Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Bug][FR] Remove Rule Type Change Restriction and Fix Version Lock Bug #2769

Merged
merged 5 commits into from
May 2, 2023
Merged

[Bug][FR] Remove Rule Type Change Restriction and Fix Version Lock Bug #2769

merged 5 commits into from
May 2, 2023

Conversation

terrancedejesus
Copy link
Contributor

@terrancedejesus terrancedejesus commented May 1, 2023 •
edited
Loading

Issues

Related

Summary

This PR removes the restriction of changing rule types. This was made a restriction due to a bug in the Detection Engine that was resolved in 8.2. Our rules currently only backport to >=8.3 and therefore are clear of the stack version window the bug exists in.

To solve this, we removed an validation error check that compares the version_lock.json rule contents type value to the existing from the loaded rule.

Bug - Version lock route B (forked rule); previous key full semantic

During testing, dev build-release --update-version-lock was ran to ensure a proper prebuilt rules package could be built after changing the rule type of an existing rule.

The VersionLockFile schema in version_lock.py failed due to the additional previous entry being fully semantic 8.3.0 instead of major and minor 8.3 as expected.

To solve this a new variable stripped_latest_locked_stack_version was added by only assigning the major and minor versions from latest_locked_stack_version as such {latest.major}.{latest.minor}. This then becomes the previous key in the version_lock.json file if a rule if forked.

Screenshot 2023-05-01 at 11 20 50 AM

Screenshot 2023-05-01 at 11 21 29 AM

Screenshot 2023-05-01 at 11 24 07 AM

@terrancedejesus terrancedejesus added bug Something isn't working enhancement New feature or request python Internal python for the repository labels May 1, 2023
@terrancedejesus terrancedejesus self-assigned this May 1, 2023
@terrancedejesus terrancedejesus linked an issue May 1, 2023 that may be closed by this pull request
[FR] Remove Rule Type Change Restriction #2765
Closed
@botelastic botelastic bot added Domain: Endpoint OS: Windows windows related rules labels May 1, 2023
@terrancedejesus terrancedejesus requested a review from w0rk3r May 2, 2023 14:31
w0rk3r
w0rk3r approved these changes May 2, 2023
View reviewed changes
Copy link
Contributor

@w0rk3r w0rk3r left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@terrancedejesus terrancedejesus merged commit a04cf18 into main May 2, 2023
@terrancedejesus terrancedejesus deleted the 2765-fr-remove-rule-type-change-restriction branch May 2, 2023 15:00
protectionsmachine pushed a commit that referenced this pull request May 2, 2023
@terrancedejesus @github-actions
[Bug][FR] Remove Rule Type Change Restriction and Fix Version Lock Bug (
0f1504c 
#2769)

* updated version_lock to remove type restriction

* addressing flake errors

* reverting version lock and testing rule

* reverting spaces in testing rule

(cherry picked from commit a04cf18)
protectionsmachine pushed a commit that referenced this pull request May 2, 2023
@terrancedejesus @github-actions
[Bug][FR] Remove Rule Type Change Restriction and Fix Version Lock Bug (
a3cd513 
#2769)

* updated version_lock to remove type restriction

* addressing flake errors

* reverting version lock and testing rule

* reverting spaces in testing rule

(cherry picked from commit a04cf18)
protectionsmachine pushed a commit that referenced this pull request May 2, 2023
@terrancedejesus @github-actions
[Bug][FR] Remove Rule Type Change Restriction and Fix Version Lock Bug (
5335da6 
#2769)

* updated version_lock to remove type restriction

* addressing flake errors

* reverting version lock and testing rule

* reverting spaces in testing rule

(cherry picked from commit a04cf18)
protectionsmachine pushed a commit that referenced this pull request May 2, 2023
@terrancedejesus @github-actions
[Bug][FR] Remove Rule Type Change Restriction and Fix Version Lock Bug (
67ea6aa 
#2769)

* updated version_lock to remove type restriction

* addressing flake errors

* reverting version lock and testing rule

* reverting spaces in testing rule

(cherry picked from commit a04cf18)
protectionsmachine pushed a commit that referenced this pull request May 2, 2023
@terrancedejesus @github-actions
[Bug][FR] Remove Rule Type Change Restriction and Fix Version Lock Bug (
d1db42d 
#2769)

* updated version_lock to remove type restriction

* addressing flake errors

* reverting version lock and testing rule

* reverting spaces in testing rule

(cherry picked from commit a04cf18)
protectionsmachine pushed a commit that referenced this pull request May 2, 2023
@terrancedejesus @github-actions
[Bug][FR] Remove Rule Type Change Restriction and Fix Version Lock Bug (
e891a3b 
#2769)

* updated version_lock to remove type restriction

* addressing flake errors

* reverting version lock and testing rule

* reverting spaces in testing rule

(cherry picked from commit a04cf18)
protectionsmachine pushed a commit that referenced this pull request May 2, 2023
@terrancedejesus @github-actions
[Bug][FR] Remove Rule Type Change Restriction and Fix Version Lock Bug (
950a195 
#2769)

* updated version_lock to remove type restriction

* addressing flake errors

* reverting version lock and testing rule

* reverting spaces in testing rule

(cherry picked from commit a04cf18)
protectionsmachine pushed a commit that referenced this pull request May 2, 2023
@terrancedejesus @github-actions
[Bug][FR] Remove Rule Type Change Restriction and Fix Version Lock Bug (
a4c0fa3 
#2769)

* updated version_lock to remove type restriction

* addressing flake errors

* reverting version lock and testing rule

* reverting spaces in testing rule

(cherry picked from commit a04cf18)
protectionsmachine pushed a commit that referenced this pull request May 2, 2023
@terrancedejesus @github-actions
[Bug][FR] Remove Rule Type Change Restriction and Fix Version Lock Bug (
0f97a77 
#2769)

* updated version_lock to remove type restriction

* addressing flake errors

* reverting version lock and testing rule

* reverting spaces in testing rule

(cherry picked from commit a04cf18)
protectionsmachine pushed a commit that referenced this pull request May 2, 2023
@terrancedejesus @github-actions
[Bug][FR] Remove Rule Type Change Restriction and Fix Version Lock Bug (
10e0aa2 
#2769)

* updated version_lock to remove type restriction

* addressing flake errors

* reverting version lock and testing rule

* reverting spaces in testing rule

(cherry picked from commit a04cf18)
@terrancedejesus terrancedejesus mentioned this pull request Jul 3, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@w0rk3r w0rk3r w0rk3r approved these changes

@Mikaayenson Mikaayenson Mikaayenson approved these changes

@eric-forte-elastic eric-forte-elastic Awaiting requested review from eric-forte-elastic eric-forte-elastic is a code owner

@brokensound77 brokensound77 Awaiting requested review from brokensound77

Assignees

@terrancedejesus terrancedejesus

Labels
backport: auto bug Something isn't working Domain: Endpoint enhancement New feature or request OS: Windows windows related rules python Internal python for the repository
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[FR] Remove Rule Type Change Restriction
3 participants
@terrancedejesus @Mikaayenson @w0rk3r