Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] - Feat Add Severity and risk_score to the Siem migrations #211202

Merged
merged 18 commits into from
Feb 21, 2025
Merged

[Security Solution] - Feat Add Severity and risk_score to the Siem migrations #211202

merged 18 commits into from
Feb 21, 2025

Conversation

logeekal
Copy link
Contributor

@logeekal logeekal commented Feb 14, 2025 •
edited by kibanamachine
Loading

Summary

Handles below Features:

This PR adds risk_score and severity based on below 3 rules

  • Rule Severity should be mapped to Splunk's alert.severity.
  • Rule Severity values should be mapped as mentioned in below section Mapping Elastic Security Rule's Severity with Splunk's Severity
Splunk's Severity Elastic Rule Severity
1- Info Low
2-Low Low
3-Medium Medium
4-High High
5-Critical Critical
  • Elastic Security Rule's Risk Score derived from the Severity of the Rulet based on below mapping( Source )

Image

Desk Testing

splunk_rules_test_severity.json

  1. Use the above attached test file which has the alert.severity exported from Splunk.
  2. Check the Severity of the translated rule should match the mapping given above. Expect results like below :
Screenshot 2025-02-17 at 14 19 23

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.

@logeekal logeekal changed the title [ Security Solution ] - Feat Add Severity to the Splunk --> Elastic migration [Security Solution] - Feat Add Severity to the Splunk --> Elastic migration Feb 14, 2025
@logeekal logeekal marked this pull request as ready for review February 17, 2025 13:24
@logeekal logeekal requested a review from a team as a code owner February 17, 2025 13:24
@logeekal logeekal added the Team:Threat Hunting Security Solution Threat Hunting Team label Feb 17, 2025
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

@logeekal logeekal added backport:version Backport to applied version labels v9.0.0 v9.1.0 v8.18.0 labels Feb 17, 2025
@logeekal logeekal changed the title [Security Solution] - Feat Add Severity to the Splunk --> Elastic migration [Security Solution] - Feat Add Severity and risk_score to the Siem migrations Feb 17, 2025
@logeekal logeekal added the release_note:feature Makes this part of the condensed release notes label Feb 17, 2025
@semd semd added release_note:skip Skip the PR/issue when compiling release notes and removed release_note:feature Makes this part of the condensed release notes labels Feb 17, 2025
@semd
Copy link
Contributor

semd commented Feb 17, 2025

We have been using release_notes:skip in the PRs all along, since this feature was disabled (not anymore) and will be "tech preview" in 8.18/9.0.
It would be good to add the release note for the entire feature, not for each single PR.

@Charelzard How do we plan to handle release notes?

@semd semd added the v8.19.0 label Feb 17, 2025
semd
semd approved these changes Feb 19, 2025
View reviewed changes
Copy link
Contributor

@semd semd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thanks @logeekal 💯

@logeekal logeekal requested review from a team as code owners February 20, 2025 11:30
@logeekal logeekal requested a review from vitaliidm February 20, 2025 11:30
@logeekal
Copy link
Contributor Author

logeekal commented Feb 20, 2025 •
edited
Loading

@elastic/security-detection-engine team,

Please refer to commit : 7a5135d where I have moved risk score - Severity mapping from /public/detection_engine to /common/detection_engine so that we can also make use of it on server side.

Please let me know if you have any opinions against this change.

cc: @semd

semd
semd approved these changes Feb 20, 2025
View reviewed changes
Copy link
Contributor

@semd semd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for reusing the logic from detections @logeekal

PhilippeOberti
PhilippeOberti approved these changes Feb 20, 2025
View reviewed changes
Copy link
Contributor

@PhilippeOberti PhilippeOberti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2 files impacted the Threat Hunting Investigations team, LGTM

vitaliidm
vitaliidm approved these changes Feb 21, 2025
View reviewed changes
Copy link
Contributor

@vitaliidm vitaliidm left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Detection Engine changes LGTM, just moving definitions around.

@logeekal , When I tired to test PR by uploading splunk rules attached to description, I got error

Screenshot 2025-02-21 at 10 13 09

Do I need to do some additional set up for this functionality to work?

@logeekal
Copy link
Contributor Author

logeekal commented Feb 21, 2025 •
edited
Loading

Do I need to do some additional set up for this functionality to work?

