Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Add support for editing prebuilt rules to the Rule Editing page #180172

Closed
3 tasks
Tracked by #174168
jpdjere opened this issue Apr 5, 2024 · 4 comments · Fixed by #199550
Closed
3 tasks
Tracked by #174168

[Security Solution] Add support for editing prebuilt rules to the Rule Editing page #180172

jpdjere opened this issue Apr 5, 2024 · 4 comments · Fixed by #199550
Assignees
@dplumlee
Labels
8.17 candidate Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.

Comments

@jpdjere
Copy link
Contributor

jpdjere commented Apr 5, 2024 •
edited by dplumlee
Loading

Epics: https://github.com/elastic/security-team/issues/1974 (internal), #174168
Design Discussion context: #178211
Design: ?

Summary

  • Add support for editing prebuilt rules to the Rule Editing page. Enable and allow users to use all section tabs for the rule editing page for both prebuilt and custom rule types (currently limited to just Actions tab)
  • Get rid of warning suppression implemented here now that users are able to utilize the query form itself

Background

Acceptance criteria

  • Feature is hidden behind prebuiltRulesCustomizationEnabled feature flag
  • Prebuilt rules can be successfully edited via the rule editing page
  • All tabs in the rule editing page are accessible for all rule types
@jpdjere jpdjere added triage_needed Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area labels Apr 5, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@jpdjere jpdjere mentioned this issue Apr 5, 2024
Open
@banderror banderror changed the title [Security Solution] Add support for editing prebuilt rules to the Rule Editing page [Security Solution] Add support for editing prebuilt rules to the Rule Editing page (DRAFT) Apr 17, 2024
@dplumlee dplumlee self-assigned this Sep 19, 2024
@dplumlee dplumlee changed the title [Security Solution] Add support for editing prebuilt rules to the Rule Editing page (DRAFT) [Security Solution] Add support for editing prebuilt rules to the Rule Editing page Sep 25, 2024
@banderror
Copy link
Contributor

Thanks @dplumlee for updating the description, LGTM 👍 /cc @jpdjere @approksiu

@dplumlee dplumlee mentioned this issue Nov 8, 2024
Merged
3 tasks
dplumlee added a commit that referenced this issue Nov 13, 2024
@dplumlee @elasticmachine
[Security Solution] Add support for editing prebuilt rules to the Rul…
d6e6145 
…e Editing page (#199550)

**Resolves: #180172

## Summary

> [!NOTE]  
> Feature is behind the `prebuiltRulesCustomizationEnabled` feature
flag.

Removes the logic gates preventing prebuilt rules from being edited via
the Rule Edit page behind the `prebuiltRulesCustomizationEnabled`
feature flag. This allows all rules types to be fully editable via the
UI.

Also removes the muting logic we had in place for `Definition` tab
warnings ([implemented
here](#191487))

### Screenshots

#### _Before_

**Prebuilt rule only has the "Actions" tab enabled, users cannot
customize anything else in the form**
![Screenshot 2024-11-08 at 3 08
15 PM](https://github.com/user-attachments/assets/b83836e6-f78f-4b3a-9fbc-55a5208250dd)


#### _After_

**Prebuilt rule now has all tabs/fields available for editing and rule
info is populated into the form**
![Screenshot 2024-11-08 at 3 02
43 PM](https://github.com/user-attachments/assets/184f6fc4-b64c-4e20-a987-76e460c61786)

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios



### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#_add_your_labels)
- [ ] This will appear in the **Release Notes** and follow the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Elastic Machine <[email protected]>
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Nov 13, 2024
@dplumlee
[Security Solution] Add support for editing prebuilt rules to the Rul…
dd36027 
…e Editing page (elastic#199550)

**Resolves: elastic#180172

## Summary

> [!NOTE]
> Feature is behind the `prebuiltRulesCustomizationEnabled` feature
flag.

Removes the logic gates preventing prebuilt rules from being edited via
the Rule Edit page behind the `prebuiltRulesCustomizationEnabled`
feature flag. This allows all rules types to be fully editable via the
UI.

Also removes the muting logic we had in place for `Definition` tab
warnings ([implemented
here](elastic#191487))

### Screenshots

#### _Before_

**Prebuilt rule only has the "Actions" tab enabled, users cannot
customize anything else in the form**
![Screenshot 2024-11-08 at 3 08
15 PM](https://github.com/user-attachments/assets/b83836e6-f78f-4b3a-9fbc-55a5208250dd)

#### _After_

**Prebuilt rule now has all tabs/fields available for editing and rule
info is populated into the form**
![Screenshot 2024-11-08 at 3 02
43 PM](https://github.com/user-attachments/assets/184f6fc4-b64c-4e20-a987-76e460c61786)

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#_add_your_labels)
- [ ] This will appear in the **Release Notes** and follow the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Elastic Machine <[email protected]>
(cherry picked from commit d6e6145)
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this issue Nov 18, 2024
@dplumlee @elasticmachine @CAWilson94
[Security Solution] Add support for editing prebuilt rules to the Rul…
69557f1 
…e Editing page (elastic#199550)

**Resolves: elastic#180172

## Summary

> [!NOTE]  
> Feature is behind the `prebuiltRulesCustomizationEnabled` feature
flag.

Removes the logic gates preventing prebuilt rules from being edited via
the Rule Edit page behind the `prebuiltRulesCustomizationEnabled`
feature flag. This allows all rules types to be fully editable via the
UI.

Also removes the muting logic we had in place for `Definition` tab
warnings ([implemented
here](elastic#191487))

### Screenshots

#### _Before_

**Prebuilt rule only has the "Actions" tab enabled, users cannot
customize anything else in the form**
![Screenshot 2024-11-08 at 3 08
15 PM](https://github.com/user-attachments/assets/b83836e6-f78f-4b3a-9fbc-55a5208250dd)


#### _After_

**Prebuilt rule now has all tabs/fields available for editing and rule
info is populated into the form**
![Screenshot 2024-11-08 at 3 02
43 PM](https://github.com/user-attachments/assets/184f6fc4-b64c-4e20-a987-76e460c61786)

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios



### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#_add_your_labels)
- [ ] This will appear in the **Release Notes** and follow the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Elastic Machine <[email protected]>
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this issue Nov 18, 2024
@dplumlee @elasticmachine @CAWilson94
[Security Solution] Add support for editing prebuilt rules to the Rul…
96ff9f0 
…e Editing page (elastic#199550)

**Resolves: elastic#180172

## Summary

> [!NOTE]  
> Feature is behind the `prebuiltRulesCustomizationEnabled` feature
flag.

Removes the logic gates preventing prebuilt rules from being edited via
the Rule Edit page behind the `prebuiltRulesCustomizationEnabled`
feature flag. This allows all rules types to be fully editable via the
UI.

Also removes the muting logic we had in place for `Definition` tab
warnings ([implemented
here](elastic#191487))

### Screenshots

#### _Before_

**Prebuilt rule only has the "Actions" tab enabled, users cannot
customize anything else in the form**
![Screenshot 2024-11-08 at 3 08
15 PM](https://github.com/user-attachments/assets/b83836e6-f78f-4b3a-9fbc-55a5208250dd)


#### _After_

**Prebuilt rule now has all tabs/fields available for editing and rule
info is populated into the form**
![Screenshot 2024-11-08 at 3 02
43 PM](https://github.com/user-attachments/assets/184f6fc4-b64c-4e20-a987-76e460c61786)

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios



### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#_add_your_labels)
- [ ] This will appear in the **Release Notes** and follow the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Elastic Machine <[email protected]>
@banderror banderror mentioned this issue Nov 27, 2024
Open
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@dplumlee dplumlee

Labels
8.17 candidate Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Security Solution] Add support for editing prebuilt rules to the Rule Editing page dplumlee/kibana
4 participants
@jpdjere @banderror @elasticmachine @dplumlee