[9.0] [Security Solution] Add UI incentivizers to upgrade prebuilt ru…

…les (#211862) (#213234) # Backport This will backport the following commits from `main` to `9.0`: - [[Security Solution] Add UI incentivizers to upgrade prebuilt rules (#211862)](#211862)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
elastic · Mar 6, 2025 · e441962 · e441962
1 parent 0b7887e
commit e441962
Show file tree

Hide file tree

Showing 56 changed files with 2,051 additions and 1,062 deletions.
diff --git a/...on/common/api/detection_engine/prebuilt_rules/model/diff/three_way_diff/three_way_diff.ts b/...on/common/api/detection_engine/prebuilt_rules/model/diff/three_way_diff/three_way_diff.ts
@@ -145,5 +145,6 @@ export interface ThreeWayDiff<TValue> {
  * Given the three versions of a value, calculates a three-way diff for it.
  */
 export type ThreeWayDiffAlgorithm<TValue> = (
-  versions: ThreeVersionsOf<TValue>
+  versions: ThreeVersionsOf<TValue>,
+  isRuleCustomized: boolean
 ) => ThreeWayDiff<TValue>;
diff --git a/...mmon/api/detection_engine/prebuilt_rules/review_rule_upgrade/review_rule_upgrade_route.ts b/...mmon/api/detection_engine/prebuilt_rules/review_rule_upgrade/review_rule_upgrade_route.ts
@@ -10,7 +10,7 @@ import { SortOrder, type RuleObjectId, type RuleSignatureId, type RuleTagArray }
 import type { PartialRuleDiff } from '../model';
 import type { RuleResponse, RuleVersion } from '../../model/rule_schema';
 import { FindRulesSortField } from '../../rule_management';
-import { PrebuiltRulesFilter } from '../common/prebuilt_rules_filter';
+import { ReviewPrebuiltRuleUpgradeFilter } from '../common/review_prebuilt_rules_upgrade_filter';
 
 export type ReviewRuleUpgradeSort = z.infer<typeof ReviewRuleUpgradeSort>;
 export const ReviewRuleUpgradeSort = z.object({
@@ -27,7 +27,7 @@ export const ReviewRuleUpgradeSort = z.object({
 export type ReviewRuleUpgradeRequestBody = z.infer<typeof ReviewRuleUpgradeRequestBody>;
 export const ReviewRuleUpgradeRequestBody = z
   .object({
-    filter: PrebuiltRulesFilter.optional(),
+    filter: ReviewPrebuiltRuleUpgradeFilter.optional(),
     sort: ReviewRuleUpgradeSort.optional(),
 
     page: z.coerce.number().int().min(1).optional().default(1),
@@ -89,4 +89,5 @@ export interface RuleUpgradeInfoForReview {
   target_rule: RuleResponse;
   diff: PartialRuleDiff;
   revision: number;
+  has_base_version: boolean;
 }
diff --git a/...tions/security/plugins/security_solution/common/detection_engine/rule_management/utils.ts b/...tions/security/plugins/security_solution/common/detection_engine/rule_management/utils.ts
@@ -6,7 +6,7 @@
  */
 
 import { ecsFieldMap } from '@kbn/alerts-as-data-utils';
-import type { RequiredField, RequiredFieldInput } from '../../api/detection_engine';
+import type { RequiredField, RequiredFieldInput, RuleResponse } from '../../api/detection_engine';
 
 /*
   Computes the boolean "ecs" property value for each required field based on the ECS field map.
@@ -23,3 +23,6 @@ export const addEcsToRequiredFields = (requiredFields?: RequiredFieldInput[]): R
       ecs: isEcsField,
     };
   });
+
+export const isRuleCustomized = (rule: RuleResponse) =>
+  rule.rule_source.type === 'external' && rule.rule_source.is_customized === true;
diff --git a/...s/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx b/...s/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx
@@ -11,6 +11,7 @@ import {
   EuiCallOut,
   EuiFlexGroup,
   EuiFlexItem,
+  EuiLink,
   EuiResizableContainer,
   EuiSpacer,
   EuiTab,
@@ -75,6 +76,7 @@ import { usePrebuiltRulesCustomizationStatus } from '../../../rule_management/lo
 import { PrebuiltRulesCustomizationDisabledReason } from '../../../../../common/detection_engine/prebuilt_rules/prebuilt_rule_customization_status';
 import { ALERT_SUPPRESSION_FIELDS_FIELD_NAME } from '../../../rule_creation/components/alert_suppression_edit';
 import { usePrebuiltRuleCustomizationUpsellingMessage } from '../../../rule_management/logic/prebuilt_rules/use_prebuilt_rule_customization_upselling_message';
+import { useRuleUpdateCallout } from '../../../rule_management/hooks/use_rule_update_callout';
 
 const EditRulePageComponent: FC<{ rule: RuleResponse }> = ({ rule }) => {
   const { addSuccess } = useAppToasts();
@@ -509,6 +511,16 @@ const EditRulePageComponent: FC<{ rule: RuleResponse }> = ({ rule }) => {
     [navigateToApp, ruleId]
   );
 
+  const upgradeCallout = useRuleUpdateCallout({
+    rule,
+    message: ruleI18n.HAS_RULE_UPDATE_EDITING_CALLOUT_MESSAGE,
+    actionButton: (
+      <EuiLink onClick={goToDetailsRule} data-test-subj="ruleEditingUpdateRuleCalloutButton">
+        {ruleI18n.HAS_RULE_UPDATE_EDITING_CALLOUT_BUTTON}
+      </EuiLink>
+    ),
+  });
+
   if (
     redirectToDetections(
       isSignalIndexExists,
@@ -550,6 +562,7 @@ const EditRulePageComponent: FC<{ rule: RuleResponse }> = ({ rule }) => {
                         setIsRulePreviewVisible={setIsRulePreviewVisible}
                         togglePanel={togglePanel}
                       />
+                      {upgradeCallout}
                       {invalidSteps.length > 0 && (
                         <EuiCallOut title={i18n.SORRY_ERRORS} color="danger" iconType="warning">
                           <FormattedMessage

diff --git a/...ns/security_solution/public/detection_engine/rule_details_ui/pages/rule_details/index.tsx b/...ns/security_solution/public/detection_engine/rule_details_ui/pages/rule_details/index.tsx
@@ -148,6 +148,7 @@ import { useManualRuleRunConfirmation } from '../../../rule_gaps/components/manu
 import { useLegacyUrlRedirect } from './use_redirect_legacy_url';
 import { RuleDetailTabs, useRuleDetailsTabs } from './use_rule_details_tabs';
 import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
+import { useRuleUpdateCallout } from '../../../rule_management/hooks/use_rule_update_callout';
 
 const RULE_EXCEPTION_LIST_TYPES = [
   ExceptionListTypeEnum.DETECTION,
@@ -254,7 +255,7 @@ const RuleDetailsPageComponent: React.FC<DetectionEngineComponentProps> = ({
 
   const { pollForSignalIndex } = useSignalHelpers();
   const [rule, setRule] = useState<RuleResponse | null>(null);
-  const isLoading = ruleLoading && rule == null;
+  const isLoading = useMemo(() => ruleLoading && rule == null, [rule, ruleLoading]);
 
   const { starting: isStartingJobs, startMlJobs } = useStartMlJobs();
   const startMlJobsIfNeeded = useCallback(async () => {
@@ -394,6 +395,12 @@ const RuleDetailsPageComponent: React.FC<DetectionEngineComponentProps> = ({
   const lastExecutionDate = lastExecution?.date ?? '';
   const lastExecutionMessage = lastExecution?.message ?? '';
 
+  const upgradeCallout = useRuleUpdateCallout({
+    rule,
+    message: ruleI18n.HAS_RULE_UPDATE_DETAILS_CALLOUT_MESSAGE,
+    onUpgrade: refreshRule,
+  });
+
   const ruleStatusInfo = useMemo(() => {
     return (
       <>
@@ -556,6 +563,7 @@ const RuleDetailsPageComponent: React.FC<DetectionEngineComponentProps> = ({
     <>
       <NeedAdminForUpdateRulesCallOut />
       <MissingPrivilegesCallOut />
+      {upgradeCallout}
       {isBulkDuplicateConfirmationVisible && (
         <BulkActionDuplicateExceptionsConfirmation
           onCancel={cancelRuleDuplication}

diff --git a/...n/public/detection_engine/rule_management/components/rule_details/rule_update_callout.tsx b/...n/public/detection_engine/rule_management/components/rule_details/rule_update_callout.tsx
@@ -0,0 +1,71 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiCallOut, EuiSpacer, EuiLink } from '@elastic/eui';
+import React, { useMemo } from 'react';
+import type { RuleResponse } from '../../../../../common/api/detection_engine';
+import * as i18n from './translations';
+import { usePrebuiltRulesUpgrade } from '../../hooks/use_prebuilt_rules_upgrade';
+
+interface RuleUpdateCalloutProps {
+  rule: RuleResponse;
+  message: string;
+  actionButton?: JSX.Element;
+  onUpgrade?: () => void;
+}
+
+const RuleUpdateCalloutComponent = ({
+  rule,
+  message,
+  actionButton,
+  onUpgrade,
+}: RuleUpdateCalloutProps): JSX.Element | null => {
+  const { upgradeReviewResponse, rulePreviewFlyout, openRulePreview } = usePrebuiltRulesUpgrade({
+    pagination: {
+      page: 1, // we only want to fetch one result
+      perPage: 1,
+    },
+    filter: { rule_ids: [rule.id] },
+    onUpgrade,
+  });
+
+  const isRuleUpgradeable = useMemo(
+    () => upgradeReviewResponse !== undefined && upgradeReviewResponse.total > 0,
+    [upgradeReviewResponse]
+  );
+
+  const updateCallToActionButton = useMemo(() => {
+    if (actionButton) {
+      return actionButton;
+    }
+    return (
+      <EuiLink
+        onClick={() => openRulePreview(rule.rule_id)}
+        data-test-subj="ruleDetailsUpdateRuleCalloutButton"
+      >
+        {i18n.HAS_RULE_UPDATE_CALLOUT_BUTTON}
+      </EuiLink>
+    );
+  }, [actionButton, openRulePreview, rule.rule_id]);
+
+  if (!isRuleUpgradeable) {
+    return null;
+  }
+
+  return (
+    <>
+      <EuiCallOut title={i18n.HAS_RULE_UPDATE_CALLOUT_TITLE} color="primary" iconType="gear">
+        <p>{message}</p>
+        {updateCallToActionButton}
+      </EuiCallOut>
+      <EuiSpacer size="l" />
+      {rulePreviewFlyout}
+    </>
+  );
+};
+
+export const RuleUpdateCallout = React.memo(RuleUpdateCalloutComponent);
diff --git a/...ment/components/rule_details/three_way_diff/rule_upgrade/missing_base_version_callout.tsx b/...ment/components/rule_details/three_way_diff/rule_upgrade/missing_base_version_callout.tsx
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiCallOut } from '@elastic/eui';
+import * as i18n from './translations';
+
+export const RuleHasMissingBaseVersionCallout = () => (
+  <EuiCallOut color="warning" size="s">
+    <p>{i18n.RULE_BASE_VERSION_IS_MISSING_DESCRIPTION}</p>
+  </EuiCallOut>
+);
diff --git a/...gine/rule_management/components/rule_details/three_way_diff/rule_upgrade/rule_upgrade.tsx b/...gine/rule_management/components/rule_details/three_way_diff/rule_upgrade/rule_upgrade.tsx
@@ -18,6 +18,7 @@ import { RuleUpgradeInfoBar } from './rule_upgrade_info_bar';
 import { RuleUpgradeCallout } from './rule_upgrade_callout';
 import { FieldUpgrade } from './field_upgrade';
 import { FieldUpgradeContextProvider } from './field_upgrade_context';
+import { RuleHasMissingBaseVersionCallout } from './missing_base_version_callout';
 
 interface RuleUpgradeProps {
   ruleUpgradeState: RuleUpgradeState;
@@ -45,6 +46,12 @@ export const RuleUpgrade = memo(function RuleUpgrade({
         targetVersionNumber={ruleUpgradeState.target_rule.version}
       />
       <EuiSpacer size="s" />
+      {!ruleUpgradeState.has_base_version && (
+        <>
+          <RuleHasMissingBaseVersionCallout />
+          <EuiSpacer size="s" />
+        </>
+      )}
       <RuleUpgradeCallout
         numOfSolvableConflicts={numOfSolvableConflicts}
         numOfNonSolvableConflicts={numOfNonSolvableConflicts}

diff --git a/...e_management/components/rule_details/three_way_diff/rule_upgrade/rule_upgrade_callout.tsx b/...e_management/components/rule_details/three_way_diff/rule_upgrade/rule_upgrade_callout.tsx
@@ -23,66 +23,72 @@ export function RuleUpgradeCallout({
 }: RuleUpgradeCalloutProps): JSX.Element {
   if (numOfNonSolvableConflicts > 0) {
     return (
-      <EuiCallOut
-        title={
-          <>
-            <strong>{i18n.UPGRADE_STATUS}</strong>
-            &nbsp;
-            <ActionRequiredBadge />
-            &nbsp;
-            {i18n.RULE_HAS_CONFLICTS(numOfNonSolvableConflicts + numOfSolvableConflicts)}
-          </>
-        }
-        color="danger"
-        size="s"
-      >
-        <span>{i18n.RULE_HAS_HARD_CONFLICTS_DESCRIPTION}</span>
-        <ul>
-          <li>{i18n.RULE_HAS_HARD_CONFLICTS_KEEP_YOUR_CHANGES}</li>
-          <li>{i18n.RULE_HAS_HARD_CONFLICTS_ACCEPT_ELASTIC_UPDATE}</li>
-          <li>{i18n.RULE_HAS_HARD_CONFLICTS_EDIT_FINAL_VERSION}</li>
-        </ul>
-      </EuiCallOut>
+      <>
+        <EuiCallOut
+          title={
+            <>
+              <strong>{i18n.UPGRADE_STATUS}</strong>
+              &nbsp;
+              <ActionRequiredBadge />
+              &nbsp;
+              {i18n.RULE_HAS_CONFLICTS(numOfNonSolvableConflicts + numOfSolvableConflicts)}
+            </>
+          }
+          color="danger"
+          size="s"
+        >
+          <span>{i18n.RULE_HAS_HARD_CONFLICTS_DESCRIPTION}</span>
+          <ul>
+            <li>{i18n.RULE_HAS_HARD_CONFLICTS_KEEP_YOUR_CHANGES}</li>
+            <li>{i18n.RULE_HAS_HARD_CONFLICTS_ACCEPT_ELASTIC_UPDATE}</li>
+            <li>{i18n.RULE_HAS_HARD_CONFLICTS_EDIT_FINAL_VERSION}</li>
+          </ul>
+        </EuiCallOut>
+      </>
     );
   }
 
