[Security Solution] Write the rule source field together with the immutable#183895
Merged
xcrzx merged 1 commit intoelastic:mainfrom May 29, 2024
xcrzx:write-rule-source
Merged
[Security Solution] Write the rule source field together with the immutable#183895xcrzx merged 1 commit intoelastic:mainfrom xcrzx:write-rule-source
xcrzx merged 1 commit intoelastic:mainfrom
xcrzx:write-rule-source
Conversation
Contributor
|
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
Contributor
|
Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management) |
Contributor
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
nkhristinin
approved these changes
May 24, 2024
jpdjere
approved these changes
May 24, 2024
Contributor
jpdjere
left a comment
There was a problem hiding this comment.
Thanks for these changes!
Tested:
- creating a new rule
- duplicating a custom rule
- duplicating a prebuilt rule
- installing a prebuilt rule
- importing a rule
- upgrading a rule with a type change
All scenarios create a rule with the expected ruleSource.
logeekal
approved these changes
May 28, 2024
Contributor
logeekal
left a comment
There was a problem hiding this comment.
Investigations Code Review look good to me.
💛 Build succeeded, but was flaky
Failed CI StepsMetrics [docs]
History
To update your PR or re-run it, just comment with: cc @xcrzx |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves: #180141
Summary
As part of our migration strategy to the new schema, we need to start writing the
rule_sourcefield together with theimmutablefield to prepare for data migration. We need to ensure that all our endpoints write therule_sourcefield before we start migrating detection rules so we do not end up in a situation when our data is migrated but rule CRUD endpoints continue writing the old format.With this PR, we start writing
rule_sourceon every rule modification or creation. Theimmutablefield is treated as the main field, andrule_sourceis always derived from it.