elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.69k stars 8.24k forks source link

[ResponseOps] Enhance bulkEdit RulesClient API to allow arbitrary attribute changes #201022

Open marshallmain opened 1 week ago

marshallmain commented 1 week ago

The bulk edit rules API provides the bulk capability that is essential for efficiently modifying a large number of rules. However, the API treats modifications of framework level attributes differently from rule type-specific parameters. Attributes can only be modified using a limited set of operations, and the same logical operation is applied to all rules, e.g. add an action, delete a tag, etc. Parameters can be modified in arbitrary ways on a per-rule basis using the paramsModifier function. For security solution rules, we'd like to have the same flexibility for attributes to apply modifications on a per-rule basis. This will drastically improve performance for the prebuilt rules customization APIs that need to apply updates to a large number of rules by allowing those APIs to use the bulkEdit API on the rules client instead of making a large number of individual update requests.

As an example of where we'd use the bulk edit capability, see https://github.com/elastic/kibana/blob/v8.16.0/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/rule_objects/upgrade_prebuilt_rules.ts. In this use case we have a list of rule objects that define fields for both framework attributes and rule type specific parameters and we want to apply all of these updates. Currently we have to make a separate promise per rule update.

elasticmachine commented 1 week ago

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

elasticmachine commented 1 week ago

Pinging @elastic/response-ops (Team:ResponseOps)