Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Users can Customize Prebuilt Detection Rules: Milestone 3 #174168

Open
77 of 92 tasks
banderror opened this issue Jan 3, 2024 · 8 comments
Open
77 of 92 tasks

[Security Solution] Users can Customize Prebuilt Detection Rules: Milestone 3 #174168

banderror opened this issue Jan 3, 2024 · 8 comments
Assignees
@rylnd @xcrzx @e40pud @maximpn @jpdjere @banderror @nikitaindik @dplumlee @jkelas
Labels
8.18 candidate Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Meta Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.14.0 v8.15.0 v8.16.0 v8.17.0 v8.18.0

Comments

@banderror
Copy link
Contributor

banderror commented Jan 3, 2024 •
edited
Loading

Epic: https://github.com/elastic/security-team/issues/1974 (internal)
Milestones: << • >>

Status: In development.

Summary

Milestone 3: Add support for customizing prebuilt rules. Extend the rule upgrade workflow with full support for 3-way diffs and conflict resolution. Allow users to:

  • Edit and customize prebuilt rules
  • Export and import prebuilt rules, including customized ones
  • Upgrade prebuilt rules while keeping the user customizations whenever possible

User stories

Prebuilt rule customization workflow:

  • User can edit a single prebuilt rule
    • User can click "edit" button for prebuilt rules and customize (almost) any field on the Rule Editing page, just like it's possible to do with custom rules
    • User can't edit the Author and License fields
  • User can bulk edit multiple prebuilt rules via bulk actions
  • User can see if the rule is customized on the Rule Details page
  • User can see which rules are customized on the Rule Management page

Prebuilt rule upgrade workflow:

  • User can upgrade a single prebuilt rule to its latest version with previewing the incoming updates
    • User can preview updates from Elastic, for each rule field that has an update from Elastic
    • User can preview their customizations, for each rule field that was customized
    • User can compare their customizations with updates from Elastic and see if there are any conflicts between them, per each rule field
    • User can manually resolve conflicts between their customizations and updates from Elastic, per each rule field
    • User can edit the final field values before submitting the update
    • User can upgrade a rule if its type has been changed by Elastic in the latest version, but can only accept the incoming changes
  • User can upgrade a single prebuilt rule to its latest version without previewing the incoming updates
  • User can bulk upgrade multiple prebuilt rules to their latest versions

Prebuilt rule export/import workflow:

  • User can export a single prebuilt rule
    • Pages: Rule Details, Rule Management
    • It can be a prebuilt non-customized or prebuilt customized rule
  • User can bulk export multiple prebuilt rules via bulk actions
    • Pages: Rule Management
    • We support exporting prebuilt non-customized, prebuilt customized, and custom rules in any combination
  • User can bulk import multiple prebuilt rules
    • Pages: Rule Management
    • We support importing prebuilt non-customized, prebuilt customized, and custom rules - in any combination

Useful info

Design

Technical design
Preview Give feedback
  1. [Security Solution] Write an RFC for customizing prebuilt rules #171309
    8.14 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp
    jpdjere
  2. [Security Solution] Discuss rule fields in the context of the prebuilt rule upgrade workflow #147239
    8.14 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp discuss
    approksiu banderror
    jpdjere
  3. [Security Solution] Discuss rule field diffs and conflicts to handle in the UI #148913
    Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp discuss release_note:skip skip-ci
    banderror

UI/UX design
Preview Give feedback
  1. [Security Solution] Discuss UI/UX designs for customizing prebuilt rules #178211
    8.14 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp design

Preparatory changes

Preparatory changes is something we can work on before starting to hide functionality behind a feature flag. This will reduce the overall complexity introduced by feature toggling.

Missing UI for editing certain rule fields
Preview Give feedback
  1. [Security Solution] Allow users to edit setup field for custom rules #173626
    8.14 candidate Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.14.0
    dplumlee
  2. [Security Solution] Allow users to edit max_signals field for custom rules #173593
    8.15 candidate Feature:Rule Creation Feature:Rule Details Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0
    ARWNightingale dplumlee
  3. [Security Solution] Allow users to edit related_integrations field for custom rules #173595
    8.15 candidate Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0
    ARWNightingale maximpn
  4. [Security Solution] Allow users to edit required_fields field for custom rules #173594
    8.15 candidate Feature:Rule Creation Feature:Rule Edit Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0
    ARWNightingale nikitaindik

Missing UI for editing certain rule fields (docs)
Preview Give feedback
  1. Edit setup guide field for custom rules in UI and API security-docs#4917
    3 of 3
    Docset: ESS Docset: Serverless Feature: Rules Team: Detections/Response v8.14.0
    joepeeples
  2. Edit max_signals field for custom rules in UI and API security-docs#5029
    3 of 3
    Docset: ESS Docset: Serverless Feature: Rules Team: Detections/Response v8.15.0
    joepeeples
  3. Edit related_integrations field for custom rules in UI and API security-docs#5099
    3 of 3
    Docset: ESS Docset: Serverless Feature: Rules Team: Detections/Response v8.15.0
    joepeeples
  4. Edit required_fields field for custom rules in UI and API security-docs#5131
    3 of 3
    Docset: ESS Docset: Serverless Feature: Rules Team: Detections/Response v8.15.0
    joepeeples

Schema-related changes
Preview Give feedback
  1. [Security Solution] Add rule_source to the API schema #180122
    8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.15.0
    xcrzx
  2. [Security Solution] Make changes in the internal rule schema #180124
    8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.15.0
    xcrzx
  3. [Security Solution] Replaced the incorrect runtime type used for ruleSource #184004
    Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp backport:skip bug impact:critical release_note:skip v8.15.0
    xcrzx
  4. [Security Solution] Write the rule_source field together with immutable #180141
    8.15 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.15.0
    xcrzx
  5. [Security Solution] RulesManagementClient refactoring. Part 1 #180128
    8.15 candidate Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp refactoring v8.15.0
    jpdjere
  6. [Security Solution] DetectionRulesClient refactoring. Part 2 #184364
    8.16 candidate Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp refactoring v8.15.0 v8.16.0
    nikitaindik xcrzx
  7. [Security Solution] Implement normalization on read for rule_source and immutable fields #180140
    8.16 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    jpdjere

Rule customization, API changes
Preview Give feedback
  1. [Security Solution] Calculate and save ruleSource.isCustomized in API endpoint handlers #180145
    8.16 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    xcrzx
  2. [Security Solution] Calculate and save ruleSource.isCustomized in bulk edit API #187706
    8.16 candidate Feature:Prebuilt Detection Rules Feature:Rule Management Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    xcrzx
  3. [Security Solution] Make rule_source field required in RuleResponse #180270
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    dplumlee
  4. [Security Solution] Prevent from updating "non-customizable" fields in prebuilt rules #180273
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    dplumlee

Rule upgrade, API changes
Preview Give feedback
  1. [Security Solution] Return user-customized fields from the POST /prebuilt_rules/upgrade/_review API endpoint even if they haven't been updated by Elastic in the target version #180154
    8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.15.0
    dplumlee
  2. [Security Solution] Extend the POST /upgrade/_review API endpoint's contract and functionality #180153
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    jpdjere
  3. [Security Solution] Handle specific fields in /upgrade/_review upgrade workflow #180393
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    jpdjere
  4. [Security Solution] Substitute MissingVersion symbol in the ThreeWayDiff object with a boolean #188277
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp refactoring
    jpdjere
  5. [Security Solution] Extend the POST /upgrade/_perform API endpoint's contract and functionality #166376
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0
    jpdjere
  6. [Security Solution] Handle specific fields in /upgrade/_perform endpoint upgrade workflow #186544
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    jpdjere
  7. [Security Solution] Add InvestigationFields and AlertSuppression fields to the upgrade workflow #190597
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp
    jpdjere
  8. [Security Solution] Remove exceptions_list, author and license from Diffable Rule #196213
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    jpdjere

Rule upgrade, diff algorithms
Preview Give feedback
  1. [Security Solution] Implement number diff algorithm #180160
    8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0
    dplumlee
  2. [Security Solution] Implement single-line string diff algorithm #180158
    8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0
    dplumlee
  3. [Security Solution] Implement multi-line string diff algorithm #180159
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0
    dplumlee
  4. [Security Solution] Implement array of scalar values diff algorithm #180162
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0
    dplumlee
  5. [Security Solution] Implement data source fields diff algorithm #187659
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0
    dplumlee
  6. [Security Solution] Implement query fields diff algorithms #187658
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0
    dplumlee
  7. [Security Solution] Implement concurrent_searches and items_per_search fields diff algorithms #188061
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement
    dplumlee
  8. [Security Solution] Implement rule type diff algorithm #190482
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0
    dplumlee

Fleet package with prebuilt rules
Preview Give feedback
  1. [Security Solution] OOMs during prebuilt rules package installation #187969
    3 of 3
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet v8.16.0
    xcrzx
  2. [Fleet] All package SOs are being read into memory during package upgrade or force installation #187975
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet technical debt
    xcrzx
  3. [Fleet] Split bulk delete into chunks to avoid high memory consumption #188208
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet technical debt
    xcrzx
  4. [Fleet] Split asset installation into chunks to avoid high memory pressure #189043
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet
    xcrzx
  5. [Security Solution] API endpoint for the package with prebuilt rules #187647
    8.16 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0
    xcrzx
  6. [Fleet] Stream-based programmatic API for installing packages #187646
    Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet
    kpollich
  7. [Security Solution] Stream-based installation of the package with prebuilt rules #192350
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp Team:Fleet performance v8.17.0
    xcrzx
  8. [Security Solution] Smart limits for the package with prebuilt rules #187645
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.17.0 v8.18.0
    approksiu xcrzx
  9. Include all historical rule versions in the prebuilt rules package detection-rules#4311
    Team: TRADE bug
    shashank-elastic
  10. Ensure that all historical rule versions are included in the prebuilt rules package detection-rules#4312
    Team: TRADE bug
    shashank-elastic
  11. [Investigation] Smart Limits for Detection Rules detection-rules#4150
    Team: TRADE enhancement
    Mikaayenson shashank-elastic
    traut
  12. [FR] [Implementation] Smart Limits for Detection Rules detection-rules#4388
    Team: TRADE community enhancement
    shashank-elastic traut

Changes hidden behind the feature flag

These are changes that will need to be hidden behind the prebuiltRulesCustomizationEnabled feature flag.

Rule customization, UI changes
Preview Give feedback
  1. [Security Solution] Add a new feature flag prebuiltRulesCustomizationEnabled #180130
    8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.15.0
    nikitaindik
  2. [Security Solution] Show if a rule is customized on the Rule Details page #180170
    8.15 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.15.0
    nikitaindik
  3. [Security Solution] Support filtering by "Modified rules" and "Unmodified rules" #180169
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement
    dplumlee
  4. [Security Solution] Add support for editing prebuilt rules to the Rule Management and Rule Details pages #180171
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp
    dplumlee
  5. [Security Solution] Add support for editing prebuilt rules to the Rule Editing page #180172
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp
    dplumlee

Rule upgrade, UI changes
Preview Give feedback
  1. [Security Solution] Handle conflicting rules in the Rule Upgrade table #180589
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp needs design
    ARWNightingale jpdjere
    xcrzx
  2. [Security Solution] Rework Update flyout to display all field updates and build Three-Way-Diff field component #171520
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement v8.16.0 v8.17.0 v8.18.0
    maximpn nikitaindik
  3. [Security Solution] Handle specific fields in the upgrade workflow's UI #188065
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.18.0
    maximpn nikitaindik
  4. [Security Solution] Implement UI for updating prebuilt rule to a new rule type (MVP) #180395
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.18.0
    xcrzx
  5. [Security Solution] Show Modified badge for fields customized by users #203718
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement
    maximpn

