Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Support rule type change during upgrade #200199

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

xcrzx
Copy link
Contributor

@xcrzx xcrzx commented Nov 14, 2024

Resolves: #180395

Summary

Supports rule type change when upgrading a rule to a newer version, covering scenarios where the current version's rule type differs from the target version. Regardless of the feature flag, the rule should be updated to the target version.

Behavior with Rule Customization OFF

No changes expected. A rule with a rule type change can be updated through:

  • The single rule update option ✅
  • The bulk update option ✅
  • The Update All option ✅

Behavior with Rule Customization ON

Regardless of whether the rule has customizations:

  • The rule cannot be updated using the single update option ❌
  • The rule is excluded from bulk updates ❌
  • The rule is excluded from Update All ❌
  • The rule can only be updated after manually reviewing changes via the update flyout ✅

The update flyout includes a warning message, advising users to back up any customizations the rule may have. The flyout is in read-only mode:

image

@xcrzx xcrzx self-assigned this Nov 14, 2024
@xcrzx xcrzx added release_note:skip Skip the PR/issue when compiling release notes v9.0.0 Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team backport:version Backport to applied version labels v8.17.0 labels Nov 14, 2024
@xcrzx xcrzx marked this pull request as ready for review November 14, 2024 15:14
@xcrzx xcrzx requested a review from a team as a code owner November 14, 2024 15:14
@xcrzx xcrzx requested a review from maximpn November 14, 2024 15:14
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@elasticmachine
Copy link
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #59 / Screenshots - serverless security UI response ops docs security cases security case settings case settings screenshot

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 6202 6203 +1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 13.4MB 13.4MB +1.0KB

History

cc @xcrzx

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport:version Backport to applied version labels release_note:skip Skip the PR/issue when compiling release notes Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.17.0 v9.0.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Security Solution] Implement UI for updating prebuilt rule to a new rule type (MVP)
3 participants