[FR] Add support for 5 group_by fields in threshold rules (>=9.2) (#5040)

Mikaayenson · web-flow · commit 3c1de72f6b45 · 2025-09-04T09:24:36.000-05:00
diff --git a/detection_rules/rule.py b/detection_rules/rule.py
@@ -810,6 +810,36 @@ class ThresholdCardinality:
     threshold: ThresholdMapping
     alert_suppression: ThresholdAlertSuppression | None = field(metadata={"metadata": {"min_compat": "8.12"}})  # type: ignore[reportIncompatibleVariableOverride]
 
+    def validate(self, meta: RuleMeta) -> None:
+        """Validate threshold fields count based on stack version."""
+        current_min_stack = load_current_package_version()
+        min_stack_raw = meta.min_stack_version or current_min_stack
+        min_stack = Version.parse(min_stack_raw, optional_minor_and_patch=True)
+        cutoff = Version.parse("9.2.0")
+
+        default_cap_lt_9_2 = 3
+        default_cap_ge_9_2 = 5
+        is_ge_9_2 = min_stack >= cutoff
+        max_fields_allowed = default_cap_ge_9_2 if is_ge_9_2 else default_cap_lt_9_2
+
+        fields = self.threshold.field or []
+        if len(fields) > max_fields_allowed:
+            # Tailored hint based on stack cap in effect
+            if is_ge_9_2:
+                hint = f" Reduce to {max_fields_allowed} or fewer fields."
+            else:
+                hint = (
+                    f" Reduce to {max_fields_allowed} or fewer fields, or set "
+                    "metadata.min_stack_version to 9.2.0+ "
+                    f"to allow up to {default_cap_ge_9_2}."
+                )
+
+            raise ValidationError(
+                f"threshold field supports at most {max_fields_allowed} field(s) for min_stack_version "
+                f"{min_stack_raw or 'unspecified (<9.2 assumed)'}. "
+                f"Received {len(fields)} group_by fields." + hint
+            )
+
 
 @dataclass(frozen=True, kw_only=True)
 class NewTermsRuleData(QueryRuleData):
diff --git a/detection_rules/schemas/definitions.py b/detection_rules/schemas/definitions.py
@@ -230,7 +230,7 @@ def validator_wrapper(value: Any) -> Any:
 BranchVer = Annotated[str, fields.String(validate=validate.Regexp(BRANCH_PATTERN))]
 CardinalityFields = Annotated[
     list[NonEmptyStr],
-    fields.List(NON_EMPTY_STRING_FIELD, validate=validate.Length(min=0, max=3)),
+    fields.List(NON_EMPTY_STRING_FIELD, validate=validate.Length(min=0, max=5)),
 ]
 ConditionSemVer = Annotated[str, fields.String(validate=validate.Regexp(CONDITION_VERSION_PATTERN))]
 Date = Annotated[str, fields.String(validate=validate.Regexp(DATE_PATTERN))]
diff --git a/pyproject.toml b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "detection_rules"
-version = "1.3.28"
+version = "1.3.29"
 description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
 readme = "README.md"
 requires-python = ">=3.12"

Original file line number	Diff line number	Diff line change
`@@ -230,7 +230,7 @@ def validator_wrapper(value: Any) -> Any:`
`230`	`230`	`BranchVer = Annotated[str, fields.String(validate=validate.Regexp(BRANCH_PATTERN))]`
`231`	`231`	`CardinalityFields = Annotated[`
`232`	`232`	`list[NonEmptyStr],`
`233`		`- fields.List(NON_EMPTY_STRING_FIELD, validate=validate.Length(min=0, max=3)),`
	`233`	`+ fields.List(NON_EMPTY_STRING_FIELD, validate=validate.Length(min=0, max=5)),`
`234`	`234`	`]`
`235`	`235`	`ConditionSemVer = Annotated[str, fields.String(validate=validate.Regexp(CONDITION_VERSION_PATTERN))]`
`236`	`236`	`Date = Annotated[str, fields.String(validate=validate.Regexp(DATE_PATTERN))]`