[Security Solution] Explore using Git for prebuilt rules delivery

xcrzx commented 2 months ago

Summary

We've been using Fleet for a while to deliver prebuilt detection rules to Kibana. This delivery method has proven unreliable and unsuited for our needs. Explore the possibilities of using Git for prebuilt rule delivery.

TODO

elasticmachine commented 2 months ago

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine commented 2 months ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 2 months ago

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

xcrzx commented 2 months ago

Things to figure out:

[ ] Space isolation when fetching repositories
[x] Safe access token storage
[ ] Possible rule ID collisions and repository validation. We might need to prefix rule IDs with a repo name
[ ] Use connectors instead of Kibana config to set up rule repositories (?)
[ ] Extend rule_source to store repo info
[ ] Changes apply and push
[ ] Use GitHub API instead of executing git commands (?)
[ ] Serverless suport. Is it possible to use on-disk rules repository cache in Serverless environment?
[ ] GitHub API limit
[ ] How to implement Kibana version constraints?

elastic / kibana

[Security Solution] Explore using Git for prebuilt rules delivery #190691

Summary