Epic: https://github.com/elastic/security-team/issues/1974 (internal)
Milestones: << • >>

Summary

Milestone 1: Release the package with historical versions of prebuilt rules. Add support for it in the app, but preserve the existing API, UI, and behavior.

This meta ticket is created to simplify tracking of various tickets related to the epic, and to make this public information so our users can track the progress.

Useful info: Prebuilt Rules Customization Technical Design

Implementation tasks

Technical design

• [Security Solution] Architecture design for prebuilt rules customization #125665
• [Security Solution] PoC of Prebuilt Detection Rules package with historical versions #137420
• [Security Solution] PoC of the rule upgrade workflow #137446
• Finalize and share Prebuilt Rules Customization Technical Design

Separating rule versions and revisions

• [Security Solution] Separate rule versions and revisions #136213
• [ResponseOps] Add revision field support to Alerting framework rules #137164
• [Security Solution] Remove logic that bumps rule version on every change #137168
• [Security Solution] Remove version column from the Rules table #148196

Removing filesystem rules

• [Security Solution] Remove filesystem detection rules in favor of a bundled Fleet package #139926
• [Security Solution] Support testing of prerelease detection rules with Kibana #147466
• [FR] Update existing release process for removed file system rules detection-rules#2386
• https://github.com/elastic/ia-trade-team/issues/17
• https://github.com/elastic/package-storage-infra/issues/370

Fleet package with historical versions of prebuilt rules

• https://github.com/elastic/ia-trade-team/issues/69
• [Fleet] Packages with a large number of saved objects in them cause Kibana to crash #147695
• [Fleet] Remove the mapping for the nested istalled_kibana field #148174
• [Fleet] Error when importing more than 10000 saved objects in a Fleet package #148175
• [Change Proposal] Allow security_rule objects to have rule IDs different from the object IDs package-spec#459
• [Security Solution] Ensure full test coverage for existing workflows of installing and upgrading prebuilt rules #148176
• [Security Solution] Add support for Fleet package with historical versions of prebuilt rules #148179