Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version #201301

Conversation

maximpn
Copy link
Contributor

@maximpn maximpn commented Nov 21, 2024

Resolves: #200904

Summary

This PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.

Details

Each Prebuilt Rule update contains version diff. version is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.

A generic numberDiffAlgorithm algorithm was used for version field. It produces a SOLVABLE conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case version field got a conflict user had no possibility to resolve it.

The fix adds a new forceTargetVersionDiffAlgorithm diff algorithm applied only for version field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that version always gets target rule's version.

@maximpn maximpn added release_note:skip Skip the PR/issue when compiling release notes impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. v9.0.0 Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area backport:version Backport to applied version labels v8.18.0 labels Nov 21, 2024
@maximpn maximpn self-assigned this Nov 21, 2024
@maximpn maximpn requested a review from xcrzx November 21, 2024 22:58
@maximpn maximpn marked this pull request as ready for review November 21, 2024 22:58
@maximpn maximpn requested a review from a team as a code owner November 21, 2024 22:58
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@maximpn maximpn changed the title force version non conflict diff when base version is missing [Security Solution] Unlock Prebuil Rules Customization workflow for rules with missing base version Nov 22, 2024
@maximpn maximpn marked this pull request as draft November 22, 2024 07:10
@maximpn maximpn force-pushed the unlock-prebuilt-rule-upgrade-with-missing-base-version branch from 0c5eff1 to c22758b Compare November 22, 2024 07:34
@maximpn maximpn marked this pull request as ready for review November 22, 2024 07:34
diff_outcome: hasBaseVersion
? ThreeWayDiffOutcome.StockValueCanUpdate
: ThreeWayDiffOutcome.MissingBaseCanUpdate,
has_update: false,
Copy link
Contributor

@xcrzx xcrzx Nov 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's set has_update to true when there's an update to account for a situation when a version is bumped without any other content changes.

Comment on lines 40 to 42
diff_outcome: hasBaseVersion
? ThreeWayDiffOutcome.StockValueCanUpdate
: ThreeWayDiffOutcome.MissingBaseCanUpdate,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We also need to handle a situation when there's no update for proper diffing without a version bump. I.e, the case when a rule is edited locally rather than compared to a remote version.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I applied determineDiffOutcome() it looks like a good fit here.

@maximpn maximpn force-pushed the unlock-prebuilt-rule-upgrade-with-missing-base-version branch 2 times, most recently from 26a3f57 to f7ac96b Compare November 22, 2024 10:32
@banderror banderror added v8.17.0 bug Fixes for quality problems that affect the customer experience labels Nov 22, 2024
Copy link
Contributor

@banderror banderror left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@maximpn @xcrzx Do we even need to calculate a diff for the version field? Is it going to do some real work we need?

Alternatively, we could simply remove the version field from DiffableRule which would exclude it from the diff calculation procedure.

@xcrzx
Copy link
Contributor

xcrzx commented Nov 22, 2024

Alternatively, we could simply remove the version field from DiffableRule which would exclude it from the diff calculation procedure.

I would keep version in the diff. Excluding some fields from DiffableRule can potentially introduce more complexity. For example, in the UI we would need to read the version from a different structure, like the target rule. That would leak knowledge about the version field special case to the UI. On the backend, algorithms might need to be adjusted as well. When applying a rule upgrade, it is much easier to traverse a diffable rule knowing that it contains all meaningful rule fields for the upgrade rather than deciding where from to pick the data.

@maximpn maximpn force-pushed the unlock-prebuilt-rule-upgrade-with-missing-base-version branch from f7ac96b to 7ec1b39 Compare November 23, 2024 09:08
@maximpn
Copy link
Contributor Author

maximpn commented Nov 23, 2024

@banderror

Me and @xcrzx discussed both options before I came up with the implementation

  • Forcing target version for version field
  • Remove version field form the diff

Both options have pros and cons but the first one looks more consistent.

Copy link
Contributor

@banderror banderror left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm 👍 if @xcrzx approves.

@maximpn maximpn requested a review from xcrzx November 25, 2024 10:02
Copy link
Contributor

@xcrzx xcrzx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested the fix locally, the rule upgrade flow now works without issues. Thanks for the fix, @maximpn!

