-
Notifications
You must be signed in to change notification settings - Fork 8.6k
[Security Solution] Prebuilt rules with missing base version are marked as customized on edit #201632
Copy link
Copy link
Closed
[Security Solution] Prebuilt rules with missing base version are marked as customized on edit#201632
Bug
Copy link
Labels
8.17 candidateFeature:Prebuilt Detection RulesSecurity Solution Prebuilt Detection Rules areaSecurity Solution Prebuilt Detection Rules areaTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeamSecurity Detection Response TeambugFixes for quality problems that affect the customer experienceFixes for quality problems that affect the customer experienceimpact:highAddressing this issue will have a high level of impact on the quality/strength of our product.Addressing this issue will have a high level of impact on the quality/strength of our product.v8.16.2v8.17.0v8.18.0v9.0.0
Metadata
Metadata
Assignees
Labels
8.17 candidateFeature:Prebuilt Detection RulesSecurity Solution Prebuilt Detection Rules areaSecurity Solution Prebuilt Detection Rules areaTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeamSecurity Detection Response TeambugFixes for quality problems that affect the customer experienceFixes for quality problems that affect the customer experienceimpact:highAddressing this issue will have a high level of impact on the quality/strength of our product.Addressing this issue will have a high level of impact on the quality/strength of our product.v8.16.2v8.17.0v8.18.0v9.0.0
Type
Fields
Give feedbackNo fields configured for Bug.
Summary
Currently, any rule update, such as adding or editing rule actions, causes the rule to be marked as customized if its base version is missing. Due to the current package size limit, this is a relatively common situation and is already affecting 8.16 with the feature flag disabled.
Steps to Reproduce
Expected Result
The rule is not marked as customized after saving, as actions do not count toward customizations.
Actual Result
The rule is erroneously marked as customized.
Mitigation
When the rule customizaiton feature flag is disabled, we should always return
isCustomized: falseregardless of changes introduced to a rule.