[RAM] Adds revision to alerts schema #151388
Conversation
|
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
There was a problem hiding this comment.
It looks like o11y (@simianhacker) is ok to add this new field on the alert index and response ops is ok with it. I am still wondering the use case/feature for adding revision in the alert index. Can you give me some light? @paulewing
thinking a little bit more about it, I will know that this alert has been detected with this rule revisions and we might be able to explain the reason of why this happen or not thanks to our detection engineer that are updating our pre-package rules. All good!
Yeah, the traceability through the system enables some nice opportunities like:
Obviously more of this power comes when storing (or at least writing to the audit log) user rule revision changes, but this is a start and will be helpful in support scenarios from the get-go. |
There was a problem hiding this comment.
Perfect, thank you @spong!
I tested it locally and reviewed the diff. Everything LGTM. The only super minor issue I noticed is this unknown field in the alert details flyout:
I thought maybe the alerts index mappings were not updated, but after checking them I found the revision field in the technical component template and in the concrete alerts index. In the end, I fixed this by reloading the page, so this feels like something related to caching fields data. We can probably safely ignore this.
💛 Build succeeded, but was flaky
Failed CI Steps
Test Failures
Metrics [docs]Public APIs missing comments
Async chunks
Public APIs missing exports
Page load bundle
Unknown metric groupsAPI count
ESLint disabled line counts
Total ESLint disabled count
History
To update your PR or re-run it, just comment with: cc @spong |
## Summary Follow up from elastic#147398, which adds `revision` to the alerts schema so the rule's current revision is included when creating alerts. In Security Solution: <p align="center"> <img width="500" src="https://user-images.githubusercontent.com/2946766/227386305-c8afe295-b79b-4b28-838a-cc3bed0f3eda.png" /> </p> In Observability: <p align="center"> <img width="500" src="https://user-images.githubusercontent.com/2946766/227577019-05307860-e0e3-4e1e-b4cf-604bdb52afdf.png" /> </p> Note: this was originally a branched off elastic#147398, so the large commit list is resulting from there as Github doesn't seem to re-write after after a rebase w/ `main` and a force push. ### Checklist Delete any items that are not applicable to this PR. - [ ] ~[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials~ * Base docs to be added for elastic#147398 - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
## Summary Follow on from #151388 & #147398, which includes the rule's current `revision` when writing to the kibana event-log. Note: Added as `kibana.alert.rule.revision` instead of as ECS field `rule.version` as the [ECS docs](https://www.elastic.co/guide/en/ecs/current/ecs-rule.html#field-rule-version) conflate `version` & `revision` and figured it was best to be explicit. If we do indeed want to use `rule.version` I'll make the change. <p align="center"> <img width="500" src="https://user-images.githubusercontent.com/2946766/233216775-f371f412-dcf6-4ef7-a396-84ec853eebbb.png" /> </p> ### Checklist Delete any items that are not applicable to this PR. - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
Summary
Follow up from #147398, which adds
revisionto the alerts schema so the rule's current revision is included when creating alerts.In Security Solution:
In Observability:
Note: this was originally a branched off #147398, so the large commit list is resulting from there as Github doesn't seem to re-write after after a rebase w/
mainand a force push.Checklist
Delete any items that are not applicable to this PR.
Documentation was added for features that require explanation or tutorials