The bulk edit rules API provides the bulk capability that is essential for efficiently modifying a large number of rules. However, the API treats modifications of framework level attributes differently from rule type-specific parameters. Attributes can only be modified using a limited set of operations, and the same logical operation is applied to all rules, e.g. add an action, delete a tag, etc. Parameters can be modified in arbitrary ways on a per-rule basis using the paramsModifier function. For security solution rules, we'd like to have the same flexibility for attributes to apply modifications on a per-rule basis. This will drastically improve performance for the prebuilt rules customization APIs that need to apply updates to a large number of rules by allowing those APIs to use the bulkEdit API on the rules client instead of making a large number of individual update requests.
The bulk edit rules API provides the bulk capability that is essential for efficiently modifying a large number of rules. However, the API treats modifications of framework level attributes differently from rule type-specific parameters. Attributes can only be modified using a limited set of
operations
, and the same logicaloperation
is applied to all rules, e.g. add an action, delete a tag, etc. Parameters can be modified in arbitrary ways on a per-rule basis using theparamsModifier
function. For security solution rules, we'd like to have the same flexibility for attributes to apply modifications on a per-rule basis. This will drastically improve performance for the prebuilt rules customization APIs that need to apply updates to a large number of rules by allowing those APIs to use the bulkEdit API on the rules client instead of making a large number of individual update requests.As an example of where we'd use the bulk edit capability, see https://github.com/elastic/kibana/blob/v8.16.0/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/rule_objects/upgrade_prebuilt_rules.ts. In this use case we have a list of
rule
objects that define fields for both framework attributes and rule type specific parameters and we want to apply all of these updates. Currently we have to make a separate promise per rule update.