[Detection Engine] Adds 8.4 rules #138574

brokensound77 · 2022-08-10T21:53:26Z

Summary

Pull updates to detection rules from https://github.com/elastic/detection-rules/tree/395ae2c1d1e1d93ea7520300d4fb5000c58ae870.

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines,
uses sentence case text and includes i18n support

vitaliidm · 2022-08-11T16:02:52Z

@brokensound77 , I've prepared a PR (#138625), which once merged should allow tests in your PR to pass.

terrancedejesus · 2022-08-11T16:06:18Z

@brokensound77 , I've prepared a PR (#138625), which once merged should allow tests in your PR to pass.

@vitaliidm thank you so much for looking into this and finding a solution. Justin will be at DefCon this week and I will be handling the rest of the detection rules release. Please let me know if there is anything I can do.

When your PR merges I will re-run the tests and hopefully they pass. Thanks again!

vitaliidm · 2022-08-12T11:15:24Z

While playing around with the updated prebuilt rules, noticed: when duplicating rules, duplicated rules are getting created without required fields, integrations and setup fields

Screen.Recording.2022-08-12.at.12.05.27.mov

cc: @banderror , is this behaviour intentional or something we will need to fix later?

banderror · 2022-08-12T15:25:32Z

@vitaliidm This behavior is expected. Users can't edit them (there's no UI for these fields on the Rule Creation and Editing pages), so the decision was to reset them to empty values in this case. Once we add support for editing them, we will need to remove this logic.

vitaliidm

@terrancedejesus , PR mentioned above is merged. Hopefully all tests will pass, I've triggered build to verify it.

Since @banderror addressed my comment before, I don't see any issues and approving changes

… update (elastic#138625) ## Summary fixes tests related to prebuilt rules update tests failures(elastic#138574 (comment)): - removed hardcoded rule version value - required_fields are not tested agains empty array, but agains actual immutable rule value (cherry picked from commit 800cc72)

… update (elastic#138625) ## Summary fixes tests related to prebuilt rules update tests failures(elastic#138574 (comment)): - removed hardcoded rule version value - required_fields are not tested agains empty array, but agains actual immutable rule value

Mikaayenson

LGTM

terrancedejesus · 2022-08-12T17:45:54Z

@terrancedejesus , PR mentioned above is merged. Hopefully all tests will pass, I've triggered build to verify it.

Since @banderror addressed my comment before, I don't see any issues and approving changes

Hey @vitaliidm thank you so much for getting that PR merged and re-running the checks. The Kibana updates look great to see them in an actual stack with the rules!

Waiting for these checks to pass and then I will go ahead and merge. Thanks everyone!

terrancedejesus · 2022-08-12T18:01:02Z

@elasticmachine merge upstream

terrancedejesus · 2022-08-15T12:49:35Z

@vitaliidm any additional information on the new errors for FTR configs #23? I believe this check passed before. Thank you in advance!

vitaliidm · 2022-08-15T14:29:28Z

@vitaliidm any additional information on the new errors for FTR configs #23? I believe this check passed before. Thank you in advance!

another fix is on its way. This test didn't fail, as CI test job exits on first test failed, so it doesn't show the rest of failures

…rules update elastic#138794 - fixes the rest of tests for elastic#138574 PR (cherry picked from commit 167bb8e)

…rules update elastic#138794 - fixes the rest of tests for elastic#138574 PR

terrancedejesus · 2022-08-15T16:14:49Z

another fix is on its way. This test didn't fail, as CI test job exits on first test failed, so it doesn't show the rest of failures

Ah alright that makes sense, thanks for the insight. Is this the PR for that? I want to make sure I include this information in our overall tracking issue outside of this.

kibana-ci · 2022-08-15T16:59:23Z

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

💔 Build #65031 failed 1ece078
💔 Build #64905 failed 1882f73
💔 Build #64900 failed a2b097c
💔 Build #64416 failed 9a0c3d9

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @terrancedejesus

vitaliidm · 2022-08-15T17:02:30Z

Ah alright that makes sense, thanks for the insight. Is #138832 the PR for that? I want to make sure I include this information in our overall tracking issue outside of this.

@terrancedejesus, correct

Meanwhile all tests have passed and PR is ready to be merged

terrancedejesus · 2022-08-15T18:05:12Z

Ah alright that makes sense, thanks for the insight. Is #138832 the PR for that? I want to make sure I include this information in our overall tracking issue outside of this.

@terrancedejesus, correct

Meanwhile all tests have passed and PR is ready to be merged

Wow thanks for the fast turnaround and solution implementation on this! Merging now.

