[Security Solution][Detections] Support error scenario for rule_id
conflicts between pre-packaged rules
#128542
Labels
enhancement
New value added to drive a business result
Feature:Detection Rules
Security Solution rules and Detection Engine
Feature:Prebuilt Detection Rules
Security Solution Prebuilt Detection Rules area
Feature:Rule Management
Security Solution Detection Rule Management area
Team:Detection Rule Management
Security Detection Rule Management Team
Team:Detections and Resp
Security Detection Response Team
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
triage_needed
Summary
As outlined in #128202, there is the possibility of pre-packaged rules ending up with non-unique
rule_id
's when being loaded from the fleet/integrationssecurity-rule
SO's. This error scenario is not currently handled and the 'first rule in wins' with no error to the user. This issue is for addressing this error scenario and raising it to the user such that they can choose which conflicting rule to install, and are provided enough information about the source package such that they can contact the package owner so they can resolve the issue and re-publish their package.In team discussions around #128202, @jethr0null mentioned it would be ideal if we could surface this information before the user clicks the
update
button, and so we may want to update theprepackaged_rules_route
to include data aroundconflicting
rules so we can augment the existing New/Update Rules callout UI.Reproduction Steps
The easy way (now less easy)
The easy way to reproduce this issue here is to modify one of the existing
security-rule
SO's in place and update it to have the samerule_id
as another rule. NOTE: Since they've disabledsuperuser
editing system indices by default, this is nowless easy
as you need to create a role that will be able to modify the.kibana
system index (for which I was unsuccessful 🤷).security-rule
assets_id
from one rule and therule_id
from another rule and then update that first ruleThe e2e way (which is now probably easier 😅 )
mage build
), then manually edit one of thesecurity-rule
assets in the latest version to have the samerule_id
as another rule. The assets are located somewhere like:go run .
in root dir).kibana.dev.yml
to use this package-registry by addingxpack.fleet.registryUrl: 'http://localhost:8080'
rule_id
is actually loaded.The text was updated successfully, but these errors were encountered: