[Security] Add security detection engine package #797
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
💔 Build Failed
Expand to view the summary
Build stats
Test stats 🧪
Trends 🧪Steps errors
Expand to view the steps failures
|
mtojek
previously requested changes
Mar 23, 2021
There was a problem hiding this comment.
I didn't review JSON files, as I don't have domain knowledge here and can't verify them thoroughly.
Please merge the latest master to load the latest dependency on elastic-package (it should start accepting new Kibana types).
Before merging this PR we need to make sure the PR is green.
…ations into add-detection-rules-pkg
ycombinator
reviewed
Mar 23, 2021
ruflin
reviewed
Mar 25, 2021
go.mod
Outdated
| @@ -4,7 +4,7 @@ go 1.12 | |||
|
|
|||
| require ( | |||
| github.com/blang/semver v3.5.1+incompatible | |||
| github.com/elastic/elastic-package v0.0.0-20210323050956-96ac7e929cae | |||
| github.com/elastic/elastic-package v0.0.0-20210324160257-57698a40f3e3 | |||
There was a problem hiding this comment.
Could you pull this go mod change into a speparate PR?
There was a problem hiding this comment.
I did it here: #804 (spotted also a different issue). Once it's merged, please rebase this PR against master.
There was a problem hiding this comment.
Merged in master and confirmed the go changes are gone.
Thanks @mtojek
|
Hm... I spotted a weird issue: Will investigate EDIT: It seems that there are few files that are not aligned with spec, I will fix them and also bump up the dependency on elastic-package. |
|
@rw-access Please rebase this branch again against the master branch. I merged the update on elastic-package, so above errors should disappear. |
|
Looking into a few more things first. Might need to change the underlying JSON format. |
2 tasks
3 tasks
eyalkraft
pushed a commit
to build-security/integrations
that referenced
this pull request
Mar 30, 2022
* Add security detection engine package * Fix some lint errors * Format the package * Update version in the changelog * Update dependencies * Change the default owner for the detection engine package * Update go deps * Fix package-* dependencies * Change the security_rule structure to match other Kibana assets
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Added an integration that contains
security_ruleassets to be used by the Detection Engine in Security. The core idea behind this effort is to use Fleet to update rules for the Detection Engine between releases. This way, users can get the latest released rules and package-relevant rules without needing to wait for the next stack release.See the "related issues" section or ping me for more context. I'll be happy to point to additional (internal) design docs and discussions.
Checklist
elastc-packageyet)I have verified that all data streams collect metrics or logs.changelog.ymlfile.Author's Checklist
We've had a lot of conversations between teams, so I think we're in alignment. The name of the integration is TBD, and the specifics to install the
security_ruleasset type are also undecided.How to test this PR locally
There is a chicken-and-egg issue here. Since it contains a brand new asset type, Kibana doesn't yet know how to install it. So the package will be published first as a pre-release and once this merges and is added to package-storage, then we can start developing the Kibana side to install the package.
There will be more iteration as we go between all of the repositories.
Related issues
*elastic/package-spec#142: Add
security_ruleasset typeNOTICE.txtfileScreenshots
None yet