[Security Solution] Rule type field diff algorithm
#193369
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dplumlee
added
release_note:skip
|
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
|
Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management) |
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
1 task
dplumlee
added
backport:prev-major
3 tasks
8 tasks
jpdjere
reviewed
Sep 26, 2024
| @@ -0,0 +1,159 @@ | |||
| /* | |||
There was a problem hiding this comment.
I think we should remove the scenarios which are not possible, since the user cannot edit the rule type, or change the type of the installed rule in any way, not even by API:
Not possible:
- ABA
- ABB
- ABC
Possible:
- AAA
- AAB
- -AA
- -AB
I think the not-possible scenarios shouldn't have test cases here cause it makes it confusing, maybe we can just add it as a comment at the top of this file. What do you think?
There was a problem hiding this comment.
A user can change between query and saved_query rule types in the UI. Not saying that's a super common use case but it can technically be done. I think that would be enough to keep those other scenarios in here and maybe just update the tests to reflect that instead of eql? I just used that for mocking simplicity since it'd be testing the same logic under the hood
There was a problem hiding this comment.
@dplumlee You are right about query and saved_query, I hadn't realized that.
Then, considering that, and what Paula mentioned in #193372 (comment), I think we should leave the tests cases as they are and add explanations in comments, detailing that such scenarios are only possible for that particular rule change; and other rule type changes should not be possible in the app.
jpdjere
approved these changes
Sep 26, 2024
dplumlee
added a commit
that referenced
this pull request
Sep 30, 2024
…193372) ## Summary Related ticket: #190482 Adds test plan for diff algorithm for `type` field diff algorithm implemented here: #193369 ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Sep 30, 2024
…lastic#193372) ## Summary Related ticket: elastic#190482 Adds test plan for diff algorithm for `type` field diff algorithm implemented here: elastic#193369 ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) (cherry picked from commit fefa59f)
💚 Build Succeeded
Metrics [docs]
History
To update your PR or re-run it, just comment with: cc @dplumlee |
|
Starting backport for target branches: 8.x |
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Sep 30, 2024
## Summary Addresses elastic#190482 Adds the diff algorithm implementation for the prebuilt rule `type` field. Returns `target_version` and a `NON_SOLVABLE` conflict for every outcome that changes the field. ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) (cherry picked from commit 18465e7)
💚 All backports created successfully
Note: Successful backport PRs will be merged automatically after passing CI. Questions ?Please refer to the Backport tool documentation |
13 tasks
kibanamachine
added a commit
that referenced
this pull request
Sep 30, 2024
…193369) (#194464) # Backport This will backport the following commits from `main` to `8.x`: - [[Security Solution] Rule `type` field diff algorithm (#193369)](#193369) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https:/sqren/backport) <!--BACKPORT [{"author":{"name":"Davis Plumlee","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-09-30T17:27:29Z","message":"[Security Solution] Rule `type` field diff algorithm (#193369)\n\n## Summary\r\n\r\nAddresses https:/elastic/kibana/issues/190482\r\n\r\nAdds the diff algorithm implementation for the prebuilt rule `type`\r\nfield. Returns `target_version` and a `NON_SOLVABLE` conflict for every\r\noutcome that changes the field.\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n\r\n\r\n### For maintainers\r\n\r\n- [ ] This was checked for breaking API changes and was [labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"18465e7f7e5d9912e61da68873045f0db984fa2b","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detections and Resp","Team: SecuritySolution","Team:Detection Rule Management","Feature:Prebuilt Detection Rules","backport:prev-minor","v8.16.0"],"title":"[Security Solution] Rule `type` field diff algorithm","number":193369,"url":"https:/elastic/kibana/pull/193369","mergeCommit":{"message":"[Security Solution] Rule `type` field diff algorithm (#193369)\n\n## Summary\r\n\r\nAddresses https:/elastic/kibana/issues/190482\r\n\r\nAdds the diff algorithm implementation for the prebuilt rule `type`\r\nfield. Returns `target_version` and a `NON_SOLVABLE` conflict for every\r\noutcome that changes the field.\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n\r\n\r\n### For maintainers\r\n\r\n- [ ] This was checked for breaking API changes and was [labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"18465e7f7e5d9912e61da68873045f0db984fa2b"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https:/elastic/kibana/pull/193369","number":193369,"mergeCommit":{"message":"[Security Solution] Rule `type` field diff algorithm (#193369)\n\n## Summary\r\n\r\nAddresses https:/elastic/kibana/issues/190482\r\n\r\nAdds the diff algorithm implementation for the prebuilt rule `type`\r\nfield. Returns `target_version` and a `NON_SOLVABLE` conflict for every\r\noutcome that changes the field.\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n\r\n\r\n### For maintainers\r\n\r\n- [ ] This was checked for breaking API changes and was [labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"18465e7f7e5d9912e61da68873045f0db984fa2b"}},{"branch":"8.x","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Davis Plumlee <[email protected]> Co-authored-by: Elastic Machine <[email protected]>
neptunian
pushed a commit
to neptunian/kibana
that referenced
this pull request
Oct 1, 2024
…lastic#193369) (elastic#194464) # Backport This will backport the following commits from `main` to `8.x`: - [[Security Solution] Rule `type` field diff algorithm (elastic#193369)](elastic#193369) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https:/sqren/backport) <!--BACKPORT [{"author":{"name":"Davis Plumlee","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-09-30T17:27:29Z","message":"[Security Solution] Rule `type` field diff algorithm (elastic#193369)\n\n## Summary\r\n\r\nAddresses https:/elastic/kibana/issues/190482\r\n\r\nAdds the diff algorithm implementation for the prebuilt rule `type`\r\nfield. Returns `target_version` and a `NON_SOLVABLE` conflict for every\r\noutcome that changes the field.\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n\r\n\r\n### For maintainers\r\n\r\n- [ ] This was checked for breaking API changes and was [labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"18465e7f7e5d9912e61da68873045f0db984fa2b","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detections and Resp","Team: SecuritySolution","Team:Detection Rule Management","Feature:Prebuilt Detection Rules","backport:prev-minor","v8.16.0"],"title":"[Security Solution] Rule `type` field diff algorithm","number":193369,"url":"https:/elastic/kibana/pull/193369","mergeCommit":{"message":"[Security Solution] Rule `type` field diff algorithm (elastic#193369)\n\n## Summary\r\n\r\nAddresses https:/elastic/kibana/issues/190482\r\n\r\nAdds the diff algorithm implementation for the prebuilt rule `type`\r\nfield. Returns `target_version` and a `NON_SOLVABLE` conflict for every\r\noutcome that changes the field.\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n\r\n\r\n### For maintainers\r\n\r\n- [ ] This was checked for breaking API changes and was [labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"18465e7f7e5d9912e61da68873045f0db984fa2b"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https:/elastic/kibana/pull/193369","number":193369,"mergeCommit":{"message":"[Security Solution] Rule `type` field diff algorithm (elastic#193369)\n\n## Summary\r\n\r\nAddresses https:/elastic/kibana/issues/190482\r\n\r\nAdds the diff algorithm implementation for the prebuilt rule `type`\r\nfield. Returns `target_version` and a `NON_SOLVABLE` conflict for every\r\noutcome that changes the field.\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n\r\n\r\n### For maintainers\r\n\r\n- [ ] This was checked for breaking API changes and was [labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"18465e7f7e5d9912e61da68873045f0db984fa2b"}},{"branch":"8.x","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Davis Plumlee <[email protected]> Co-authored-by: Elastic Machine <[email protected]>
seanrathier
pushed a commit
to seanrathier/kibana
that referenced
this pull request
Oct 2, 2024
…lastic#193372) ## Summary Related ticket: elastic#190482 Adds test plan for diff algorithm for `type` field diff algorithm implemented here: elastic#193369 ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
seanrathier
pushed a commit
to seanrathier/kibana
that referenced
this pull request
Oct 2, 2024
## Summary Addresses elastic#190482 Adds the diff algorithm implementation for the prebuilt rule `type` field. Returns `target_version` and a `NON_SOLVABLE` conflict for every outcome that changes the field. ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
dplumlee
added a commit
that referenced
this pull request
Oct 8, 2024
…rithms (#193375) ## Summary Completes #190482 Switches rule `type` field to use the implemented diff algorithms assigned to them in #193369 Adds integration tests in accordance to #193372 for the `upgrade/_review` API endpoint for the rule `type` field diff algorithm. Also fixes some nested bracket misalignment that occurred in earlier PRs with some test files ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Oct 8, 2024
…rithms (elastic#193375) ## Summary Completes elastic#190482 Switches rule `type` field to use the implemented diff algorithms assigned to them in elastic#193369 Adds integration tests in accordance to elastic#193372 for the `upgrade/_review` API endpoint for the rule `type` field diff algorithm. Also fixes some nested bracket misalignment that occurred in earlier PRs with some test files ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) (cherry picked from commit e119d83)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Addresses #190482
Adds the diff algorithm implementation for the prebuilt rule
typefield. Returnstarget_versionand aNON_SOLVABLEconflict for every outcome that changes the field.Checklist
Delete any items that are not applicable to this PR.
For maintainers