Skip to content

[Security Solution] Implement rule upgrade concurrency control #200134

@xcrzx

Description

@xcrzx

Summary

The UpgradePrebuiltRulesTableContext currently doesn’t consider rule revisions and target versions. It's possible for users to start resolving rule upgrades in the UI while a new package version is installed in the background. In such cases, all user-resolved values should be invalidated to prevent potential issues. Without this, users may unknowingly apply updates to an outdated version, resulting in unpredictable outcomes and difficult-to-debug situations.

User-resolved values should be invalidated in the following situations:

  • A rule with a higher revision has been fetched. In this case, another user concurrently edited the rule
  • A target rule with a higher version has been fetched. In this case, a newer rule package version was installed asynchronously

Metadata

Metadata

Assignees

Labels

8.18 candidateFeature:Prebuilt Detection RulesSecurity Solution Prebuilt Detection Rules areaTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeambugFixes for quality problems that affect the customer experienceimpact:highAddressing this issue will have a high level of impact on the quality/strength of our product.v8.18.0

Type

No fields configured for Bug.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions