Skip to content

Commit b1d7ea1

Browse files
kibanamachinebanderror
kibanamachine
and
banderror
authored
[9.2] [Security Solution] Add detection rules customization status for telemetry snapshot (#237583) (#238993)
# Backport This will backport the following commits from `main` to `9.2`: - [[Security Solution] Add detection rules customization status for telemetry snapshot (#237583)](#237583) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Jacek Kolezynski","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-10-14T18:00:01Z","message":"[Security Solution] Add detection rules customization status for telemetry snapshot (#237583)\n\n**Partially addresses: #140369**\n\n## Summary\n\nThis is another PR from of a series of PRs I am planning to create to\ncover the requirements in the\nhttps://github.com//issues/140369 ticket.\n\n\nThe requirement covered in this PR is: \" Breakdown of which fields are\nbeing customized.\"\n\nTesting:\n\nDisplay the snapshot:\n```\nPOST kbn:/internal/telemetry/clusters/_stats?apiVersion=2\n{ \"unencrypted\": true, \"refreshCache\": true }\n```\n\nSend the snapshot to staging telemetry cluster.\n```\nPOST kbn:/internal/telemetry/force_send?apiVersion=1&elasticInternalOrigin=true\n{}\n```\n\nCo-authored-by: Georgii Gorbachev <[email protected]>","sha":"1f4156499ff9f0e74efeac99e05fa8c2d54bf7e8","branchLabelMapping":{"^v9.3.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Detections and Resp","Team: SecuritySolution","Team:Detection Rule Management","Feature:Prebuilt Detection Rules","backport:version","v9.2.0","v9.3.0","v9.1.6","v8.18.9","v8.19.6"],"title":"[Security Solution] Add detection rules customization status for telemetry snapshot","number":237583,"url":"https://github.com/elastic/kibana/pull/237583","mergeCommit":{"message":"[Security Solution] Add detection rules customization status for telemetry snapshot (#237583)\n\n**Partially addresses: #140369**\n\n## Summary\n\nThis is another PR from of a series of PRs I am planning to create to\ncover the requirements in the\nhttps://github.com//issues/140369 ticket.\n\n\nThe requirement covered in this PR is: \" Breakdown of which fields are\nbeing customized.\"\n\nTesting:\n\nDisplay the snapshot:\n```\nPOST kbn:/internal/telemetry/clusters/_stats?apiVersion=2\n{ \"unencrypted\": true, \"refreshCache\": true }\n```\n\nSend the snapshot to staging telemetry cluster.\n```\nPOST kbn:/internal/telemetry/force_send?apiVersion=1&elasticInternalOrigin=true\n{}\n```\n\nCo-authored-by: Georgii Gorbachev <[email protected]>","sha":"1f4156499ff9f0e74efeac99e05fa8c2d54bf7e8"}},"sourceBranch":"main","suggestedTargetBranches":["9.2","9.1","8.18","8.19"],"targetPullRequestStates":[{"branch":"9.2","label":"v9.2.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.3.0","branchLabelMappingKey":"^v9.3.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/237583","number":237583,"mergeCommit":{"message":"[Security Solution] Add detection rules customization status for telemetry snapshot (#237583)\n\n**Partially addresses: #140369**\n\n## Summary\n\nThis is another PR from of a series of PRs I am planning to create to\ncover the requirements in the\nhttps://github.com//issues/140369 ticket.\n\n\nThe requirement covered in this PR is: \" Breakdown of which fields are\nbeing customized.\"\n\nTesting:\n\nDisplay the snapshot:\n```\nPOST kbn:/internal/telemetry/clusters/_stats?apiVersion=2\n{ \"unencrypted\": true, \"refreshCache\": true }\n```\n\nSend the snapshot to staging telemetry cluster.\n```\nPOST kbn:/internal/telemetry/force_send?apiVersion=1&elasticInternalOrigin=true\n{}\n```\n\nCo-authored-by: Georgii Gorbachev <[email protected]>","sha":"1f4156499ff9f0e74efeac99e05fa8c2d54bf7e8"}},{"branch":"9.1","label":"v9.1.6","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.9","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.6","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Georgii Gorbachev <[email protected]>
1 parent 974e497 commit b1d7ea1

