From dd36027ecc2821c13750cf0c870e6dc1d008a4cf Mon Sep 17 00:00:00 2001 From: Davis Plumlee <56367316+dplumlee@users.noreply.github.com> Date: Wed, 13 Nov 2024 18:04:38 -0500 Subject: [PATCH] [Security Solution] Add support for editing prebuilt rules to the Rule Editing page (#199550) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Resolves: https://github.com/elastic/kibana/issues/180172** ## Summary > [!NOTE] > Feature is behind the `prebuiltRulesCustomizationEnabled` feature flag. Removes the logic gates preventing prebuilt rules from being edited via the Rule Edit page behind the `prebuiltRulesCustomizationEnabled` feature flag. This allows all rules types to be fully editable via the UI. Also removes the muting logic we had in place for `Definition` tab warnings ([implemented here](https://github.com/elastic/kibana/pull/191487)) ### Screenshots #### _Before_ **Prebuilt rule only has the "Actions" tab enabled, users cannot customize anything else in the form** ![Screenshot 2024-11-08 at 3 08 15 PM](https://github.com/user-attachments/assets/b83836e6-f78f-4b3a-9fbc-55a5208250dd) #### _After_ **Prebuilt rule now has all tabs/fields available for editing and rule info is populated into the form** ![Screenshot 2024-11-08 at 3 02 43 PM](https://github.com/user-attachments/assets/184f6fc4-b64c-4e20-a987-76e460c61786) ### Checklist Delete any items that are not applicable to this PR. - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#_add_your_labels) - [ ] This will appear in the **Release Notes** and follow the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: Elastic Machine (cherry picked from commit d6e6145dacf25bf3e900611425434b0713bce005) --- .../pages/rule_editing/index.tsx | 22 ++++++++++++------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx index 3b1112d47c91d..0a1733bd831fd 100644 --- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx +++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx @@ -69,6 +69,7 @@ import { useRuleForms, useRuleFormsErrors, useRuleIndexPattern } from '../form'; import { useEsqlIndex, useEsqlQueryForAboutStep } from '../../hooks'; import { CustomHeaderPageMemo } from '..'; import { SaveWithErrorsModal } from '../../components/save_with_errors_confirmation'; +import { useIsPrebuiltRulesCustomizationEnabled } from '../../../rule_management/hooks/use_is_prebuilt_rules_customization_enabled'; import { ALERT_SUPPRESSION_FIELDS_FIELD_NAME } from '../../../rule_creation/components/alert_suppression_edit'; const EditRulePageComponent: FC<{ rule: RuleResponse }> = ({ rule }) => { @@ -86,11 +87,14 @@ const EditRulePageComponent: FC<{ rule: RuleResponse }> = ({ rule }) => { useListsConfig(); const { application, triggersActionsUi } = useKibana().services; const { navigateToApp } = application; + const isPrebuiltRulesCustomizationEnabled = useIsPrebuiltRulesCustomizationEnabled(); const { detailName: ruleId } = useParams<{ detailName: string }>(); const [activeStep, setActiveStep] = useState( - rule.immutable ? RuleStep.ruleActions : RuleStep.defineRule + !isPrebuiltRulesCustomizationEnabled && rule.immutable + ? RuleStep.ruleActions + : RuleStep.defineRule ); const { mutateAsync: updateRule, isLoading } = useUpdateRule(); const [isRulePreviewVisible, setIsRulePreviewVisible] = useState(true); @@ -211,7 +215,7 @@ const EditRulePageComponent: FC<{ rule: RuleResponse }> = ({ rule }) => { 'data-test-subj': 'edit-rule-define-tab', id: RuleStep.defineRule, name: ruleI18n.DEFINITION, - disabled: rule?.immutable, + disabled: !isPrebuiltRulesCustomizationEnabled && rule?.immutable, content: (
= ({ rule }) => { 'data-test-subj': 'edit-rule-about-tab', id: RuleStep.aboutRule, name: ruleI18n.ABOUT, - disabled: rule?.immutable, + disabled: !isPrebuiltRulesCustomizationEnabled && rule?.immutable, content: (
= ({ rule }) => { 'data-test-subj': 'edit-rule-schedule-tab', id: RuleStep.scheduleRule, name: ruleI18n.SCHEDULE, - disabled: rule?.immutable, + disabled: !isPrebuiltRulesCustomizationEnabled && rule?.immutable, content: (
= ({ rule }) => { }, ], [ + isPrebuiltRulesCustomizationEnabled, rule?.immutable, rule?.id, activeStep, @@ -356,15 +361,15 @@ const EditRulePageComponent: FC<{ rule: RuleResponse }> = ({ rule }) => { isIndexPatternLoading, isQueryBarValid, defineStepData, + memoizedIndex, aboutStepData, aboutStepForm, + esqlQueryForAboutStep, scheduleStepData, scheduleStepForm, actionsStepData, actionMessageParams, actionsStepForm, - memoizedIndex, - esqlQueryForAboutStep, ] ); @@ -414,7 +419,7 @@ const EditRulePageComponent: FC<{ rule: RuleResponse }> = ({ rule }) => { setNonBlockingRuleErrors([]); const actionsStepFormValid = await actionsStepForm.validate(); - if (rule.immutable) { + if (!isPrebuiltRulesCustomizationEnabled && rule.immutable) { // Since users cannot edit Define, About and Schedule tabs of the rule, we skip validation of those to avoid // user confusion of seeing that those tabs have error and not being able to see or do anything about that. // We will need to remove this condition once rule customization work is done. @@ -451,11 +456,12 @@ const EditRulePageComponent: FC<{ rule: RuleResponse }> = ({ rule }) => { showSaveWithErrorsModal(); } }, [ + actionsStepForm, + isPrebuiltRulesCustomizationEnabled, rule.immutable, defineStepForm, aboutStepForm, scheduleStepForm, - actionsStepForm, getRuleFormsErrors, saveChanges, showSaveWithErrorsModal,