Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Rule Tuning] Remove empty technique array logic #813

Closed
brokensound77 opened this issue Jan 6, 2021 · 4 comments
Closed

[Rule Tuning] Remove empty technique array logic #813

brokensound77 opened this issue Jan 6, 2021 · 4 comments
Labels
Rule: Tuning tweaking or tuning an existing rule stale 60 days of inactivity

Comments

@brokensound77
Copy link
Contributor

Related to elastic/kibana#87546
Related to #812

7.11 required technique to at least contain an empty array when techniques were not defined. Once Kibana updates the schema to make the field optional, we should strip it from all of the rules:

@brokensound77 brokensound77 added Rule: Tuning tweaking or tuning an existing rule v7.12.0 7.12 rules release package labels Jan 6, 2021
@brokensound77
Copy link
Contributor Author

#828 removed the empty array from rules and inserts them dynamically, so this is no longer required. We should remove the dynamic insertion though, once the schema no longer requires it (updating title)

@brokensound77 brokensound77 changed the title [Rule Tuning] Remove empty technique arrays once Kibana schema accepts it [Rule Tuning] Remove empty technique array logic Jan 11, 2021
@brokensound77
Copy link
Contributor Author

Kibana PR removes the need for the empty technique array. Will remove the build-time insertion logic alongside upcoming OOB release code updates.

@botelastic
Copy link

botelastic bot commented Aug 25, 2021

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@botelastic botelastic bot added the stale 60 days of inactivity label Aug 25, 2021
@brokensound77
Copy link
Contributor Author

I think we are just going to leave it as is

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Rule: Tuning tweaking or tuning an existing rule stale 60 days of inactivity
Projects
None yet
Development

No branches or pull requests

1 participant