Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution][Detections] Support error scenario for rule_id conflicts between pre-packaged rules #128542

Open
spong opened this issue Mar 24, 2022 · 2 comments
Labels
enhancement New value added to drive a business result Feature:Detection Rules Security Solution rules and Detection Engine Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Feature:Rule Management Security Solution Detection Rule Management area Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. triage_needed

Comments

@spong
Copy link
Member

spong commented Mar 24, 2022

Summary

As outlined in #128202, there is the possibility of pre-packaged rules ending up with non-unique rule_id's when being loaded from the fleet/integrations security-rule SO's. This error scenario is not currently handled and the 'first rule in wins' with no error to the user. This issue is for addressing this error scenario and raising it to the user such that they can choose which conflicting rule to install, and are provided enough information about the source package such that they can contact the package owner so they can resolve the issue and re-publish their package.

In team discussions around #128202, @jethr0null mentioned it would be ideal if we could surface this information before the user clicks the update button, and so we may want to update the prepackaged_rules_route to include data around conflicting rules so we can augment the existing New/Update Rules callout UI.

Reproduction Steps

The easy way (now less easy)

The easy way to reproduce this issue here is to modify one of the existing security-rule SO's in place and update it to have the same rule_id as another rule. NOTE: Since they've disabled superuser editing system indices by default, this is now less easy as you need to create a role that will be able to modify the .kibana system index (for which I was unsuccessful 🤷).

  1. Ensure you've navigated to the Security Solution UI at least once since starting Kibana (this will ensure the fleet detection rule assets are installed)
  2. Go to dev tools and query for some security-rule assets
GET .kibana_8.2.0/_search
{
  "query": {
    "term": {
      "type": {
        "value": "security-rule"
      }
    }
  }
}
  1. Grab the _id from one rule and the rule_id from another rule and then update that first rule
POST .kibana_8.2.0/_update/security-rule:e3c5d5cb-41d5-4206-805c-f30561eae3ac
{
  "doc": {
    "rule_id": "e48236ca-b67a-4b4e-840c-fdc7782bc0c3"
  }
}

The e2e way (which is now probably easier 😅 )

  1. Clone the EPR repo from here: https://github.com/elastic/package-registry
  2. Follow instructions in readme to get setup -- may take a little to get dependencies right depending on your system/setup
  3. Do a build (mage build), then manually edit one of the security-rule assets in the latest version to have the same rule_id as another rule. The assets are located somewhere like:

build/package-storage/packages/security_detection_engine/1.0.1/kibana/security_rule/0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0.json

  1. Run package-registry (go run . in root dir)
  2. Modify .kibana.dev.yml to use this package-registry by adding xpack.fleet.registryUrl: 'http://localhost:8080'
  3. Run kibana, load pre-packaged rules, notice only one of the two rules with the same rule_id is actually loaded.
  4. 🎉 You did it!🏅 🎉
@spong spong added triage_needed enhancement New value added to drive a business result Feature:Detection Rules Security Solution rules and Detection Engine Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Feature:Rule Management Security Solution Detection Rule Management area Team:Detection Rule Management Security Detection Rule Management Team labels Mar 24, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New value added to drive a business result Feature:Detection Rules Security Solution rules and Detection Engine Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Feature:Rule Management Security Solution Detection Rule Management area Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. triage_needed
Projects
None yet
Development

No branches or pull requests

2 participants