Co-authored-by: Vitalii Dmyterko <92328789+vitaliidm@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> (cherry picked from commit 3021824)

kibanamachine · 2022-08-15T18:09:39Z

💚 All backports created successfully

Status	Branch	Result
✅	8.4

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation and see the Github Action logs for details

Co-authored-by: Vitalii Dmyterko <92328789+vitaliidm@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> (cherry picked from commit 3021824) Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

… update (elastic#138625) ## Summary fixes tests related to prebuilt rules update tests failures(elastic#138574 (comment)): - removed hardcoded rule version value - required_fields are not tested agains empty array, but agains actual immutable rule value

…rules update elastic#138794 - fixes the rest of tests for elastic#138574 PR

Co-authored-by: Vitalii Dmyterko <92328789+vitaliidm@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

[Detection Rules] Add 8.4 rules

9a0c3d9

brokensound77 requested a review from a team as a code owner August 10, 2022 21:53

brokensound77 added release_note:skip Skip the PR/issue when compiling release notes auto-backport Deprecated - use backport:version if exact versions are needed v8.4.0 labels Aug 10, 2022

terrancedejesus mentioned this pull request Aug 11, 2022

[Detection Engine] Adds 8.4 rules #138515

Closed

1 task

terrancedejesus requested review from vitaliidm and a team August 11, 2022 00:32

terrancedejesus self-assigned this Aug 11, 2022

vitaliidm mentioned this pull request Aug 11, 2022

[Security Solution][Detections] fixes tests related to prebuilt rules update #138625

Merged

Merge branch 'main' into detection-rules/8.4-395ae2c1

df72607

vitaliidm approved these changes Aug 12, 2022

View reviewed changes

Mikaayenson approved these changes Aug 12, 2022

View reviewed changes

kibanamachine and others added 3 commits August 12, 2022 14:01

Merge branch 'main' into detection-rules/8.4-395ae2c1

a2b097c

Merge branch 'main' into detection-rules/8.4-395ae2c1

1882f73

Merge branch 'main' into detection-rules/8.4-395ae2c1

1ece078

vitaliidm mentioned this pull request Aug 15, 2022

[Security Solution][Detections] fixes failing tests for 8.4 prebuilt rules update #138794

Merged

Merge branch 'main' into detection-rules/8.4-395ae2c1

7245788

kibanamachine pushed a commit to rahuldimri/kibana that referenced this pull request Aug 15, 2022

[Security Solution][Detections] fixes failing tests for 8.4 prebuilt …

167bb8e

…rules update elastic#138794 - fixes the rest of tests for elastic#138574 PR

terrancedejesus merged commit 3021824 into elastic:main Aug 15, 2022

kibanamachine mentioned this pull request Aug 15, 2022

[8.4] [Detection Rules] Add 8.4 rules (#138574) #138840

Merged

terrancedejesus mentioned this pull request Aug 18, 2022

[Bug] Pre-Built Detection Rules Package Versioning elastic/detection-rules#2251

Closed

5 tasks

Mpdreamz pushed a commit to Mpdreamz/kibana that referenced this pull request Sep 6, 2022

[Security Solution][Detections] fixes failing tests for 8.4 prebuilt …

21a7731

…rules update elastic#138794 - fixes the rest of tests for elastic#138574 PR

terrancedejesus mentioned this pull request Sep 8, 2022

[Security Solution] Remove filesystem detection rules in favor of a bundled Fleet package #139926

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Detection Engine] Adds 8.4 rules #138574

[Detection Engine] Adds 8.4 rules #138574

brokensound77 commented Aug 10, 2022

vitaliidm commented Aug 11, 2022

terrancedejesus commented Aug 11, 2022

vitaliidm commented Aug 12, 2022

banderror commented Aug 12, 2022

vitaliidm left a comment

Mikaayenson left a comment

terrancedejesus commented Aug 12, 2022

terrancedejesus commented Aug 12, 2022

terrancedejesus commented Aug 15, 2022 •

edited

Loading

vitaliidm commented Aug 15, 2022

terrancedejesus commented Aug 15, 2022 •

edited

Loading

kibana-ci commented Aug 15, 2022

vitaliidm commented Aug 15, 2022 •

edited

Loading

terrancedejesus commented Aug 15, 2022

kibanamachine commented Aug 15, 2022

[Detection Engine] Adds 8.4 rules #138574

[Detection Engine] Adds 8.4 rules #138574

Conversation

brokensound77 commented Aug 10, 2022

Summary

Checklist

vitaliidm commented Aug 11, 2022

terrancedejesus commented Aug 11, 2022

vitaliidm commented Aug 12, 2022

banderror commented Aug 12, 2022

vitaliidm left a comment

Choose a reason for hiding this comment

Mikaayenson left a comment

Choose a reason for hiding this comment

terrancedejesus commented Aug 12, 2022

terrancedejesus commented Aug 12, 2022

terrancedejesus commented Aug 15, 2022 • edited Loading

vitaliidm commented Aug 15, 2022

terrancedejesus commented Aug 15, 2022 • edited Loading

kibana-ci commented Aug 15, 2022

💚 Build Succeeded

Metrics [docs]

History

vitaliidm commented Aug 15, 2022 • edited Loading

terrancedejesus commented Aug 15, 2022

kibanamachine commented Aug 15, 2022

💚 All backports created successfully

Questions ?

terrancedejesus commented Aug 15, 2022 •

edited

Loading

terrancedejesus commented Aug 15, 2022 •

edited

Loading

vitaliidm commented Aug 15, 2022 •

edited

Loading