Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Detection Engine] Adds 8.4 rules #138574

Merged
merged 6 commits into from
Aug 15, 2022
Merged

[Detection Engine] Adds 8.4 rules #138574

merged 6 commits into from
Aug 15, 2022

Conversation

brokensound77
Copy link
Contributor

Summary

Pull updates to detection rules from https://github.com/elastic/detection-rules/tree/395ae2c1d1e1d93ea7520300d4fb5000c58ae870.

Checklist

Delete any items that are not applicable to this PR.

@brokensound77 brokensound77 requested a review from a team as a code owner August 10, 2022 21:53
@brokensound77 brokensound77 added release_note:skip Skip the PR/issue when compiling release notes auto-backport Deprecated - use backport:version if exact versions are needed v8.4.0 labels Aug 10, 2022
@terrancedejesus terrancedejesus mentioned this pull request Aug 11, 2022
Closed
1 task
@terrancedejesus terrancedejesus requested review from vitaliidm and a team August 11, 2022 00:32
@terrancedejesus terrancedejesus self-assigned this Aug 11, 2022
@vitaliidm vitaliidm mentioned this pull request Aug 11, 2022
Merged
@vitaliidm
Copy link
Contributor

@brokensound77 , I've prepared a PR (#138625), which once merged should allow tests in your PR to pass.

@terrancedejesus
Copy link
Contributor

@brokensound77 , I've prepared a PR (#138625), which once merged should allow tests in your PR to pass.

@vitaliidm thank you so much for looking into this and finding a solution. Justin will be at DefCon this week and I will be handling the rest of the detection rules release. Please let me know if there is anything I can do.

When your PR merges I will re-run the tests and hopefully they pass. Thanks again!

@vitaliidm
Copy link
Contributor

While playing around with the updated prebuilt rules, noticed: when duplicating rules, duplicated rules are getting created without required fields, integrations and setup fields

Screen.Recording.2022-08-12.at.12.05.27.mov

cc: @banderror , is this behaviour intentional or something we will need to fix later?

@banderror
Copy link
Contributor

@vitaliidm This behavior is expected. Users can't edit them (there's no UI for these fields on the Rule Creation and Editing pages), so the decision was to reset them to empty values in this case. Once we add support for editing them, we will need to remove this logic.

vitaliidm
vitaliidm approved these changes Aug 12, 2022
View reviewed changes
Copy link
Contributor

@vitaliidm vitaliidm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@terrancedejesus , PR mentioned above is merged. Hopefully all tests will pass, I've triggered build to verify it.

Since @banderror addressed my comment before, I don't see any issues and approving changes

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Aug 12, 2022
@vitaliidm
[Security Solution][Detections] fixes tests related to prebuilt rules…
8bfb6c9 
… update (elastic#138625)

## Summary

fixes tests related to prebuilt rules update tests failures(elastic#138574 (comment)):
- removed hardcoded rule version value
- required_fields are not tested agains empty array, but agains actual immutable rule value

(cherry picked from commit 800cc72)
kibanamachine pushed a commit to cee-chen/kibana that referenced this pull request Aug 12, 2022
@vitaliidm
[Security Solution][Detections] fixes tests related to prebuilt rules…
800cc72 
… update (elastic#138625)

## Summary

fixes tests related to prebuilt rules update tests failures(elastic#138574 (comment)):
- removed hardcoded rule version value
- required_fields are not tested agains empty array, but agains actual immutable rule value
Mikaayenson
Mikaayenson approved these changes Aug 12, 2022
View reviewed changes
Copy link
Contributor

@Mikaayenson Mikaayenson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@terrancedejesus
Copy link
Contributor

@terrancedejesus , PR mentioned above is merged. Hopefully all tests will pass, I've triggered build to verify it.

Since @banderror addressed my comment before, I don't see any issues and approving changes

Hey @vitaliidm thank you so much for getting that PR merged and re-running the checks. The Kibana updates look great to see them in an actual stack with the rules!

Waiting for these checks to pass and then I will go ahead and merge. Thanks everyone!

@terrancedejesus
Copy link
Contributor

@elasticmachine merge upstream

@vitaliidm vitaliidm mentioned this pull request Aug 15, 2022
Merged
@terrancedejesus
Copy link
Contributor

terrancedejesus commented Aug 15, 2022 •
edited
Loading

@vitaliidm any additional information on the new errors for FTR configs #23? I believe this check passed before. Thank you in advance!

