[Detection Engine] Adds 8.4 rules

[terrancedejesus]

Summary

Pull updates to detection rules from https://github.com/elastic/detection-rules/tree/395ae2c1d1e1d93ea7520300d4fb5000c58ae870.

Checklist

Delete any items that are not applicable to this PR.

• Any text added follows EUI's writing guidelines,
  uses sentence case text and includes i18n support

[terrancedejesus]

@elasticmachine merge upstream

[terrancedejesus]

⏳ Build in-progress, with failures

• Buildkite Build
• Commit: 9f635d8
• Interpreting CI Failures
• Storybooks Preview

Failed CI Steps

• Build Kibana Distribution and Plugins
• Jest Tests #1
• Jest Tests #2
• Jest Tests #5
• Jest Tests #7
• Jest Integration Tests #2
• Linting
• Linting (with types)
• Checks
• Check Types

Test Failures

• [job] [logs] Jest Integration Tests Change of links to styles and js #2 / incompatible_cluster_routing_allocation retries the INIT action with a descriptive message when cluster settings are incompatible
• [job] [logs] Jest Integration Tests Change of links to styles and js #2 / migrating from 7.3.0-xpack which used v1 migrations copies all the document of the previous index to the new one
• [job] [logs] Jest Integration Tests Change of links to styles and js #2 / migrating from 7.3.0-xpack which used v1 migrations creates the new index and the correct aliases
• [job] [logs] Jest Integration Tests Change of links to styles and js #2 / migrating from 7.3.0-xpack which used v1 migrations migrates the documents to the highest version
• [job] [logs] Jest Integration Tests Change of links to styles and js #2 / migrating from the same Kibana version that used v1 migrations copies the documents from the previous index to the new one
• [job] [logs] Jest Integration Tests Change of links to styles and js #2 / migrating from the same Kibana version that used v1 migrations creates the new index and the correct aliases
• [job] [logs] Jest Integration Tests Change of links to styles and js #2 / migrating from the same Kibana version that used v1 migrations migrates the documents to the highest version
• [job] [logs] Jest Integration Tests Change of links to styles and js #2 / migration from 7.13 to 7.14+ with many failed action_tasks filters out all outdated action_task_params and action tasks
• [job] [logs] Jest Integration Tests Change of links to styles and js #2 / migration from 7.7.2-xpack with 100k objects copies all the document of the previous index to the new one
• [job] [logs] Jest Integration Tests Change of links to styles and js #2 / migration v2 completes the migration even when a full batch would exceed ES http.max_content_length
• [job] [logs] Jest Integration Tests Change of links to styles and js #2 / migration v2 fails with a descriptive message when a single document exceeds maxBatchSizeBytes
• [job] [logs] Jest Integration Tests Change of links to styles and js #2 / migration v2 fails with a descriptive message when maxBatchSizeBytes exceeds ES http.max_content_length
• [job] [logs] Jest Integration Tests Change of links to styles and js #2 / migration v2 with corrupt saved object documents collects corrupt saved object documents across batches
• [job] [logs] Jest Integration Tests Change of links to styles and js #2 / SO type registrations does not remove types from registrations without updating excludeOnUpgradeQuery

History

To update your PR or re-run it, just comment with: @elasticmachine merge upstream

cc @terrancedejesus

These were due to conflicts that were addressed locally in VSCode but still had delta comments in them and then made their way into the files which caused the jobs to fail. Fixed locally and then pushed but changes did not take affect for some odd reason so I edited each file in Github's editor with the local fixes and committed them, the following files caused these errors.

• index.ts
• execution_user_exec_to_pod.json
• discovery_remote_system_discovery_commands_windows.json

[kibana-ci]

💔 Build Failed

• Buildkite Build
• Commit: 5f5d186
• Interpreting CI Failures
• Storybooks Preview

Failed CI Steps

• x-pack/test/detection_engine_api_integration/security_and_spaces/group1/config.ts
• x-pack/test/detection_engine_api_integration/security_and_spaces/group1/config.ts
• FTR Configs #31
• FTR Configs #31

Test Failures

• [job] [logs] x-pack/test/detection_engine_api_integration/security_and_spaces/group1/config.ts / detection engine api security and spaces enabled - Group 1 update_actions updating actions should be able to create a new webhook action and attach it to an immutable rule
• [job] [logs] x-pack/test/detection_engine_api_integration/security_and_spaces/group1/config.ts / detection engine api security and spaces enabled - Group 1 update_actions updating actions should be able to create a new webhook action and attach it to an immutable rule
• [job] [logs] FTR Configs #31 / detection engine api security and spaces enabled - Group 4 Detection rule type telemetry Detection rule telemetry "pre-packaged"/"immutable" rules should show stats for the detection_rule_details for a specific pre-packaged rule
• [job] [logs] FTR Configs #31 / detection engine api security and spaces enabled - Group 4 Detection rule type telemetry Detection rule telemetry "pre-packaged"/"immutable" rules should show stats for the detection_rule_details for a specific pre-packaged rule

Metrics [docs]

✅ unchanged

History

• 💔 Build #64244 failed 9f635d8

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @terrancedejesus

[terrancedejesus]

@elastic/security-detections-response any potential insight into why this test failed?

https://buildkite.com/elastic/kibana-pull-request/builds/64272#0182886d-8b78-44a0-ad8c-66a006c9fcd1

From the looks of it, something in the build job attempts to create an example rule and was expecting most of it to be blank but required_fields was added and it threw the error? Does this happen to be something on our end or the testing side?

[terrancedejesus]

Closing this due to some original conflicts when the PR was created that I addressed but were likely due to local differences. Confirmed with @brokensound77 during his PR creation using the same Detection Rules tag release but no initial conflicts. The BuildKite job failures are consistent.

• [Detection Engine] Adds 8.4 rules #138574