[Security Solution] Allow prebuilt rules import and export #212509

nikitaindik · 2025-02-26T12:18:13Z

Resolves: https://github.com/elastic/security-team/issues/11502 (internal)

This PR implements following changes and adds API integration tests for them:

Users with any license can export prebuilt rules (with enabled feature flag)
Users with Basic/Essentials license can import prebuilt rules only if they are non-customized and the feature flag is enabled
Users with Enterprise/Complete license can import prebuilt rules without restrictions

Flaky test runner (had to create 4 separate runs to test all configs):

1
2
3
4

elasticmachine · 2025-03-04T15:51:35Z

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine · 2025-03-04T15:51:37Z

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine · 2025-03-04T15:51:38Z

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

jbudz

.ftr_configs.yml LGTM

banderror · 2025-03-04T16:40:54Z

@nikitaindik Can you please run all the new and changed tests via the flaky test runner?

xcrzx · 2025-03-05T09:44:37Z

...ons_response/rules_management/rule_import_export/trial_license_complete_tier/import_rules.ts

@@ -1626,6 +1626,7 @@ export default ({ getService }: FtrProviderContext): void => {
    describe('supporting prebuilt rule customization', () => {
      describe('compatibility with prebuilt rule fields', () => {
        it('rejects rules with "immutable: true" when the feature flag is disabled', async () => {
+          // duplicate test


let's remove it then

Heh, good catch! This was a note to myself that I forgot to handle :)

xcrzx · 2025-03-05T09:52:46Z

...security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_all.ts

-  const ruleAlertTypes = prebuiltRulesCustomizationEnabled
-    ? await getRules({ rulesClient, filter: '' })
-    : await getNonPackagedRules({ rulesClient });


...t_suites/detections_response/rules_management/rule_bulk_actions/export/bulk_action_export.ts

xcrzx · 2025-03-05T10:01:20Z

...t_suites/detections_response/rules_management/rule_bulk_actions/export/bulk_action_export.ts

+      await deleteAllPrebuiltRuleAssets(es, log);
+    });
+
+    it(`exports prebuilt rules if the feature flag is enabled`, async () => {


Suggested change

it(`exports prebuilt rules if the feature flag is enabled`, async () => {

it(`exports prebuilt rules`, async () => {

xcrzx · 2025-03-05T10:27:20Z

...ustomized_prebuilt_rules/feature_disabled/not_allowed_importing_customized_prebuilt_rules.ts

+      await deleteAllPrebuiltRuleAssets(es, log);
+    });
+
+    it(`does NOT import customized prebuilt rules when feature flag is disabled`, async () => {


Suggested change

it(`does NOT import customized prebuilt rules when feature flag is disabled`, async () => {

it(`does NOT import customized prebuilt rules when rule customization is disabled`, async () => {

…-prebuilt-rules

xcrzx

Tested the changes locally and found a few issues with Export buttons disabled in UI

1. FF enabled, sufficient license

🟢 Prebuilt rules can be exported
🟢 Customized rules can be imported
🟢 Non-customized rules can be imported

2. FF enabled, insufficient license

🔴 Prebuilt rules cannot be exported, the export option is disabled. It should be enabled
🟡 Customized rules cannot be imported. This is expected, but the error message should be more clear saying that the rule cannot be imported because it is Modified
🟢 Non-customized rules can be imported

3. FF disabled, sufficient license

🔴 Prebuilt rules cannot be exported, the export option is disabled. It should be enabled
🟢 Customized rules cannot be imported
🟢 Non-customized rules cannot be imported

nikitaindik · 2025-03-05T15:55:06Z

Thanks for review and testing, @xcrzx! As discussed I've reverted the exporting behaviour to only allow exporting if the feature flag is disabled.

Also, I've addressed your feedback, so feel free to do another review pass.

elasticmachine · 2025-03-05T16:16:46Z

💔 Build Failed

Buildkite Build
Commit: 502bf29

Failed CI Steps

Check Types

History

cc @nikitaindik

kibanamachine · 2025-03-05T17:18:14Z

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#7987

[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_customized_prebuilt_rules/feature_disabled/configs/ess_feature_flag_disabled.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/export_prebuilt_rules/feature_enabled/configs/ess_basic_license.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/export_prebuilt_rules/feature_disabled/configs/ess_feature_flag_disabled.config.ts: 50/50 tests passed.

see run history

kibanamachine · 2025-03-05T17:30:42Z

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#7986

[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_non_customized_prebuilt_rules/feature_enabled/configs/ess_basic_license.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_non_customized_prebuilt_rules/feature_disabled/configs/ess_feature_flag_disabled.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_customized_prebuilt_rules/feature_enabled/configs/ess_enterprise_license.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_customized_prebuilt_rules/feature_disabled/configs/ess_basic_license.config.ts: 50/50 tests passed.

see run history

kibanamachine · 2025-03-05T17:33:12Z

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#7985

[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_customized_prebuilt_rules/feature_disabled/configs/serverless_feature_flag_disabled.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/export_prebuilt_rules/feature_enabled/configs/serverless_essentials_tier.config.ts: 50/50 tests passed.
[❌] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/export_prebuilt_rules/feature_disabled/configs/serverless_feature_flag_disabled.config.ts: 49/50 tests passed.
[❌] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_bulk_actions/export/configs/serverless_feature_flag_disabled.config.ts: 0/50 tests passed.

see run history

kibanamachine · 2025-03-05T18:23:33Z

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#7984

[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_non_customized_prebuilt_rules/feature_enabled/configs/serverless_essentials_tier.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_non_customized_prebuilt_rules/feature_disabled/configs/serverless_feature_flag_disabled.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_customized_prebuilt_rules/feature_enabled/configs/serverless_complete_tier.config.ts: 50/50 tests passed.
[❌] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_customized_prebuilt_rules/feature_disabled/configs/serverless_essentials_tier.config.ts: 28/50 tests passed.

see run history

nikitaindik self-assigned this Feb 26, 2025

nikitaindik requested a review from xcrzx March 3, 2025 10:27

nikitaindik force-pushed the allow-import-export-prebuilt-rules branch from 8df69e5 to d3e1af5 Compare March 3, 2025 13:28

nikitaindik added 6 commits March 4, 2025 11:12

Allow exporting prebuilt rules

9bcf021

WIP

9e75371

Add export prebuilt tests into the new structure

8bffba5

Merge some tests to reduce number of configs

1c3633f

Reorder configs in YAMLs

52a5dd5

Update tests

08b9f1b

nikitaindik force-pushed the allow-import-export-prebuilt-rules branch from d3e1af5 to 08b9f1b Compare March 4, 2025 10:44

Refactor dir structure

828f36c

nikitaindik marked this pull request as ready for review March 4, 2025 15:51

nikitaindik requested review from a team as code owners March 4, 2025 15:51

jbudz approved these changes Mar 4, 2025

View reviewed changes

xcrzx reviewed Mar 5, 2025

View reviewed changes

Merge remote-tracking branch 'upstream/main' into allow-import-export…

d82190d

…-prebuilt-rules

xcrzx requested changes Mar 5, 2025

View reviewed changes

nikitaindik added 2 commits March 5, 2025 13:27

Merge bulk action export and normal export tests

e7c13d2

Forbid exporting prebuilt rules if the feature flag is disabled

502bf29

nikitaindik requested a review from xcrzx March 5, 2025 15:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Allow prebuilt rules import and export #212509

[Security Solution] Allow prebuilt rules import and export #212509

nikitaindik commented Feb 26, 2025 •

edited

Loading

elasticmachine commented Mar 4, 2025

elasticmachine commented Mar 4, 2025

elasticmachine commented Mar 4, 2025

jbudz left a comment

banderror commented Mar 4, 2025

xcrzx Mar 5, 2025

nikitaindik Mar 5, 2025

xcrzx Mar 5, 2025

xcrzx Mar 5, 2025

xcrzx Mar 5, 2025

xcrzx left a comment •

edited

Loading

nikitaindik commented Mar 5, 2025

elasticmachine commented Mar 5, 2025 •

edited

Loading

kibanamachine commented Mar 5, 2025

kibanamachine commented Mar 5, 2025

kibanamachine commented Mar 5, 2025

kibanamachine commented Mar 5, 2025

	it(`exports prebuilt rules if the feature flag is enabled`, async () => {
	it(`exports prebuilt rules`, async () => {

	it(`does NOT import customized prebuilt rules when feature flag is disabled`, async () => {
	it(`does NOT import customized prebuilt rules when rule customization is disabled`, async () => {

[Security Solution] Allow prebuilt rules import and export #212509

Are you sure you want to change the base?

[Security Solution] Allow prebuilt rules import and export #212509

Conversation

nikitaindik commented Feb 26, 2025 • edited Loading

elasticmachine commented Mar 4, 2025

elasticmachine commented Mar 4, 2025

elasticmachine commented Mar 4, 2025

jbudz left a comment

Choose a reason for hiding this comment

banderror commented Mar 4, 2025

xcrzx Mar 5, 2025

Choose a reason for hiding this comment

nikitaindik Mar 5, 2025

Choose a reason for hiding this comment

xcrzx Mar 5, 2025

Choose a reason for hiding this comment

xcrzx Mar 5, 2025

Choose a reason for hiding this comment

xcrzx Mar 5, 2025

Choose a reason for hiding this comment

xcrzx left a comment • edited Loading

Choose a reason for hiding this comment

nikitaindik commented Mar 5, 2025

elasticmachine commented Mar 5, 2025 • edited Loading

💔 Build Failed

Failed CI Steps

History

kibanamachine commented Mar 5, 2025

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#7987

kibanamachine commented Mar 5, 2025

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#7986

kibanamachine commented Mar 5, 2025

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#7985

kibanamachine commented Mar 5, 2025

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#7984

nikitaindik commented Feb 26, 2025 •

edited

Loading

xcrzx left a comment •

edited

Loading

elasticmachine commented Mar 5, 2025 •

edited

Loading