Rule export and import, API and UI changes
Preview Give feedback
  1. [Security Solution] Allow exporting prebuilt rules at the API level #180167
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement
    rylnd
  2. [Security Solution] Allow importing prebuilt rules at the API level #180168
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp enhancement
    rylnd
  3. [Security Solution] Support exporting prebuilt rules from the Rule Management page #180173
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp
    dplumlee
  4. [Security Solution] Support exporting prebuilt rules from the Rule Details page #180176
    8.17 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp
    dplumlee
  5. [Security Solution] Benchmark performance of importing a large number of prebuilt rules #195632
    8.18 candidate Feature:Prebuilt Detection Rules Feature:Rule Import/Export Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.18.0
    rylnd

Licensing
Preview Give feedback

Telemetry
Preview Give feedback
  1. [Security Solution] Collect usage statistics for prebuilt rule customization #140369
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp needs product telemetry
    xcrzx

Before release

Bugs
Preview Give feedback
  1. [Security Solution] Users can Customize Prebuilt Detection Rules: Milestone 3 bugs #201502
    60 of 71
    8.18 candidate Feature:Prebuilt Detection Rules Meta Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.16.0 v8.17.0 v8.18.0
    banderror dplumlee
    jkelas jpdjere maximpn nikitaindik xcrzx

Testing
Preview Give feedback
  1. [Security Solution] Write tests for "Customized Elastic rule" badge on the Rule Details page #186916
    8.18 candidate Feature:Prebuilt Detection Rules Feature:Rule Details Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp technical debt test-coverage v8.18.0
    dplumlee nikitaindik
  2. [Security Solution] Tests for prebuilt rule customization workflow #202068
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp test test-coverage test-plan v8.18.0
    banderror dplumlee
  3. [Security Solution] Tests for prebuilt rule upgrade workflow #202078
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp test test-coverage test-plan v8.18.0
    maximpn
  4. [Security Solution] Tests for prebuilt rule import/export workflow #202079
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp test test-coverage test-plan v8.18.0
    banderror dplumlee
  5. [Security Solution] Exploratory testing of prebuilt rule customization workflows #180398
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.18.0
    MadameSheema pborgonovi

Documentation
Preview Give feedback
  1. [Request] Prebuilt rule customization, upgrade, and export/import workflows security-docs#5061
    Docset: ESS Docset: Serverless Feature: Prebuilt rules Feature: Rules Team: Detections/Response v8.18.0 v9.0.0
    nastasha-solomon
  2. [Request] Prebuilt rule customization, upgrade, and export/import workflows - UI copy review security-docs#6238
    Docset: ESS Docset: Serverless Feature: Prebuilt rules Feature: Rules Team: Detections/Response ui-copy v8.18.0 v9.0.0
    ARWNightingale nastasha-solomon
    nikitaindik
  3. [Request] Document new rule_source property for rules in the API schema (DRAFT) security-docs#5063
    v8.18.0
    banderror jpdjere

Release
Preview Give feedback
  1. [Security Solution] Release prebuilt rule customization feature #180267
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.18.0
    maximpn

After release

Last changes after releasing the feature
Preview Give feedback
  1. [Security Solution] Exploratory testing of prebuilt rule customization workflows in production #180399
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.18.0
    pborgonovi
  2. [Security Solution] Add a banner to promote prebuilt rule customization in Serverless (DRAFT) #209000
    8.18 candidate Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp triage_needed
    banderror
  3. [Security Solution] Add a banner to promote prebuilt rule customization in ESS #205594
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp v8.18.0
    nikitaindik
  4. [Security Solution] Remove the prebuiltRulesCustomizationEnabled feature flag #180272
    8.18 candidate Feature:Prebuilt Detection Rules Team: SecuritySolution Team:Detection Rule Management Team:Detections and Resp
@banderror banderror added Meta Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area labels Jan 3, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

This was referenced Jan 12, 2024
Open
Open
This was referenced Jan 26, 2024
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
@banderror banderror mentioned this issue Feb 6, 2024
Open
This was referenced Feb 23, 2024
Open
Closed
@banderror
Copy link
Contributor Author

banderror commented Feb 23, 2024 •
edited
Loading

Draft plan for Milestone 3

UPD: the plan has been moved to the ticket description.

