Add toggle to enable/disable rule install from SOs #106189

rw-access · 2021-07-19T23:37:48Z

Summary

Added config flags xpack.securitySolution.prebuiltRulesFromSavedObjects and xpack.securitySolution.prebuiltRulesFromFileSystem so cloud rule updates can be disabled for CI.

Here's how I tested the flag locally. Left a persistent ES running and removed three rules, then ran:

$ yarn start --ssl --xpack.securitySolution.prebuiltRulesFromSavedObjects=false

Then restarted Kibana (kept ES running) and enabled rules from Fleet SOs. The removed rules are now available as an update:

$ yarn start --ssl --xpack.securitySolution.prebuiltRulesFromSavedObjects=true

Checklist

Existing tests should work as-is.

Testing this under a few different scenarios

Remove a few rules, with prebuiltRulesFromSavedObjects=false. Should pass CI (035e116). Result: ✅ as expected
Remove a few rules, with prebuiltRulesFromSavedObjects=true. Should fail CI (327abcb). Result ❌ as expected for the relevant tests
Restore the rules back as they were and with prebuiltRulesFromSavedObjects=false. Must pass CI and be ready to merge (c0e4e03). Result: ✅ as expected

...ns/security_solution/server/lib/detection_engine/routes/rules/add_prepackaged_rules_route.ts

x-pack/plugins/security_solution/server/config.ts

jbudz

kibana-docker LGTM

…curity-rules

FrankHassanabad

LGTM,

What I did:

Review the code

What I couldn't do:

I couldn't run Cypress, it crashes right now on my system. But it also on master, so it's not this PR issue.

kibanamachine · 2021-07-21T01:58:11Z

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

💔 Build #139863 failed 8f9eb82
💚 Build #139739 succeeded c0e4e03
💔 Build #139610 failed 327abcb
💚 Build #139602 succeeded 035e116
💔 Build #139596 failed 1ab430c

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

academo · 2021-07-21T07:04:03Z

Could add some unit tests as well for prebuiltRulesFromSavedObjects=true? I only see them for the false scenario.

paul-tavares

LGTM 🚢
Had only one question, but it's more for my own understanding.

paul-tavares · 2021-07-21T12:06:05Z

x-pack/plugins/security_solution/server/fleet_integration/handlers/install_prepackaged_rules.ts

@@ -37,6 +39,8 @@ export const installPrepackagedRules = async ({
  securityStart,
  alerts,
  maxTimelineImportExportSize,
+  prebuiltRulesFromFileSystem,


Just for my own understanding - Is this why we needed to "thread" these two new arguments all the way through to the endpoint context + Fleet integration callback? to feed it into alerts.getAlertsClientWithRequest()?

yeah exactly

* Add toggle to enable/disable rule install from SOs * Fix lint and type tests * Fix types for tests * Enable prebuiltRulesFromSavedObjects with extra rules in fleet * Restore rules and disable prebuiltRulesFromSavedObjects * Pass explicit arguments instead of full config * Set values in 'endpoint' setup * Propagate prebuiltRulesFrom{FileSystem,SavedObjects} from configs

kibanamachine · 2021-07-21T12:10:52Z

💔 Backport failed

Status	Branch	Result
❌	7.14	Commit could not be cherrypicked due to conflicts
✅	7.x

Successful backport PRs will be merged automatically after passing CI.

To backport manually run:
node scripts/backport --pr 106189

* Add toggle to enable/disable rule install from SOs * Fix lint and type tests * Fix types for tests * Enable prebuiltRulesFromSavedObjects with extra rules in fleet * Restore rules and disable prebuiltRulesFromSavedObjects * Pass explicit arguments instead of full config * Set values in 'endpoint' setup * Propagate prebuiltRulesFrom{FileSystem,SavedObjects} from configs Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>

…y-show-migrate-to-authzd-users * 'master' of github.com:elastic/kibana: (48 commits) [Canvas] Expression shape (elastic#103219) [FTR] Skips Vega tests [Sample data] Use Lens in ecommerce data (elastic#106039) [APM] Backends inventory & overview page routes (elastic#106223) [TSVB] Add more functional tests for Gauge and TopN (elastic#105361) Add toggle to enable/disable rule install from SOs (elastic#106189) Improve unit test coverage of FS API calls (elastic#106242) Remove recursive plugin status in meta field (elastic#106286) [Ingest pipelines] add community id processor (elastic#103863) [XY axis] Fixes the values inside bar charts (elastic#106198) [data.search] Set default expiration to 1m if search sessions are disabled (elastic#105329) set the doc title when navigating to reporting and unset when navigating away (elastic#106253) [Lens] Display legend inside chart (elastic#105571) [RAC] [TGrid] Migrate the TGrid's rendering to `EuiDataGrid` (elastic#106199) [Security Solutions] Removes the elastic legacy client from lists and security_solution plugins (elastic#106130) [Enterprise Search] Require security plugin in 8.0 (elastic#106307) [DOCS] Updates screenshots in Dev Tools docs (elastic#105859) [DOCS] Updates text and screenshots in tags doc (elastic#105853) [Alerting] Allow rule types to extract/inject saved object references on rule CRU (elastic#101896) Jest and Storybook fixes (elastic#104991) ... # Conflicts: # x-pack/plugins/reporting/public/plugin.ts

…106418) * Add toggle to enable/disable rule install from SOs * Fix lint and type tests * Fix types for tests * Enable prebuiltRulesFromSavedObjects with extra rules in fleet * Restore rules and disable prebuiltRulesFromSavedObjects * Pass explicit arguments instead of full config * Set values in 'endpoint' setup * Propagate prebuiltRulesFrom{FileSystem,SavedObjects} from configs

Add toggle to enable/disable rule install from SOs

3b5032d

rw-access added v8.0.0 v7.14.0 v7.15.0 labels Jul 19, 2021

Fix lint and type tests

1ab430c

rw-access added release_note:skip Skip the PR/issue when compiling release notes auto-backport Deprecated - use backport:version if exact versions are needed labels Jul 20, 2021

rw-access added 3 commits July 19, 2021 19:17

Fix types for tests

035e116

Enable prebuiltRulesFromSavedObjects with extra rules in fleet

327abcb

Restore rules and disable prebuiltRulesFromSavedObjects

c0e4e03

rw-access marked this pull request as ready for review July 20, 2021 16:05

rw-access requested a review from a team as a code owner July 20, 2021 16:05

FrankHassanabad reviewed Jul 20, 2021

View reviewed changes

...ns/security_solution/server/lib/detection_engine/routes/rules/add_prepackaged_rules_route.ts Outdated Show resolved Hide resolved

FrankHassanabad reviewed Jul 20, 2021

View reviewed changes

...ns/security_solution/server/lib/detection_engine/routes/rules/add_prepackaged_rules_route.ts Outdated Show resolved Hide resolved

FrankHassanabad reviewed Jul 20, 2021

View reviewed changes

x-pack/plugins/security_solution/server/config.ts Show resolved Hide resolved

Pass explicit arguments instead of full config

8f9eb82

rw-access requested a review from a team as a code owner July 20, 2021 19:34

jbudz approved these changes Jul 20, 2021

View reviewed changes

rw-access added 2 commits July 20, 2021 17:25

Merge remote-tracking branch 'origin/master' into ci/disable-fleet-se…

7c0eea9

…curity-rules

Set values in 'endpoint' setup

91d87c9

rw-access requested a review from a team as a code owner July 20, 2021 23:36

rw-access requested review from academo and parkiino July 20, 2021 23:36

Propagate prebuiltRulesFrom{FileSystem,SavedObjects} from configs

4ddc48a

FrankHassanabad approved these changes Jul 20, 2021

View reviewed changes

rw-access enabled auto-merge (squash) July 21, 2021 02:55

paul-tavares approved these changes Jul 21, 2021

View reviewed changes

rw-access merged commit 218c9c2 into elastic:master Jul 21, 2021

kibanamachine mentioned this pull request Jul 21, 2021

[7.x] Add toggle to enable/disable rule install from SOs (#106189) #106397

Merged

rw-access deleted the ci/disable-fleet-security-rules branch July 21, 2021 15:14

rw-access mentioned this pull request Jul 21, 2021

[7.14] Add toggle to enable/disable rule install from SOs (#106189) #106418

Merged

FrankHassanabad mentioned this pull request Jul 22, 2021

[Security Solutions] Make Cypress tests work independent of on-disk rules vs cloud rules #105857

Closed

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add toggle to enable/disable rule install from SOs #106189

Add toggle to enable/disable rule install from SOs #106189

rw-access commented Jul 19, 2021 •

edited

Loading

jbudz left a comment

FrankHassanabad left a comment

kibanamachine commented Jul 21, 2021

academo commented Jul 21, 2021

paul-tavares left a comment

paul-tavares Jul 21, 2021

rw-access Jul 21, 2021

kibanamachine commented Jul 21, 2021

Add toggle to enable/disable rule install from SOs #106189

Add toggle to enable/disable rule install from SOs #106189

Conversation

rw-access commented Jul 19, 2021 • edited Loading

Summary

Checklist

jbudz left a comment

Choose a reason for hiding this comment

FrankHassanabad left a comment

Choose a reason for hiding this comment

kibanamachine commented Jul 21, 2021

💚 Build Succeeded

Metrics [docs]

History

academo commented Jul 21, 2021

paul-tavares left a comment

Choose a reason for hiding this comment

paul-tavares Jul 21, 2021

Choose a reason for hiding this comment

rw-access Jul 21, 2021

Choose a reason for hiding this comment

kibanamachine commented Jul 21, 2021

💔 Backport failed

rw-access commented Jul 19, 2021 •

edited

Loading