security Solution] Allow importing prebuilt rules at the API level #180168
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement +6
   
3. [Security Solution] Support exporting prebuilt rules from the Rule Management page #180173
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +5
   
4. [Security Solution] Support exporting prebuilt rules from the Rule Details page #180176
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +5
   
5. [Security Solution] Benchmark performance of importing a large number of prebuilt rules #195632
   8.17 candidate Feature:Prebuilt Detection Rules Feature:Rule Import/Export Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +6
   
6. [Security Solution] Create asynchronous rules import API #195633
   8.17 candidate Feature:Prebuilt Detection Rules Feature:Rule Import/Export Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +6
   

RBAC

Beta Give feedback

1. https://github.com/elastic/security-team/issues/10410

Telemetry

Beta Give feedback

1. [Security Solution] Collect usage statistics for prebuilt rule customization #140369
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp needs product telemetry +7
   

Before release

Bugs: rule editing and customization

Beta Give feedback

1. [Security Solution] Rule's EQL query validation fails unexpectedly when fields missing #178611
   8.16 candidate Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug fixed impact:medium v8.16.0 +10
   
2. [Security Solution] Rules mistakenly marked as customized #199629
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high v8.16.1 v8.17.0 v9.0.0 +10
   
3. [Security Solution] Required fields are getting erased on rule PATCH #199665
   8.17 candidate Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium v8.16.1 v8.17.0 v9.0.0 +10
   
4. [Security Solution] Custom Query field overflows the viewport and cannot be completely visualized or edited when the query is too long #178615
   8.18 candidate Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium +8
5. https://github.com/elastic/security-team/issues/10215
6. [Security Solution] Add validation error description on prebuilt rule editing #191832
   8.18 candidate Feature:Rule Edit Team: SecuritySolution Team:Detection Engine Team:Detection Rule Management Team:Detections and Resp needs design needs product +8
   
7. [Security Solution] Editing rules independently of source data #180407
   2 of 5
   8.18 candidate Feature:Prebuilt Detection Rules Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Engine Team:Detection Rule Management Team:Detections and Resp +8

Bugs: rule details and upgrade flyout

Beta Give feedback

1. [Security Solution] Warnings in rule filters on the Rule Details page: "Field does not exist in current view" #178908
   8.17 candidate Feature:Rule Details Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium +7
   
2. [Security Solution] Show count field on Rule details page for threshold rules #161576
   8.17 candidate Feature:Rule Details Feature:Threshold Rule Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug enhancement sdh-linked +9
   
3. [Security Solution] Wrapping of default data view index not done on Rule Details page (Firefox) #140156
   8.17 candidate Feature:Rule Details Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:low +7
   

Bugs: rule installation and upgrade

Beta Give feedback

1. [Security Solution] Infinite loading state on the rule install page when user doesn't have write privileges #161543
   8.14 candidate Feature:Detection Alerts/Rules RBAC Feature:Prebuilt Detection Rules QA:Validated Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug fixed impact:medium v8.12.2 v8.13.0 v8.14.0 +13
   
2. [Security Solution] Error Unable to load page is shown for Rules Page after updating Rules. #180120
   8.14 candidate Feature:Prebuilt Detection Rules QA:Validated Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high +8
3. [Security Solution] Prebuilt rule flyout: Fix the delay that occurs when a user tries to open a flyout #166166
   Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:low performance +7
   
4. [Security Solution] Replace PATCH logic with PUT when upgrading rules #180195
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:medium v8.16.0 +8
   
5. [Security Solution] 'Update rule' button is disabled when there are prebuilt rules updates available #198155
   8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug fixed impact:high v8.16.0 +9
   
6. [Security Solution] upgrade/_review blocks main thread #199290
   8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:critical performance v8.16.1 v8.17.0 v9.0.0 +11
   
7. [Security Solution] Implement rule upgrade concurrency control #200134
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high +7
   
8. [Security Solution] Prebuilt rules being duplicated on upgrade #174847
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug impact:high +7

Bugs: rule import and export

Beta Give feedback

1. https://github.com/elastic/infosec/issues/15731
2. [Security Solution] Users can import custom rules with rule_id equal to that of a not-installed prebuilt rule (DRAFT) #180198
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug triage_needed +7

Bugs: misc

Beta Give feedback

1. [Security Solution] When duplicating a prebuilt rule, 'Related Integrations' and 'Required Fields' values are not inherited from the original rule #190628
   8.16 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp bug fixed impact:medium v8.15.1 v8.16.0 +11
   

Testing

Beta Give feedback

1. [Security Solution] Acceptance testing of prebuilt rule customization workflows #180397
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +5
   
2. [Security Solution] Exploratory testing of prebuilt rule customization workflows #180398
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +5
   
3. [Security Solution] Write tests for "Customized Elastic rule" badge on the Rule Details page #186916
   8.18 candidate Feature:Prebuilt Detection Rules Feature:Rule Details Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp technical debt test-coverage +8
   

Documentation

Beta Give feedback

1. [Request] Prebuilt rule customization and upgrade workflows (DRAFT) security-docs#5061
   v8.18.0 +1
   
2. [Request] Document new rule_source property for rules in the API schema (DRAFT) security-docs#5063
   v8.18.0 +1
   

Final changes before releasing the feature

Beta Give feedback

1. [Security Solution] Enable prebuilt rule customization feature #180267
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +5

After release

Last changes after releasing the feature

Beta Give feedback

1. [Security Solution] Exploratory testing of prebuilt rule customization workflows in production #180399
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +5
   
2. [Security Solution] Remove the prebuiltRulesCustomizationEnabled feature flag #180272
   8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +5

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[banderror]

Draft plan for Milestone 3

UPD: the plan has been moved to the ticket description.

[banderror]

@jpdjere Please review the updated ticket and let's sync on it on Monday.

Here are the changes I made:

• Addressed all the todos, except pinging Kseniia and Alex about the work to do on their side. Before we ask other people to prioritize certain work, I'd like to sync on our plan with a few people.
• Opened new tickets:
  • Stream-based programmatic API for installing packages #187646
  • API endpoint for the package with prebuilt rules #187647
  • Smart limits for the package with prebuilt rules #187645
  • Splitting the package with prebuilt rules #187648
  • Alternative mechanism for distributing prebuilt rules #187649
  • Detection rule migration mechanism #187651
  • DetectionRulesClient refactoring. Part 3 #187656
  • Implement query fields diff algorithm #187658
  • Implement data source fields diff algorithm #187659
  • Implement MITRE ATT&CK® field diff algorithm #187660
  • Calculate and save ruleSource.isCustomized in bulk edit API #187706
• Wrote descriptions for:
  • Implement UI for updating prebuilt rule to a new rule type #180395
  • Replace PATCH logic with PUT when upgrading rules #180195
• Assigned 8.16 candidate and 8.17 candidate labels to all the tickets in Milestone 3.
• Moved the tickets that we can postpone until later to Milestone 4.