This was referenced Mar 6, 2024
Closed
Closed
Closed
@banderror banderror mentioned this issue Mar 7, 2024
Closed
13 tasks
@approksiu approksiu mentioned this issue Jan 24, 2025
Closed
This was referenced Jan 28, 2025
Closed
Closed
This was referenced Feb 4, 2025
Open
Open
Open
Open
Open
Open
Open
banderror added a commit that referenced this issue Feb 14, 2025
@maximpn @banderror
[Security Solution] Test plan for upgrading prebuilt rules with previ…
ecd3316 
…ew (Rule Upgrade flyout) v1 (#205645)

**Epics:** elastic/security-team#1974
(internal), #174168
**Addresses:** #202078

## Summary

This PR adds a test plan for rule upgrade flyout.

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Feb 14, 2025
@maximpn
[Security Solution] Test plan for upgrading prebuilt rules with previ…
947a8d4 
…ew (Rule Upgrade flyout) v1 (elastic#205645)

**Epics:** elastic/security-team#1974
(internal), elastic#174168
**Addresses:** elastic#202078

## Summary

This PR adds a test plan for rule upgrade flyout.

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
(cherry picked from commit ecd3316)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Feb 14, 2025
@maximpn
[Security Solution] Test plan for upgrading prebuilt rules with previ…
c09f210 
…ew (Rule Upgrade flyout) v1 (elastic#205645)

**Epics:** elastic/security-team#1974
(internal), elastic#174168
**Addresses:** elastic#202078

## Summary

This PR adds a test plan for rule upgrade flyout.

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
(cherry picked from commit ecd3316)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Feb 14, 2025
@maximpn
[Security Solution] Test plan for upgrading prebuilt rules with previ…
b798bd9 
…ew (Rule Upgrade flyout) v1 (elastic#205645)

**Epics:** elastic/security-team#1974
(internal), elastic#174168
**Addresses:** elastic#202078

## Summary

This PR adds a test plan for rule upgrade flyout.

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
(cherry picked from commit ecd3316)
@banderror banderror mentioned this issue Feb 14, 2025
Merged
banderror added a commit that referenced this issue Feb 14, 2025
@banderror
[Security Solution] Refactor prebuilt rule customization test plans, …
9600de4 
…part 1 (#211300)

**Epic:** #174168
**Partially addresses:**
#202068,
#202078,
#202079

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, in this PR we're consistently:

- Changing the file names and test plan titles.
- Adding or expanding test plan summaries.
- Regenerating tables of contents using the [Markdown All in
One](https://marketplace.visualstudio.com/items?itemName=yzhang.markdown-all-in-one)
VS Code extension.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios.

This refactoring prepares the test plans for being "functionally"
changed and improved in follow-up PRs. For example, we're going to cover
the logic described in #210358
and address any other gaps in coverage.
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Feb 14, 2025
@banderror
[Security Solution] Refactor prebuilt rule customization test plans, …
2317d54 
…part 1 (elastic#211300)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202068,
elastic#202078,
elastic#202079

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, in this PR we're consistently:

- Changing the file names and test plan titles.
- Adding or expanding test plan summaries.
- Regenerating tables of contents using the [Markdown All in
One](https://marketplace.visualstudio.com/items?itemName=yzhang.markdown-all-in-one)
VS Code extension.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios.

This refactoring prepares the test plans for being "functionally"
changed and improved in follow-up PRs. For example, we're going to cover
the logic described in elastic#210358
and address any other gaps in coverage.

(cherry picked from commit 9600de4)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Feb 14, 2025
@banderror
[Security Solution] Refactor prebuilt rule customization test plans, …
56ede92 
…part 1 (elastic#211300)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202068,
elastic#202078,
elastic#202079

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, in this PR we're consistently:

- Changing the file names and test plan titles.
- Adding or expanding test plan summaries.
- Regenerating tables of contents using the [Markdown All in
One](https://marketplace.visualstudio.com/items?itemName=yzhang.markdown-all-in-one)
VS Code extension.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios.

