mirror of
https://github.com/elastic/kibana.git
synced 2025-04-23 17:28:26 -04:00
199378c60c
**Resolves:** https://github.com/elastic/security-team/issues/10410 ## Summary We want to make Rule Customization available at higher license tiers. ### **Intended Workflows/UX** #### **Basic/Platinum/Security Essentials License Tiers** - **Editing Prebuilt Rules:** - Allow the 8.16 behavior: only actions, exceptions, snoozing, and enable/disable options can be modified. - On the rule editing page, all tabs except *Actions* are disabled. Disabled tabs will display a hover explanation: - "Upgrade to Enterprise to enable prebuilt rule customization" for ECH. - "Upgrade to Security Complete to enable prebuilt rule customization" for Serverless. <img width="356" alt="image" src="https://github.com/user-attachments/assets/72e60933-aaaf-45a0-9660-4cd066d3afec" /> - Rule editing via API is not restricted (tracked separately: https://github.com/elastic/security-team/issues/11504. - **Bulk Actions:** - Modifications to rule content via bulk actions are not allowed. Prebuilt rules are excluded from bulk actions if the license level is insufficient. Users will see an explanation for the exclusion. - Serverless <img width="737" alt="image" src="https://github.com/user-attachments/assets/99fef72f-dd38-4c73-a9e3-7b4c8018b4ed" /> - ECH - On the API level (`_bulk_action`), an error is returned if a user tries to modify a prebuilt rule without the required license. Response in this case looks like this: ```json { "statusCode": 500, "error": "Internal Server Error", "message": "Bulk edit failed", "attributes": { "errors": [ { "message": "Elastic rule can't be edited", "status_code": 500, "rules": [] } ] } } ``` - **Rule Updates:** - Updates are restricted to Elastic’s incoming updates only. - The rule upgrade flyout is in read-only mode. <img width="949" alt="image" src="https://github.com/user-attachments/assets/16a56430-63e6-4096-8ffd-b97f828abdd4" /> - For previously customized rules where customization is now disabled due to insufficient licensing, a notification will appear on the upgrade flyout, clarifying that only an upgrade to Elastic's version is available.  - On the API level (`_perform`), only requests with `pick_version = target` are permitted. Requests with `rule.fields` values are not allowed. API response when `pick_version` is not `target`: ```json { "message": "Only the 'TARGET' version can be selected for a rule update; received: 'CURRENT'", "status_code": 400 } ``` API response when the `fields` value is provided: ```json { "message": "Rule field customization is not allowed. Received fields: name, description", "status_code": 400 } ``` - **Customized Rules:** - Existing customizations remain intact, and the “Modified” badge is retained - On the rule management, monitoring, and update tables:  - On the rule update flyout:  - On the rule details page:  - When we edit a rule with customizations (e.g., change rule's actions), the rule should stay marked as customized - **Import/Export Scenarios:** - These are handled separately (https://github.com/elastic/security-team/issues/11502) #### **Enterprise/Security Complete License Tiers** - All rules can be fully edited - Upgraded prebuilt or customized rules will have an editable view, enabling full customization |
||
|---|---|---|
| .. | ||
| hooks | ||
| pipeline-resource-definitions | ||
| pipeline-utils | ||
| pipelines | ||
| scripts | ||
| .mocharc.json | ||
| .npmrc | ||
| disabled_jest_configs.json | ||
| ftr_base_serverless_configs.yml | ||
| ftr_configs_manifests.json | ||
| ftr_oblt_serverless_configs.yml | ||
| ftr_oblt_stateful_configs.yml | ||
| ftr_platform_stateful_configs.yml | ||
| ftr_search_serverless_configs.yml | ||
| ftr_search_stateful_configs.yml | ||
| ftr_security_serverless_configs.yml | ||
| ftr_security_stateful_configs.yml | ||
| package-lock.json | ||
| package.json | ||
| pull_requests.json | ||
| README.md | ||
| tsconfig.json | ||
| tsconfig.test.json | ||
Kibana / Buildkite
Directory Structure
hooks- special directory used by Buildkite agents for hookspipeline-utils- Shared TypeScript utils for use in pipeline scriptspipelines- contains pipeline definitionsscripts/common- scripts that getsourced by other scripts to set environment variables or import shared functionsscripts/lifecycle- general scripts for tasks that run before or after individual steps or the entire buildscripts/steps- scripts that define something that will run for a step defined in a pipelinescripts/*- all other scripts are building blocks that make up the tasks in pipelines. They may be run by other scripts, but should not besourced