Pinging @elastic/security-detections-response (Team:Detections and Resp)

Pinging @elastic/security-solution (Team: SecuritySolution)

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#6670

[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/management/trial_license_complete_tier/configs/ess.config.ts: 100/100 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/management/trial_license_complete_tier/configs/serverless.config.ts: 100/100 tests passed.

see run history

@dplumlee

I'm OK with leaving data_source as optional in the diffable rules, but then let's do the following:

1. Add a JSDoc to the dataSourceDiffAlgorithm function explaining why the type of its version parameter is ThreeVersionsOf<RuleDataSource | undefined> instead of ThreeVersionsOf<RuleDataSource>. This will otherwise lead to confusion in the future. Let's just clearly explain that Data Source can either be an index pattern, or a data view id, or neither, and that's why the versions are optionally undefined.
2. Add both some unit and integrations tests for the scenario in which the current version of the rule is undefined. Almost 100% sure that it doesn't make sense to test cases in which base or target versions are undefined, since the TRADE team won't distribute rules with no data source. But let's do add some tests for current being undefined in the different scenarios where possible: ABA, ABC, -AB

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: dc062f9

Failed CI Steps

• Jest Integration Tests #6

Metrics [docs]

✅ unchanged

History

• 💛 Build #226673 was flaky a2970ec
• 💚 Build #226600 succeeded ad724cf
• 💛 Build #226129 was flaky 5d5556a
• 💛 Build #225430 was flaky c6ae78a
• 💔 Build #225413 failed 2b0e77c

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @dplumlee