  • Tested rue upgrade with missing base version
  • Rule upgrade with base version
  • Tested rule editing that doesn't include rule version bump

@maximpn maximpn enabled auto-merge (squash) November 25, 2024 14:02
@maximpn maximpn merged commit dea9312 into elastic:main Nov 25, 2024
50 of 51 checks passed
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.16, 8.17, 8.x

https://github.com/elastic/kibana/actions/runs/12015208978

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

cc @maximpn

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Nov 25, 2024
…ules with missing base version (elastic#201301)

**Resolves: elastic#200904

## Summary

This PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.

## Details

Each Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.

A generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it.

The fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.

(cherry picked from commit dea9312)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Nov 25, 2024
…ules with missing base version (elastic#201301)

**Resolves: elastic#200904

## Summary

This PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.

## Details

Each Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.

A generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it.

The fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.

(cherry picked from commit dea9312)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Nov 25, 2024
…ules with missing base version (elastic#201301)

**Resolves: elastic#200904

## Summary

This PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.

## Details

Each Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.

A generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it.

The fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.

(cherry picked from commit dea9312)
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
8.16
8.17
8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

@maximpn maximpn deleted the unlock-prebuilt-rule-upgrade-with-missing-base-version branch November 25, 2024 18:07
kibanamachine added a commit that referenced this pull request Nov 25, 2024
…w for rules with missing base version (#201301) (#201656)

# Backport

This will backport the following commits from `main` to `8.17`:
- [[Security Solution] Unlock Prebuil Rules Customization workflow for
rules with missing base version
(#201301)](#201301)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-11-25T17:12:35Z","message":"[Security
Solution] Unlock Prebuil Rules Customization workflow for rules with
missing base version (#201301)\n\n**Resolves:
https://github.com/elastic/kibana/issues/200904**\r\n\r\n##
Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for
rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt
Rule update contains `version` diff. `version` is a special
non-customizable field we use to track prebuilt rule version. It always
gets target rule version's value after rule upgrade.\r\n\r\nA generic
`numberDiffAlgorithm` algorithm was used for `version` field. It
produces a `SOLVABLE` conflict when rule's base version is missing. It
blocked the workflow in UI. We check the number of field with conflicts
versus resolved conflicts to decide when a rule is ready for upgrade. In
case `version` field got a conflict user had no possibility to resolve
it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff
algorithm applied only for `version` field. It produces a non-conflict
diff all the time even when base version is missing. The reason behind
is that `version` always gets target rule's
version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","impact:high","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.17.0","v8.18.0","v8.16.2"],"title":"[Security
Solution] Unlock Prebuil Rules Customization workflow for rules with
missing base
version","number":201301,"url":"https://github.com/elastic/kibana/pull/201301","mergeCommit":{"message":"[Security
Solution] Unlock Prebuil Rules Customization workflow for rules with
missing base version (#201301)\n\n**Resolves:
https://github.com/elastic/kibana/issues/200904**\r\n\r\n##
Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for
rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt
Rule update contains `version` diff. `version` is a special
non-customizable field we use to track prebuilt rule version. It always
gets target rule version's value after rule upgrade.\r\n\r\nA generic
`numberDiffAlgorithm` algorithm was used for `version` field. It
produces a `SOLVABLE` conflict when rule's base version is missing. It
blocked the workflow in UI. We check the number of field with conflicts
versus resolved conflicts to decide when a rule is ready for upgrade. In
case `version` field got a conflict user had no possibility to resolve
it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff
algorithm applied only for `version` field. It produces a non-conflict
diff all the time even when base version is missing. The reason behind
is that `version` always gets target rule's
version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a"}},"sourceBranch":"main","suggestedTargetBranches":["8.17","8.x","8.16"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/201301","number":201301,"mergeCommit":{"message":"[Security
Solution] Unlock Prebuil Rules Customization workflow for rules with
missing base version (#201301)\n\n**Resolves:
https://github.com/elastic/kibana/issues/200904**\r\n\r\n##
Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for
rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt
Rule update contains `version` diff. `version` is a special
non-customizable field we use to track prebuilt rule version. It always
gets target rule version's value after rule upgrade.\r\n\r\nA generic
`numberDiffAlgorithm` algorithm was used for `version` field. It
produces a `SOLVABLE` conflict when rule's base version is missing. It
blocked the workflow in UI. We check the number of field with conflicts
versus resolved conflicts to decide when a rule is ready for upgrade. In
case `version` field got a conflict user had no possibility to resolve
it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff
algorithm applied only for `version` field. It produces a non-conflict
diff all the time even when base version is missing. The reason behind
is that `version` always gets target rule's
version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a"}},{"branch":"8.17","label":"v8.17.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.16","label":"v8.16.2","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Maxim Palenov <[email protected]>
kibanamachine added a commit that referenced this pull request Nov 25, 2024
…w for rules with missing base version (#201301) (#201655)

# Backport

This will backport the following commits from `main` to `8.16`:
- [[Security Solution] Unlock Prebuil Rules Customization workflow for
rules with missing base version
(#201301)](#201301)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-11-25T17:12:35Z","message":"[Security
Solution] Unlock Prebuil Rules Customization workflow for rules with
missing base version (#201301)\n\n**Resolves:
https://github.com/elastic/kibana/issues/200904**\r\n\r\n##
Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for
rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt
Rule update contains `version` diff. `version` is a special
non-customizable field we use to track prebuilt rule version. It always
gets target rule version's value after rule upgrade.\r\n\r\nA generic
`numberDiffAlgorithm` algorithm was used for `version` field. It
produces a `SOLVABLE` conflict when rule's base version is missing. It
blocked the workflow in UI. We check the number of field with conflicts
versus resolved conflicts to decide when a rule is ready for upgrade. In
case `version` field got a conflict user had no possibility to resolve
it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff
algorithm applied only for `version` field. It produces a non-conflict
diff all the time even when base version is missing. The reason behind
is that `version` always gets target rule's
version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","impact:high","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.17.0","v8.18.0","v8.16.2"],"title":"[Security
Solution] Unlock Prebuil Rules Customization workflow for rules with
missing base
version","number":201301,"url":"https://github.com/elastic/kibana/pull/201301","mergeCommit":{"message":"[Security
Solution] Unlock Prebuil Rules Customization workflow for rules with
missing base version (#201301)\n\n**Resolves:
https://github.com/elastic/kibana/issues/200904**\r\n\r\n##
Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for
rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt
Rule update contains `version` diff. `version` is a special
non-customizable field we use to track prebuilt rule version. It always
gets target rule version's value after rule upgrade.\r\n\r\nA generic
`numberDiffAlgorithm` algorithm was used for `version` field. It
produces a `SOLVABLE` conflict when rule's base version is missing. It
blocked the workflow in UI. We check the number of field with conflicts
versus resolved conflicts to decide when a rule is ready for upgrade. In
case `version` field got a conflict user had no possibility to resolve
it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff
algorithm applied only for `version` field. It produces a non-conflict
diff all the time even when base version is missing. The reason behind
is that `version` always gets target rule's
version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a"}},"sourceBranch":"main","suggestedTargetBranches":["8.17","8.x","8.16"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/201301","number":201301,"mergeCommit":{"message":"[Security
Solution] Unlock Prebuil Rules Customization workflow for rules with
missing base version (#201301)\n\n**Resolves:
https://github.com/elastic/kibana/issues/200904**\r\n\r\n##
Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for
rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt
Rule update contains `version` diff. `version` is a special
non-customizable field we use to track prebuilt rule version. It always
gets target rule version's value after rule upgrade.\r\n\r\nA generic
`numberDiffAlgorithm` algorithm was used for `version` field. It
produces a `SOLVABLE` conflict when rule's base version is missing. It
blocked the workflow in UI. We check the number of field with conflicts
versus resolved conflicts to decide when a rule is ready for upgrade. In
case `version` field got a conflict user had no possibility to resolve
it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff
algorithm applied only for `version` field. It produces a non-conflict
diff all the time even when base version is missing. The reason behind
is that `version` always gets target rule's
version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a"}},{"branch":"8.17","label":"v8.17.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.16","label":"v8.16.2","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Maxim Palenov <[email protected]>
kibanamachine added a commit that referenced this pull request Nov 25, 2024
… for rules with missing base version (#201301) (#201657)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution] Unlock Prebuil Rules Customization workflow for
rules with missing base version
(#201301)](#201301)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-11-25T17:12:35Z","message":"[Security
Solution] Unlock Prebuil Rules Customization workflow for rules with
missing base version (#201301)\n\n**Resolves:
https://github.com/elastic/kibana/issues/200904**\r\n\r\n##
Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for
rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt
Rule update contains `version` diff. `version` is a special
non-customizable field we use to track prebuilt rule version. It always
gets target rule version's value after rule upgrade.\r\n\r\nA generic
`numberDiffAlgorithm` algorithm was used for `version` field. It
produces a `SOLVABLE` conflict when rule's base version is missing. It
