Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Add support for Fleet package with historical versions of prebuilt rules #148179

Closed
2 tasks done
Tracked by #174166
banderror opened this issue Dec 29, 2022 · 2 comments · Fixed by #148643
Closed
2 tasks done
Tracked by #174166
Assignees
Labels
8.7 candidate Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.7.0

Comments

@banderror
Copy link
Contributor

banderror commented Dec 29, 2022

Epic: https://github.com/elastic/security-team/issues/1974 (internal)

Summary

Add support for historical rule asset saved objects according to the data model chosen based on #144060. Adjust the code to support both the latest and historical rule assets at the same time, so we could release the security_detection_engine package with historical versions at any given time.

Todo

  • Figure out what should we do with existing security-rule saved objects.
  • Adjust the existing rules/prepackaged endpoints so that they could be used with both the latest and historical rule assets.

Details

Saved objects

Figure out what should we do with existing security-rule saved objects. Options:

  1. Keep existing security-rule saved objects type unchanged. There's a chance we could reuse it for storing historical rule assets without any modifications.
  2. Adjust existing security-rule saved objects type according to the needs, so it's capable of storing historical assets.
  3. Create a new saved objects type for historical assets.

Options 1 and 2 look more suitable for the flat data model. Option 3 looks more suitable for the composite data model.

Existing endpoints

Adjust the two existing rules/prepackaged endpoints so that they could be used with both the latest and historical rule assets.

The endpoints should determine which assets are stored based on the data in the assets. We could write some aggregation queries for that.

Keep the contract and the existing behavior of the endpoints unchanged regardless of what kind of data is stored under the hood.

@banderror banderror added triage_needed Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules labels Dec 29, 2022
@banderror banderror self-assigned this Dec 29, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
8.7 candidate Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.7.0
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants