Skip to content

[Security Solution][Detection Rules] Makes threat techniques optional#85481

Merged
dplumlee merged 3 commits intoelastic:masterfrom
dplumlee:mitre-optional-techniques
Dec 15, 2020
Merged

[Security Solution][Detection Rules] Makes threat techniques optional#85481
dplumlee merged 3 commits intoelastic:masterfrom
dplumlee:mitre-optional-techniques

Conversation

@dplumlee
Copy link
Copy Markdown
Contributor

@dplumlee dplumlee commented Dec 9, 2020

Summary

Removes the validation and requirement to have at least one technique per tactic in the rule's threat field, giving users the ability to map to any level they desire (tactic, technique, subtechnique) for threats in the rule creation UI.

Screenshots

Before

image

After

Screen Shot 2020-12-09 at 4 39 30 PM
Screen Shot 2020-12-09 at 4 39 15 PM

Checklist

Delete any items that are not applicable to this PR.

For maintainers

@dplumlee dplumlee added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Feature:Detection Rules Security Solution rules and Detection Engine v7.11.0 Team:Detections and Resp Security Detection Response Team labels Dec 9, 2020
@dplumlee dplumlee self-assigned this Dec 9, 2020
@dplumlee dplumlee marked this pull request as ready for review December 9, 2020 23:56
@dplumlee dplumlee requested review from a team as code owners December 9, 2020 23:56
@dplumlee
Copy link
Copy Markdown
Contributor Author

@elasticmachine merge upstream

@dplumlee dplumlee force-pushed the mitre-optional-techniques branch from e67273a to d48c696 Compare December 14, 2020 18:41
@peluja1012
Copy link
Copy Markdown
Contributor

@dplumlee Should these types also be updated to reflect that techniques are optional?
https://github.com/elastic/kibana/blob/master/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/types.ts#L216

Also is there a way to combine those types with the ones defined here? Or is there a reason they need to be duplicated?
https://github.com/elastic/kibana/blob/master/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts#L448

@dplumlee
Copy link
Copy Markdown
Contributor Author

@peluja1012 there's no reason they need to be duplicated, I'll consolidate them. As for the technique field being optional, as it stands right now, all rules created and have a technique array and the form to create rules, defaults every threat to an empty array. I talked to @marshallmain and we concurred that the best way to handle switching to an optional field was to leave the schema as is and change the form validation to allow empty arrays

@kibanamachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 8.3MB 8.3MB -3.0KB

Distributable file count

id before after diff
default 47130 47890 +760

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
securitySolution 214.6KB 214.6KB +24.0B

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

Copy link
Copy Markdown
Contributor

@peluja1012 peluja1012 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Works well and I'm now able to create a rule with only a "tactic" and no "technique". Thanks for consolidating the types here, also.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Feature:Detection Rules Security Solution rules and Detection Engine release_note:skip Skip the PR/issue when compiling release notes Team:Detections and Resp Security Detection Response Team v7.11.0 v8.0.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants