-
Notifications
You must be signed in to change notification settings - Fork 8.6k
[Security Solution] Prebuilt rules marked as customized after applying updates #201631
Copy link
Copy link
Closed
Closed
Copy link
Labels
8.18 candidateFeature:Prebuilt Detection RulesSecurity Solution Prebuilt Detection Rules areaSecurity Solution Prebuilt Detection Rules areaTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeamSecurity Detection Response TeambugFixes for quality problems that affect the customer experienceFixes for quality problems that affect the customer experienceimpact:highAddressing this issue will have a high level of impact on the quality/strength of our product.Addressing this issue will have a high level of impact on the quality/strength of our product.v8.17.1v8.18.0v9.0.0
Metadata
Metadata
Assignees
Labels
8.18 candidateFeature:Prebuilt Detection RulesSecurity Solution Prebuilt Detection Rules areaSecurity Solution Prebuilt Detection Rules areaTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeamSecurity Detection Response TeambugFixes for quality problems that affect the customer experienceFixes for quality problems that affect the customer experienceimpact:highAddressing this issue will have a high level of impact on the quality/strength of our product.Addressing this issue will have a high level of impact on the quality/strength of our product.v8.17.1v8.18.0v9.0.0
Type
Fields
Give feedbackNo fields configured for issues without a type.
Summary
Non-customized rules are incorrectly marked as customized after applying an update.
Steps to Reproduce
Expected Result
The rule is upgraded and remains marked as non-customized.
Actual Result
The rule is upgraded but is incorrectly marked as customized.
Initial analysis shows a difference in the
lookbackfield between the saved updated rule and the target version. The value changes from-60sto240s.