Skip to content

[Security Solution] Prebuilt rules with missing base version are marked as customized on edit #201632

@xcrzx

Description

@xcrzx

Summary

Currently, any rule update, such as adding or editing rule actions, causes the rule to be marked as customized if its base version is missing. Due to the current package size limit, this is a relatively common situation and is already affecting 8.16 with the feature flag disabled.

Steps to Reproduce

  1. Ensure the rule customization feature flag is disabled.
  2. Open any prebuilt rule that doesn’t have a base version in the rules package.
  3. Edit the rule (e.g., add or modify its actions).
  4. Save the rule.

Expected Result

The rule is not marked as customized after saving, as actions do not count toward customizations.

Actual Result

The rule is erroneously marked as customized.

Mitigation

When the rule customizaiton feature flag is disabled, we should always return isCustomized: false regardless of changes introduced to a rule.

Metadata

Metadata

Assignees

Labels

8.17 candidateFeature:Prebuilt Detection RulesSecurity Solution Prebuilt Detection Rules areaTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeambugFixes for quality problems that affect the customer experienceimpact:highAddressing this issue will have a high level of impact on the quality/strength of our product.v8.16.2v8.17.0v8.18.0v9.0.0

Type

No fields configured for Bug.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions