Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Implement overall rule diff algorithm #148189

Closed
2 tasks done
Tracked by #174167
banderror opened this issue Dec 29, 2022 · 3 comments · Fixed by #148392
Closed
2 tasks done
Tracked by #174167

[Security Solution] Implement overall rule diff algorithm #148189

banderror opened this issue Dec 29, 2022 · 3 comments · Fixed by #148392
Labels
Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.9.0

Comments

@banderror
Copy link
Contributor

banderror commented Dec 29, 2022 •
edited
Loading

Epic: https://github.com/elastic/security-team/issues/1974 (internal)
Related to: #144060

Summary

Implement the overall structure of the rule diff algorithm. Finalize the draft implementation made in #144060.

Todo

  • Initial implementation (PR)
  • Make base versions optional for diff calculation. We need to support this in order to be able to still show diffs for rule assets coming from packages without historical versions. (PR)
@banderror banderror added triage_needed Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area labels Dec 29, 2022
@banderror banderror self-assigned this Dec 29, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@banderror banderror mentioned this issue Jan 5, 2023
Closed
@banderror banderror mentioned this issue Jan 27, 2023
Merged
@banderror banderror linked a pull request Jan 27, 2023 that will close this issue
[Security Solution] Prebuilt rule upgrade and installation endpoints, initial implementation #148392
Merged
@banderror banderror mentioned this issue Jan 27, 2023
Closed
12 tasks
banderror added a commit that referenced this issue Mar 8, 2023
@banderror
[Security Solution] Prebuilt rule upgrade and installation endpoints,…
03cdec3 
… initial implementation (#148392)

**Addresses:** #148181,
#148182,
#148185
**Partially addresses:**
#148183,
#148189

## Summary

Based on the [POC](#144060), this
PR adds 4 endpoints for the new upgrade and installation workflows for
prebuilt rules:

- `GET /internal/detection_engine/prebuilt_rules/status`
- `POST /internal/detection_engine/prebuilt_rules/upgrade/_review`
- `POST /internal/detection_engine/prebuilt_rules/installation/_review`
- `POST /internal/detection_engine/prebuilt_rules/_generate_assets`
(temporary helper endpoint for development and testing)

The new endpoints are hidden behind a feature flag and can be enabled by
the following config setting:

```yaml
xpack.securitySolution.enableExperimental: ['prebuiltRulesNewUpgradeAndInstallationWorkflowsEnabled']
```

## In the next episodes

Will be done later in follow-up PRs:

- Implementation of some additional response properties for the
`upgrade/_review` endpoint:
  - #148183
- Making base versions optional for diff calculation (we need to support
this in order to be able to still show diffs for rule assets coming from
packages without historical versions):
  - #148189
- Further development of the diff algorithm:
  - #148191
- Test coverage:
  - #148192
bmorelli25 pushed a commit to bmorelli25/kibana that referenced this issue Mar 10, 2023
@banderror @bmorelli25
[Security Solution] Prebuilt rule upgrade and installation endpoints,…
ebc623a 
… initial implementation (elastic#148392)

**Addresses:** elastic#148181,
elastic#148182,
elastic#148185
**Partially addresses:**
elastic#148183,
elastic#148189

## Summary

Based on the [POC](elastic#144060), this
PR adds 4 endpoints for the new upgrade and installation workflows for
prebuilt rules:

- `GET /internal/detection_engine/prebuilt_rules/status`
- `POST /internal/detection_engine/prebuilt_rules/upgrade/_review`
- `POST /internal/detection_engine/prebuilt_rules/installation/_review`
- `POST /internal/detection_engine/prebuilt_rules/_generate_assets`
(temporary helper endpoint for development and testing)

The new endpoints are hidden behind a feature flag and can be enabled by
the following config setting:

```yaml
xpack.securitySolution.enableExperimental: ['prebuiltRulesNewUpgradeAndInstallationWorkflowsEnabled']
```

## In the next episodes

Will be done later in follow-up PRs:

- Implementation of some additional response properties for the
`upgrade/_review` endpoint:
  - elastic#148183
- Making base versions optional for diff calculation (we need to support
this in order to be able to still show diffs for rule assets coming from
packages without historical versions):
  - elastic#148189
- Further development of the diff algorithm:
  - elastic#148191
- Test coverage:
  - elastic#148192
@xcrzx xcrzx reopened this Mar 13, 2023
@xcrzx xcrzx assigned xcrzx and unassigned banderror Mar 13, 2023
@xcrzx xcrzx mentioned this issue Apr 6, 2023
Merged
xcrzx added a commit that referenced this issue Apr 19, 2023
@xcrzx
[Security Solution] Handle missing base versions during rule upgrade (#…
4e5ad09 
…154571)

**Resolves: #152836
**Resolves: #148183
**Resolves partially: #148189
@banderror banderror mentioned this issue Sep 13, 2023
Closed
2 tasks
@banderror
Copy link
Contributor Author

Moved leftovers to #166388

@banderror banderror mentioned this issue Jan 3, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.9.0
Projects
None yet
Milestone
No milestone
3 participants
@xcrzx @banderror @elasticmachine