diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/calculate_rule_fields_diff.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/calculate_rule_fields_diff.ts index 41625af391bd2..0f2544ca99f5c 100644 --- a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/calculate_rule_fields_diff.ts +++ b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/calculate_rule_fields_diff.ts @@ -219,7 +219,7 @@ const commonFieldsDiffAlgorithms: FieldsDiffAlgorithmsFor version: forceTargetVersionDiffAlgorithm, name: singleLineStringDiffAlgorithm, tags: createScalarArrayDiffAlgorithm({ - missingBaseVersionStrategy: ScalarArrayDiffMissingBaseVersionStrategy.Merge, + missingBaseVersionStrategy: ScalarArrayDiffMissingBaseVersionStrategy.UseTarget, }), description: multiLineStringDiffAlgorithm, severity: singleLineStringDiffAlgorithm, diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/diffable_rule_fields/common_fields/tags.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/diffable_rule_fields/common_fields/tags.ts index ecaa093a7f359..1f67e55692fa1 100644 --- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/diffable_rule_fields/common_fields/tags.ts +++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/customization_enabled/diffable_rule_fields/common_fields/tags.ts @@ -297,11 +297,11 @@ export function tagsField({ getService }: FtrProviderContext): void { ruleUpgradeAssets, diffableRuleFieldName: 'tags', expectedDiffOutcome: ThreeWayDiffOutcome.MissingBaseCanUpdate, - isMergableField: true, + isMergableField: false, expectedFieldDiffValues: { current: ['tagB'], target: ['tagC'], - merged: ['tagB', 'tagC'], + merged: ['tagC'], }, }, getService