blocked the workflow in UI. We check the number of field with conflicts
versus resolved conflicts to decide when a rule is ready for upgrade. In
case `version` field got a conflict user had no possibility to resolve
it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff
algorithm applied only for `version` field. It produces a non-conflict
diff all the time even when base version is missing. The reason behind
is that `version` always gets target rule's
version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","impact:high","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.17.0","v8.18.0","v8.16.2"],"title":"[Security
Solution] Unlock Prebuil Rules Customization workflow for rules with
missing base
version","number":201301,"url":"https://github.com/elastic/kibana/pull/201301","mergeCommit":{"message":"[Security
Solution] Unlock Prebuil Rules Customization workflow for rules with
missing base version (#201301)\n\n**Resolves:
https://github.com/elastic/kibana/issues/200904**\r\n\r\n##
Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for
rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt
Rule update contains `version` diff. `version` is a special
non-customizable field we use to track prebuilt rule version. It always
gets target rule version's value after rule upgrade.\r\n\r\nA generic
`numberDiffAlgorithm` algorithm was used for `version` field. It
produces a `SOLVABLE` conflict when rule's base version is missing. It
blocked the workflow in UI. We check the number of field with conflicts
versus resolved conflicts to decide when a rule is ready for upgrade. In
case `version` field got a conflict user had no possibility to resolve
it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff
algorithm applied only for `version` field. It produces a non-conflict
diff all the time even when base version is missing. The reason behind
is that `version` always gets target rule's
version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a"}},"sourceBranch":"main","suggestedTargetBranches":["8.17","8.x","8.16"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/201301","number":201301,"mergeCommit":{"message":"[Security
Solution] Unlock Prebuil Rules Customization workflow for rules with
missing base version (#201301)\n\n**Resolves:
https://github.com/elastic/kibana/issues/200904**\r\n\r\n##
Summary\r\n\r\nThis PR unlocks Prebuilt Rules Customization workflow for
rules with missing base version.\r\n\r\n## Details\r\n\r\nEach Prebuilt
Rule update contains `version` diff. `version` is a special
non-customizable field we use to track prebuilt rule version. It always
gets target rule version's value after rule upgrade.\r\n\r\nA generic
`numberDiffAlgorithm` algorithm was used for `version` field. It
produces a `SOLVABLE` conflict when rule's base version is missing. It
blocked the workflow in UI. We check the number of field with conflicts
versus resolved conflicts to decide when a rule is ready for upgrade. In
case `version` field got a conflict user had no possibility to resolve
it.\r\n\r\nThe fix adds a new `forceTargetVersionDiffAlgorithm` diff
algorithm applied only for `version` field. It produces a non-conflict
diff all the time even when base version is missing. The reason behind
is that `version` always gets target rule's
version.","sha":"dea9312246554c6af0ce148e2ec967bb5f9cca8a"}},{"branch":"8.17","label":"v8.17.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.16","label":"v8.16.2","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Maxim Palenov <[email protected]>
paulinashakirova pushed a commit to paulinashakirova/kibana that referenced this pull request Nov 26, 2024
…ules with missing base version (elastic#201301)

**Resolves: elastic#200904

## Summary

This PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.

## Details

Each Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.

A generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it.

The fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Dec 12, 2024
…ules with missing base version (elastic#201301)

**Resolves: elastic#200904

## Summary

This PR unlocks Prebuilt Rules Customization workflow for rules with missing base version.

## Details

Each Prebuilt Rule update contains `version` diff. `version` is a special non-customizable field we use to track prebuilt rule version. It always gets target rule version's value after rule upgrade.

A generic `numberDiffAlgorithm` algorithm was used for `version` field. It produces a `SOLVABLE` conflict when rule's base version is missing. It blocked the workflow in UI. We check the number of field with conflicts versus resolved conflicts to decide when a rule is ready for upgrade. In case `version` field got a conflict user had no possibility to resolve it.

The fix adds a new `forceTargetVersionDiffAlgorithm` diff algorithm applied only for `version` field. It produces a non-conflict diff all the time even when base version is missing. The reason behind is that `version` always gets target rule's version.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport:version Backport to applied version labels bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. release_note:skip Skip the PR/issue when compiling release notes Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.16.2 v8.17.0 v8.18.0 v9.0.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Security Solution] Unable to upgrade rules with missing base version
5 participants