[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version#201301
Conversation
|
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
|
Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management) |
0c5eff1 to
c22758b
Compare
There was a problem hiding this comment.
Let's set has_update to true when there's an update to account for a situation when a version is bumped without any other content changes.
There was a problem hiding this comment.
We also need to handle a situation when there's no update for proper diffing without a version bump. I.e, the case when a rule is edited locally rather than compared to a remote version.
There was a problem hiding this comment.
I applied determineDiffOutcome() it looks like a good fit here.
26a3f57 to
f7ac96b
Compare
I would keep |
f7ac96b to
7ec1b39
Compare
|
Me and @xcrzx discussed both options before I came up with the implementation
Both options have pros and cons but the first one looks more consistent. |
xcrzx
left a comment
There was a problem hiding this comment.
Tested the fix locally, the rule upgrade flow now works without issues. Thanks for the fix, @maximpn!
- Tested rue upgrade with missing base version
- Rule upgrade with base version
- Tested rule editing that doesn't include rule version bump
|
Starting backport for target branches: 8.16, 8.17, 8.x |
💚 Build Succeeded
Metrics [docs]
History
cc @maximpn |
…ules with missing base version (elastic#201301) **Resolves: elastic#200904 ## Summary This PR unlocks Prebuilt Rules Customization workflow for rules with missing base version. ## Details Each Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade. A generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it. The fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version. (cherry picked from commit dea9312)
…ules with missing base version (elastic#201301) **Resolves: elastic#200904 ## Summary This PR unlocks Prebuilt Rules Customization workflow for rules with missing base version. ## Details Each Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade. A generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it. The fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version. (cherry picked from commit dea9312)
…ules with missing base version (elastic#201301) **Resolves: elastic#200904 ## Summary This PR unlocks Prebuilt Rules Customization workflow for rules with missing base version. ## Details Each Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade. A generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it. The fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version. (cherry picked from commit dea9312)
💚 All backports created successfully
Note: Successful backport PRs will be merged automatically after passing CI. Questions ?Please refer to the Backport tool documentation |
…w for rules with missing base version (#201301) (#201656) # Backport This will backport the following commits from `main` to `8.17`: - [[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version (#201301)](#201301) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Maxim Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2024-11-25T17:12:35Z","message":"[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version (#201301)\n\n**Resolves: https://github.com/elastic/kibana/issues/200904**\r\n\r\n## Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.\r\n\r\nA generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","impact:high","v9.0.0","Team:Detections and Resp","Team: SecuritySolution","Team:Detection Rule Management","Feature:Prebuilt Detection Rules","backport:version","v8.17.0","v8.18.0","v8.16.2"],"title":"[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version","number":201301,"url":"https://github.com/elastic/kibana/pull/201301","mergeCommit":{"message":"[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version (#201301)\n\n**Resolves: https://github.com/elastic/kibana/issues/200904**\r\n\r\n## Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.\r\n\r\nA generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a"}},"sourceBranch":"main","suggestedTargetBranches":["8.17","8.x","8.16"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/201301","number":201301,"mergeCommit":{"message":"[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version (#201301)\n\n**Resolves: https://github.com/elastic/kibana/issues/200904**\r\n\r\n## Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.\r\n\r\nA generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a"}},{"branch":"8.17","label":"v8.17.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.16","label":"v8.16.2","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
…w for rules with missing base version (#201301) (#201655) # Backport This will backport the following commits from `main` to `8.16`: - [[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version (#201301)](#201301) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Maxim Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2024-11-25T17:12:35Z","message":"[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version (#201301)\n\n**Resolves: https://github.com/elastic/kibana/issues/200904**\r\n\r\n## Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.\r\n\r\nA generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","impact:high","v9.0.0","Team:Detections and Resp","Team: SecuritySolution","Team:Detection Rule Management","Feature:Prebuilt Detection Rules","backport:version","v8.17.0","v8.18.0","v8.16.2"],"title":"[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version","number":201301,"url":"https://github.com/elastic/kibana/pull/201301","mergeCommit":{"message":"[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version (#201301)\n\n**Resolves: https://github.com/elastic/kibana/issues/200904**\r\n\r\n## Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.\r\n\r\nA generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a"}},"sourceBranch":"main","suggestedTargetBranches":["8.17","8.x","8.16"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/201301","number":201301,"mergeCommit":{"message":"[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version (#201301)\n\n**Resolves: https://github.com/elastic/kibana/issues/200904**\r\n\r\n## Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.\r\n\r\nA generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a"}},{"branch":"8.17","label":"v8.17.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.16","label":"v8.16.2","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
… for rules with missing base version (#201301) (#201657) # Backport This will backport the following commits from `main` to `8.x`: - [[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version (#201301)](#201301) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Maxim Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2024-11-25T17:12:35Z","message":"[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version (#201301)\n\n**Resolves: https://github.com/elastic/kibana/issues/200904**\r\n\r\n## Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.\r\n\r\nA generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","impact:high","v9.0.0","Team:Detections and Resp","Team: SecuritySolution","Team:Detection Rule Management","Feature:Prebuilt Detection Rules","backport:version","v8.17.0","v8.18.0","v8.16.2"],"title":"[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version","number":201301,"url":"https://github.com/elastic/kibana/pull/201301","mergeCommit":{"message":"[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version (#201301)\n\n**Resolves: https://github.com/elastic/kibana/issues/200904**\r\n\r\n## Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.\r\n\r\nA generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a"}},"sourceBranch":"main","suggestedTargetBranches":["8.17","8.x","8.16"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/201301","number":201301,"mergeCommit":{"message":"[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version (#201301)\n\n**Resolves: https://github.com/elastic/kibana/issues/200904**\r\n\r\n## Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.\r\n\r\nA generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a"}},{"branch":"8.17","label":"v8.17.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.16","label":"v8.16.2","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
…ules with missing base version (elastic#201301) **Resolves: elastic#200904 ## Summary This PR unlocks Prebuilt Rules Customization workflow for rules with missing base version. ## Details Each Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade. A generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it. The fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.
…ules with missing base version (elastic#201301) **Resolves: elastic#200904 ## Summary This PR unlocks Prebuilt Rules Customization workflow for rules with missing base version. ## Details Each Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade. A generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it. The fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.
Resolves: #200904
Summary
This PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.
Details
Each Prebuilt Rule update contains
versiondiff.versionis a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.A generic
numberDiffAlgorithmalgorithm was used forversionfield. It produces aSOLVABLEconflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In caseversionfield got a conflict user had no possibility to resolve it.The fix adds a new
forceTargetVersionDiffAlgorithmdiff algorithm applied only forversionfield. It produces a non-conflict diff all the time even when base version is missing. The reason behind is thatversionalways gets target rule's version.