Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Implement prebuilt rule installation/_perform API endpoint #148186

Closed
Tracked by #174167
banderror opened this issue Dec 29, 2022 · 2 comments · Fixed by #155517
Closed
Tracked by #174167

[Security Solution] Implement prebuilt rule installation/_perform API endpoint #148186

banderror opened this issue Dec 29, 2022 · 2 comments · Fixed by #155517
Assignees
Labels
8.9 candidate Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.

Comments

@banderror
Copy link
Contributor

banderror commented Dec 29, 2022

Epic: https://github.com/elastic/security-team/issues/1974 (internal)
Related to: #144060, #148181

Summary

Based on the API design made in #144060, implement the new rule installation/_perform API endpoint and hide it behind the feature flag.

POST /internal/detection_engine/prebuilt_rules/installation/_perform

Request body:

export interface PerformRuleInstallationRequestBody {
  mode: `ALL_RULES` | `SPECIFIC_RULES`;
  rules: RuleVersionSpecifier[]; // required if mode is `SPECIFIC_RULES`
}

export interface RuleVersionSpecifier {
  rule_id: RuleSignatureId;

  /**
   * This parameter is needed for handling race conditions with Optimistic Concurrency Control.
   * Two or more users can call installation/_review and installation/_perform endpoints concurrently.
   * Also, in general the time between these two calls can be anything.
   * The idea is to only allow the user to install a rule if the user has reviewed the exact version
   * of it that had been returned from the _review endpoint. If the version changed on the BE,
   * installation/_perform endpoint will return a version mismatch error for this rule.
   */
  version: SemanticVersion;
}

Response body:

export interface PerformRuleInstallationResponseBody {
  summary: {
    total: number;
    succeeded: number;
    skipped: number;
    failed: number;
  };
  results: {
    created: RuleResponse[];
    skipped: Array<{
      rule_id: RuleSignatureId;
      reason: 'RULE_INSTALLED';
    }>;
  };
  errors: AggregatedPrebuiltRuleError[];
}

interface AggregatedPrebuiltRuleError {
  message: string;
  status_code?: number;
  rules: Array<{
    rule_id: string;
    name?: string;
  }>;
}
@banderror banderror added triage_needed Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules labels Dec 29, 2022
@banderror banderror self-assigned this Dec 29, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@banderror banderror changed the title [Security Solution] Implement the new rule installation/_perform API endpoint [Security Solution] Implement the new prebuilt rule installation/_perform API endpoint Dec 29, 2022
@banderror banderror changed the title [Security Solution] Implement the new prebuilt rule installation/_perform API endpoint [Security Solution] Implement prebuilt rule installation/_perform API endpoint Dec 29, 2022
@banderror banderror removed their assignment Feb 22, 2023
xcrzx added a commit that referenced this issue May 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
8.9 candidate Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants