Skip to content

Commit

Permalink
[Security Solution] Finalize Prebuilt Rule Customization workflow lay…
Browse files Browse the repository at this point in the history
…out (#201501)

**Addresses:** #171520

## Summary

This PR updates Prebuilt Rules Customization UI to match the [design](https://www.figma.com/design/gLHm8LpTtSkAUQHrkG3RHU/%5B8.7%5D-%5BRules%5D-Rule-Immutability%2FCustomization?node-id=5146-77820). On top of that it renames and toss files to organize them in a much more clear way.

## Details

A number of changes required to match the [design](https://www.figma.com/design/gLHm8LpTtSkAUQHrkG3RHU/%5B8.7%5D-%5BRules%5D-Rule-Immutability%2FCustomization?node-id=5146-77820)

- move save/accept button to the field's right side header
- expose additional field upgrade state `NoConflicts` to distinguish between `Accepted` and `NoConflicts` states
- consume `ruleUpgradeState` in different components to display proper badges and texts

Additional refactoring was done to facilitate the changes

- `FinalRuleContext` and `FieldFinalEditContext` were merged together into `FieldUpgradeContext`
- files and some folders were renamed and tossed to make the structure simpler and transparent
  There is still space for improvement. Current PR tries to minimize the changes to avoid too many conflicts since development is still in progress. And an additional limit of 200 path characters is imposed in Kibana preventing too deep foldering. Some functionality could be moved to a package later on to mitigate that obstacle.

## How to test locally

- Ensure the `prebuiltRulesCustomizationEnabled` feature flag is enabled
- Allow internal APIs via adding `server.restrictInternalApis: false` to `kibana.dev.yaml`
- Clear Elasticsearch data
- Run Elasticsearch and Kibana locally (do not open Kibana in a web browser)
- Install an outdated version of the `security_detection_engine` Fleet package
```bash
curl -X POST --user elastic:changeme  -H 'Content-Type: application/json' -H 'kbn-xsrf: 123' -H "elastic-api-version: 2023-10-31" -d '{"force":true}' http://localhost:5601/kbn/api/fleet/epm/packages/security_detection_engine/8.14.1
```

- Install prebuilt rules
```bash
curl -X POST --user elastic:changeme  -H 'Content-Type: application/json' -H 'kbn-xsrf: 123' -H "elastic-api-version: 1" -d '{"mode":"ALL_RULES"}' http://localhost:5601/kbn/internal/detection_engine/prebuilt_rules/installation/_perform
```
- Open `Detection Rules (SIEM)` Page -> `Rule Updates`
- Modify one or more prebuilt rules with updates to see unresolved conflicts (don't forget to refresh the page after rule's modification, it's required to clear the cache)

## Screenshots and screen recordings

![Screenshot 2024-11-26 at 13 42 16](https://github.com/user-attachments/assets/126bdc64-b810-424a-b81e-7674480a66cf)

![Screenshot 2024-11-26 at 13 42 27](https://github.com/user-attachments/assets/af5d9c2c-055d-423d-880a-b69e95ba129c)

![Screenshot 2024-11-26 at 13 42 40](https://github.com/user-attachments/assets/b0f87a95-df23-42a8-883b-29665f3db325)


https://github.com/user-attachments/assets/7befe77a-3af7-48ea-a23f-aa0017d94be5


https://github.com/user-attachments/assets/2837b405-3889-44a0-b1cb-d6c51cd9d051


https://github.com/user-attachments/assets/7cbc411d-a927-45e9-8607-7ef515337ab5
  • Loading branch information
maximpn authored Dec 11, 2024
1 parent a176c0f commit 2dcbc5d
Show file tree
Hide file tree
Showing 134 changed files with 1,966 additions and 1,333 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -39080,43 +39080,26 @@
"xpack.securitySolution.detectionEngine.rules.upgradeRules.comparisonSide.title": "Affichage différé",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.currentVersionDescriptionLabel": "Affiche la règle actuellement installée",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.currentVersionLabel": "Règle actuelle",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.diffTab.fieldsWithUpdates": "La mise à niveau contient {count} {count, plural, one {champ} other {champs}}",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.diffTab.numOfConflicts": "{count} {count, plural, one {conflit} other {conflits}}",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.editButtonLabel": "Modifier",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.elasticUpdateVersionLabel": "Mise à jour Elastic",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.expandHiddenDiffLinesLabel": "Développer {linesCount}{linesCount, plural, one {ligne} other {lignes}}",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldReadOnly.noteLabel": "Guide d'investigation",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.nonSolvableConflict": "Conflit résolu",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.nonSolvableConflictDescription": "Nous avons suggéré une mise à jour pour ce champ modifié, veuillez la consulter avant d'accepter.",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleHasNonSolvableConflicts": "{count} des champs {count, plural, one {a} other {ont}} un conflit non résolu. Veuillez en prendre connaissance et apporter les modifications appropriées.",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleHasNonSolvableConflictsDescription": "Veuillez apporter une contribution au conflit non résolu. Vous pouvez également conserver la version actuelle sans les mises à jour, ou accepter la mise à jour Elastic tout en perdant vos modifications.",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleHasSolvableConflicts": "{count} des champs {count, plural, one {a} other {ont}} un conflit de mise à jour. Veuillez examiner la mise à jour en cours suggérée.",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleHasSolvableConflictsDescription": "Veuillez consulter la version mise à jour recommandée avant de l'accepter. Vous pouvez modifier le champ, puis l'enregistrer, si nécessaire.",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleIsReadyForUpgrade": "La mise à jour est prête à être appliquée.",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleIsReadyForUpgradeDescription": "Tous les conflits ont maintenant été examinés et résolus, veuillez mettre à jour la règle.",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.separator": "-",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.solvableConflict": "Conflit résolu",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.solvableConflictDescription": "Nous avons suggéré une mise à jour pour ce champ modifié, veuillez la consulter avant d'accepter.",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.updateAccepted": "Mise à jour acceptée",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.updateAcceptedDescription": "Vous pouvez toujours apporter des modifications, veuillez consulter/accepter tous les autres conflits avant de mettre à jour la règle.",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.finalUpdate": "Mise à jour finale",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.noRulesBodyTitle": "Il n’y a actuellement aucune mise à jour disponible pour vos règles Elastic installées.",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.noRulesTitle": "Toutes les règles Elastic sont à jour",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.ruleUpgradeHelper": "Découvrez comment {docsLink}.",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.saveButtonLabel": "Enregistrer",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.searchBarPlaceholder": "Rechercher par nom de règle",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.updatedVersionDescriptionLabel": "Affiche la règle qui sera installée",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.updateYourRulesDocsLink": "mettre à jour vos règles",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.upgradeAll": "Tout mettre à jour",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.upgradeHelpText": "Choisissez les valeurs de champ utilisées dans la règle mise à niveau.",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.upgradeSelected": "Mettre à jour {numberOfSelectedRules} règle(s) sélectionnée(s)",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.ariaLabel": "Sélectionnez les versions à comparer",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.baseVsCurrentLabel": "Base - Actuel",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.baseVsFinalLabel": "Base - Final",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.baseVsTargetLabel": "Base - Cible",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.currentVsFinalLabel": "Actuel - Final",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.currentVsTargetLabel": "Actuel - Cible",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.targetVsFinalLabel": "Actuel - Final",
"xpack.securitySolution.detectionEngine.rulesSnoozeBadge.error.unableToFetch": "Impossible de récupérer les paramètres de répétition",
"xpack.securitySolution.detectionEngine.ruleStatus.askAssistant": "Demander à l'assistant",
"xpack.securitySolution.detectionEngine.ruleStatus.askAssistantDesc": "Message d'erreur de l'exécution de la règle",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -38937,43 +38937,26 @@
"xpack.securitySolution.detectionEngine.rules.upgradeRules.comparisonSide.title": "差異ビュー",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.currentVersionDescriptionLabel": "現在インストールされているルールを表示します",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.currentVersionLabel": "現在のルール",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.diffTab.fieldsWithUpdates": "アップグレードには{count} {count, plural, other {個のフィールド}}があります",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.diffTab.numOfConflicts": "{count} {count, plural, other {件の競合}}",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.editButtonLabel": "編集",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.elasticUpdateVersionLabel": "Elastic更新",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.expandHiddenDiffLinesLabel": "変更されていない{linesCount} {linesCount, plural, other {行}}を展開",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldReadOnly.noteLabel": "調査ガイド",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.nonSolvableConflict": "解決された競合",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.nonSolvableConflictDescription": "この修正されたフィールドの更新を提案しました。承認する前に確認してください。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleHasNonSolvableConflicts": "{count}個のフィールド{count, plural, other {には}}未解決の競合があります。確認し、必要に応じて修正してください。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleHasNonSolvableConflictsDescription": "未解決の競合の情報を入力してください。更新を適用せずに現在の状態を維持することもできます。Elasticの更新を承認すると、修正内容は失われます。