File tree

16 files changed

+834
-30
lines changed

16 files changed

+834
-30
lines changed

‎x-pack/platform/plugins/private/telemetry_collection_xpack/schema/xpack_security.json‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7338,6 +7338,130 @@
73387338
}
73397339
}
73407340
}
7341+
},
7342+
"elastic_detection_rule_customization_status": {
7343+
"properties": {
7344+
"alert_suppression": {
7345+
"type": "long",
7346+
"_meta": {
7347+
"description": "The number of prebuilt rules with customized alert_suppression field"
7348+
}
7349+
},
7350+
"anomaly_threshold": {
7351+
"type": "long",
7352+
"_meta": {
7353+
"description": "The number of prebuilt rules with customized anomaly_threshold field"
7354+
}
7355+
},
7356+
"data_view_id": {
7357+
"type": "long",
7358+
"_meta": {
7359+
"description": "The number of prebuilt rules with customized data_view_id field"
7360+
}
7361+
},
7362+
"description": {
7363+
"type": "long",
7364+
"_meta": {
7365+
"description": "The number of prebuilt rules with customized description field"
7366+
}
7367+
},
7368+
"filters": {
7369+
"type": "long",
7370+
"_meta": {
7371+
"description": "The number of prebuilt rules with customized filters field"
7372+
}
7373+
},
7374+
"from": {
7375+
"type": "long",
7376+
"_meta": {
7377+
"description": "The number of prebuilt rules with customized from field"
7378+
}
7379+
},
7380+
"index": {
7381+
"type": "long",
7382+
"_meta": {
7383+
"description": "The number of prebuilt rules with customized index field"
7384+
}
7385+
},
7386+
"interval": {
7387+
"type": "long",
7388+
"_meta": {
7389+
"description": "The number of prebuilt rules with customized interval field"
7390+
}
7391+
},
7392+
"investigation_fields": {
7393+
"type": "long",
7394+
"_meta": {
7395+
"description": "The number of prebuilt rules with customized investigation_fields field"
7396+
}
7397+
},
7398+
"name": {
7399+
"type": "long",
7400+
"_meta": {
7401+
"description": "The number of prebuilt rules with customized name field"
7402+
}
7403+
},
7404+
"new_terms_fields": {
7405+
"type": "long",
7406+
"_meta": {
7407+
"description": "The number of prebuilt rules with customized new_terms_fields field"
7408+
}
7409+
},
7410+
"note": {
7411+
"type": "long",
7412+
"_meta": {
7413+
"description": "The number of prebuilt rules with customized note field"
7414+
}
7415+
},
7416+
"query": {
7417+
"type": "long",
7418+
"_meta": {
7419+
"description": "The number of prebuilt rules with customized query field"
7420+
}
7421+
},
7422+
"risk_score": {
7423+
"type": "long",
7424+
"_meta": {
7425+
"description": "The number of prebuilt rules with customized risk_score field"
7426+
}
7427+
},
7428+
"severity": {
7429+
"type": "long",
7430+
"_meta": {
7431+
"description": "The number of prebuilt rules with customized severity field"
7432+
}
7433+
},
7434+
"setup": {
7435+
"type": "long",
7436+
"_meta": {
7437+
"description": "The number of prebuilt rules with customized setup field"
7438+
}
7439+
},
7440+
"tags": {
7441+
"type": "long",
7442+
"_meta": {
7443+
"description": "The number of prebuilt rules with customized tags field"
7444+
}
7445+
},
7446+
"threat_query": {
7447+
"type": "long",
7448+
"_meta": {
7449+
"description": "The number of prebuilt rules with customized threat_query field"
7450+
}
7451+
},
7452+
"threshold": {
7453+
"type": "long",
7454+
"_meta": {
7455+
"description": "The number of prebuilt rules with customized threshold field"
7456+
}
7457+
},
7458+
"timeline_id": {
7459+
"type": "long",
7460+
"_meta": {
7461+
"description": "The number of prebuilt rules with customized timeline_id field"
7462+
}
7463+
}
7464+
}
73417465
}
73427466
}
73437467
},

‎x-pack/solutions/security/plugins/security_solution/server/usage/detections/get_initial_usage.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import type { DetectionMetrics } from './types';
1010
import { getInitialMlJobUsage } from './ml_jobs/get_initial_usage';
1111
import {
1212
getInitialEventLogUsage,
13+
getInitialRuleCustomizationStatus,
1314
getInitialRuleUpgradeStatus,
1415
getInitialRulesUsage,
1516
getInitialSpacesUsage,
@@ -30,6 +31,7 @@ export const getInitialDetectionMetrics = (): DetectionMetrics => ({
3031
detection_rule_usage: getInitialRulesUsage(),
3132
detection_rule_status: getInitialEventLogUsage(),
3233
elastic_detection_rule_upgrade_status: getInitialRuleUpgradeStatus(),
34+
elastic_detection_rule_customization_status: getInitialRuleCustomizationStatus(),
3335
spaces_usage: getInitialSpacesUsage(),
3436
},
3537
legacy_siem_signals: getInitialLegacySiemSignalsUsage(),

0 commit comments

Comments
 (0)