…part 3 (elastic#212420)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202068,
elastic#202078,
elastic#202079
**Follow-up to:** elastic#211472

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, this PR:

- Updates the common structure of test plans:
- Adds a tip to each test plan's header to help with navigating all our
test plans for prebuilt rules.
- Introduces a new `Requirements` section to each one and consolidates
assumptions, technical requirements and product requirements under it.
- Each `Product requirements` section now contains relevant user stories
and other product details. In the document flow this is kept close to
the `Scenarios` section.
  - Updates the test plan template according to the updated structure.
- Moves the documentation about customizable and non-customizable rule
fields to the common info document.
- Restores the lost changes from commit
elastic@bde4612.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios. The only functional-like
changes were made to the user stories when creating/updating the product
requirements sections.

This PR wraps up the refactoring efforts aimed to prepare the test plans
for being "functionally" changed and improved in follow-up PRs. In the
following PRs, we're going to cover the logic described in
elastic#210358, address any gaps in the
coverage, and improve the scenarios structure and wording.

## Review tip

It might be easier to review this PR commit-by-commit as each of them
contains logically cohesive changes.

(cherry picked from commit c961659)

…part 3 (elastic#212420)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202068,
elastic#202078,
elastic#202079
**Follow-up to:** elastic#211472

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, this PR:

- Updates the common structure of test plans:
- Adds a tip to each test plan's header to help with navigating all our
test plans for prebuilt rules.
- Introduces a new `Requirements` section to each one and consolidates
assumptions, technical requirements and product requirements under it.
- Each `Product requirements` section now contains relevant user stories
and other product details. In the document flow this is kept close to
the `Scenarios` section.
  - Updates the test plan template according to the updated structure.
- Moves the documentation about customizable and non-customizable rule
fields to the common info document.
- Restores the lost changes from commit
elastic@bde4612.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios. The only functional-like
changes were made to the user stories when creating/updating the product
requirements sections.

This PR wraps up the refactoring efforts aimed to prepare the test plans
for being "functionally" changed and improved in follow-up PRs. In the
following PRs, we're going to cover the logic described in
elastic#210358, address any gaps in the
coverage, and improve the scenarios structure and wording.

## Review tip

It might be easier to review this PR commit-by-commit as each of them
contains logically cohesive changes.

(cherry picked from commit c961659)

…part 3 (elastic#212420)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202068,
elastic#202078,
elastic#202079
**Follow-up to:** elastic#211472

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, this PR:

- Updates the common structure of test plans:
- Adds a tip to each test plan's header to help with navigating all our
test plans for prebuilt rules.
- Introduces a new `Requirements` section to each one and consolidates
assumptions, technical requirements and product requirements under it.
- Each `Product requirements` section now contains relevant user stories
and other product details. In the document flow this is kept close to
the `Scenarios` section.
  - Updates the test plan template according to the updated structure.
- Moves the documentation about customizable and non-customizable rule
fields to the common info document.
- Restores the lost changes from commit
elastic@bde4612.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios. The only functional-like
changes were made to the user stories when creating/updating the product
requirements sections.

This PR wraps up the refactoring efforts aimed to prepare the test plans
for being "functionally" changed and improved in follow-up PRs. In the
following PRs, we're going to cover the logic described in
elastic#210358, address any gaps in the
coverage, and improve the scenarios structure and wording.

## Review tip

It might be easier to review this PR commit-by-commit as each of them
contains logically cohesive changes.

