[Security Rules] Update security rules package to v9.1.17 by tradebot-elastic · Pull Request #17746 · elastic/integrations

tradebot-elastic · 2026-03-11T04:10:10Z

What does this PR do?

Update the Security Rules package to version 9.1.17.
Autogenerated from commit https://github.com/elastic/detection-rules/tree/375f72291f0e585ed1c4fbfc4754517d6c61e1ad

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
~~I have verified that all data streams collect metrics or logs.~~
I have added an entry to my package's changelog.yml file.
If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^7.13.0).

Author's Checklist

Install the most recently release security rules in the Detection Engine
Install the package
Confirm the update is available in Kibana. Click "Update X rules" or "Install X rules"
Look at the changes made after the install and confirm they are consistent

How to test this PR locally

Perform the above checklist, and use package-storage to build EPR from source

Related issues

None

Screenshots

None

elasticmachine · 2026-03-11T05:04:52Z

💚 Build Succeeded

Buildkite Build
Commit: 236dfed

cc @shashank-elastic

elastic-vault-github-plugin-prod · 2026-03-11T06:45:30Z

Package security_detection_engine - 9.1.17 containing this change is available at https://epr.elastic.co/package/security_detection_engine/9.1.17/

…tion FTR tests (#257073) **Resolves: #256891 ## Summary This PR unskips the tests skipped in the scope of #256891. The failure was caused by publishing a malformed prebuilt rule in a **security_detection_engine** prerelease package version. The problem has been fixed in the release package version. ## Details The following **security_detection_engine** prerelease package versions have a malformed prebuilt rule - [9.3.5-beta.1](elastic/integrations#17735) - [9.2.9-beta.1](elastic/integrations#17734) - [9.1.17-beta.1](elastic/integrations#17733) - [8.19.17-beta.1](elastic/integrations#17732) `First Time Seen DNS Query to RMM Domain` (rule_id = `e5f6a7b8-c9d0-8e1f-2a3b-4c5d6e7f8a9b`) in those package versions has a small history window size. The failed functional test installs all prebuilt rules. And the error `params invalid: History window size is smaller than rule interval + additional lookback, 'historyWindowStart' must be earlier than 'from'` gets thrown upon this rule installation. The problem has been fixed and the tests pass for the following prerelese and release versions - [9.3.5-beta.2](elastic/integrations#17740) released [9.3.5](elastic/integrations#17749) - [9.2.9-beta.2](elastic/integrations#17739) released [9.2.9](elastic/integrations#17747) - [9.1.17-beta.2](elastic/integrations#17738) released [9.1.17](elastic/integrations#17746) - [8.19.17-beta.2](elastic/integrations#17737) released [8.19.17](elastic/integrations#17745) This PR unskips previously skipped in the scope of #256891 FTR tests. On top of that this PR improves related debug logging message to be able to faster troubleshoot similar issues in the future. An example error message looks like ```` createPrebuiltRules: Creating prebuilt rules - done. Rules created: 1532. Rules failed to create: 1. Errors: [{"rule_id":"e5f6a7b8-c9d0-8e1f-2a3b-4c5d6e7f8a9b","ruleName":"First Time Seen DNS Query to RMM Domain","error":"params invalid: History window size is smaller than rule interval + additional lookback, 'historyWindowStart' must be earlier than 'from'"}] ````

…tion FTR tests (elastic#257073) **Resolves: elastic#256891 ## Summary This PR unskips the tests skipped in the scope of elastic#256891. The failure was caused by publishing a malformed prebuilt rule in a **security_detection_engine** prerelease package version. The problem has been fixed in the release package version. ## Details The following **security_detection_engine** prerelease package versions have a malformed prebuilt rule - [9.3.5-beta.1](elastic/integrations#17735) - [9.2.9-beta.1](elastic/integrations#17734) - [9.1.17-beta.1](elastic/integrations#17733) - [8.19.17-beta.1](elastic/integrations#17732) `First Time Seen DNS Query to RMM Domain` (rule_id = `e5f6a7b8-c9d0-8e1f-2a3b-4c5d6e7f8a9b`) in those package versions has a small history window size. The failed functional test installs all prebuilt rules. And the error `params invalid: History window size is smaller than rule interval + additional lookback, 'historyWindowStart' must be earlier than 'from'` gets thrown upon this rule installation. The problem has been fixed and the tests pass for the following prerelese and release versions - [9.3.5-beta.2](elastic/integrations#17740) released [9.3.5](elastic/integrations#17749) - [9.2.9-beta.2](elastic/integrations#17739) released [9.2.9](elastic/integrations#17747) - [9.1.17-beta.2](elastic/integrations#17738) released [9.1.17](elastic/integrations#17746) - [8.19.17-beta.2](elastic/integrations#17737) released [8.19.17](elastic/integrations#17745) This PR unskips previously skipped in the scope of elastic#256891 FTR tests. On top of that this PR improves related debug logging message to be able to faster troubleshoot similar issues in the future. An example error message looks like ```` createPrebuiltRules: Creating prebuilt rules - done. Rules created: 1532. Rules failed to create: 1. Errors: [{"rule_id":"e5f6a7b8-c9d0-8e1f-2a3b-4c5d6e7f8a9b","ruleName":"First Time Seen DNS Query to RMM Domain","error":"params invalid: History window size is smaller than rule interval + additional lookback, 'historyWindowStart' must be earlier than 'from'"}] ```` (cherry picked from commit 9370986)

