mirror of
https://github.com/elastic/detection-rules
synced 2026-06-08 14:00:08 +00:00
Mika Ayenson, PhD
adf12e8e22
* fix(integrations): emit stack-invariant OR ranges for related_integrations
Replace find_least_compatible_version with find_compatible_version_range
so prebuilt rules export the same related_integrations.version across
stack backports. Bump version.lock for rules whose export changes.
* fix(integrations): emit stack-invariant OR ranges for related_integrations
Replace find_least_compatible_version with find_compatible_version_range
so prebuilt rules export the same related_integrations.version across
stack backports. Bump pyproject.toml patch version.
Resolves #5601
* fix(integrations): satisfy ruff SIM110 in _major_has_compatible_stack
* fix(integrations): address review feedback for stack-major resolution
Iterate all majors overlapped by parsed Kibana bounds, derive legacy
stack walk versions from manifest range floors instead of 8.19.0, remove
a dead aligned-major branch, and drop RST-style double backticks in new
docstrings.
* fix(integrations): tighten stack-major overlap and anchor resolution
Walk every stack major whose band intersects a bounded Kibana clause
(e.g. >=8.12.0 <9.1.0 includes major 9) and pick the earliest compatible
stack point within a major for the legacy least-compatible walk.
* fix(integrations): annotate majors_to_check for pyright
* style(rule): apply ruff format for CI code-checks
Fix formatting on integration_name assignment that failed ruff format --check.
* fix(integrations): address PR review on version range export
Walk all stack majors for non-aligned packages, handle unbounded Kibana
ranges, restore schema comments, use immutable anchor tuples, and add
UNKNOWN_PACKAGE_INTEGRATION constant with regression tests.
* fix(integrations): anchor RI export to shipped stack backports only
Prebuilt rules ship to the stack lines in stack-schema-map, not every Kibana
major a manifest ever claimed. Filter against get_stack_versions() so dead
lines like Kibana 7.x do not pull azure 0.0.2 into related_integrations.
* refactor(integrations): simplify version range export helpers
Remove aligned-major fast path, redundant overlap checks, and dead
branches from the #5601 OR-range export. Cache shipped stack majors,
derive unbounded-range test expectations from _MAX_UNBOUNDED_STACK_MAJOR_SPAN,
and inline schema-floor fallback at its single call site.
* fix(rule): dedupe ES|QL related_integrations metadata package row
Skip the metadata-only package entry when the ES|QL query already names
a data stream for that package (e.g. azure.signinlogs). Kuery/EQL paths
are unchanged. Adds regression tests for azure signinlogs and aadgraph.
* test(integrations): drop brittle ES|QL rule-file export tests
Remove file-path-based related_integrations tests that depend on
local-only rule TOMLs and live manifest output. Keep the pure helper
coverage for _esql_metadata_package_row_needed.
* refactor(integrations): dedupe schema floor lookup and trim comments
Hoist _integration_schema_floor() to remove duplicate minimum_schema
calls in find_compatible_version_range. Shorten export-path comments
after audit; no behavior change.
* fix(integrations): walk shipped stack lines for RI anchor collection
Collect related_integrations anchors from each get_stack_versions() entry
instead of synthesizing stack-major floors (e.g. 9.0.0). AWS 5.x/6.x require
Kibana ^9.2+ and were missed, causing false version-mismatch warnings on 9.2+.
* fix(rule): dedupe NON_DATASET metadata RI rows when datasets cover package
Skip redundant related_integrations rows for endpoint, windows, and other
NON_DATASET_PACKAGES when the query already references package.* datasets.
Extends ES|QL metadata dedupe to EQL/KQL rules.
(cherry picked from commit 1bc3dc0636)