Removing detection rules from the lmd package
#7901
Conversation
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
| @@ -25,7 +25,7 @@ source: | |||
| script: | |||
| source: "if (doc['host.ip'].size()!=0){emit(doc['host.ip'][1]);} else{emit('None');}" | |||
| dest: | |||
| index: "ml-rdp-lmd-1.0.2" | |||
| index: "ml-rdp-lmd" | |||
There was a problem hiding this comment.
Is the expectation for subsequent higher versions (say in 3.0.0) that this version' destination index should be deleted? If the results from this transform might be helpful to keep in the future, we recommend appending the fleet transform version to the dest index's name, and adding aliases.
Reason I'm noting this when user upgrade to a higher version in the future, Fleet does not delete ml-rdp-lmd, so we will need to make sure teh dest.index of that future version is different.
There was a problem hiding this comment.
I removed the version as this transform ingests all the data in a users' environment, so, the upgrade will not affect the data collection at all. Also, tested it locally by bumping the fleet version (2.1.0) and can confirm that the data remains unchanged, only the name of the underlying transform i.e., logs-lmd.pivot_transform-default-2.0.0 changes to logs-lmd.pivot_transform-default-2.1.0.
There was a problem hiding this comment.
Any reason to believe that fleet will delete the dest.index? I haven't seen it while testing!
There was a problem hiding this comment.
@qn895 @sodhikirti07 Did y'all reach a consensus on this? This PR is ready to merge pending y'all's 🟢 .
There was a problem hiding this comment.
Sorry @sodhikirti07, I meant to clarify that Fleet will NOT delete the dest.index of the old version, so in case there's any incompatibility in the future. But if we have tested potential future upgrades and found that the current package works well then that's great. The rest LGTM 🎉
There was a problem hiding this comment.
Approving as I've already tested dest.index name for upgrades. Thank you @qn895 for taking a look!
|
Transform changes LGTM 🎉 |
|
Keeping this open until a new Detection Engine release goes out. Please do not merge. |
|
Package lmd - 2.0.0 containing this change is available at https://epr.elastic.co/search?package=lmd |
What does this PR do?
This PR moves detection rules associated with Lateral Movement Detection (lmd) out of the integration package.
Checklist
changelog.ymlfile.How to test this PR locally
Lateral Movement Detectiontag show up on the Rules Management page under SecurityRelated Issues
Not linking since these are internal issues
Screenshots
2.0.0