…tion FTR tests (#257073) **Resolves: #256891 ## Summary This PR unskips the tests skipped in the scope of #256891. The failure was caused by publishing a malformed prebuilt rule in a **security_detection_engine** prerelease package version. The problem has been fixed in the release package version. ## Details The following **security_detection_engine** prerelease package versions have a malformed prebuilt rule - [9.3.5-beta.1](elastic/integrations#17735) - [9.2.9-beta.1](elastic/integrations#17734) - [9.1.17-beta.1](elastic/integrations#17733) - [8.19.17-beta.1](elastic/integrations#17732) `First Time Seen DNS Query to RMM Domain` (rule_id = `e5f6a7b8-c9d0-8e1f-2a3b-4c5d6e7f8a9b`) in those package versions has a small history window size. The failed functional test installs all prebuilt rules. And the error `params invalid: History window size is smaller than rule interval + additional lookback, 'historyWindowStart' must be earlier than 'from'` gets thrown upon this rule installation. The problem has been fixed and the tests pass for the following prerelese and release versions - [9.3.5-beta.2](elastic/integrations#17740) released [9.3.5](elastic/integrations#17749) - [9.2.9-beta.2](elastic/integrations#17739) released [9.2.9](elastic/integrations#17747) - [9.1.17-beta.2](elastic/integrations#17738) released [9.1.17](elastic/integrations#17746) - [8.19.17-beta.2](elastic/integrations#17737) released [8.19.17](elastic/integrations#17745) This PR unskips previously skipped in the scope of #256891 FTR tests. On top of that this PR improves related debug logging message to be able to faster troubleshoot similar issues in the future. An example error message looks like ```` createPrebuiltRules: Creating prebuilt rules - done. Rules created: 1532. Rules failed to create: 1. Errors: [{"rule_id":"e5f6a7b8-c9d0-8e1f-2a3b-4c5d6e7f8a9b","ruleName":"First Time Seen DNS Query to RMM Domain","error":"params invalid: History window size is smaller than rule interval + additional lookback, 'historyWindowStart' must be earlier than 'from'"}] ````

…tion FTR tests (elastic#257073) **Resolves: elastic#256891 ## Summary This PR unskips the tests skipped in the scope of elastic#256891. The failure was caused by publishing a malformed prebuilt rule in a **security_detection_engine** prerelease package version. The problem has been fixed in the release package version. ## Details The following **security_detection_engine** prerelease package versions have a malformed prebuilt rule - [9.3.5-beta.1](elastic/integrations#17735) - [9.2.9-beta.1](elastic/integrations#17734) - [9.1.17-beta.1](elastic/integrations#17733) - [8.19.17-beta.1](elastic/integrations#17732) `First Time Seen DNS Query to RMM Domain` (rule_id = `e5f6a7b8-c9d0-8e1f-2a3b-4c5d6e7f8a9b`) in those package versions has a small history window size. The failed functional test installs all prebuilt rules. And the error `params invalid: History window size is smaller than rule interval + additional lookback, 'historyWindowStart' must be earlier than 'from'` gets thrown upon this rule installation. The problem has been fixed and the tests pass for the following prerelese and release versions - [9.3.5-beta.2](elastic/integrations#17740) released [9.3.5](elastic/integrations#17749) - [9.2.9-beta.2](elastic/integrations#17739) released [9.2.9](elastic/integrations#17747) - [9.1.17-beta.2](elastic/integrations#17738) released [9.1.17](elastic/integrations#17746) - [8.19.17-beta.2](elastic/integrations#17737) released [8.19.17](elastic/integrations#17745) This PR unskips previously skipped in the scope of elastic#256891 FTR tests. On top of that this PR improves related debug logging message to be able to faster troubleshoot similar issues in the future. An example error message looks like ```` createPrebuiltRules: Creating prebuilt rules - done. Rules created: 1532. Rules failed to create: 1. Errors: [{"rule_id":"e5f6a7b8-c9d0-8e1f-2a3b-4c5d6e7f8a9b","ruleName":"First Time Seen DNS Query to RMM Domain","error":"params invalid: History window size is smaller than rule interval + additional lookback, 'historyWindowStart' must be earlier than 'from'"}] ````

[Security Rules] Update security rules package to v9.1.17

d0dfc29

tradebot-elastic assigned shashank-elastic Mar 11, 2026

Add changelog entry for 9.1.17

236dfed

shashank-elastic added enhancement New feature or request Integration:security_detection_engine Prebuilt Security Detection Rules labels Mar 11, 2026

shashank-elastic approved these changes Mar 11, 2026

View reviewed changes

shashank-elastic marked this pull request as ready for review March 11, 2026 04:11

shashank-elastic requested a review from a team as a code owner March 11, 2026 04:11

shashank-elastic enabled auto-merge (squash) March 11, 2026 04:11

shashank-elastic merged commit ce91111 into backport-security_detection_engine-9.1 Mar 11, 2026
11 checks passed

shashank-elastic deleted the detection-rules/9.1.17-375f72291 branch March 11, 2026 05:04

maximpn mentioned this pull request Mar 11, 2026

[Security Solution] Unskip security_detection_engine package installation FTR tests elastic/kibana#257073

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Rules] Update security rules package to v9.1.17#17746

[Security Rules] Update security rules package to v9.1.17#17746
shashank-elastic merged 2 commits into
backport-security_detection_engine-9.1from
detection-rules/9.1.17-375f72291

tradebot-elastic commented Mar 11, 2026

Uh oh!

elasticmachine commented Mar 11, 2026

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Mar 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

tradebot-elastic commented Mar 11, 2026

What does this PR do?

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

elasticmachine commented Mar 11, 2026

💚 Build Succeeded

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Mar 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants