-
Notifications
You must be signed in to change notification settings - Fork 8.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Security Solution][Platform] - Step 4 of SO migrations, marking as share capable #114548
Comments
Pinging @elastic/security-solution (Team: SecuritySolution) |
Confirmed with @michaelolo24 that timeline SOs have been made "share-capable". cc @jonathan-buttner |
For reference: #113552 |
Also (thanks Mike) - cases is all set here as well ✅ |
NOTE: |
NOTE: |
@yctercero I'm about to start looking into this for things associated with Artifacts and Exceptions (for trusted apps, event filters) and want to confirm: Our artifacts and exceptions SOs are all space agnostic, does that mean we don't have to do anything? 😁 |
Hi @yctercero , Here is an update for SO types:
Both of these SO types are These, as well as |
We confirmed that's true, for |
PR to update our |
I spoke to @rylnd about the
With that in mind, I don't think we need to convert these to become share-capable, we can leave them as isolated ( |
… action status, and exception lists multiple space shareable (#115427) ## Summary See #114548 Makes the following saved objects multiple-isolated: * siem-detection-engine-rule-status * exception-list * siem-detection-engine-rule-actions ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
Closing out as it seems all SOs have been taken care of. Thanks everyone! |
As part of 8.0 SO migrations need to mark certain SOs as "share capable".
See docs https://www.elastic.co/guide/en/kibana/master/sharing-saved-objects.html
An example PR of this is here.
Security Solution SOs can be found here.
So what's it means for our SOs? Alerting has marked rules as share-capable, does this mean all our SOs need to now be made share-capable as well?
Do agnostic ones need to be marked?
siem-detection-engine-rule-actions
exception-list-agnostic
references
[Update - were migrated]exception-list
siem-detection-engine-rule-status
security-rule
agnostic
and so don't need to be touched for 8.0endpoint:user-artifact-manifest
@peluja1012@paul-tavares followupendpoint:user-artifact
@peluja1012@paul-tavares followupsecurity-solution-signals-migration
The text was updated successfully, but these errors were encountered: