Kibana version:
7.9

When updating prepackaged rules any existing exceptions on the rules being updated will be overridden with whatever exceptions are on the prepackaged rules. To mitigate this, we can merge any existing exceptions_list items from the rulesFromFileSystem with those coming from the prepackagedRules.

Flow:

Get rules to update:

Add logic for merging existing exceptions

Patch in update_prepacked_rules.ts will now include any pre-existing exceptions and will no longer overwrite:

Steps to recreate:

• Add prepackaged rules
• Add exception to prepackaged rule
• Increment version of the rule that the exception was added to
• Update prepackaged rules
• Observe exception added is no longer present