[Security Solution] Users can Customize Prebuilt Detection Rules: Milestone 1

[banderror]

Epic: https://github.com/elastic/security-team/issues/1974 (internal)
Milestones: << • >>

Summary

Milestone 1: Release the package with historical versions of prebuilt rules. Add support for it in the app, but preserve the existing API, UI, and behavior.

This meta ticket is created to simplify tracking of various tickets related to the epic, and to make this public information so our users can track the progress.

Useful info: Prebuilt Rules Customization Technical Design

Implementation tasks

Technical design

Preview Give feedback

1. [Security Solution] Architecture design for prebuilt rules customization #125665
   8.7 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.7.0 +6
   
2. [Security Solution] PoC of Prebuilt Detection Rules package with historical versions #137420
   8.7 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.7.0 +6
   
3. [Security Solution] PoC of the rule upgrade workflow #137446
   8.7 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.7.0 +6
   
4. Finalize and share Prebuilt Rules Customization Technical Design

Separating rule versions and revisions

Preview Give feedback

1. [Security Solution] Separate rule versions and revisions #136213
   Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:ResponseOps v8.8.0 +6
2. [ResponseOps] Add revision field support to Alerting framework rules #137164
   8.8 candidate Feature:Alerting/RulesFramework Feature:Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:ResponseOps v8.8.0 +8
   
3. [Security Solution] Remove logic that bumps rule version on every change #137168
   8.8 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.8.0 +7
   
4. [Security Solution] Remove version column from the Rules table #148196
   8.7 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp +6
   

Removing filesystem rules

Preview Give feedback

1. [Security Solution] Remove filesystem detection rules in favor of a bundled Fleet package #139926
   8.7 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.7.0 +6
   
2. [Security Solution] Support testing of prerelease detection rules with Kibana #147466
   8.7 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.7.0 +6
   
3. [FR] Update existing release process for removed file system rules detection-rules#2386
   backlog enhancement python v8.7.0 +4
   
4. https://github.com/elastic/ia-trade-team/issues/17
5. https://github.com/elastic/package-storage-infra/issues/370

Fleet package with historical versions of prebuilt rules

Preview Give feedback

1. https://github.com/elastic/ia-trade-team/issues/69
2. [Fleet] Packages with a large number of saved objects in them cause Kibana to crash #147695
   8.7 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet bug impact:high v8.7.0 +9
   
3. [Fleet] Remove the mapping for the nested istalled_kibana field #148174
   8.7 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet bug impact:high v8.7.0 +9
   
4. [Fleet] Error when importing more than 10000 saved objects in a Fleet package #148175
   8.7 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet bug impact:high v8.7.0 +9
   
5. [Change Proposal] Allow security_rule objects to have rule IDs different from the object IDs package-spec#459
   discuss +1
6. [Security Solution] Ensure full test coverage for existing workflows of installing and upgrading prebuilt rules #148176
   8.9 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp test-coverage v8.9.0 +7
   
7. [Security Solution] Add support for Fleet package with historical versions of prebuilt rules #148179
   8.7 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.7.0 +6
   

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)