Allow security_rule objects to have rule IDs different from the object IDs#463
Merged
mrodm merged 1 commit intoelastic:mainfrom Jan 18, 2023
Merged
Allow security_rule objects to have rule IDs different from the object IDs#463mrodm merged 1 commit intoelastic:mainfrom
mrodm merged 1 commit intoelastic:mainfrom
Conversation
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
0cc0050 to
e46da14
Compare
🌐 Coverage report
|
banderror
reviewed
Jan 16, 2023
code/go/internal/validator/semantic/validate_kibana_matching_object_ids.go
Show resolved
Hide resolved
e46da14 to
60354cb
Compare
mrodm
reviewed
Jan 17, 2023
Contributor
mrodm
left a comment
There was a problem hiding this comment.
LGTM, just a note about avoiding possible panics in some type assertions.
code/go/internal/validator/semantic/validate_kibana_matching_object_ids.go
Outdated
Show resolved
Hide resolved
60354cb to
0c9b8f7
Compare
0c9b8f7 to
886dc69
Compare
Contributor
Author
|
@mrodm It seems like this PR has all the required approves. How could I merge it? The merge button is inactive, saying, |
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Change validation check that enforces saved object ID to match
rule_idfor security solution prebuilt detection rules. Allow saved object IDs to have arbitrary suffixes.Why is it important?
Security Solution migrates the detection rules package from storing a single saved object per rule to multiple saved objects. See elastic/kibana#137420 for more context regarding the change.
The package will contain rule saved objects with rule id and version in the name (
security_rule/[ruleId]_[ruleVersion].json) with the following content:{ "id": "[ruleId]_[ruleVersion]", "type": "security-rule", "attributes": { "rule_id": "[ruleId]", "version": "[ruleVersion]", // Other rule attributes } }So the saved object ID and the rule ID do not match anymore, making this validation check always return an error.
Checklist
test/packagesthat prove my change is effective.spec/changelog.yml.Related issues