Epic: https://github.com/elastic/security-team/issues/1974 (internal)
Milestones: << • >>
Milestone 3: #174168

Status: Done.

Summary

This is a part of Milestone 3 epic and was extracted from it because there were too many issues that started to cause glitches.

Please find the rest of Milestone 3 issues in #174168.

Bugs

Bugs: rule editing and customization

• [Security Solution] Rule's EQL query validation fails unexpectedly when fields missing #178611
• [Security Solution] Rules mistakenly marked as customized #199629 (comment)
• [Security Solution] Required fields are getting erased on rule PATCH #199665
• [Security Solution] Prebuilt rules with missing base version are marked as customized on edit #201632
• [Security Solution] “Author” and “License” Fields Are Editable in UI but Result in Errors When Updated #200251
• [Security Solution] Validation for Invalid Field Inputs in Advanced Settings Is Bypassed #200830
• [Security Solution] Prebuilt rules marked as customized after applying updates #201631
• [Security Solution] Prebuilt rules marked as customized on upgrade when updating the package from 8.16.2-beta.1 to 8.16.2 #202575
• [Security Solution] is_customized Flag is Set to True When Reverting Changes to Prebuilt Rules #203151
• [Security Solution] Bulk action confirmation dialog should not mention "custom" rules #203149
• [Security Solution] Custom Query field overflows the viewport and cannot be completely visualized or edited when the query is too long #178615
• [Security Solution] Prebuilt Rule Marked as Customized By Just Clicking "Edit rule settings" And Clicking Save Without Any Changes #203315
• [Security Solution] Prebuilt Rule Incorrectly Marked as Customized After Adding a Rule Exception #203011
• [Security Solution] Adding Actions to Prebuilt Rules Incorrectly Marks Them as Customized #203484
• [Security Solution] Incorrect is_customized Value on Re-Import of Non-Customized Prebuilt Rule #202613
• [Security Solution] Prebuilt Rule with query filters incorrectly marked as customized after saving without changes #206527
• [Security Solution] Rule incorrectly retains customized status after reverting MITRE ATT&CK changes #208251
• [Security Solution] Bulk actions partially fail when several prebuilt and custom rules are selected together when under Platinum license #209888
• [Security Solution] Incorrect Callout Displayed for Prebuilt Rule Updates on Restricted License or Tiers #213983

Bugs: rule installation

• [Security Solution] Infinite loading state on the rule install page when user doesn't have write privileges #161543
• [Security Solution] Install All button on Add Elastic Rules page gets re-enabled when user revisit the page while rules are loading. #180660
• [Security Solution] Fix load rules callout copy #200521

Bugs: rule upgrade general issues

• [Security Solution] Error Unable to load page is shown for Rules Page after updating Rules. #180120
• [Security Solution] Prebuilt rule flyout: Fix the delay that occurs when a user tries to open a flyout #166166
• [Security Solution] Replace PATCH logic with PUT when upgrading rules #180195
• [Security Solution] 'Update rule' button is disabled when there are prebuilt rules updates available #198155
• [Security Solution] upgrade/_review blocks main thread #199290
• [Security Solution] Unable to upgrade rules with missing base version #200904
• [Security Solution] Inconsistent conflict state messaging in Rule Upgrade flyout #200811
• [Security Solution] Incorrect field count in Rule Upgrade flyout #200286
• [Security Solution] Unable to upgrade Threat Match prebuilt rules #203365
• [Security Solution] Stale rule data is displayed in the upgrade flyout #202779
• [Security Solution] Unable to unset field value upon rules upgrade #203634
• [Security Solution] Rule upgrade fails due to Failed to parse date-math expression #203476
• [Security Solution] Rule upgrade flyout crashes on a rule with negative lookback time #202715
• [Security Solution] Negative lookback is not handled properly during upgrade #204714
• [Security Solution] Implement rule upgrade concurrency control #200134
• [Security Solution] Diff view incorrectly highlights changes in multiline strings #202016
• [Security Solution] Users can't upgrade rules without customizations when rule type changed #202967
• [Security Solution] Incorrect “my changes” statement displayed in update flyout for fields with no final column changes #206666
• [Security Solution] Update Button Enabled While Field is in Edit Mode #203912
• [Security Solution] Incorrect filtering behavior when combining ‘Modifications’ and ‘Tags’ filters in Rule Updates table #206132
• [Security Solution] Rule Updates Table refresh redirects to page 1 after editing or updating rules #207245
• [Security Solution] Update flyout diff view for "My changes merged with Elastic's" changes #208085
• [Security Solution] Docs link in the diff flyout is incorrect #208203
• [Security Solution] Relax the rules of handling missing base versions of prebuilt rules #210358
• [Security Solution] Prebuilt rule customization is lost on upgrade when Base version is missing #201500
• [Security Solution] Customized Prebuilt Rule Retains “Modified” Status After Bypassing Review via Bulk Update #213503
• [Security Solution] Reverting customization on prebuilt rule with missing base version after update does not reset is_customized status for fields covered by the scalar diff array #213621
• [Security Solution] Remove the link to the downloadable rule updates docs #213103
• [Security Solution] Misaligned line below section header in update flyout #206695

