elastic / elastic/detection-rules

[FR] Update Rule Versioning to Semantic Versioning

Open
#2,496 1 comment 0 reactions 0 assignees View on GitHub
backlog enhancement python
Dominant language
Python
Stars
2.7k
Forks
696
Avg merge
4d 17h
Merged PRs (30d)
87

Description

**Is your feature request related to a problem? Please describe.**
This feature request is not related to a problem. At the moment, detection rule versions are whole integers whereas we have the capability to change those to semantic versioning.

**Describe the solution you'd like**
Rather than rule versions be whole integers, we can change them to semantic versioning. This would allow more granularity when determining rule version changes programmatically by determining what is constitutes a major, minor or path update. From this, we can also enhance our communication via documentation about what specific rule changes indicate. For example if a major bump in the rule change is noticed, this indicates the detection logic or query has been modified.

**Describe alternatives you've considered**
The alternative to consider is staying with whole integers. At the moment, because we have to account for forked rules, rule versions are programmatically given a buffer space of ~100 so that rule collisions do not take place. As a result, minor changes to any data field could will cause a whole integer version bump. Worse, a new min-stack is given to the rule, the version bumps 100 spaces and thus can be misleading to customers.

**Additional context**
There are several considerations that need to take place for this.
* Consult with Security Detections Response team about requirements for Kibana
* Review semantic versioning and develop design for semantic versioning rules and logic
* Develop feature request PR with logic as designed and planned
* Test with local Kibana and Kibana CI testing to ensure successful results and rule change logic and comparison in Kibana works
* Potential - Develop blog to explain the new changes to rules and what semantic versioning indicates
* Update detection rules README to deliver clear communication about versioning
* Consider any changes necessary for the prebuilt rules package releases

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.