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleHasSolvableConflicts": "{count}個のフィールド{count, plural, other {には}}更新の競合があります。更新中の候補の更新を確認してください。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleHasSolvableConflictsDescription": "更新を承認する前に、提案された更新バージョンを確認してください。変更する場合は、編集してフィールドを保存できます。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleIsReadyForUpgrade": "更新を適用できます。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleIsReadyForUpgradeDescription": "すべての競合が確認され、解決されました。ルールを更新してください。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.separator": "-",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.solvableConflict": "解決された競合",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.solvableConflictDescription": "この修正されたフィールドの更新を提案しました。承認する前に確認してください。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.updateAccepted": "更新が承認されました",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.updateAcceptedDescription": "変更を行うことができます。ルールを更新する前に、他のすべての競合を確認/承認してください。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.finalUpdate": "最終更新",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.noRulesBodyTitle": "現在、インストールされているElasticルールに利用可能な更新はありません。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.noRulesTitle": "すべてのElasticルールが最新です",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.ruleUpgradeHelper": "{docsLink}方法を確認してください。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.saveButtonLabel": "保存",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.searchBarPlaceholder": "ルール名で検索",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.updatedVersionDescriptionLabel": "インストールされるルールを表示します",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.updateYourRulesDocsLink": "ルールを更新",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.upgradeAll": "すべて更新",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.upgradeHelpText": "アップグレードされたルールで使用されるフィールド値を選択してください。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.upgradeSelected": "{numberOfSelectedRules}個の選択したルールを更新",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.ariaLabel": "比較するバージョンを選択",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.baseVsCurrentLabel": "基本と現在",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.baseVsFinalLabel": "基本と最終",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.baseVsTargetLabel": "基本とターゲット",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.currentVsFinalLabel": "現在と最終",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.currentVsTargetLabel": "現在とターゲット",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.targetVsFinalLabel": "ターゲットと最終",
"xpack.securitySolution.detectionEngine.rulesSnoozeBadge.error.unableToFetch": "スヌーズ設定を取得できません",
"xpack.securitySolution.detectionEngine.ruleStatus.askAssistant": "アシスタントに聞く",
"xpack.securitySolution.detectionEngine.ruleStatus.askAssistantDesc": "ルールの実行失敗メッセージ",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -38361,43 +38361,26 @@
"xpack.securitySolution.detectionEngine.rules.upgradeRules.comparisonSide.title": "差异视图",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.currentVersionDescriptionLabel": "显示当前安装的规则",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.currentVersionLabel": "当前规则",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.diffTab.fieldsWithUpdates": "升级包含 {count} 个{count, plural, other {字段}}",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.diffTab.numOfConflicts": "{count} 个{count, plural, other {冲突}}",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.editButtonLabel": "编辑",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.elasticUpdateVersionLabel": "Elastic 更新",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.expandHiddenDiffLinesLabel": "展开 {linesCount} 个未更改的{linesCount, plural, other {行}}",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldReadOnly.noteLabel": "调查指南",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.nonSolvableConflict": "已解决冲突",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.nonSolvableConflictDescription": "我们已为这个已修改字段推荐了更新,请在接受前进行复查。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleHasNonSolvableConflicts": "{count} 个字段{count, plural, other {存在}}未解决的冲突。请复查并做出相应更改。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleHasNonSolvableConflictsDescription": "请为未解决的冲突提供输入。您还可以保持现状而不进行更新,也可以接受 Elastic 更新但丢失修改。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleHasSolvableConflicts": "{count} 个字段{count, plural, other {存在}}更新冲突,请复查正在更新的建议更新。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleHasSolvableConflictsDescription": "在接受更新之前,请复查建议的已更新版本。如果希望更改字段,您可以编辑然后保存字段。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleIsReadyForUpgrade": "更新已准备就绪,可以应用。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.ruleIsReadyForUpgradeDescription": "现已复查并解决所有冲突,请更新规则。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.separator": "-",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.solvableConflict": "已解决冲突",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.solvableConflictDescription": "我们已为这个已修改字段推荐了更新,请在接受前进行复查。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.updateAccepted": "已接受更新",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.fieldUpgradeState.updateAcceptedDescription": "您仍然可以做出更改,在更新规则之前,请复查/接受所有其他冲突。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.finalUpdate": "最后更新",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.noRulesBodyTitle": "您已安装的 Elastic 规则当前没有可用更新。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.noRulesTitle": "所有 Elastic 规则均保持最新",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.ruleUpgradeHelper": "了解如何 {docsLink}。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.saveButtonLabel": "保存",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.searchBarPlaceholder": "按规则名称搜索",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.updatedVersionDescriptionLabel": "显示将安装的规则",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.updateYourRulesDocsLink": "更新您的规则",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.upgradeAll": "全部更新",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.upgradeHelpText": "选择用在已升级规则中的字段值。",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.upgradeSelected": "更新 {numberOfSelectedRules} 个选定规则",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.ariaLabel": "选择要比较的版本",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.baseVsCurrentLabel": "基础与当前",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.baseVsFinalLabel": "基础与最终",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.baseVsTargetLabel": "基础与目标",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.currentVsFinalLabel": "当前与最终",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.currentVsTargetLabel": "当前与目标",
"xpack.securitySolution.detectionEngine.rules.upgradeRules.versionsPicker.targetVsFinalLabel": "目标与最终",
"xpack.securitySolution.detectionEngine.rulesSnoozeBadge.error.unableToFetch": "无法提取暂停设置",
"xpack.securitySolution.detectionEngine.ruleStatus.askAssistant": "询问助手",
"xpack.securitySolution.detectionEngine.ruleStatus.askAssistantDesc": "规则的执行失败消息",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,7 @@ export const RuleUpgradeSpecifier = z.object({
export type UpgradeSpecificRulesRequest = z.infer<typeof UpgradeSpecificRulesRequest>;
export const UpgradeSpecificRulesRequest = z.object({
mode: z.literal('SPECIFIC_RULES'),
rules: z.array(RuleUpgradeSpecifier),
rules: z.array(RuleUpgradeSpecifier).min(1),
pick_version: PickVersionValues.optional(),
});

Expand Down
Loading

0 comments on commit 2dcbc5d

Please sign in to comment.