search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.73k stars 8.14k forks source link

[Security Solution] Warning to inform users if all detections are disabled and auto_disabled_8.0 tag is present #164984

Open wasserman opened 1 year ago

wasserman commented 1 year ago

Describe the feature: Add a banner in Kibana to make users aware after upgrading from v7.17 to v8.x (if auto_disabled_8.0 tag exists) that they may want to re-enable these rules and that there is a tag already added to flag rules that were disabled automatically during the upgrade process. Probably some warning notification banner in the Security app would be helpful. Including a hyperlink filtering to the auto_disabled_8.0 tag would be handy.

Describe a specific use case for the feature: Ensure that detections aren't silently missed after an upgrade since it may not be obvious to them that they were disabled during the upgrade automatically. The goal is to minimize the time it will take to realize this has happened.

There may be some relevant comments in https://github.com/elastic/kibana/issues/148230 I see that https://github.com/elastic/kibana/pull/151541 added an additional warning to the Upgrade Assistant as a v7.17.10, but we were running v7.17.1 so having this warning after the upgrade would still have helped. It also helps cover the situations where the Upgrade Assistant warning is missed.

elasticmachine commented 1 year ago

Pinging @elastic/security-solution (Team: SecuritySolution)