Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Handle rule deprecations within Prebuilt Rule upgrade workflow #118942

Open
spong opened this issue Nov 17, 2021 · 9 comments
Open

[Security Solution] Handle rule deprecations within Prebuilt Rule upgrade workflow #118942

spong opened this issue Nov 17, 2021 · 9 comments
Assignees
@ARWNightingale
Labels
enhancement New value added to drive a business result Feature:Detection Rules Security Solution rules and Detection Engine Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area needs design Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.

Comments

@spong
Copy link
Member

spong commented Nov 17, 2021

A current limitation of the Prebuilt Rule upgrade workflow (whether loading from filesystem or the Fleet Prebuilt Security Detection Rule integration) is that we don't support the deprecation or removal of prebuilt rules. As a result, when a rule is deprecated, has its' id changed, or is flat out removed from future distributions, previous versions of the installed rule will stick around whether or not they were enabled by the user, and with no indication of why or what rule may have superseded it. This issue is for discussing a deprecation workflow, and what functionality may need to be added in support of it (deprecatedVersion/deprecatedMessage fields, delete-on-update functionality for the pre-packaged rules route, etc).

Note: This information can usually be found either in the Prebuilt Rule Reference documentation, or directly within the detection-rules repo, but is not accessible from within the Security Solution application at the moment.
@spong spong added triage_needed Feature:Detection Rules Security Solution rules and Detection Engine Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. reason:enhancement Team:Detection Rule Management Security Detection Rule Management Team labels Nov 17, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@spong spong changed the title [Security Solution][Detections] Handle deprecation on Prebuilt Rule upgrade workflow [Security Solution][Detections] Handle rule deprecations within Prebuilt Rule upgrade workflow Nov 17, 2021
@spong
Copy link
Member Author

spong commented Dec 6, 2021

Note: the behavior outlined in this issue was present when reviewing #119527. Current thought is the old rule (version 2) was being loaded from a pre-7.16 fleet package (v0.14.2) which didn't include the ruleId update from #118657.

@spong spong mentioned this issue Jan 19, 2022
Closed
@spong spong added the 8.2 candidate considered, but not committed, for 8.2 release label Feb 7, 2022
@spong spong self-assigned this Mar 1, 2022
@banderror banderror added needs design SecuritySolution:QAAssist Part of QA testing process for release v8.2.0 and removed triage_needed labels Mar 7, 2022
@spong spong added 8.3 candidate and removed v8.2.0 8.2 candidate considered, but not committed, for 8.2 release labels Mar 20, 2022
@Mikaayenson Mikaayenson removed needs design Feature:Detection Rules Security Solution rules and Detection Engine Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. reason:enhancement Team:Detection Rule Management Security Detection Rule Management Team SecuritySolution:QAAssist Part of QA testing process for release labels Apr 21, 2022
@botelastic botelastic bot added the needs-team Issues missing a team label label Apr 21, 2022
@banderror
Copy link
Contributor

Hey @Mikaayenson, is there a reason why you removed the labels?

@Mikaayenson
Copy link
Contributor

Mikaayenson commented Apr 25, 2022 •
edited
Loading

Hey @Mikaayenson, is there a reason why you removed the labels?

Glitch in the matrix. (I think when I pruned other issues I made a mistake and removed these) although I don't recall seeing this. I've added them back.

@Mikaayenson Mikaayenson added needs design Feature:Detection Rules Security Solution rules and Detection Engine Team:Detections and Resp Security Detection Response Team reason:enhancement Team:Security Solution Platform Security Solution Platform Team Team:Detection Rule Management Security Detection Rule Management Team SecuritySolution:QAAssist Part of QA testing process for release labels Apr 25, 2022
@botelastic botelastic bot removed the needs-team Issues missing a team label label Apr 25, 2022
@banderror
Copy link
Contributor

Ok cool, thanks for getting them back 🙂

@banderror banderror added Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area 8.4 candidate and removed Team:Security Solution Platform Security Solution Platform Team 8.3 candidate SecuritySolution:QAAssist Part of QA testing process for release labels Apr 26, 2022
@banderror banderror changed the title [Security Solution][Detections] Handle rule deprecations within Prebuilt Rule upgrade workflow [Security Solution] Handle rule deprecations within Prebuilt Rule upgrade workflow Nov 24, 2022
@banderror banderror mentioned this issue Dec 5, 2022
Closed
12 tasks
@spong
Copy link
Member Author

spong commented Jan 4, 2023 •
edited
Loading

Was just discussing this with @terrancedejesus as they've been seeing some deprecated rules being reported in telemetry multiple version past their deprecation (since they'll just keep rolling forward with each version upgrade). So it would be nice to get some part of this worked so users can know within the app that they shouldn't be using these rules anymore (whether that's a deprecated tag, or something more prominent in the UI like a warning callout on Rule Details). May be tougher to add retroactively since we're not shipping these rules anymore, but we'll potentially have more options once the rule immutability work ships, or as @xcrzx brought up, doing a delta between the current package and currently installed.

cc @jethr0null @peluja1012

@terrancedejesus
Copy link
Contributor

terrancedejesus commented Jan 4, 2023 •
edited
Loading

Thanks for sharing @spong. To put some perspective on this from Telemetry, the Unusual Process Execution - Temp detection rule was deprecated prior to the release of 8.4.

However, in the last 60 days, we have ~192 clusters reporting security alerts for this rule with ~4m security alerts in total across these client stacks. 75% of these ~4m security alerts are from stacks where this rule would not exist if removed because it was deprecated.

@ARWNightingale ARWNightingale self-assigned this Jan 10, 2023
@ARWNightingale
Copy link

Hi All, I think this initial design could belong here.

https://www.figma.com/file/gLHm8LpTtSkAUQHrkG3RHU/%5B8.7%5D-%5BRules%5D-Rule-Immutability%2FCustomization?node-id=2218%3A468370&t=1BLDw8a7h50XzbAt-1

@sophiec20 sophiec20 added enhancement New value added to drive a business result and removed reason:enhancement labels Mar 27, 2024
@Mikaayenson Mikaayenson mentioned this issue Mar 29, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ARWNightingale ARWNightingale

Labels
enhancement New value added to drive a business result Feature:Detection Rules Security Solution rules and Detection Engine Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area needs design Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@Mikaayenson @spong @sophiec20 @banderror @elasticmachine @terrancedejesus @ARWNightingale