search

elastic / detection-rules

https://www.elastic.co/guide/en/security/current/detection-engine-overview.html
Other
1.92k stars 492 forks source link

[Bug] Refreshing Latest Integration Schemas Breaks DGA #3994

Closed shashank-elastic closed 1 month ago

shashank-elastic commented 1 month ago

Describe the Bug

As part of the PR - https://github.com/elastic/detection-rules/pull/3993 which was a monthly cadence of refresh of integration schema for the release, we noticed it broke the DGA rules in prebuilt detection package.

The issue is changes in upstream Refer - https://github.com/elastic/integrations/pull/10476

image (10)

To Reproduce

  1. Generate Latest Integration Schema and Manifest for DGA
  2. Use View-Rule on DGA Rule
  3. See the error produced on latest schema 2.0.3

Expected Behavior

  1. Background context -> https://github.com/elastic/detection-rules/blob/10ba6ad5a636b510dea9b1440ab5a30c2aff2dd5/detection_rules/integrations.py#L146
  2. We pull any YML field files for all integrations to do integration specific field validation within our queries.
  3. Today our tests is that they rely on static mappings somewhere.

Screenshots

No response

Desktop - OS

None

Desktop - Version

No response

Additional Context

The File used for filed validation is being added back via - https://github.com/elastic/security-ml/issues/474 The refresh can happen post the fix is available.