This refactoring prepares the test plans for being "functionally"
changed and improved in follow-up PRs. For example, we're going to cover
the logic described in elastic#210358
and address any other gaps in coverage.

(cherry picked from commit 9600de4)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Feb 14, 2025
@banderror
[Security Solution] Refactor prebuilt rule customization test plans, …
037db7c 
…part 1 (elastic#211300)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202068,
elastic#202078,
elastic#202079

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, in this PR we're consistently:

- Changing the file names and test plan titles.
- Adding or expanding test plan summaries.
- Regenerating tables of contents using the [Markdown All in
One](https://marketplace.visualstudio.com/items?itemName=yzhang.markdown-all-in-one)
VS Code extension.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios.

This refactoring prepares the test plans for being "functionally"
changed and improved in follow-up PRs. For example, we're going to cover
the logic described in elastic#210358
and address any other gaps in coverage.

(cherry picked from commit 9600de4)
@banderror banderror mentioned this issue Feb 18, 2025
Merged
banderror added a commit that referenced this issue Feb 18, 2025
@banderror
[Security Solution] Refactor prebuilt rule customization test plans, …
786df79 
…part 2 (#211472)

**Epic:** #174168
**Partially addresses:**
#202068,
#202078,
#202079
**Follow-up to:** #211300

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, this PR:

- Creates an "entrypoint" file that should help navigate all the test
plans for prebuilt rules.
- Creates a file for keeping common information about prebuilt rules
that can be shared between the test plans.
- Extracts duplicated terminology to the file with common information.
- Extracts duplicated assumptions to the file with common information.
- Extracts duplicated non-functional requirements to the file with
common information.
- Adds user stories to each test plan.
- Updates links to tickets in every test plan.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios.

This refactoring prepares the test plans for being "functionally"
changed and improved in follow-up PRs. For example, we're going to cover
the logic described in #210358
and address any other gaps in coverage.

## Review tip

It might be easier to review this PR commit-by-commit as each of them
contains logically cohesive changes.
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Feb 18, 2025
@banderror
[Security Solution] Refactor prebuilt rule customization test plans, …
726048b 
…part 2 (elastic#211472)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202068,
elastic#202078,
elastic#202079
**Follow-up to:** elastic#211300

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, this PR:

- Creates an "entrypoint" file that should help navigate all the test
plans for prebuilt rules.
- Creates a file for keeping common information about prebuilt rules
that can be shared between the test plans.
- Extracts duplicated terminology to the file with common information.
- Extracts duplicated assumptions to the file with common information.
- Extracts duplicated non-functional requirements to the file with
common information.
- Adds user stories to each test plan.
- Updates links to tickets in every test plan.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios.

This refactoring prepares the test plans for being "functionally"
changed and improved in follow-up PRs. For example, we're going to cover
the logic described in elastic#210358
and address any other gaps in coverage.

## Review tip

It might be easier to review this PR commit-by-commit as each of them
contains logically cohesive changes.

(cherry picked from commit 786df79)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Feb 18, 2025
@banderror
[Security Solution] Refactor prebuilt rule customization test plans, …
2f8267b 
…part 2 (elastic#211472)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202068,
elastic#202078,
elastic#202079
**Follow-up to:** elastic#211300

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, this PR:

- Creates an "entrypoint" file that should help navigate all the test
plans for prebuilt rules.
- Creates a file for keeping common information about prebuilt rules
that can be shared between the test plans.
- Extracts duplicated terminology to the file with common information.
- Extracts duplicated assumptions to the file with common information.
- Extracts duplicated non-functional requirements to the file with
common information.
- Adds user stories to each test plan.
- Updates links to tickets in every test plan.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios.

This refactoring prepares the test plans for being "functionally"
changed and improved in follow-up PRs. For example, we're going to cover
the logic described in elastic#210358
and address any other gaps in coverage.

## Review tip

It might be easier to review this PR commit-by-commit as each of them
contains logically cohesive changes.

