[Security Solution][Platform] - 7.16/8.0 Sanity Check

[yctercero]

Sanity check on work done for 7.16/8.0 releases. Merging these two together as they tend to overlap a bit this go around. Feel free to add a comment with different test cases you've tried and any results, bugs found, etc.

7.16 Release Build Ticket

7.16

• End to End test - basic:

  • Verify rules with actions from 7.15 or earlier, continue to work on upgrade to 7.16
  • Verify that on touch of rule with action from pre 7.16, data structure is updated to new actions
  • Verify that you can export 7.15 rules and import in 7.16
  • Verify that you can create a rule with an action in 7.16 (verify notification fires)
  • Verify that you can export rules in one space and import into another
  • Verify that exceptions are exported on rule export

• End to End test - trial:

  • Verify user is unable to import rules with actions [license check]

8.0

• End to End test - basic:
  • Verify rules with actions from 7.16, continue to work on upgrade to 8.0
  • Verify that on touch of rule with action from pre 7.16, data structure is updated to new actions
  • Verify that you can export 7.16 rules and import in 8.0
  • Verify that you can create a rule with an action in 8.0 (verify notification fires)
  • Verify that you can export rules in one space and import into another

Bugs

• [Security Solution] "No Data" screen is displayed when a user has missing privileges #114960
• [Security Solution]Rebranding required in the Import modal text  #115537
• [Security Solution][Platform] - Remove exceptions duplicates on rule export #116329 (comment)
  • [Security Solution][Platform] - Exceptions export duplicates #116698
• [Security Solution][Platform] - Restore exceptions_count on rule export #116330 (comment)
  • [Security Solution][Platform] - Update rule exported counts to include total object count #116338

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[FrankHassanabad]

Bug found by @MadameSheema and @dhurley14 when verifying during BC1:

• Verify that you can export rules in one space and import into another

Glo tried to import some rules (with actions) into a different space but received a 400 (or 404? I don’t remember) saying the action:some-guid-id does not exist. This was a result of the connector not existing in the space she imported the rule into. This is known at least within our area but I could not find an issue describing if we will just document this behavior or if we are fixing for one of the next BC’s. Anyone know if there is an issue open and what the next steps are?

From me:

This a bug (thanks for finding it) and I will work on this as a fix. Basically I will do a pre-emptive search for all connectors associated with rules to ensure they exist before importing as a validation. If it fails then I will give a clear message that the connector does not exist and I could not import the rule with the missing connector.
We don't support exporting/importing connectors just yet directly from the export button.

I am going to try to make the message more clear to the end user but still do a rejection of the rule if the connector does not exist for the action before the next BC.

[MadameSheema]

7.16 BC2

• End to End test - basic:

  • Verify rules with actions from 7.15 or earlier, continue to work on upgrade to 7.16
  • Verify that on touch of rule with action from pre 7.16, data structure is updated to new actions
  • Verify that you can export 7.15 rules and import in 7.16
  • Verify that you can create a rule with an action in 7.16 (verify notification fires)
  • Verify that you can export rules in one space and import into another
  • Verify that exceptions are exported on rule export

• End to End test - trial:

  • Verify user is unable to import rules with actions [license check]

[yctercero]

Critical bug fix [@dhurley14]

• [Security Solution] [Platform] Fix critical bug when migrating action within update route #116512