Security Solution migrates the detection rules package from storing a single saved object per rule to multiple saved objects. See elastic/kibana#137420 for more context regarding the change.
The package will contain rule saved objects with rule id and version in the name (security_rule/[ruleId]_[ruleVersion].json) with the following content:
{
"id": "[ruleId]_[ruleVersion]",
"type": "security-rule",
"attributes": {
"rule_id": "[ruleId]",
"version": "[ruleVersion]",
// Other rule attributes
}
}So the saved object ID and the rule ID do not match anymore, making this validation check always return an error:
|
if ruleID != objectID { |
|
errs = append(errs, errors.New("rule ID is different from the object ID")) |
|
continue |
|
} |
I would like to know why that validation exists in the first place and if we could remove or update it.
Security Solution migrates the detection rules package from storing a single saved object per rule to multiple saved objects. See elastic/kibana#137420 for more context regarding the change.
The package will contain rule saved objects with rule id and version in the name (
security_rule/[ruleId]_[ruleVersion].json) with the following content:{ "id": "[ruleId]_[ruleVersion]", "type": "security-rule", "attributes": { "rule_id": "[ruleId]", "version": "[ruleVersion]", // Other rule attributes } }So the saved object ID and the rule ID do not match anymore, making this validation check always return an error:
package-spec/code/go/internal/validator/semantic/validate_kibana_matching_object_ids.go
Lines 50 to 53 in fafbc4b
I would like to know why that validation exists in the first place and if we could remove or update it.