-
Notifications
You must be signed in to change notification settings - Fork 8.6k
[Security Solution] DetectionRulesClient refactoring. Part 2 #184364
Copy link
Copy link
Closed
Labels
8.16 candidateFeature:Rule ManagementSecurity Solution Detection Rule Management areaSecurity Solution Detection Rule Management areaTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeamSecurity Detection Response Teamrefactoringv8.15.0v8.16.0
Metadata
Metadata
Assignees
Labels
8.16 candidateFeature:Rule ManagementSecurity Solution Detection Rule Management areaSecurity Solution Detection Rule Management areaTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeamSecurity Detection Response Teamrefactoringv8.15.0v8.16.0
Type
Fields
Give feedbackNo fields configured for issues without a type.
Epics: https://github.com/elastic/security-team/issues/1974 (internal), #174168
Follow-up to: #180128
Summary
We need to finalize the
DetectionRulesClient(formerly known asRulesManagementClient) refactoring and address the remaining comments left after the initial PR: #182802.PRs
PR 1 (merged)
DetectionRulesClientPR 2 (merged)
withSecuritySpan(comment)_) outside of the main client implementation for better code readability.PR 3 (merged)
DetectionRulesClientcontaining directory fromrule_managementtodetection_rules_clientDetectionRulesClientmethods into thedetection_rules_client/methodsdirDetectionRulesClientinto a separate filedetection_rules_client_interface.tsimportRulemethod parametersgetDetectionRulesClientPR 4 (merged)
PrebuiltRuleAssettype withRuleCreatePropsandRulePatchPropsinupgradePrebuiltRuleandcreatePrebuiltRuleRuleAlertTypefromRulesManagementClient(see this comment). Transition to returningRuleResponsefor these methods:createCustomRuleandcreatePrebuiltRulePR 5 (merged)
RuleAlertTypefromRulesManagementClient(see this comment). Transition to returningRuleResponsefor the remaining methods:updateRule,patchRule,deleteRule,upgradePrebuiltRuleandimportRule.toggleRuleEnabledOnUpdatereturnenabledand then use it in return valueupgradePrebuiltRuleenable behaviour - there might be a bug (place in code). Check if we need to explicitly toggle "enabled" on upgrade.PR 6 (in review)
rule_management/normalization/rule_converters) inside the new rules management client. Check how the converters are used outside the client to see if we can encapsulate them inside the client.RuleResponseand throws an error into a function (comment)Left to do
Leftovers moved to #187656.