Skip to content

[Security Solution] Add detection rules customization status for telemetry snapshot #237583

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Oct 14, 2025
Merged

[Security Solution] Add detection rules customization status for telemetry snapshot #237583

merged 1 commit into from
Oct 14, 2025
+834 −30

Conversation

jkelas
Copy link
Contributor

@jkelas jkelas commented Oct 6, 2025 •
edited by kibanamachine
Loading

Partially addresses: #140369

Summary

This is another PR from of a series of PRs I am planning to create to cover the requirements in the #140369 ticket.

The requirement covered in this PR is: " Breakdown of which fields are being customized."

Testing:

Display the snapshot:

POST kbn:/internal/telemetry/clusters/_stats?apiVersion=2
{ "unencrypted": true, "refreshCache": true }

Send the snapshot to staging telemetry cluster.

POST kbn:/internal/telemetry/force_send?apiVersion=1&elasticInternalOrigin=true
{}

@jkelas jkelas force-pushed the 140369_req_2_customization_status_telemetry branch 6 times, most recently from 96cc9de to c91b984 Compare October 6, 2025 10:27
@jkelas jkelas changed the title [Security Solution] Add customization status for telemetry snapshot [Security Solution] Add detection rules customization status for telemetry snapshot Oct 6, 2025
@jkelas jkelas self-assigned this Oct 6, 2025
@jkelas jkelas added release_note:skip Skip the PR/issue when compiling release notes Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area backport:version Backport to applied version labels v9.2.0 v9.3.0 v8.18.9 v8.19.6 labels Oct 6, 2025
@jkelas jkelas marked this pull request as ready for review October 6, 2025 12:07
@jkelas jkelas requested review from a team as code owners October 6, 2025 12:07
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@jkelas jkelas requested review from a team and maximpn October 6, 2025 12:08
@banderror banderror mentioned this pull request Oct 6, 2025
Open
35 tasks
@jkelas jkelas force-pushed the 140369_req_2_customization_status_telemetry branch from c91b984 to 9c5fee8 Compare October 7, 2025 10:24
maximpn
maximpn reviewed Oct 8, 2025
View reviewed changes
Copy link
Contributor

@maximpn maximpn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jkelas Thanks for adding a snapshot telemetry for customized fields 🙏

I left some comments and haven't tested the PR yet.

@jkelas
Copy link
Contributor Author

jkelas commented Oct 8, 2025

Created visualization here: https://telemetry-v2-staging.elastic.dev/s/securitysolution/app/dashboards#/view/ed2311c0-4920-4d2a-bebb-b7a5ef18b511?_g=(filters:!(),refreshInterval:(pause:!t,value:60000),time:(from:now-7d%2Fd,to:now))

At the moment there is little data.

image

@jkelas jkelas requested a review from maximpn October 8, 2025 08:59
@jkelas jkelas force-pushed the 140369_req_2_customization_status_telemetry branch from 2ba68c0 to 234d324 Compare October 8, 2025 10:59
maximpn
maximpn approved these changes Oct 9, 2025
View reviewed changes
Copy link
Contributor

@maximpn maximpn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jkelas Thanks for addressing my comments 👍

I've tested the PR locally and it works as expected. The only thing would be nice to have is a comment explaining why we track only specific fields and a link to the details (task or PR on GitHub).

szaffarano
szaffarano approved these changes Oct 9, 2025
View reviewed changes
Copy link
Contributor

@szaffarano szaffarano left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jkelas jkelas force-pushed the 140369_req_2_customization_status_telemetry branch from 1dd28b6 to daca2b0 Compare October 9, 2025 09:13
@jkelas
Copy link
Contributor Author

jkelas commented Oct 9, 2025

/ci

@jkelas jkelas requested a review from ddillinger October 9, 2025 19:23
@banderror banderror force-pushed the 140369_req_2_customization_status_telemetry branch from daca2b0 to 8fe9d70 Compare October 10, 2025 10:00
banderror
banderror requested changes Oct 10, 2025
View reviewed changes
Copy link
Contributor

@banderror banderror left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blocking until all the prior telemetry PRs are backported to all the required branches:

@banderror banderror force-pushed the 140369_req_2_customization_status_telemetry branch from 8fe9d70 to 7f5b4f3 Compare October 13, 2025 17:22
banderror
banderror approved these changes Oct 13, 2025
View reviewed changes
Copy link
Contributor

@banderror banderror left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unblocking as all the prior telemetry PRs have been backported correctly

@banderror
Copy link
Contributor

/ci

@banderror
Copy link
Contributor

@elasticmachine run docs-build

@elasticmachine
Copy link
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

✅ unchanged

History

cc @jkelas

@banderror banderror removed the v9.0.9 label Oct 14, 2025
@banderror banderror force-pushed the 140369_req_2_customization_status_telemetry branch from 7f5b4f3 to ca4c8b0 Compare October 14, 2025 15:25
@banderror
Copy link
Contributor

/ci

@banderror
Copy link
Contributor

@elasticmachine run docs-build

ddillinger
ddillinger approved these changes Oct 14, 2025
View reviewed changes
Copy link
Contributor

@ddillinger ddillinger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

telemetry schema ✅

@banderror banderror enabled auto-merge (squash) October 14, 2025 17:05
@banderror banderror merged commit 1f41564 into elastic:main Oct 14, 2025
12 checks passed
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.18, 8.19, 9.1, 9.2

https://github.com/elastic/kibana/actions/runs/18505607358

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Oct 14, 2025
@jkelas @banderror
[Security Solution] Add detection rules customization status for tele…
005d33b 
…metry snapshot (elastic#237583)

**Partially addresses: elastic#140369**

## Summary

This is another PR from of a series of PRs I am planning to create to
cover the requirements in the
elastic#140369 ticket.

The requirement covered in this PR is: " Breakdown of which fields are
being customized."

Testing:

Display the snapshot:
```
POST kbn:/internal/telemetry/clusters/_stats?apiVersion=2
{ "unencrypted": true, "refreshCache": true }
```

Send the snapshot to staging telemetry cluster.
```
POST kbn:/internal/telemetry/force_send?apiVersion=1&elasticInternalOrigin=true
{}
```

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
(cherry picked from commit 1f41564)
@kibanamachine kibanamachine mentioned this pull request Oct 14, 2025
Open
@kibanamachine
Copy link
Contributor

💔 Some backports could not be created

Status Branch Result
❌ 8.18 Backport failed because of merge conflicts
❌ 8.19 Backport failed because of merge conflicts

You might need to backport the following PRs to 8.19:
- [ska] relocation security_solution_* FTR tests (#231416)
❌ 9.1 Backport failed because of merge conflicts
✅ 9.2

Note: Successful backport PRs will be merged automatically after passing CI.

Manual backport

To create the backport manually run:

node scripts/backport --pr 237583

Questions ?

Please refer to the Backport tool documentation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@szaffarano szaffarano szaffarano approved these changes

@ddillinger ddillinger ddillinger approved these changes

@maximpn maximpn maximpn approved these changes

@banderror banderror banderror approved these changes

Assignees

@jkelas jkelas

Labels

backport:version Backport to applied version labels Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area release_note:skip Skip the PR/issue when compiling release notes Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.18.9 v8.19.6 v9.1.6 v9.2.0 v9.3.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@jkelas @elasticmachine @banderror @kibanamachine @szaffarano @ddillinger @maximpn