elastic
diff --git a/‎x-pack/solutions/security/plugins/security_solution/docs/testing/test_plans/detection_response/prebuilt_rules/prebuilt_rule_export.md‎
Lines changed: 20 additions & 1 deletion b/‎x-pack/solutions/security/plugins/security_solution/docs/testing/test_plans/detection_response/prebuilt_rules/prebuilt_rule_export.md‎
Lines changed: 20 additions & 1 deletion
diff --git a/‎x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/common/configs/ess_air_gapped.config.ts‎
Lines changed: 2 additions & 2 deletions b/‎x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/common/configs/ess_air_gapped.config.ts‎
Lines changed: 2 additions & 2 deletions
@@ -1,6 +1,6 @@
 # Test plan: exporting prebuilt rules <!-- omit from toc -->
 
-**Status**: `in progress`, matches [Milestone 3](https://github.com/elastic/kibana/issues/174168).
+**Status**: `implemented`, matches [Milestone 3](https://github.com/elastic/kibana/issues/174168).
 
 > [!TIP]
 > If you're new to prebuilt rules, get started [here](./prebuilt_rules.md) and check an overview of the features of prebuilt rules in [this section](./prebuilt_rules_common_info.md#features).
@@ -40,6 +40,7 @@ https://marketplace.visualstudio.com/items?itemName=yzhang.markdown-all-in-one
     - [**Scenario: Exporting a prebuilt rule from rules management table**](#scenario-exporting-a-prebuilt-rule-from-rules-management-table)
     - [**Scenario: Exporting multiple prebuilt rules in bulk**](#scenario-exporting-multiple-prebuilt-rules-in-bulk)
     - [**Scenario: Exporting a mix of prebuilt and custom rules in bulk**](#scenario-exporting-a-mix-of-prebuilt-and-custom-rules-in-bulk)
+    - [**Scenario: Importing a mix of just bulk exported prebuilt and custom rules**](#scenario-importing-a-mix-of-just-bulk-exported-prebuilt-and-custom-rules)
   - [Error Handling](#error-handling)
     - [**Scenario: Exporting beyond the export limit**](#scenario-exporting-beyond-the-export-limit)
 
@@ -177,10 +178,28 @@ And the exported custom rules should include an "immutable" field having false v
 And the exported custom rules "rule_source.type" should be "internal"
 ```
 
+#### **Scenario: Importing a mix of just bulk exported prebuilt and custom rules**
+
+**Automation**: 1 integration test and 1 cypress test.
+
+```Gherkin
+Given a mix of customized prebuilt, non-customized prebuilt and custom rules
+When user selects some rules of each type in the rule management table
+And bulk exports them
+Then the selected rules should be exported as an NDJSON file
+When user removes the rules and imports just exported NDJSON file
+Then the rules should be created
+And the created rules should be correctly identified as prebuilt or custom
+And the created rules' is_customized field should be correctly calculated
+And the created rules' parameters should match the import payload
+```
+
 ### Error Handling
 
 #### **Scenario: Exporting beyond the export limit**
 
+**Automation**: 2 integration tests and 1 cypress test.
+
 ```Gherkin
 Given prebuilt and custom rules
 And the number of rules is greater than the export limit (defaults to 10_000)
 
@@ -10,7 +10,7 @@ import path from 'path';
 
 const SECURITY_DETECTION_ENGINE_PACKAGES_PATH = path.join(
   path.dirname(__filename),
-  '../import/fixtures/packages'
+  '../import_export/fixtures/packages'
 );
 
 export default async function ({ readConfigFile }: FtrConfigProviderContext) {
@@ -20,7 +20,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
 
   return {
     ...functionalConfig.getAll(),
-    testFiles: [require.resolve('../import/import_with_installing_package')],
+    testFiles: [require.resolve('../import_export/import_with_installing_package')],
     kbnTestServer: {
       ...functionalConfig.get('kbnTestServer'),
       serverArgs: [