Bugs: rule upgrade field-specific issues

• [Security Solution] Show count field on Rule details page for threshold rules #161576
• [Security Solution] Wrapping of default data view index not done on Rule Details page (Firefox) #140156
• [Security Solution] Warnings in rule filters on the Rule Details page: "Field does not exist in current view" #178908
• [Security Solution] ML jobs are missing on rule details/editing/update pages #202700
• [Security Solution] ESQL editor inserts random values on Enter in upgrade flyout #202206
• [Security Solution] ES|QL Query bar's tooltip is rendered in wrong place #203305
• [Security Solution] Severity override checkbox is not clickable in the rule upgrade flyout #203643
• [Security Solution] KQL/Lucene Query bar filters generate diff when saved without changes in Prebuilt Rule Customization workflow #202966
• [Security Solution] KQL query isn't visible in edit mode #203523

Bugs: rule import and export

• https://github.com/elastic/infosec/issues/15731
• [Security Solution] Incorrect Rule Source Type and Customization Status After Importing a Custom Rule #205651

Bugs: handling missing base versions

• [Security Solution] Relax the rules of handling missing base versions of prebuilt rules #210358
• [Security Solution] Prebuilt rule customization is lost on upgrade when Base version is missing #201500
• [Security Solution] Customized Prebuilt Rule Retains “Modified” Status After Bypassing Review via Bulk Update #213503
• [Security Solution] Reverting customization on prebuilt rule with missing base version after update does not reset is_customized status for fields covered by the scalar diff array #213621
• [Security Solution] Incorrect merged version for Reference URLs in -AB scenarios #214171

Bugs: licensing

• [Security Solution] Incorrect Callout Displayed for Prebuilt Rule Updates on Restricted License or Tiers #213983
• [Security Solution] Conflict modal is shown under Platinum license / Essentials tier #214302
• [Security Solution] Conflict badges are shown under Platinum license / Essentials tier #214301

Bugs: performance

• https://github.com/elastic/security-team/issues/11822
• [Security Solution] Cache upgrade/_review endpoint calculations #208357
• [Security Solution] Limit the rule upgrade, install, and bootstrap endpoints concurrency #208355
• [Security Solution] Reduce response sizes of prebuilt rules _review API endpoints #210544
• [Security Solution] Add pagination to the upgrade/_review endpoint #208361
• [Security Solution] Memory leak during prebuilt rule installation and upgrade #204800

Bugs: misc

• [Security Solution] When duplicating a prebuilt rule, 'Related Integrations' and 'Required Fields' values are not inherited from the original rule #190628
• [Security Solution] Unable to Save Edited ESQL Rule Due to Query Validation Error #203502
• [Security Solution] The wrong endpoint package version is installed when prebuiltRulesPackageVersion config option is present #203471