   if (numOfSolvableConflicts > 0) {
     return (
+      <>
+        <EuiCallOut
+          title={
+            <>
+              <strong>{i18n.UPGRADE_STATUS}</strong>
+              &nbsp;
+              <ReviewRequiredBadge />
+              &nbsp;
+              {i18n.RULE_HAS_CONFLICTS(numOfSolvableConflicts)}
+            </>
+          }
+          color="warning"
+          size="s"
+        >
+          <span>{i18n.RULE_HAS_SOFT_CONFLICTS_DESCRIPTION}</span>
+          <ul>
+            <li>{i18n.RULE_HAS_SOFT_CONFLICTS_ACCEPT_SUGGESTED_UPDATE}</li>
+            <li>{i18n.RULE_HAS_SOFT_CONFLICTS_EDIT_FINAL_VERSION}</li>
+          </ul>
+        </EuiCallOut>
+      </>
+    );
+  }
+
+  return (
+    <>
       <EuiCallOut
         title={
           <>
             <strong>{i18n.UPGRADE_STATUS}</strong>
             &nbsp;
-            <ReviewRequiredBadge />
-            &nbsp;
-            {i18n.RULE_HAS_CONFLICTS(numOfSolvableConflicts)}
+            <ReadyForUpgradeBadge />
           </>
         }
-        color="warning"
+        color="success"
         size="s"
       >
-        <span>{i18n.RULE_HAS_SOFT_CONFLICTS_DESCRIPTION}</span>
-        <ul>
-          <li>{i18n.RULE_HAS_SOFT_CONFLICTS_ACCEPT_SUGGESTED_UPDATE}</li>
-          <li>{i18n.RULE_HAS_SOFT_CONFLICTS_EDIT_FINAL_VERSION}</li>
-        </ul>
+        <p>{i18n.RULE_IS_READY_FOR_UPGRADE_DESCRIPTION}</p>
       </EuiCallOut>
-    );
-  }
-
-  return (
-    <EuiCallOut
-      title={
-        <>
-          <strong>{i18n.UPGRADE_STATUS}</strong>
-          &nbsp;
-          <ReadyForUpgradeBadge />
-        </>
-      }
-      color="success"
-      size="s"
-    >
-      <p>{i18n.RULE_IS_READY_FOR_UPGRADE_DESCRIPTION}</p>
-    </EuiCallOut>
+    </>
   );
 }
diff --git a/...gine/rule_management/components/rule_details/three_way_diff/rule_upgrade/translations.tsx b/...gine/rule_management/components/rule_details/three_way_diff/rule_upgrade/translations.tsx
@@ -158,3 +158,11 @@ export const FIELD_MODIFIED_BADGE_DESCRIPTION = i18n.translate(
       'This field value differs from the one provided in the original version of the rule.',
   }
 );
+
+export const RULE_BASE_VERSION_IS_MISSING_DESCRIPTION = i18n.translate(
+  'xpack.securitySolution.detectionEngine.upgradeFlyout.baseVersionMissingDescription',
+  {
+    defaultMessage:
+      "The original, unedited version of this Elastic rule couldn't be found. This sometimes happens when a rule hasn't been updated in a while. You can still update this rule, but will only have access to its current version and the incoming Elastic update. Updating Elastic rules more often can help you avoid this in the future. We encourage you to review this update carefully and ensure your changes are not accidentally overwritten.",
+  }
+);
diff --git a/...solution/public/detection_engine/rule_management/components/rule_details/translations.tsx b/...solution/public/detection_engine/rule_management/components/rule_details/translations.tsx
@@ -461,3 +461,17 @@ export const LUCENE_LANGUAGE_LABEL = i18n.translate(
     defaultMessage: 'Lucene',
   }
 );
+
+export const HAS_RULE_UPDATE_CALLOUT_TITLE = i18n.translate(
+  'xpack.securitySolution.detectionEngine.ruleDetails.updateCalloutTitle',
+  {
+    defaultMessage: 'Elastic rule update available',
+  }
+);
+
+export const HAS_RULE_UPDATE_CALLOUT_BUTTON = i18n.translate(
+  'xpack.securitySolution.detectionEngine.ruleDetailsUpdate.calloutButton',
+  {
+    defaultMessage: 'Review update',
+  }
+);