Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Refactor the rule export endpoint #151690

Open
maximpn opened this issue Feb 21, 2023 · 2 comments
Open

[Security Solution] Refactor the rule export endpoint #151690

maximpn opened this issue Feb 21, 2023 · 2 comments
Labels
Feature:Rule Import/Export Security Solution Detection Rule Import & Export workflow refactoring Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. technical debt Improvement of the software architecture and operational architecture

Comments

@maximpn
Copy link
Contributor

maximpn commented Feb 21, 2023

Relates to: https://github.com/elastic/security-team/issues/5339, #150097, #150553

Description

Rule exporting implementation contains two separate branches to handle the export, one for exporting all rules via getExportAll() and another one for exporting only selected rules via getExportByObjectIds(). While the functionality should be the same which is not totally true here the only difference is rules for processing. This way it looks logical to have a single function to handle exporting logic which accepts a set of rules. This will also help to make sure exported rule data doesn't contain any runtime information stored in SO like execution_summary as we encountered a such a problem before and fixed it in #150553 and #150097. Refactoring of rule exporting functionality will help mitigate mentioned risks and improve maintainability.
@maximpn maximpn added enhancement New value added to drive a business result Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team 8.8 candidate Feature:Rule Import/Export Security Solution Detection Rule Import & Export workflow labels Feb 21, 2023
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@maximpn maximpn changed the title [Security Solution] Simplify rule exporting [Security Solution] Simplify rule export Feb 21, 2023
@banderror banderror added refactoring technical debt Improvement of the software architecture and operational architecture and removed enhancement New value added to drive a business result 8.8 candidate labels Mar 23, 2023
@banderror banderror changed the title [Security Solution] Simplify rule export [Security Solution] Refactor the rule export exndpoint Mar 23, 2023
@banderror banderror changed the title [Security Solution] Refactor the rule export exndpoint [Security Solution] Refactor the rule export endpoint Mar 23, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Feature:Rule Import/Export Security Solution Detection Rule Import & Export workflow refactoring Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. technical debt Improvement of the software architecture and operational architecture
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@maximpn @banderror @elasticmachine