mirror of
https://github.com/elastic/detection-rules
synced 2026-06-08 14:00:08 +00:00
Mika Ayenson, PhD
1bc3dc0636
* fix(integrations): emit stack-invariant OR ranges for related_integrations Replace find_least_compatible_version with find_compatible_version_range so prebuilt rules export the same related_integrations.version across stack backports. Bump version.lock for rules whose export changes. * fix(integrations): emit stack-invariant OR ranges for related_integrations Replace find_least_compatible_version with find_compatible_version_range so prebuilt rules export the same related_integrations.version across stack backports. Bump pyproject.toml patch version. Resolves #5601 * fix(integrations): satisfy ruff SIM110 in _major_has_compatible_stack * fix(integrations): address review feedback for stack-major resolution Iterate all majors overlapped by parsed Kibana bounds, derive legacy stack walk versions from manifest range floors instead of 8.19.0, remove a dead aligned-major branch, and drop RST-style double backticks in new docstrings. * fix(integrations): tighten stack-major overlap and anchor resolution Walk every stack major whose band intersects a bounded Kibana clause (e.g. >=8.12.0 <9.1.0 includes major 9) and pick the earliest compatible stack point within a major for the legacy least-compatible walk. * fix(integrations): annotate majors_to_check for pyright * style(rule): apply ruff format for CI code-checks Fix formatting on integration_name assignment that failed ruff format --check. * fix(integrations): address PR review on version range export Walk all stack majors for non-aligned packages, handle unbounded Kibana ranges, restore schema comments, use immutable anchor tuples, and add UNKNOWN_PACKAGE_INTEGRATION constant with regression tests. * fix(integrations): anchor RI export to shipped stack backports only Prebuilt rules ship to the stack lines in stack-schema-map, not every Kibana major a manifest ever claimed. Filter against get_stack_versions() so dead lines like Kibana 7.x do not pull azure 0.0.2 into related_integrations. * refactor(integrations): simplify version range export helpers Remove aligned-major fast path, redundant overlap checks, and dead branches from the #5601 OR-range export. Cache shipped stack majors, derive unbounded-range test expectations from _MAX_UNBOUNDED_STACK_MAJOR_SPAN, and inline schema-floor fallback at its single call site. * fix(rule): dedupe ES|QL related_integrations metadata package row Skip the metadata-only package entry when the ES|QL query already names a data stream for that package (e.g. azure.signinlogs). Kuery/EQL paths are unchanged. Adds regression tests for azure signinlogs and aadgraph. * test(integrations): drop brittle ES|QL rule-file export tests Remove file-path-based related_integrations tests that depend on local-only rule TOMLs and live manifest output. Keep the pure helper coverage for _esql_metadata_package_row_needed. * refactor(integrations): dedupe schema floor lookup and trim comments Hoist _integration_schema_floor() to remove duplicate minimum_schema calls in find_compatible_version_range. Shorten export-path comments after audit; no behavior change. * fix(integrations): walk shipped stack lines for RI anchor collection Collect related_integrations anchors from each get_stack_versions() entry instead of synthesizing stack-major floors (e.g. 9.0.0). AWS 5.x/6.x require Kibana ^9.2+ and were missed, causing false version-mismatch warnings on 9.2+. * fix(rule): dedupe NON_DATASET metadata RI rows when datasets cover package Skip redundant related_integrations rows for endpoint, windows, and other NON_DATASET_PACKAGES when the query already references package.* datasets. Extends ES|QL metadata dedupe to EQL/KQL rules.