Skip to content

[Security Solution] Required fields are getting erased on rule PATCH #199665

@xcrzx

Description

@xcrzx

Summary

After sending a PATCH update to any rule that includes the required_fields field, the field is being erased.

For example, I have a prebuilt rule with required fields:

GET /api/detection_engine/rules?id=e9c05e3b-ca79-4d61-bd9a-44995b8f762d
{
    "id": "e9c05e3b-ca79-4d61-bd9a-44995b8f762d",
    "required_fields": [
        {
            "name": "event.action",
            "type": "keyword",
            "ecs": true
        },
       // ...
    ],
  //... other fields
}

I send a PATCH request to update its description:

PATCH /api/detection_engine/rules
{
    "id": "e9c05e3b-ca79-4d61-bd9a-44995b8f762d",
    "description": "Slightly updated description"
}

After the PATCH, I retrieve the rule and find the required fields are missing:

GET /api/detection_engine/rules?id=e9c05e3b-ca79-4d61-bd9a-44995b8f762d
{
    "id": "e9c05e3b-ca79-4d61-bd9a-44995b8f762d",
    "required_fields": [],
  //... other fields
}

Metadata

Metadata

Assignees

Labels

8.17 candidateFeature:Rule ManagementSecurity Solution Detection Rule Management areaTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeambugFixes for quality problems that affect the customer experienceimpact:mediumAddressing this issue will have a medium level of impact on the quality/strength of our product.v8.16.1v8.17.0v9.0.0

Type

No fields configured for Bug.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions