[Detections & Response][Upgrade to 8.x] - Known SO corruption issue when upgrading from 7.x to 8.x

[yctercero]

Summary

It would be beneficial to make it known to users that they may hit the following error: when upgrading from 7.17.x to 8.x rules display an error when you try re-enable your rules. During upgrade, rules get disabled and a user must go in and re-enable their rules. When they do this, they may hit an error like the ones screenshot below. These signal that there was an issue during migration that corrupted the rule SO.

As of now, the only workaround is to duplicate the rules. Please see this issue for details and discussion on this issue - elastic/kibana#177852

[jmikell821]

Hi @yctercero, confirming that this doesn't affect upgrading from 8.18 -> 9.0 as well?

[yctercero]

@jmikell821 I think it still can. But I'm not sure - this is being handled by @elastic/security-detection-rule-management . cc @banderror

[banderror]

@jmikell821 We don't know for sure if the bug can occur on a 8.18 -> 9.0 upgrade. We don't have evidence for that. We only have a few reports of this bug from 7.x -> 8.x upgrades.

@pborgonovi Is working on reproducing the bug. I'll post an update when we have more information.

[banderror]

Hey @jmikell821,

@pborgonovi performed some testing and:

• was able to reproduce the bug on a 7.17 -> 8.18 upgrade
• wasn't able to reproduce it on a 8.18 -> 9.0 upgrade

This confirms the hypothesis that the bug is caused by some differences between 7.x and 8.x versions (and only occurs on 7.x -> 8.x upgrades), and is not directly related to the 9.0 version.

So, only those users who will be upgrading 7.17 -> 8.18 -> 9.0, which is one of the officially supported upgrade paths, will be affected by it. Can we document a known issue about just that?

[jmikell821]

So, only those users who will be upgrading 7.17 -> 8.18 -> 9.0, which is one of the officially supported upgrade paths, will be affected by it. Can we document a known issue about just that?

@banderror sure we can! Just want to confirm to add these in the 8.18 release notes?

[banderror]

@jmikell821 Correct, the 8.18 release notes. Thank you!

[nastasha-solomon]

Added as a known issue to the 8.18 release notes.