(cherry picked from commit 786df79)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Feb 18, 2025
@banderror
[Security Solution] Refactor prebuilt rule customization test plans, …
f7e113c 
…part 2 (elastic#211472)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202068,
elastic#202078,
elastic#202079
**Follow-up to:** elastic#211300

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, this PR:

- Creates an "entrypoint" file that should help navigate all the test
plans for prebuilt rules.
- Creates a file for keeping common information about prebuilt rules
that can be shared between the test plans.
- Extracts duplicated terminology to the file with common information.
- Extracts duplicated assumptions to the file with common information.
- Extracts duplicated non-functional requirements to the file with
common information.
- Adds user stories to each test plan.
- Updates links to tickets in every test plan.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios.

This refactoring prepares the test plans for being "functionally"
changed and improved in follow-up PRs. For example, we're going to cover
the logic described in elastic#210358
and address any other gaps in coverage.

## Review tip

It might be easier to review this PR commit-by-commit as each of them
contains logically cohesive changes.

(cherry picked from commit 786df79)
@banderror banderror mentioned this issue Feb 25, 2025
Merged
banderror added a commit that referenced this issue Feb 26, 2025
@banderror
[Security Solution] Refactor prebuilt rule customization test plans, …
c961659 
…part 3 (#212420)

**Epic:** #174168
**Partially addresses:**
#202068,
#202078,
#202079
**Follow-up to:** #211472

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, this PR:

- Updates the common structure of test plans:
- Adds a tip to each test plan's header to help with navigating all our
test plans for prebuilt rules.
- Introduces a new `Requirements` section to each one and consolidates
assumptions, technical requirements and product requirements under it.
- Each `Product requirements` section now contains relevant user stories
and other product details. In the document flow this is kept close to
the `Scenarios` section.
  - Updates the test plan template according to the updated structure.
- Moves the documentation about customizable and non-customizable rule
fields to the common info document.
- Restores the lost changes from commit
bde4612.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios. The only functional-like
changes were made to the user stories when creating/updating the product
requirements sections.

This PR wraps up the refactoring efforts aimed to prepare the test plans
for being "functionally" changed and improved in follow-up PRs. In the
following PRs, we're going to cover the logic described in
#210358, address any gaps in the
coverage, and improve the scenarios structure and wording.

## Review tip

It might be easier to review this PR commit-by-commit as each of them
contains logically cohesive changes.
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Feb 26, 2025
@banderror
[Security Solution] Refactor prebuilt rule customization test plans, …
f3b61d1 
…part 3 (elastic#212420)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202068,
elastic#202078,
elastic#202079
**Follow-up to:** elastic#211472

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, this PR:

- Updates the common structure of test plans:
- Adds a tip to each test plan's header to help with navigating all our
test plans for prebuilt rules.
- Introduces a new `Requirements` section to each one and consolidates
assumptions, technical requirements and product requirements under it.
- Each `Product requirements` section now contains relevant user stories
and other product details. In the document flow this is kept close to
the `Scenarios` section.
  - Updates the test plan template according to the updated structure.
- Moves the documentation about customizable and non-customizable rule
fields to the common info document.
- Restores the lost changes from commit
elastic@bde4612.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios. The only functional-like
changes were made to the user stories when creating/updating the product
requirements sections.

This PR wraps up the refactoring efforts aimed to prepare the test plans
for being "functionally" changed and improved in follow-up PRs. In the
following PRs, we're going to cover the logic described in
elastic#210358, address any gaps in the
coverage, and improve the scenarios structure and wording.

## Review tip

It might be easier to review this PR commit-by-commit as each of them
contains logically cohesive changes.

(cherry picked from commit c961659)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Feb 26, 2025
@banderror
[Security Solution] Refactor prebuilt rule customization test plans, …
2a2e88e 
…part 3 (elastic#212420)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202068,
elastic#202078,
elastic#202079
**Follow-up to:** elastic#211472

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, this PR:

- Updates the common structure of test plans:
- Adds a tip to each test plan's header to help with navigating all our
test plans for prebuilt rules.
- Introduces a new `Requirements` section to each one and consolidates
assumptions, technical requirements and product requirements under it.
- Each `Product requirements` section now contains relevant user stories
and other product details. In the document flow this is kept close to
the `Scenarios` section.
  - Updates the test plan template according to the updated structure.
- Moves the documentation about customizable and non-customizable rule
fields to the common info document.
- Restores the lost changes from commit
elastic@bde4612.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios. The only functional-like
changes were made to the user stories when creating/updating the product
requirements sections.

This PR wraps up the refactoring efforts aimed to prepare the test plans
for being "functionally" changed and improved in follow-up PRs. In the
following PRs, we're going to cover the logic described in
elastic#210358, address any gaps in the
coverage, and improve the scenarios structure and wording.

## Review tip

It might be easier to review this PR commit-by-commit as each of them
contains logically cohesive changes.

(cherry picked from commit c961659)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Feb 26, 2025
@banderror
[Security Solution] Refactor prebuilt rule customization test plans, …
ed8faab 
…part 3 (elastic#212420)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202068,
elastic#202078,
elastic#202079
**Follow-up to:** elastic#211472

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, this PR:

- Updates the common structure of test plans:
- Adds a tip to each test plan's header to help with navigating all our
test plans for prebuilt rules.
- Introduces a new `Requirements` section to each one and consolidates
assumptions, technical requirements and product requirements under it.
- Each `Product requirements` section now contains relevant user stories
and other product details. In the document flow this is kept close to
the `Scenarios` section.
  - Updates the test plan template according to the updated structure.
- Moves the documentation about customizable and non-customizable rule
fields to the common info document.
- Restores the lost changes from commit
elastic@bde4612.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios. The only functional-like
changes were made to the user stories when creating/updating the product
requirements sections.

This PR wraps up the refactoring efforts aimed to prepare the test plans
for being "functionally" changed and improved in follow-up PRs. In the
following PRs, we're going to cover the logic described in
elastic#210358, address any gaps in the
coverage, and improve the scenarios structure and wording.

## Review tip

It might be easier to review this PR commit-by-commit as each of them
contains logically cohesive changes.

(cherry picked from commit c961659)
JoseLuisGJ pushed a commit to JoseLuisGJ/kibana that referenced this issue Feb 27, 2025
@banderror @JoseLuisGJ
[Security Solution] Refactor prebuilt rule customization test plans, …
03f4cd7 
…part 3 (elastic#212420)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202068,
elastic#202078,
elastic#202079
**Follow-up to:** elastic#211472

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, this PR:

- Updates the common structure of test plans:
- Adds a tip to each test plan's header to help with navigating all our
test plans for prebuilt rules.
- Introduces a new `Requirements` section to each one and consolidates
assumptions, technical requirements and product requirements under it.
- Each `Product requirements` section now contains relevant user stories
and other product details. In the document flow this is kept close to
the `Scenarios` section.
  - Updates the test plan template according to the updated structure.
- Moves the documentation about customizable and non-customizable rule
fields to the common info document.
- Restores the lost changes from commit
elastic@bde4612.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios. The only functional-like
changes were made to the user stories when creating/updating the product
requirements sections.

This PR wraps up the refactoring efforts aimed to prepare the test plans
for being "functionally" changed and improved in follow-up PRs. In the
following PRs, we're going to cover the logic described in
elastic#210358, address any gaps in the
coverage, and improve the scenarios structure and wording.

## Review tip

It might be easier to review this PR commit-by-commit as each of them
contains logically cohesive changes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rylnd rylnd

@xcrzx xcrzx

@e40pud e40pud

@maximpn maximpn

@jpdjere jpdjere

@banderror banderror

@nikitaindik nikitaindik

@dplumlee dplumlee

@jkelas jkelas

Labels
8.18 candidate Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Meta Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.14.0 v8.15.0 v8.16.0 v8.17.0 v8.18.0
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
10 participants
@rylnd @xcrzx @e40pud @maximpn @jpdjere @banderror @elasticmachine @nikitaindik @dplumlee @jkelas