@vitaliidm ,

I tried the exactly same file on this branch and below is my result. Could you please tell when which connector did you use?

image

Edit:

I was able to replicate this error with OpenAI connector. I will check why telemetry is causing the issue.

image

@vitaliidm
Copy link
Contributor

I was able to replicate this error with OpenAI connector. I will check why telemetry is causing the issue.

Yes, I am using OpenAI Azure connector too

@logeekal
Copy link
Contributor Author

@vitaliidm ,

Could you please try now as well? After updating main changes, error is gone.

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 8.9MB 8.9MB -20.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
securitySolution 85.2KB 85.3KB +89.0B
Unknown metric groups

ESLint disabled line counts

id before after diff
securitySolution 577 579 +2

Total ESLint disabled count

id before after diff
securitySolution 660 662 +2

History

@vitaliidm
Copy link
Contributor

@logeekal

I've got 429, too many requests:

                    "message": "Error migrating rule: Error calling connector: Status code: 429. Message: API Error: Too Many Requests - Requests to the ChatCompletions_Create Operation under Azure OpenAI API version 2024-02-15-preview have exceeded token rate limit of your current OpenAI S0 pricing tier. Please retry after 49 seconds. Please go here: https://aka.ms/oai/quotaincrease if you would like to further increase the default rate limit.",

At least it proves, it tried to migrate rules

@logeekal
Copy link
Contributor Author

At least it proves, it tried to migrate rules

Thanks. Yes. This error occurs sometimes depending on the connector. But it should be resolved soon with this PR: #211469

@logeekal logeekal merged commit 74ef9fc into elastic:main Feb 21, 2025
9 checks passed
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.18, 8.x, 9.0

https://github.com/elastic/kibana/actions/runs/13460950999

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 21, 2025
@logeekal
[Security Solution] - Feat Add Severity and risk_score to the Sie…
562d752 
…m migrations (elastic#211202)

## Summary

Handles below Features:
- elastic/security-team#11837

This PR adds `risk_score` and `severity` based on below 3 rules
- `Rule Severity` should be mapped to Splunk's `alert.severity`.
- `Rule Severity` values should be mapped as mentioned in below section
Mapping Elastic Security Rule's Severity with Splunk's Severity

>
> |Splunk's Severity| Elastic Rule Severity |
> |---|---|
> |1- Info|Low|
> |2-Low|Low|
> |3-Medium|Medium|
> |4-High|High|
> |5-Critical|Critical|

- Elastic Security Rule's `Risk Score` derived from the `Severity` of
the Rulet based on below mapping(
[Source](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-ui-basic-params)
)

![Image](https://github.com/user-attachments/assets/d88acd1f-9b73-467f-bf16-0dbecadec465)

## Desk Testing

[splunk_rules_test_severity.json](https://github.com/user-attachments/files/18825855/splunk_rules_test_severity.json)

1. Use the above attached test file which has the `alert.severity`
exported from Splunk.
2. Check the Severity of the translated rule should match the mapping
given above. Expect results like below :

<img width="1474" alt="Screenshot 2025-02-17 at 14 19 23"
src="https://github.com/user-attachments/assets/a8459c71-3208-480e-8049-05293a0a3d2a"
/>

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### Identify risks

Does this PR introduce any risks? For example, consider risks like hard
to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified
risk. Invite stakeholders and evaluate how to proceed before merging.

- [ ] [See some risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)
- [ ] ...

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
(cherry picked from commit 74ef9fc)
@kibanamachine kibanamachine mentioned this pull request Feb 21, 2025
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 21, 2025
@logeekal
[Security Solution] - Feat Add Severity and risk_score to the Sie…
ceffb26 
…m migrations (elastic#211202)

## Summary

Handles below Features:
- elastic/security-team#11837

This PR adds `risk_score` and `severity` based on below 3 rules
- `Rule Severity` should be mapped to Splunk's `alert.severity`.
- `Rule Severity` values should be mapped as mentioned in below section
Mapping Elastic Security Rule's Severity with Splunk's Severity

>
> |Splunk's Severity| Elastic Rule Severity |
> |---|---|
> |1- Info|Low|
> |2-Low|Low|
> |3-Medium|Medium|
> |4-High|High|
> |5-Critical|Critical|

- Elastic Security Rule's `Risk Score` derived from the `Severity` of
the Rulet based on below mapping(
[Source](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-ui-basic-params)
)

![Image](https://github.com/user-attachments/assets/d88acd1f-9b73-467f-bf16-0dbecadec465)

## Desk Testing

[splunk_rules_test_severity.json](https://github.com/user-attachments/files/18825855/splunk_rules_test_severity.json)

1. Use the above attached test file which has the `alert.severity`
exported from Splunk.
2. Check the Severity of the translated rule should match the mapping
given above. Expect results like below :

<img width="1474" alt="Screenshot 2025-02-17 at 14 19 23"
src="https://github.com/user-attachments/assets/a8459c71-3208-480e-8049-05293a0a3d2a"
/>

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### Identify risks

Does this PR introduce any risks? For example, consider risks like hard
to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified
risk. Invite stakeholders and evaluate how to proceed before merging.

- [ ] [See some risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)
- [ ] ...

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
(cherry picked from commit 74ef9fc)
@kibanamachine kibanamachine mentioned this pull request Feb 21, 2025
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 21, 2025
@logeekal
[Security Solution] - Feat Add Severity and risk_score to the Sie…
3d405f8 
…m migrations (elastic#211202)

## Summary

Handles below Features:
- elastic/security-team#11837

This PR adds `risk_score` and `severity` based on below 3 rules
- `Rule Severity` should be mapped to Splunk's `alert.severity`.
- `Rule Severity` values should be mapped as mentioned in below section
Mapping Elastic Security Rule's Severity with Splunk's Severity

>
> |Splunk's Severity| Elastic Rule Severity |
> |---|---|
> |1- Info|Low|
> |2-Low|Low|
> |3-Medium|Medium|
> |4-High|High|
> |5-Critical|Critical|

- Elastic Security Rule's `Risk Score` derived from the `Severity` of
the Rulet based on below mapping(
[Source](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-ui-basic-params)
)

![Image](https://github.com/user-attachments/assets/d88acd1f-9b73-467f-bf16-0dbecadec465)

## Desk Testing

[splunk_rules_test_severity.json](https://github.com/user-attachments/files/18825855/splunk_rules_test_severity.json)

1. Use the above attached test file which has the `alert.severity`
exported from Splunk.
2. Check the Severity of the translated rule should match the mapping
given above. Expect results like below :

<img width="1474" alt="Screenshot 2025-02-17 at 14 19 23"
src="https://github.com/user-attachments/assets/a8459c71-3208-480e-8049-05293a0a3d2a"
/>

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### Identify risks

Does this PR introduce any risks? For example, consider risks like hard
to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified
risk. Invite stakeholders and evaluate how to proceed before merging.

- [ ] [See some risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)
- [ ] ...

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
(cherry picked from commit 74ef9fc)
@kibanamachine kibanamachine mentioned this pull request Feb 21, 2025
Open
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
✅ 8.18
✅ 8.x
✅ 9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Feb 21, 2025
@kibanamachine @logeekal
[8.x] [Security Solution] - Feat Add Severity and risk_score to t…
02a1a03 
…he Siem migrations (#211202) (#212118)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution] - Feat Add `Severity` and `risk_score` to the
Siem migrations
(#211202)](#211202)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jatin
Kathuria","email":"jatin.kathuria@elastic.co"},"sourceCommit":{"committedDate":"2025-02-21T16:24:44Z","message":"[Security
Solution] - Feat Add `Severity` and `risk_score` to the Siem migrations
(#211202)\n\n## Summary\n\nHandles below Features:\n-
https://github.com/elastic/security-team/issues/11837\n\n\nThis PR adds
`risk_score` and `severity` based on below 3 rules\n- `Rule Severity`
should be mapped to Splunk's `alert.severity`.\n- `Rule Severity` values
should be mapped as mentioned in below section\nMapping Elastic Security
Rule's Severity with Splunk's Severity\n\n> \n> |Splunk's Severity|
Elastic Rule Severity |\n> |---|---|\n> |1- Info|Low|\n> |2-Low|Low|\n>
|3-Medium|Medium|\n> |4-High|High|\n> |5-Critical|Critical|\n\n- Elastic
Security Rule's `Risk Score` derived from the `Severity` of\nthe Rulet
based on below
mapping(\n[Source](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-ui-basic-params)\n)\n\n\n![Image](https://github.com/user-attachments/assets/d88acd1f-9b73-467f-bf16-0dbecadec465)\n\n\n##
Desk
Testing\n\n\n[splunk_rules_test_severity.json](https://github.com/user-attachments/files/18825855/splunk_rules_test_severity.json)\n\n\n1.
Use the above attached test file which has the
`alert.severity`\nexported from Splunk.\n2. Check the Severity of the
translated rule should match the mapping\ngiven above. Expect results
like below :\n\n<img width=\"1474\" alt=\"Screenshot 2025-02-17 at 14 19
23\"\nsrc=\"https://github.com/user-attachments/assets/a8459c71-3208-480e-8049-05293a0a3d2a\"\n/>\n\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [x] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n\n\n### Identify
risks\n\nDoes this PR introduce any risks? For example, consider risks
like hard\nto test bugs, performance regression, potential of data
loss.\n\nDescribe the risk, its severity, and mitigation for each
identified\nrisk. Invite stakeholders and evaluate how to proceed before
merging.\n\n- [ ] [See some
risk\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)\n-
[ ] ...\n\n---------\n\nCo-authored-by: kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"74ef9fcdee2086bf2c48a35c5c15fb0997fc41dd","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Threat
Hunting","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] - Feat Add `Severity` and `risk_score` to the Siem
migrations","number":211202,"url":"https://github.com/elastic/kibana/pull/211202","mergeCommit":{"message":"[Security
Solution] - Feat Add `Severity` and `risk_score` to the Siem migrations
(#211202)\n\n## Summary\n\nHandles below Features:\n-
https://github.com/elastic/security-team/issues/11837\n\n\nThis PR adds
`risk_score` and `severity` based on below 3 rules\n- `Rule Severity`
should be mapped to Splunk's `alert.severity`.\n- `Rule Severity` values
should be mapped as mentioned in below section\nMapping Elastic Security
Rule's Severity with Splunk's Severity\n\n> \n> |Splunk's Severity|
Elastic Rule Severity |\n> |---|---|\n> |1- Info|Low|\n> |2-Low|Low|\n>
|3-Medium|Medium|\n> |4-High|High|\n> |5-Critical|Critical|\n\n- Elastic
Security Rule's `Risk Score` derived from the `Severity` of\nthe Rulet
based on below
mapping(\n[Source](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-ui-basic-params)\n)\n\n\n![Image](https://github.com/user-attachments/assets/d88acd1f-9b73-467f-bf16-0dbecadec465)\n\n\n##
Desk
Testing\n\n\n[splunk_rules_test_severity.json](https://github.com/user-attachments/files/18825855/splunk_rules_test_severity.json)\n\n\n1.
Use the above attached test file which has the
`alert.severity`\nexported from Splunk.\n2. Check the Severity of the
translated rule should match the mapping\ngiven above. Expect results
like below :\n\n<img width=\"1474\" alt=\"Screenshot 2025-02-17 at 14 19
23\"\nsrc=\"https://github.com/user-attachments/assets/a8459c71-3208-480e-8049-05293a0a3d2a\"\n/>\n\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [x] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n\n\n### Identify
risks\n\nDoes this PR introduce any risks? For example, consider risks
like hard\nto test bugs, performance regression, potential of data
loss.\n\nDescribe the risk, its severity, and mitigation for each
identified\nrisk. Invite stakeholders and evaluate how to proceed before
merging.\n\n- [ ] [See some
risk\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)\n-
[ ] ...\n\n---------\n\nCo-authored-by: kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"74ef9fcdee2086bf2c48a35c5c15fb0997fc41dd"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/211202","number":211202,"mergeCommit":{"message":"[Security
Solution] - Feat Add `Severity` and `risk_score` to the Siem migrations
(#211202)\n\n## Summary\n\nHandles below Features:\n-
https://github.com/elastic/security-team/issues/11837\n\n\nThis PR adds
`risk_score` and `severity` based on below 3 rules\n- `Rule Severity`
should be mapped to Splunk's `alert.severity`.\n- `Rule Severity` values
should be mapped as mentioned in below section\nMapping Elastic Security
Rule's Severity with Splunk's Severity\n\n> \n> |Splunk's Severity|
Elastic Rule Severity |\n> |---|---|\n> |1- Info|Low|\n> |2-Low|Low|\n>
|3-Medium|Medium|\n> |4-High|High|\n> |5-Critical|Critical|\n\n- Elastic
Security Rule's `Risk Score` derived from the `Severity` of\nthe Rulet
based on below
mapping(\n[Source](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-ui-basic-params)\n)\n\n\n![Image](https://github.com/user-attachments/assets/d88acd1f-9b73-467f-bf16-0dbecadec465)\n\n\n##
Desk
Testing\n\n\n[splunk_rules_test_severity.json](https://github.com/user-attachments/files/18825855/splunk_rules_test_severity.json)\n\n\n1.
Use the above attached test file which has the
`alert.severity`\nexported from Splunk.\n2. Check the Severity of the
translated rule should match the mapping\ngiven above. Expect results
like below :\n\n<img width=\"1474\" alt=\"Screenshot 2025-02-17 at 14 19
23\"\nsrc=\"https://github.com/user-attachments/assets/a8459c71-3208-480e-8049-05293a0a3d2a\"\n/>\n\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [x] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n\n\n### Identify
risks\n\nDoes this PR introduce any risks? For example, consider risks
like hard\nto test bugs, performance regression, potential of data
loss.\n\nDescribe the risk, its severity, and mitigation for each
identified\nrisk. Invite stakeholders and evaluate how to proceed before
merging.\n\n- [ ] [See some
risk\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)\n-
[ ] ...\n\n---------\n\nCo-authored-by: kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"74ef9fcdee2086bf2c48a35c5c15fb0997fc41dd"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Jatin Kathuria <jatin.kathuria@elastic.co>
kibanamachine added a commit that referenced this pull request Feb 21, 2025
@kibanamachine @logeekal
[8.18] [Security Solution] - Feat Add Severity and risk_score to …
65065aa 
…the Siem migrations (#211202) (#212116)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] - Feat Add `Severity` and `risk_score` to the
Siem migrations
(#211202)](#211202)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jatin
Kathuria","email":"jatin.kathuria@elastic.co"},"sourceCommit":{"committedDate":"2025-02-21T16:24:44Z","message":"[Security
Solution] - Feat Add `Severity` and `risk_score` to the Siem migrations
(#211202)\n\n## Summary\n\nHandles below Features:\n-
https://github.com/elastic/security-team/issues/11837\n\n\nThis PR adds
`risk_score` and `severity` based on below 3 rules\n- `Rule Severity`
should be mapped to Splunk's `alert.severity`.\n- `Rule Severity` values
should be mapped as mentioned in below section\nMapping Elastic Security
Rule's Severity with Splunk's Severity\n\n> \n> |Splunk's Severity|
Elastic Rule Severity |\n> |---|---|\n> |1- Info|Low|\n> |2-Low|Low|\n>
|3-Medium|Medium|\n> |4-High|High|\n> |5-Critical|Critical|\n\n- Elastic
Security Rule's `Risk Score` derived from the `Severity` of\nthe Rulet
based on below
mapping(\n[Source](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-ui-basic-params)\n)\n\n\n![Image](https://github.com/user-attachments/assets/d88acd1f-9b73-467f-bf16-0dbecadec465)\n\n\n##
Desk
Testing\n\n\n[splunk_rules_test_severity.json](https://github.com/user-attachments/files/18825855/splunk_rules_test_severity.json)\n\n\n1.
Use the above attached test file which has the
`alert.severity`\nexported from Splunk.\n2. Check the Severity of the
translated rule should match the mapping\ngiven above. Expect results
like below :\n\n<img width=\"1474\" alt=\"Screenshot 2025-02-17 at 14 19
23\"\nsrc=\"https://github.com/user-attachments/assets/a8459c71-3208-480e-8049-05293a0a3d2a\"\n/>\n\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [x] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n\n\n### Identify
risks\n\nDoes this PR introduce any risks? For example, consider risks
like hard\nto test bugs, performance regression, potential of data
loss.\n\nDescribe the risk, its severity, and mitigation for each
identified\nrisk. Invite stakeholders and evaluate how to proceed before
merging.\n\n- [ ] [See some
risk\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)\n-
[ ] ...\n\n---------\n\nCo-authored-by: kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"74ef9fcdee2086bf2c48a35c5c15fb0997fc41dd","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Threat
Hunting","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] - Feat Add `Severity` and `risk_score` to the Siem
migrations","number":211202,"url":"https://github.com/elastic/kibana/pull/211202","mergeCommit":{"message":"[Security
Solution] - Feat Add `Severity` and `risk_score` to the Siem migrations
(#211202)\n\n## Summary\n\nHandles below Features:\n-
https://github.com/elastic/security-team/issues/11837\n\n\nThis PR adds
`risk_score` and `severity` based on below 3 rules\n- `Rule Severity`
should be mapped to Splunk's `alert.severity`.\n- `Rule Severity` values
should be mapped as mentioned in below section\nMapping Elastic Security
Rule's Severity with Splunk's Severity\n\n> \n> |Splunk's Severity|
Elastic Rule Severity |\n> |---|---|\n> |1- Info|Low|\n> |2-Low|Low|\n>
|3-Medium|Medium|\n> |4-High|High|\n> |5-Critical|Critical|\n\n- Elastic
Security Rule's `Risk Score` derived from the `Severity` of\nthe Rulet
based on below
mapping(\n[Source](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-ui-basic-params)\n)\n\n\n![Image](https://github.com/user-attachments/assets/d88acd1f-9b73-467f-bf16-0dbecadec465)\n\n\n##
Desk
Testing\n\n\n[splunk_rules_test_severity.json](https://github.com/user-attachments/files/18825855/splunk_rules_test_severity.json)\n\n\n1.
Use the above attached test file which has the
`alert.severity`\nexported from Splunk.\n2. Check the Severity of the
translated rule should match the mapping\ngiven above. Expect results
like below :\n\n<img width=\"1474\" alt=\"Screenshot 2025-02-17 at 14 19
23\"\nsrc=\"https://github.com/user-attachments/assets/a8459c71-3208-480e-8049-05293a0a3d2a\"\n/>\n\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [x] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n\n\n### Identify
risks\n\nDoes this PR introduce any risks? For example, consider risks
like hard\nto test bugs, performance regression, potential of data
loss.\n\nDescribe the risk, its severity, and mitigation for each
identified\nrisk. Invite stakeholders and evaluate how to proceed before
merging.\n\n- [ ] [See some
risk\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)\n-
[ ] ...\n\n---------\n\nCo-authored-by: kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"74ef9fcdee2086bf2c48a35c5c15fb0997fc41dd"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/211202","number":211202,"mergeCommit":{"message":"[Security
Solution] - Feat Add `Severity` and `risk_score` to the Siem migrations
(#211202)\n\n## Summary\n\nHandles below Features:\n-
https://github.com/elastic/security-team/issues/11837\n\n\nThis PR adds
`risk_score` and `severity` based on below 3 rules\n- `Rule Severity`
should be mapped to Splunk's `alert.severity`.\n- `Rule Severity` values
should be mapped as mentioned in below section\nMapping Elastic Security
Rule's Severity with Splunk's Severity\n\n> \n> |Splunk's Severity|
Elastic Rule Severity |\n> |---|---|\n> |1- Info|Low|\n> |2-Low|Low|\n>
|3-Medium|Medium|\n> |4-High|High|\n> |5-Critical|Critical|\n\n- Elastic
Security Rule's `Risk Score` derived from the `Severity` of\nthe Rulet
based on below
mapping(\n[Source](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-ui-basic-params)\n)\n\n\n![Image](https://github.com/user-attachments/assets/d88acd1f-9b73-467f-bf16-0dbecadec465)\n\n\n##
Desk
Testing\n\n\n[splunk_rules_test_severity.json](https://github.com/user-attachments/files/18825855/splunk_rules_test_severity.json)\n\n\n1.
Use the above attached test file which has the
`alert.severity`\nexported from Splunk.\n2. Check the Severity of the
translated rule should match the mapping\ngiven above. Expect results
like below :\n\n<img width=\"1474\" alt=\"Screenshot 2025-02-17 at 14 19
23\"\nsrc=\"https://github.com/user-attachments/assets/a8459c71-3208-480e-8049-05293a0a3d2a\"\n/>\n\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [x] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n\n\n### Identify
risks\n\nDoes this PR introduce any risks? For example, consider risks
like hard\nto test bugs, performance regression, potential of data
loss.\n\nDescribe the risk, its severity, and mitigation for each
identified\nrisk. Invite stakeholders and evaluate how to proceed before
merging.\n\n- [ ] [See some
risk\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)\n-
[ ] ...\n\n---------\n\nCo-authored-by: kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"74ef9fcdee2086bf2c48a35c5c15fb0997fc41dd"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Jatin Kathuria <jatin.kathuria@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@PhilippeOberti PhilippeOberti PhilippeOberti approved these changes

@semd semd semd approved these changes

@vitaliidm vitaliidm vitaliidm approved these changes

Assignees
No one assigned
Labels
backport:version Backport to applied version labels release_note:skip Skip the PR/issue when compiling release notes Team:Threat Hunting Security Solution Threat Hunting Team v8.18.0 v8.19.0 v9.0.0 v9.1.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@logeekal @elasticmachine @semd @vitaliidm @kibanamachine @PhilippeOberti