Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[RAM] add support of bulk update "muteAll" rule property in rulesClient #139084

Closed
Tracked by #151924
vitaliidm opened this issue Aug 18, 2022 · 7 comments
Closed
Tracked by #151924
Labels
8.5 candidate Feature:Alerting/RulesManagement Issues related to the Rules Management UX Feature:Rule Management Security Solution Detection Rule Management area performance Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.

Comments

@vitaliidm
Copy link
Contributor

vitaliidm commented Aug 18, 2022

Describe the feature:
Add support of bulk update "muteAll" rule property in rulesClient

Describe a specific use case for the feature:
To add/update rule actions on Security Solution side, we need an ability to update muteAll rule property in bulk.
It needed for cases:

  • when throttle set to no_actions, but rule was unmuted
  • when throttle set to some value, but previously rule was muted

Reference in code:
https://github.com/elastic/kibana/blob/8.4/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.ts#L122-L147

Proposals of implementation

  1. Add a new operation to rulesClient bulkEdit method
    Proposed new operation would look like:
{
      operation: 'set';
      field: Extract<BulkEditFields, 'muteAll'>;
      value: Rule['muteAll'];
};

Also, we will need to address some additional logic, that exists in current muteAll/unmuteAll methods

  • cleanup of additional properties in rule
        ...
        mutedInstanceIds: [],
        snoozeSchedule: clearUnscheduledSnooze(attributes),
        ...
  • check rule actions authorization:
     if (attributes.actions.length) {
       await this.actionsAuthorization.ensureAuthorized('execute');
     }
@botelastic botelastic bot added the needs-team Issues missing a team label label Aug 18, 2022
@vitaliidm vitaliidm changed the title [WIP][RAM] add support bulk edit of "muteAll" rule property in rulesClient [WIP][RAM] add support of bulk update "muteAll" rule property in rulesClient Aug 18, 2022
@vitaliidm vitaliidm added 8.5 candidate Team:Endpoint Response Endpoint Response Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team labels Aug 18, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@botelastic botelastic bot removed the needs-team Issues missing a team label label Aug 18, 2022
@vitaliidm vitaliidm added Feature:Rule Management Security Solution Detection Rule Management area Feature:Alerting/RulesManagement Issues related to the Rules Management UX labels Aug 18, 2022
@vitaliidm vitaliidm changed the title [WIP][RAM] add support of bulk update "muteAll" rule property in rulesClient [RAM] add support of bulk update "muteAll" rule property in rulesClient Aug 18, 2022
@vitaliidm vitaliidm added Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) and removed Team:Endpoint Response Endpoint Response Team labels Aug 18, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/response-ops (Team:ResponseOps)

@XavierM
Copy link
Contributor

XavierM commented Aug 30, 2022

@vitaliidm, we think that this #139742 will allow you to create bulk snooze with out problem. And we will also hope that this #137430 will allow your users to take advantage of the new snooze functionality that we created.

@vitaliidm
Copy link
Contributor Author

@XavierM
Thanks for the update.

we think that this #139742 will allow you to create bulk snooze with out problem.

Looks like functionality in this PR would allow to set/unset muteAll 👍

vitaliidm added a commit that referenced this issue Sep 6, 2022
## Summary

- addresses elastic/security-team#2072
- adds new bulk edit actions: `add_rule_actions`, `set_rule_actions`
- moved immutability check from rule `validateMutatedParams` to action validator. Because, rule immutability depends on actions performed on it, not only on `immutable` property
- adds some test coverage
- using workaround for #139084, by muting/unmuting single rule. This would only happen:
    - if rule was muted before, throttle set to some value
    - rule was unmuted, throttle set to `no_actions`

### Feature recording
Note: callouts on recording are not up to date

https://user-images.githubusercontent.com/92328789/185381912-6c4a25f6-fb36-4c31-bf08-8ec28f2358c0.mov

### Screen 
<img width="1465" alt="Screenshot 2022-08-25 at 17 23 56" src="https://user-images.githubusercontent.com/92328789/186731607-574687b8-8a7a-43de-8f30-6cda3dcecfc5.png">

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
- [x] This renders correctly on smaller devices using a responsive layout. (You can test this [in your browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

### Release note

Adding bulk edit of rule actions
@cnasikas
Copy link
Member

Hey @vitaliidm! It seems that the functionality added in #139742 allows to set/unset muteAll. Should we close the issue?

@vitaliidm
Copy link
Contributor Author

@cnasikas , Yes I think it can be closed
mute/unmute logic was changed in #147736, so this one not needed anynore

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
8.5 candidate Feature:Alerting/RulesManagement Issues related to the Rules Management UX Feature:Rule Management Security Solution Detection Rule Management area performance Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Projects
None yet
Development

No branches or pull requests

5 participants