-
Notifications
You must be signed in to change notification settings - Fork 8.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Security Solution][Detections] Add warning for EQL and Threshold rules if exception list contains value list items #92914
Merged
marshallmain
merged 1 commit into
elastic:master
from
marshallmain:warning-for-list-exceptions
Feb 26, 2021
Merged
[Security Solution][Detections] Add warning for EQL and Threshold rules if exception list contains value list items #92914
marshallmain
merged 1 commit into
elastic:master
from
marshallmain:warning-for-list-exceptions
Feb 26, 2021
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
marshallmain
added
release_note:skip
Skip the PR/issue when compiling release notes
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Team:Detections and Resp
Security Detection Response Team
v7.12.0
v7.13.0
v8.0.0
labels
Feb 25, 2021
Pinging @elastic/security-solution (Team: SecuritySolution) |
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
marshallmain
added
the
Feature:Detection Rules
Anything related to Security Solution's Detection Rules
label
Feb 25, 2021
dhurley14
approved these changes
Feb 25, 2021
marshallmain
added a commit
to marshallmain/kibana
that referenced
this pull request
Feb 26, 2021
marshallmain
added a commit
to marshallmain/kibana
that referenced
this pull request
Feb 26, 2021
gmmorris
added a commit
to gmmorris/kibana
that referenced
this pull request
Feb 26, 2021
…bana into task-manager/docs-monitoring * 'task-manager/docs-monitoring' of github.com:gmmorris/kibana: (40 commits) [Security Solution][Case][Bug] Improve case logging (elastic#91924) [Alerts][Doc] Added README documentation for alerts plugin status and framework health checks configuration options. (elastic#92761) Add warning for EQL and Threshold rules if exception list contains value list items (elastic#92914) [Security Solution][Case] Fix subcases bugs on detections and case view (elastic#91836) [APM] Always allow access to Profiling via URL (elastic#92889) [Vega] Allow image loading without CORS policy by changing the default to crossOrigin=null (elastic#91991) skip flaky suite (elastic#92114) [APM] Fix for default fields in correlations view (elastic#91868) (elastic#92090) chore(NA): bump bazelisk to v1.7.5 (elastic#92905) [Maps] fix selecting EMS basemap does not populate input (elastic#92711) API docs (elastic#92827) [kbn/test] add import/export support to KbnClient (elastic#92526) Test fix management scripted field filter functional test and unskip it (elastic#92756) [App Search] Create Curation view/functionality (elastic#92560) [Reporting/Discover] include the document's entire set of fields (elastic#92730) [Fleet] Add new index to fleet for artifacts being served out of fleet-server (elastic#92860) [Alerts][Doc] Added README documentation for API key invalidation configuration options. (elastic#92757) [Discover][docs] Add search for relevance (elastic#90611) [Alerts][Docs] Extended README.md and the user docs with the licensing information. (elastic#92564) [7.12][Telemetry] Security telemetry allowlist fix. (elastic#92850) ...
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
Feature:Detection Rules
Anything related to Security Solution's Detection Rules
release_note:skip
Skip the PR/issue when compiling release notes
Team:Detections and Resp
Security Detection Response Team
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
v7.12.0
v7.13.0
v8.0.0
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Addresses #84385, comments on the issue contain more info on difficulties with validating that value list exceptions are only added to valid rule types.
This adds a notification in the form of a warning on rule execution if the exception list(s) a rule references contain value list exceptions that the rule can't evaluate. The expected case that would cause this warning to appear is if a user had value list exceptions on a pre-packaged query rule in earlier versions of Kibana, as some KQL rules were updated to be EQL rules instead. A warning is appropriate here as we don't want to silently delete or ignore these exceptions but the rule can still execute and will process non-value list exceptions correctly.
Summary
Summarize your PR. If it involves visual changes include a screenshot or gif.
Checklist
Delete any items that are not applicable to this PR.
For maintainers