Epic: #179907

Summary

To help users understand what changes were made to the prebuilt Elastic rule, we want to indicate that field was customised, and allow to see the previous field version.

Telemetry:

• collect events for viewing previous field version

Acceptance criteria

• every modified field of the Elastic Prebuilt rule is clearly indicated in UI
• User can view the previous Elastic version of the field
• user cannot see any previous custom field modifications.

Design

Figma file

Release progress

• UX design is done by @ARWNightingale.
• Test plan is written and approved by the team.
  • [Security Solution] Test plan for reverting customized prebuilt rules to their base version #219628
• Initial implementation is done.
  • [Security Solution] Display which fields are customized for prebuilt rules #225939
• Automated tests are written based on the test plan.
• Acceptance testing is done by @approksiu and @ARWNightingale.
  • @approksiu
  • @ARWNightingale
• Exploratory testing is done by @pborgonovi @chetnarajput-qasource.
• UI copies are suggested by @nastasha-solomon and ready to be implemented (link to the ticket)
• Feature is fully implemented and is ready to be released.
  • [Security Solution] Prebuilt rule customizations flyout refactor #227355
• Documentation is written for Serverless and ESS by @nastasha-solomon (ticket).
  • [8.19] Prebuilt rule reversion documentation  security-docs#6937
  • [SECURITY][9.1 & Serverless] Prebuilt rule reversion documentation docs-content#2175
• Feature is released in Serverless.

Planned release in Serverless: DONE.
Planned release in ESS: v8.19.0, v9.1.0.