[Security Solution] RFC: Saved Objects versioning capability #241431
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
🤖 Jobs for this PR can be triggered through checkboxes. 🚧
ℹ️ To trigger the CI, please tick the checkbox below 👇
|
sdesalas
added
Team:Detections and Resp
sdesalas
changed the title
sdesalas
force-pushed
the
rfc/saved-object-versioning-capability
branch
3 times, most recently
from
18906f2 to
2c4b802
Compare
sdesalas
changed the title
sdesalas
force-pushed
the
rfc/saved-object-versioning-capability
branch
from
2c4b802 to
e4b62b9
Compare
|
Please note that this RFC has been moved and is now being hosted as a Google Doc on 👉 this link (internal) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
RFC: Saved Objects versioning capability
This RFC proposes changes to the Saved Objects service in order to support optional versioning and change tracking capabilities in order to meet security product requirements.
👉 Click for complete RFC - Rendered view 👈
Motivation
Security departments need to comply with an ever increasing set of standards and regulations (DORA, ISO 27001).
As such, users of our security platform are expecting a modern and robust change management process when it comes to modifying their detection rules and related entities such as rule exceptions, which are currently stored in Kibana as Saved Objects (1, 2, 3, 4, 5).
Specifically, users need to be able to show the state of the rule at a specific point in time. They need to be able to review historical changes made to rules, including those that have been deleted. And they also expect the ability revert to a previous state of the rule as needed. They need this for compliance reasons, to understand why the changes were made, as well as to troubleshoot and ensure their correct behaviour.
This is currently one of top SIEM topics in terms of value and impact to our users.