@vitaliidm
Copy link
Contributor

@vitaliidm any additional information on the new errors for FTR configs #23? I believe this check passed before. Thank you in advance!

another fix is on its way. This test didn't fail, as CI test job exits on first test failed, so it doesn't show the rest of failures

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Aug 15, 2022
@vitaliidm
[Security Solution][Detections] fixes failing tests for 8.4 prebuilt …
9568adb 
…rules update elastic#138794

- fixes the rest of tests for elastic#138574 PR

(cherry picked from commit 167bb8e)
kibanamachine pushed a commit to rahuldimri/kibana that referenced this pull request Aug 15, 2022
@vitaliidm
[Security Solution][Detections] fixes failing tests for 8.4 prebuilt …
167bb8e 
…rules update elastic#138794

- fixes the rest of tests for elastic#138574 PR
@terrancedejesus
Copy link
Contributor

terrancedejesus commented Aug 15, 2022 •
edited
Loading

another fix is on its way. This test didn't fail, as CI test job exits on first test failed, so it doesn't show the rest of failures

Ah alright that makes sense, thanks for the insight. Is this the PR for that? I want to make sure I include this information in our overall tracking issue outside of this.

@kibana-ci
Copy link
Collaborator

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @terrancedejesus

@vitaliidm
Copy link
Contributor

vitaliidm commented Aug 15, 2022 •
edited
Loading

Ah alright that makes sense, thanks for the insight. Is #138832 the PR for that? I want to make sure I include this information in our overall tracking issue outside of this.

@terrancedejesus, correct

Meanwhile all tests have passed and PR is ready to be merged

@terrancedejesus
Copy link
Contributor

Ah alright that makes sense, thanks for the insight. Is #138832 the PR for that? I want to make sure I include this information in our overall tracking issue outside of this.

@terrancedejesus, correct

Meanwhile all tests have passed and PR is ready to be merged

Wow thanks for the fast turnaround and solution implementation on this! Merging now.

@terrancedejesus terrancedejesus merged commit 3021824 into elastic:main Aug 15, 2022
@kibanamachine kibanamachine mentioned this pull request Aug 15, 2022
Merged
kibanamachine pushed a commit that referenced this pull request Aug 15, 2022
@brokensound77
[Detection Rules] Add 8.4 rules (#138574)
2850ce5 
Co-authored-by: Vitalii Dmyterko <[email protected]>
Co-authored-by: Kibana Machine <[email protected]>
Co-authored-by: Terrance DeJesus <[email protected]>
(cherry picked from commit 3021824)
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
✅ 8.4

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation and see the Github Action logs for details

kibanamachine added a commit to kibanamachine/kibana that referenced this pull request Aug 15, 2022
@kibanamachine @brokensound77
[Detection Rules] Add 8.4 rules (elastic#138574) (elastic#138840)
c2e88ff 
Co-authored-by: Vitalii Dmyterko <[email protected]>
Co-authored-by: Kibana Machine <[email protected]>
Co-authored-by: Terrance DeJesus <[email protected]>
(cherry picked from commit 3021824)

Co-authored-by: Justin Ibarra <[email protected]>
@terrancedejesus terrancedejesus mentioned this pull request Aug 18, 2022
Closed
5 tasks
Mpdreamz pushed a commit to Mpdreamz/kibana that referenced this pull request Sep 6, 2022
@vitaliidm @Mpdreamz
[Security Solution][Detections] fixes tests related to prebuilt rules…
3125759 
… update (elastic#138625)

## Summary

fixes tests related to prebuilt rules update tests failures(elastic#138574 (comment)):
- removed hardcoded rule version value
- required_fields are not tested agains empty array, but agains actual immutable rule value
Mpdreamz pushed a commit to Mpdreamz/kibana that referenced this pull request Sep 6, 2022
@vitaliidm @Mpdreamz
[Security Solution][Detections] fixes failing tests for 8.4 prebuilt …
21a7731 
…rules update elastic#138794

- fixes the rest of tests for elastic#138574 PR
Mpdreamz pushed a commit to Mpdreamz/kibana that referenced this pull request Sep 6, 2022
@brokensound77 @vitaliidm
@kibanamachine @terrancedejesus @Mpdreamz
[Detection Rules] Add 8.4 rules (elastic#138574)
ef525b5 
Co-authored-by: Vitalii Dmyterko <[email protected]>
Co-authored-by: Kibana Machine <[email protected]>
Co-authored-by: Terrance DeJesus <[email protected]>
@terrancedejesus terrancedejesus mentioned this pull request Sep 8, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Mikaayenson Mikaayenson Mikaayenson approved these changes

@vitaliidm vitaliidm vitaliidm approved these changes

Assignees

@terrancedejesus terrancedejesus

Labels
auto-backport Deprecated - use backport:version if exact versions are needed release_note:skip Skip the PR/issue when compiling release notes v8.4.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@brokensound77 @vitaliidm @terrancedejesus @banderror @kibana-ci @kibanamachine @Mikaayenson