Skip to content

[Security Solution] Allow prebuilt rules import and export#212509

Merged
nikitaindik merged 16 commits intoelastic:mainfrom
nikitaindik:allow-import-export-prebuilt-rules
Mar 6, 2025
Merged

[Security Solution] Allow prebuilt rules import and export#212509
nikitaindik merged 16 commits intoelastic:mainfrom
nikitaindik:allow-import-export-prebuilt-rules

Conversation

@nikitaindik
Copy link
Contributor

@nikitaindik nikitaindik commented Feb 26, 2025

Resolves: https://github.com/elastic/security-team/issues/11502 (internal)

This PR implements following changes and adds API integration tests for them:

  • Users with any license can export prebuilt rules (with enabled feature flag)
  • Users with Basic/Essentials license can import prebuilt rules only if they are non-customized and the feature flag is enabled
  • Users with Enterprise/Complete license can import prebuilt rules without restrictions

Flaky test runner (had to create 4 separate runs to test all configs):

@nikitaindik nikitaindik added release_note:skip Skip the PR/issue when compiling release notes v9.0.0 Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Feature:Rule Import/Export Security Solution Detection Rule Import & Export workflow backport:version Backport to applied version labels v8.18.0 v9.1.0 v8.19.0 labels Feb 26, 2025
@nikitaindik nikitaindik self-assigned this Feb 26, 2025
@nikitaindik nikitaindik requested a review from xcrzx March 3, 2025 10:27
@nikitaindik nikitaindik force-pushed the allow-import-export-prebuilt-rules branch from 8df69e5 to d3e1af5 Compare March 3, 2025 13:28
@nikitaindik nikitaindik force-pushed the allow-import-export-prebuilt-rules branch from d3e1af5 to 08b9f1b Compare March 4, 2025 10:44
@nikitaindik nikitaindik marked this pull request as ready for review March 4, 2025 15:51
@nikitaindik nikitaindik requested review from a team as code owners March 4, 2025 15:51
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

Copy link
Contributor

@jbudz jbudz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.ftr_configs.yml LGTM

@kibanamachine
Copy link
Contributor

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#7986

[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_non_customized_prebuilt_rules/feature_enabled/configs/ess_basic_license.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_non_customized_prebuilt_rules/feature_disabled/configs/ess_feature_flag_disabled.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_customized_prebuilt_rules/feature_enabled/configs/ess_enterprise_license.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_customized_prebuilt_rules/feature_disabled/configs/ess_basic_license.config.ts: 50/50 tests passed.

see run history

@kibanamachine
Copy link
Contributor

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#7985

[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_customized_prebuilt_rules/feature_disabled/configs/serverless_feature_flag_disabled.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/export_prebuilt_rules/feature_enabled/configs/serverless_essentials_tier.config.ts: 50/50 tests passed.
[❌] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/export_prebuilt_rules/feature_disabled/configs/serverless_feature_flag_disabled.config.ts: 49/50 tests passed.
[❌] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_bulk_actions/export/configs/serverless_feature_flag_disabled.config.ts: 0/50 tests passed.

see run history

@kibanamachine
Copy link
Contributor

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#7984

[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_non_customized_prebuilt_rules/feature_enabled/configs/serverless_essentials_tier.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_non_customized_prebuilt_rules/feature_disabled/configs/serverless_feature_flag_disabled.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_customized_prebuilt_rules/feature_enabled/configs/serverless_complete_tier.config.ts: 50/50 tests passed.
[❌] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_customized_prebuilt_rules/feature_disabled/configs/serverless_essentials_tier.config.ts: 28/50 tests passed.

see run history

Copy link
Contributor

@xcrzx xcrzx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Retested locally, and all previously tested scenarios are now working as expected 👍

Leaving a minor comment regarding test scripts - looks like they’re pointing to the wrong test files after refactoring. I also don’t see much value in maintaining these test scripts. There are a lot of them, making navigation difficult. Using the FTR server and runner directly seems much more practical. So, I’d suggest removing the added test scripts from package.json altogether.

@kibanamachine
Copy link
Contributor

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#7988

[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_customized_prebuilt_rules/feature_disabled/configs/serverless_feature_flag_disabled.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/export_prebuilt_rules/feature_enabled/configs/serverless_essentials_tier.config.ts: 50/50 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/export_prebuilt_rules/feature_disabled/configs/serverless_feature_flag_disabled.config.ts: 50/50 tests passed.

see run history

@kibanamachine
Copy link
Contributor

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#7989

[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/import_customized_prebuilt_rules/feature_disabled/configs/serverless_essentials_tier.config.ts: 50/50 tests passed.

see run history

@nikitaindik nikitaindik enabled auto-merge (squash) March 6, 2025 13:55
@nikitaindik nikitaindik merged commit ebe90e5 into elastic:main Mar 6, 2025
9 checks passed
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.18, 8.x, 9.0

https://github.com/elastic/kibana/actions/runs/13702844293

@elasticmachine
Copy link
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #111 / Stateful Observability - Deployment-agnostic API integration tests SyntheticsAPITests getSyntheticsMonitors get many monitors without params
  • [job] [logs] Jest Tests #8 / Tags it changes the tags
  • [job] [logs] Jest Tests #8 / Tags it shows error when tag is empty

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 8.9MB 8.9MB +10.0B

History

cc @nikitaindik

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 6, 2025
…12509)

**Resolves: elastic/security-team#11502
(internal)

This PR implements following changes and adds API integration tests for
them:
- [x] Users with any license can export prebuilt rules (with enabled
feature flag)
- [x] Users with Basic/Essentials license can import prebuilt rules only
if they are non-customized and the feature flag is enabled
- [x] Users with Enterprise/Complete license can import prebuilt rules
without restrictions

Flaky test runner (had to create 4 separate runs to test all configs):
-
[1](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7987)
-
[2](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7986)
-
[3](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7988)
-
[4](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7989)

(cherry picked from commit ebe90e5)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 6, 2025
…12509)

**Resolves: elastic/security-team#11502
(internal)

This PR implements following changes and adds API integration tests for
them:
- [x] Users with any license can export prebuilt rules (with enabled
feature flag)
- [x] Users with Basic/Essentials license can import prebuilt rules only
if they are non-customized and the feature flag is enabled
- [x] Users with Enterprise/Complete license can import prebuilt rules
without restrictions

Flaky test runner (had to create 4 separate runs to test all configs):
-
[1](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7987)
-
[2](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7986)
-
[3](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7988)
-
[4](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7989)

(cherry picked from commit ebe90e5)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 6, 2025
…12509)

**Resolves: elastic/security-team#11502
(internal)

This PR implements following changes and adds API integration tests for
them:
- [x] Users with any license can export prebuilt rules (with enabled
feature flag)
- [x] Users with Basic/Essentials license can import prebuilt rules only
if they are non-customized and the feature flag is enabled
- [x] Users with Enterprise/Complete license can import prebuilt rules
without restrictions

Flaky test runner (had to create 4 separate runs to test all configs):
-
[1](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7987)
-
[2](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7986)
-
[3](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7988)
-
[4](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7989)

(cherry picked from commit ebe90e5)
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
8.18
8.x
9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Mar 6, 2025
…12509) (#213419)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Allow prebuilt rules import and export
(#212509)](#212509)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Nikita
Indik","email":"nikita.indik@elastic.co"},"sourceCommit":{"committedDate":"2025-03-06T15:58:33Z","message":"[Security
Solution] Allow prebuilt rules import and export
(#212509)\n\n**Resolves:
https://github.com/elastic/security-team/issues/11502**\n(internal)\n\nThis
PR implements following changes and adds API integration tests
for\nthem:\n- [x] Users with any license can export prebuilt rules (with
enabled\nfeature flag)\n- [x] Users with Basic/Essentials license can
import prebuilt rules only\nif they are non-customized and the feature
flag is enabled\n- [x] Users with Enterprise/Complete license can import
prebuilt rules\nwithout restrictions\n\nFlaky test runner (had to create
4 separate runs to test all
configs):\n-\n[1](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7987)\n-\n[2](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7986)\n-\n[3](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7988)\n-\n[4](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7989)","sha":"ebe90e5c80e1dbe34d96ccd8a1e8e34d032affa4","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection Rules","Feature:Rule
Import/Export","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Allow prebuilt rules import and
export","number":212509,"url":"https://github.com/elastic/kibana/pull/212509","mergeCommit":{"message":"[Security
Solution] Allow prebuilt rules import and export
(#212509)\n\n**Resolves:
https://github.com/elastic/security-team/issues/11502**\n(internal)\n\nThis
PR implements following changes and adds API integration tests
for\nthem:\n- [x] Users with any license can export prebuilt rules (with
enabled\nfeature flag)\n- [x] Users with Basic/Essentials license can
import prebuilt rules only\nif they are non-customized and the feature
flag is enabled\n- [x] Users with Enterprise/Complete license can import
prebuilt rules\nwithout restrictions\n\nFlaky test runner (had to create
4 separate runs to test all
configs):\n-\n[1](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7987)\n-\n[2](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7986)\n-\n[3](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7988)\n-\n[4](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7989)","sha":"ebe90e5c80e1dbe34d96ccd8a1e8e34d032affa4"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/212509","number":212509,"mergeCommit":{"message":"[Security
Solution] Allow prebuilt rules import and export
(#212509)\n\n**Resolves:
https://github.com/elastic/security-team/issues/11502**\n(internal)\n\nThis
PR implements following changes and adds API integration tests
for\nthem:\n- [x] Users with any license can export prebuilt rules (with
enabled\nfeature flag)\n- [x] Users with Basic/Essentials license can
import prebuilt rules only\nif they are non-customized and the feature
flag is enabled\n- [x] Users with Enterprise/Complete license can import
prebuilt rules\nwithout restrictions\n\nFlaky test runner (had to create
4 separate runs to test all
configs):\n-\n[1](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7987)\n-\n[2](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7986)\n-\n[3](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7988)\n-\n[4](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7989)","sha":"ebe90e5c80e1dbe34d96ccd8a1e8e34d032affa4"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Nikita Indik <nikita.indik@elastic.co>
kibanamachine added a commit that referenced this pull request Mar 6, 2025
…2509) (#213420)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution] Allow prebuilt rules import and export
(#212509)](#212509)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Nikita
Indik","email":"nikita.indik@elastic.co"},"sourceCommit":{"committedDate":"2025-03-06T15:58:33Z","message":"[Security
Solution] Allow prebuilt rules import and export
(#212509)\n\n**Resolves:
https://github.com/elastic/security-team/issues/11502**\n(internal)\n\nThis
PR implements following changes and adds API integration tests
for\nthem:\n- [x] Users with any license can export prebuilt rules (with
enabled\nfeature flag)\n- [x] Users with Basic/Essentials license can
import prebuilt rules only\nif they are non-customized and the feature
flag is enabled\n- [x] Users with Enterprise/Complete license can import
prebuilt rules\nwithout restrictions\n\nFlaky test runner (had to create
4 separate runs to test all
configs):\n-\n[1](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7987)\n-\n[2](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7986)\n-\n[3](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7988)\n-\n[4](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7989)","sha":"ebe90e5c80e1dbe34d96ccd8a1e8e34d032affa4","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection Rules","Feature:Rule
Import/Export","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Allow prebuilt rules import and
export","number":212509,"url":"https://github.com/elastic/kibana/pull/212509","mergeCommit":{"message":"[Security
Solution] Allow prebuilt rules import and export
(#212509)\n\n**Resolves:
https://github.com/elastic/security-team/issues/11502**\n(internal)\n\nThis
PR implements following changes and adds API integration tests
for\nthem:\n- [x] Users with any license can export prebuilt rules (with
enabled\nfeature flag)\n- [x] Users with Basic/Essentials license can
import prebuilt rules only\nif they are non-customized and the feature
flag is enabled\n- [x] Users with Enterprise/Complete license can import
prebuilt rules\nwithout restrictions\n\nFlaky test runner (had to create
4 separate runs to test all
configs):\n-\n[1](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7987)\n-\n[2](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7986)\n-\n[3](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7988)\n-\n[4](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7989)","sha":"ebe90e5c80e1dbe34d96ccd8a1e8e34d032affa4"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/212509","number":212509,"mergeCommit":{"message":"[Security
Solution] Allow prebuilt rules import and export
(#212509)\n\n**Resolves:
https://github.com/elastic/security-team/issues/11502**\n(internal)\n\nThis
PR implements following changes and adds API integration tests
for\nthem:\n- [x] Users with any license can export prebuilt rules (with
enabled\nfeature flag)\n- [x] Users with Basic/Essentials license can
import prebuilt rules only\nif they are non-customized and the feature
flag is enabled\n- [x] Users with Enterprise/Complete license can import
prebuilt rules\nwithout restrictions\n\nFlaky test runner (had to create
4 separate runs to test all
configs):\n-\n[1](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7987)\n-\n[2](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7986)\n-\n[3](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7988)\n-\n[4](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7989)","sha":"ebe90e5c80e1dbe34d96ccd8a1e8e34d032affa4"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Nikita Indik <nikita.indik@elastic.co>
kibanamachine added a commit that referenced this pull request Mar 6, 2025
…2509) (#213421)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security Solution] Allow prebuilt rules import and export
(#212509)](#212509)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Nikita
Indik","email":"nikita.indik@elastic.co"},"sourceCommit":{"committedDate":"2025-03-06T15:58:33Z","message":"[Security
Solution] Allow prebuilt rules import and export
(#212509)\n\n**Resolves:
https://github.com/elastic/security-team/issues/11502**\n(internal)\n\nThis
PR implements following changes and adds API integration tests
for\nthem:\n- [x] Users with any license can export prebuilt rules (with
enabled\nfeature flag)\n- [x] Users with Basic/Essentials license can
import prebuilt rules only\nif they are non-customized and the feature
flag is enabled\n- [x] Users with Enterprise/Complete license can import
prebuilt rules\nwithout restrictions\n\nFlaky test runner (had to create
4 separate runs to test all
configs):\n-\n[1](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7987)\n-\n[2](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7986)\n-\n[3](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7988)\n-\n[4](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7989)","sha":"ebe90e5c80e1dbe34d96ccd8a1e8e34d032affa4","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection Rules","Feature:Rule
Import/Export","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Allow prebuilt rules import and
export","number":212509,"url":"https://github.com/elastic/kibana/pull/212509","mergeCommit":{"message":"[Security
Solution] Allow prebuilt rules import and export
(#212509)\n\n**Resolves:
https://github.com/elastic/security-team/issues/11502**\n(internal)\n\nThis
PR implements following changes and adds API integration tests
for\nthem:\n- [x] Users with any license can export prebuilt rules (with
enabled\nfeature flag)\n- [x] Users with Basic/Essentials license can
import prebuilt rules only\nif they are non-customized and the feature
flag is enabled\n- [x] Users with Enterprise/Complete license can import
prebuilt rules\nwithout restrictions\n\nFlaky test runner (had to create
4 separate runs to test all
configs):\n-\n[1](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7987)\n-\n[2](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7986)\n-\n[3](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7988)\n-\n[4](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7989)","sha":"ebe90e5c80e1dbe34d96ccd8a1e8e34d032affa4"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/212509","number":212509,"mergeCommit":{"message":"[Security
Solution] Allow prebuilt rules import and export
(#212509)\n\n**Resolves:
https://github.com/elastic/security-team/issues/11502**\n(internal)\n\nThis
PR implements following changes and adds API integration tests
for\nthem:\n- [x] Users with any license can export prebuilt rules (with
enabled\nfeature flag)\n- [x] Users with Basic/Essentials license can
import prebuilt rules only\nif they are non-customized and the feature
flag is enabled\n- [x] Users with Enterprise/Complete license can import
prebuilt rules\nwithout restrictions\n\nFlaky test runner (had to create
4 separate runs to test all
configs):\n-\n[1](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7987)\n-\n[2](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7986)\n-\n[3](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7988)\n-\n[4](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7989)","sha":"ebe90e5c80e1dbe34d96ccd8a1e8e34d032affa4"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Nikita Indik <nikita.indik@elastic.co>
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Mar 22, 2025
…12509)

**Resolves: elastic/security-team#11502
(internal)

This PR implements following changes and adds API integration tests for
them:
- [x] Users with any license can export prebuilt rules (with enabled
feature flag)
- [x] Users with Basic/Essentials license can import prebuilt rules only
if they are non-customized and the feature flag is enabled
- [x] Users with Enterprise/Complete license can import prebuilt rules
without restrictions

Flaky test runner (had to create 4 separate runs to test all configs):
-
[1](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7987)
-
[2](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7986)
-
[3](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7988)
-
[4](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7989)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:version Backport to applied version labels ci:build-serverless-image Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Feature:Rule Import/Export Security Solution Detection Rule Import & Export workflow release_note:skip Skip the PR/issue when compiling release notes Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.18.0 v8.19.0 v9.0.0 v9.1.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants