[Security Solution] Move prebuilt rule install/upgrade/revert into DetectionRulesClient#272038
Draft
maximpn wants to merge 2 commits into
Draft
Conversation
…tectionRulesClient Moves the prebuilt rule install, upgrade, and revert logic from standalone `rule_objects/` helpers into new DetectionRulesClient methods, completing the consolidation started in elastic#270446. Deletes create_prebuilt_rules.ts, upgrade_prebuilt_rules.ts, and revert_prebuilt_rules.ts from rule_objects/ and simplifies the corresponding API handlers to delegate to the DRC.
maximpn
added
refactoring
release_note:skip
|
🤖 Jobs for this PR can be triggered through checkboxes. 🚧
ℹ️ To trigger the CI, please tick the checkbox below 👇
|
maximpn
force-pushed
the
changes-history/condence-security-rules-instrumentation-in-drc
branch
from
9500dc4 to
6f976fa
Compare
maximpn
force-pushed
the
changes-history/condence-security-rules-instrumentation-in-drc
branch
from
6f976fa to
a12b7c3
Compare
Contributor
💔 Build Failed
Failed CI Steps
Test Failures
Metrics [docs]
History
cc @maximpn |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to: #270446
Epic: https://github.com/elastic/security-team/issues/12367 (internal)
Summary
Follow-up to #270446, which added change tracking instrumentation to
DetectionRulesClient(DRC) by threading
changeTrackingparameters through API handlers. While that PR wired upthe tracking parameters, the actual prebuilt rule install/upgrade/revert logic remained in
standalone helpers under
prebuilt_rules/logic/rule_objects/. This PR completes theconsolidation by moving that logic into the DRC itself, making the DRC the single authoritative
layer for all prebuilt rule management operations — including their change tracking.
Details
Detection Rules Client — new methods
installPrebuiltRulesandinstallAllPrebuiltRulesupgradePrebuiltRulesandupgradeAllPrebuiltRulesrevertPrebuiltRulesIDetectionRulesClientinterface accordinglycreate_upgradeable_rules_payload.ts→logic/create_modified_prebuilt_rule_assets.tsDetection Rules Client — deleted helpers
prebuilt_rules/logic/rule_objects/create_prebuilt_rules.tsprebuilt_rules/logic/rule_objects/upgrade_prebuilt_rules.tsprebuilt_rules/logic/rule_objects/revert_prebuilt_rules.tsAPI handlers — simplified
perform_rule_installation_handler.tsandperform_rule_upgrade_handler.ts:bulk prebuilt rule logic now delegated to the new DRC methods
revert_prebuilt_rule_handler.ts: delegates torevertPrebuiltRuleslegacy_create_prepackaged_rules.ts: updated to useinstallAllPrebuiltRulesinstall_endpoint_security_prebuilt_rule.tsandinstall_promotion_rules.ts: updatedRule import and Security Solution Migrations
import_rules.tsrefactored to use DRC consistentlysiem_migrations/rules/api/util/installation.tsupdated to the new DRC APIHow to test
This is a pure refactoring — no API surface or user-visible behavior changes. All existing
automated tests cover the affected paths.
Run the unit test suite for the affected areas:
To verify end-to-end behavior with change tracking enabled, follow the manual steps from #270446.
Release note
skip
Checklist
release_note:*label is applied per the guidelinesIdentify risks
Low risk — pure internal refactoring. No API surface, schema, or user-visible behavior changes.
All external API routes remain unchanged. The only risk is a regression in prebuilt rule
management operations, which is guarded by the existing unit and integration test suites.