(cherry picked from commit c961659)

…lans, part 3 (#212420) (#212481)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security Solution] Refactor prebuilt rule customization test plans,
part 3 (#212420)](#212420)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Georgii
Gorbachev","email":"georgii.gorbachev@elastic.co"},"sourceCommit":{"committedDate":"2025-02-26T08:39:32Z","message":"[Security
Solution] Refactor prebuilt rule customization test plans, part 3
(#212420)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202068,\nhttps://github.com//issues/202078,\nhttps://github.com//issues/202079\n**Follow-up
to:** https://github.com/elastic/kibana/pull/211472\n\n##
Summary\n\nWe're cleaning up and refactoring our existing test plans for
prebuilt\nrule customization, upgrade, and export/import
workflows.\n\nSpecifically, this PR:\n\n- Updates the common structure
of test plans:\n- Adds a tip to each test plan's header to help with
navigating all our\ntest plans for prebuilt rules.\n- Introduces a new
`Requirements` section to each one and consolidates\nassumptions,
technical requirements and product requirements under it.\n- Each
`Product requirements` section now contains relevant user stories\nand
other product details. In the document flow this is kept close to\nthe
`Scenarios` section.\n - Updates the test plan template according to the
updated structure.\n- Moves the documentation about customizable and
non-customizable rule\nfields to the common info document.\n- Restores
the lost changes from
commit\nhttps://github.com/elastic/kibana/commit/bde4612e5256b3b779961736291ccae2e328c310.\n\nNo
\"functional\" changes have been made to any test plans, such
as\nadding, removing, or updating any scenarios. The only
functional-like\nchanges were made to the user stories when
creating/updating the product\nrequirements sections.\n\nThis PR wraps
up the refactoring efforts aimed to prepare the test plans\nfor being
\"functionally\" changed and improved in follow-up PRs. In
the\nfollowing PRs, we're going to cover the logic described
in\nhttps://github.com//issues/210358, address any gaps in
the\ncoverage, and improve the scenarios structure and wording.\n\n##
Review tip\n\nIt might be easier to review this PR commit-by-commit as
each of them\ncontains logically cohesive
changes.","sha":"c9616593c1deeb52f73fa5720f16288073943f3e","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","test-plan","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Refactor prebuilt rule customization test plans, part
3","number":212420,"url":"https://github.com/elastic/kibana/pull/212420","mergeCommit":{"message":"[Security
Solution] Refactor prebuilt rule customization test plans, part 3
(#212420)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202068,\nhttps://github.com//issues/202078,\nhttps://github.com//issues/202079\n**Follow-up
to:** https://github.com/elastic/kibana/pull/211472\n\n##
Summary\n\nWe're cleaning up and refactoring our existing test plans for
prebuilt\nrule customization, upgrade, and export/import
workflows.\n\nSpecifically, this PR:\n\n- Updates the common structure
of test plans:\n- Adds a tip to each test plan's header to help with
navigating all our\ntest plans for prebuilt rules.\n- Introduces a new
`Requirements` section to each one and consolidates\nassumptions,
technical requirements and product requirements under it.\n- Each
`Product requirements` section now contains relevant user stories\nand
other product details. In the document flow this is kept close to\nthe
`Scenarios` section.\n - Updates the test plan template according to the
updated structure.\n- Moves the documentation about customizable and
non-customizable rule\nfields to the common info document.\n- Restores
the lost changes from
commit\nhttps://github.com/elastic/kibana/commit/bde4612e5256b3b779961736291ccae2e328c310.\n\nNo
\"functional\" changes have been made to any test plans, such
as\nadding, removing, or updating any scenarios. The only
functional-like\nchanges were made to the user stories when
creating/updating the product\nrequirements sections.\n\nThis PR wraps
up the refactoring efforts aimed to prepare the test plans\nfor being
\"functionally\" changed and improved in follow-up PRs. In
the\nfollowing PRs, we're going to cover the logic described
in\nhttps://github.com//issues/210358, address any gaps in
the\ncoverage, and improve the scenarios structure and wording.\n\n##
Review tip\n\nIt might be easier to review this PR commit-by-commit as
each of them\ncontains logically cohesive
changes.","sha":"c9616593c1deeb52f73fa5720f16288073943f3e"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/212420","number":212420,"mergeCommit":{"message":"[Security
Solution] Refactor prebuilt rule customization test plans, part 3
(#212420)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202068,\nhttps://github.com//issues/202078,\nhttps://github.com//issues/202079\n**Follow-up
to:** https://github.com/elastic/kibana/pull/211472\n\n##
Summary\n\nWe're cleaning up and refactoring our existing test plans for
prebuilt\nrule customization, upgrade, and export/import
workflows.\n\nSpecifically, this PR:\n\n- Updates the common structure
of test plans:\n- Adds a tip to each test plan's header to help with
navigating all our\ntest plans for prebuilt rules.\n- Introduces a new
`Requirements` section to each one and consolidates\nassumptions,
technical requirements and product requirements under it.\n- Each
`Product requirements` section now contains relevant user stories\nand
other product details. In the document flow this is kept close to\nthe
`Scenarios` section.\n - Updates the test plan template according to the
updated structure.\n- Moves the documentation about customizable and
non-customizable rule\nfields to the common info document.\n- Restores
the lost changes from
commit\nhttps://github.com/elastic/kibana/commit/bde4612e5256b3b779961736291ccae2e328c310.\n\nNo
\"functional\" changes have been made to any test plans, such
as\nadding, removing, or updating any scenarios. The only
functional-like\nchanges were made to the user stories when
creating/updating the product\nrequirements sections.\n\nThis PR wraps
up the refactoring efforts aimed to prepare the test plans\nfor being
\"functionally\" changed and improved in follow-up PRs. In
the\nfollowing PRs, we're going to cover the logic described
in\nhttps://github.com//issues/210358, address any gaps in
the\ncoverage, and improve the scenarios structure and wording.\n\n##
Review tip\n\nIt might be easier to review this PR commit-by-commit as
each of them\ncontains logically cohesive
changes.","sha":"c9616593c1deeb52f73fa5720f16288073943f3e"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>

…plans, part 3 (#212420) (#212479)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Refactor prebuilt rule customization test plans,
part 3 (#212420)](#212420)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Georgii
Gorbachev","email":"georgii.gorbachev@elastic.co"},"sourceCommit":{"committedDate":"2025-02-26T08:39:32Z","message":"[Security
Solution] Refactor prebuilt rule customization test plans, part 3
(#212420)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202068,\nhttps://github.com//issues/202078,\nhttps://github.com//issues/202079\n**Follow-up
to:** https://github.com/elastic/kibana/pull/211472\n\n##
Summary\n\nWe're cleaning up and refactoring our existing test plans for
prebuilt\nrule customization, upgrade, and export/import
workflows.\n\nSpecifically, this PR:\n\n- Updates the common structure
of test plans:\n- Adds a tip to each test plan's header to help with
navigating all our\ntest plans for prebuilt rules.\n- Introduces a new
`Requirements` section to each one and consolidates\nassumptions,
technical requirements and product requirements under it.\n- Each
`Product requirements` section now contains relevant user stories\nand
other product details. In the document flow this is kept close to\nthe
`Scenarios` section.\n - Updates the test plan template according to the
updated structure.\n- Moves the documentation about customizable and
non-customizable rule\nfields to the common info document.\n- Restores
the lost changes from
commit\nhttps://github.com/elastic/kibana/commit/bde4612e5256b3b779961736291ccae2e328c310.\n\nNo
\"functional\" changes have been made to any test plans, such
as\nadding, removing, or updating any scenarios. The only
functional-like\nchanges were made to the user stories when
creating/updating the product\nrequirements sections.\n\nThis PR wraps
up the refactoring efforts aimed to prepare the test plans\nfor being
\"functionally\" changed and improved in follow-up PRs. In
the\nfollowing PRs, we're going to cover the logic described
in\nhttps://github.com//issues/210358, address any gaps in
the\ncoverage, and improve the scenarios structure and wording.\n\n##
Review tip\n\nIt might be easier to review this PR commit-by-commit as
each of them\ncontains logically cohesive
changes.","sha":"c9616593c1deeb52f73fa5720f16288073943f3e","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","test-plan","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Refactor prebuilt rule customization test plans, part
3","number":212420,"url":"https://github.com/elastic/kibana/pull/212420","mergeCommit":{"message":"[Security
Solution] Refactor prebuilt rule customization test plans, part 3
(#212420)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202068,\nhttps://github.com//issues/202078,\nhttps://github.com//issues/202079\n**Follow-up
to:** https://github.com/elastic/kibana/pull/211472\n\n##
Summary\n\nWe're cleaning up and refactoring our existing test plans for
prebuilt\nrule customization, upgrade, and export/import
workflows.\n\nSpecifically, this PR:\n\n- Updates the common structure
of test plans:\n- Adds a tip to each test plan's header to help with
navigating all our\ntest plans for prebuilt rules.\n- Introduces a new
`Requirements` section to each one and consolidates\nassumptions,
technical requirements and product requirements under it.\n- Each
`Product requirements` section now contains relevant user stories\nand
other product details. In the document flow this is kept close to\nthe
`Scenarios` section.\n - Updates the test plan template according to the
updated structure.\n- Moves the documentation about customizable and
non-customizable rule\nfields to the common info document.\n- Restores
the lost changes from
commit\nhttps://github.com/elastic/kibana/commit/bde4612e5256b3b779961736291ccae2e328c310.\n\nNo
\"functional\" changes have been made to any test plans, such
as\nadding, removing, or updating any scenarios. The only
functional-like\nchanges were made to the user stories when
creating/updating the product\nrequirements sections.\n\nThis PR wraps
up the refactoring efforts aimed to prepare the test plans\nfor being
\"functionally\" changed and improved in follow-up PRs. In
the\nfollowing PRs, we're going to cover the logic described
in\nhttps://github.com//issues/210358, address any gaps in
the\ncoverage, and improve the scenarios structure and wording.\n\n##
Review tip\n\nIt might be easier to review this PR commit-by-commit as
each of them\ncontains logically cohesive
changes.","sha":"c9616593c1deeb52f73fa5720f16288073943f3e"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/212420","number":212420,"mergeCommit":{"message":"[Security
Solution] Refactor prebuilt rule customization test plans, part 3
(#212420)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202068,\nhttps://github.com//issues/202078,\nhttps://github.com//issues/202079\n**Follow-up
to:** https://github.com/elastic/kibana/pull/211472\n\n##
Summary\n\nWe're cleaning up and refactoring our existing test plans for
prebuilt\nrule customization, upgrade, and export/import
workflows.\n\nSpecifically, this PR:\n\n- Updates the common structure
of test plans:\n- Adds a tip to each test plan's header to help with
navigating all our\ntest plans for prebuilt rules.\n- Introduces a new
`Requirements` section to each one and consolidates\nassumptions,
technical requirements and product requirements under it.\n- Each
`Product requirements` section now contains relevant user stories\nand
other product details. In the document flow this is kept close to\nthe
`Scenarios` section.\n - Updates the test plan template according to the
updated structure.\n- Moves the documentation about customizable and
non-customizable rule\nfields to the common info document.\n- Restores
the lost changes from
commit\nhttps://github.com/elastic/kibana/commit/bde4612e5256b3b779961736291ccae2e328c310.\n\nNo
\"functional\" changes have been made to any test plans, such
as\nadding, removing, or updating any scenarios. The only
functional-like\nchanges were made to the user stories when
creating/updating the product\nrequirements sections.\n\nThis PR wraps
up the refactoring efforts aimed to prepare the test plans\nfor being
\"functionally\" changed and improved in follow-up PRs. In
the\nfollowing PRs, we're going to cover the logic described
in\nhttps://github.com//issues/210358, address any gaps in
the\ncoverage, and improve the scenarios structure and wording.\n\n##
Review tip\n\nIt might be easier to review this PR commit-by-commit as
each of them\ncontains logically cohesive
changes.","sha":"c9616593c1deeb52f73fa5720f16288073943f3e"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>

…lans, part 3 (#212420) (#212480)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution] Refactor prebuilt rule customization test plans,
part 3 (#212420)](#212420)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Georgii
Gorbachev","email":"georgii.gorbachev@elastic.co"},"sourceCommit":{"committedDate":"2025-02-26T08:39:32Z","message":"[Security
Solution] Refactor prebuilt rule customization test plans, part 3
(#212420)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202068,\nhttps://github.com//issues/202078,\nhttps://github.com//issues/202079\n**Follow-up
to:** https://github.com/elastic/kibana/pull/211472\n\n##
Summary\n\nWe're cleaning up and refactoring our existing test plans for
prebuilt\nrule customization, upgrade, and export/import
workflows.\n\nSpecifically, this PR:\n\n- Updates the common structure
of test plans:\n- Adds a tip to each test plan's header to help with
navigating all our\ntest plans for prebuilt rules.\n- Introduces a new
`Requirements` section to each one and consolidates\nassumptions,
technical requirements and product requirements under it.\n- Each
`Product requirements` section now contains relevant user stories\nand
other product details. In the document flow this is kept close to\nthe
`Scenarios` section.\n - Updates the test plan template according to the
updated structure.\n- Moves the documentation about customizable and
non-customizable rule\nfields to the common info document.\n- Restores
the lost changes from
commit\nhttps://github.com/elastic/kibana/commit/bde4612e5256b3b779961736291ccae2e328c310.\n\nNo
\"functional\" changes have been made to any test plans, such
as\nadding, removing, or updating any scenarios. The only
functional-like\nchanges were made to the user stories when
creating/updating the product\nrequirements sections.\n\nThis PR wraps
up the refactoring efforts aimed to prepare the test plans\nfor being
\"functionally\" changed and improved in follow-up PRs. In
the\nfollowing PRs, we're going to cover the logic described
in\nhttps://github.com//issues/210358, address any gaps in
the\ncoverage, and improve the scenarios structure and wording.\n\n##
Review tip\n\nIt might be easier to review this PR commit-by-commit as
each of them\ncontains logically cohesive
changes.","sha":"c9616593c1deeb52f73fa5720f16288073943f3e","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","test-plan","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Refactor prebuilt rule customization test plans, part
3","number":212420,"url":"https://github.com/elastic/kibana/pull/212420","mergeCommit":{"message":"[Security
Solution] Refactor prebuilt rule customization test plans, part 3
(#212420)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202068,\nhttps://github.com//issues/202078,\nhttps://github.com//issues/202079\n**Follow-up
to:** https://github.com/elastic/kibana/pull/211472\n\n##
Summary\n\nWe're cleaning up and refactoring our existing test plans for
prebuilt\nrule customization, upgrade, and export/import
workflows.\n\nSpecifically, this PR:\n\n- Updates the common structure
of test plans:\n- Adds a tip to each test plan's header to help with
navigating all our\ntest plans for prebuilt rules.\n- Introduces a new
`Requirements` section to each one and consolidates\nassumptions,
technical requirements and product requirements under it.\n- Each
`Product requirements` section now contains relevant user stories\nand
other product details. In the document flow this is kept close to\nthe
`Scenarios` section.\n - Updates the test plan template according to the
updated structure.\n- Moves the documentation about customizable and
non-customizable rule\nfields to the common info document.\n- Restores
the lost changes from
commit\nhttps://github.com/elastic/kibana/commit/bde4612e5256b3b779961736291ccae2e328c310.\n\nNo
\"functional\" changes have been made to any test plans, such
as\nadding, removing, or updating any scenarios. The only
functional-like\nchanges were made to the user stories when
creating/updating the product\nrequirements sections.\n\nThis PR wraps
up the refactoring efforts aimed to prepare the test plans\nfor being
\"functionally\" changed and improved in follow-up PRs. In
the\nfollowing PRs, we're going to cover the logic described
in\nhttps://github.com//issues/210358, address any gaps in
the\ncoverage, and improve the scenarios structure and wording.\n\n##
Review tip\n\nIt might be easier to review this PR commit-by-commit as
each of them\ncontains logically cohesive
changes.","sha":"c9616593c1deeb52f73fa5720f16288073943f3e"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/212420","number":212420,"mergeCommit":{"message":"[Security
Solution] Refactor prebuilt rule customization test plans, part 3
(#212420)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202068,\nhttps://github.com//issues/202078,\nhttps://github.com//issues/202079\n**Follow-up
to:** https://github.com/elastic/kibana/pull/211472\n\n##
Summary\n\nWe're cleaning up and refactoring our existing test plans for
prebuilt\nrule customization, upgrade, and export/import
workflows.\n\nSpecifically, this PR:\n\n- Updates the common structure
of test plans:\n- Adds a tip to each test plan's header to help with
navigating all our\ntest plans for prebuilt rules.\n- Introduces a new
`Requirements` section to each one and consolidates\nassumptions,
technical requirements and product requirements under it.\n- Each
`Product requirements` section now contains relevant user stories\nand
other product details. In the document flow this is kept close to\nthe
`Scenarios` section.\n - Updates the test plan template according to the
updated structure.\n- Moves the documentation about customizable and
non-customizable rule\nfields to the common info document.\n- Restores
the lost changes from
commit\nhttps://github.com/elastic/kibana/commit/bde4612e5256b3b779961736291ccae2e328c310.\n\nNo
\"functional\" changes have been made to any test plans, such
as\nadding, removing, or updating any scenarios. The only
functional-like\nchanges were made to the user stories when
creating/updating the product\nrequirements sections.\n\nThis PR wraps
up the refactoring efforts aimed to prepare the test plans\nfor being
\"functionally\" changed and improved in follow-up PRs. In
the\nfollowing PRs, we're going to cover the logic described
in\nhttps://github.com//issues/210358, address any gaps in
the\ncoverage, and improve the scenarios structure and wording.\n\n##
Review tip\n\nIt might be easier to review this PR commit-by-commit as
each of them\ncontains logically cohesive
changes.","sha":"c9616593c1deeb52f73fa5720f16288073943f3e"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>

…part 3 (elastic#212420)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202068,
elastic#202078,
elastic#202079
**Follow-up to:** elastic#211472

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, this PR:

- Updates the common structure of test plans:
- Adds a tip to each test plan's header to help with navigating all our
test plans for prebuilt rules.
- Introduces a new `Requirements` section to each one and consolidates
assumptions, technical requirements and product requirements under it.
- Each `Product requirements` section now contains relevant user stories
and other product details. In the document flow this is kept close to
the `Scenarios` section.
  - Updates the test plan template according to the updated structure.
- Moves the documentation about customizable and non-customizable rule
fields to the common info document.
- Restores the lost changes from commit
elastic@bde4612.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios. The only functional-like
changes were made to the user stories when creating/updating the product
requirements sections.

This PR wraps up the refactoring efforts aimed to prepare the test plans
for being "functionally" changed and improved in follow-up PRs. In the
following PRs, we're going to cover the logic described in
elastic#210358, address any gaps in the
coverage, and improve the scenarios structure and wording.

## Review tip

It might be easier to review this PR commit-by-commit as each of them
contains logically cohesive changes.

…lans, part 3 (elastic#212420) (elastic#212480)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution] Refactor prebuilt rule customization test plans,
part 3 (elastic#212420)](elastic#212420)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Georgii
Gorbachev","email":"georgii.gorbachev@elastic.co"},"sourceCommit":{"committedDate":"2025-02-26T08:39:32Z","message":"[Security
Solution] Refactor prebuilt rule customization test plans, part 3
(elastic#212420)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com/elastic/issues/202068,\nhttps://github.com/elastic/issues/202078,\nhttps://github.com/elastic/issues/202079\n**Follow-up
to:** https://github.com/elastic/kibana/pull/211472\n\n##
Summary\n\nWe're cleaning up and refactoring our existing test plans for
prebuilt\nrule customization, upgrade, and export/import
workflows.\n\nSpecifically, this PR:\n\n- Updates the common structure
of test plans:\n- Adds a tip to each test plan's header to help with
navigating all our\ntest plans for prebuilt rules.\n- Introduces a new
`Requirements` section to each one and consolidates\nassumptions,
technical requirements and product requirements under it.\n- Each
`Product requirements` section now contains relevant user stories\nand
other product details. In the document flow this is kept close to\nthe
`Scenarios` section.\n - Updates the test plan template according to the
updated structure.\n- Moves the documentation about customizable and
non-customizable rule\nfields to the common info document.\n- Restores
the lost changes from
commit\nhttps://github.com/elastic/kibana/commit/bde4612e5256b3b779961736291ccae2e328c310.\n\nNo
\"functional\" changes have been made to any test plans, such
as\nadding, removing, or updating any scenarios. The only
functional-like\nchanges were made to the user stories when
creating/updating the product\nrequirements sections.\n\nThis PR wraps
up the refactoring efforts aimed to prepare the test plans\nfor being
\"functionally\" changed and improved in follow-up PRs. In
the\nfollowing PRs, we're going to cover the logic described
in\nhttps://github.com/elastic/issues/210358, address any gaps in
the\ncoverage, and improve the scenarios structure and wording.\n\n##
Review tip\n\nIt might be easier to review this PR commit-by-commit as
each of them\ncontains logically cohesive
changes.","sha":"c9616593c1deeb52f73fa5720f16288073943f3e","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","test-plan","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Refactor prebuilt rule customization test plans, part
3","number":212420,"url":"https://github.com/elastic/kibana/pull/212420","mergeCommit":{"message":"[Security
Solution] Refactor prebuilt rule customization test plans, part 3
(elastic#212420)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com/elastic/issues/202068,\nhttps://github.com/elastic/issues/202078,\nhttps://github.com/elastic/issues/202079\n**Follow-up
to:** https://github.com/elastic/kibana/pull/211472\n\n##
Summary\n\nWe're cleaning up and refactoring our existing test plans for
prebuilt\nrule customization, upgrade, and export/import
workflows.\n\nSpecifically, this PR:\n\n- Updates the common structure
of test plans:\n- Adds a tip to each test plan's header to help with
navigating all our\ntest plans for prebuilt rules.\n- Introduces a new
`Requirements` section to each one and consolidates\nassumptions,
technical requirements and product requirements under it.\n- Each
`Product requirements` section now contains relevant user stories\nand
other product details. In the document flow this is kept close to\nthe
`Scenarios` section.\n - Updates the test plan template according to the
updated structure.\n- Moves the documentation about customizable and
non-customizable rule\nfields to the common info document.\n- Restores
the lost changes from
commit\nhttps://github.com/elastic/kibana/commit/bde4612e5256b3b779961736291ccae2e328c310.\n\nNo
\"functional\" changes have been made to any test plans, such
as\nadding, removing, or updating any scenarios. The only
functional-like\nchanges were made to the user stories when
creating/updating the product\nrequirements sections.\n\nThis PR wraps
up the refactoring efforts aimed to prepare the test plans\nfor being
\"functionally\" changed and improved in follow-up PRs. In
the\nfollowing PRs, we're going to cover the logic described
in\nhttps://github.com/elastic/issues/210358, address any gaps in
the\ncoverage, and improve the scenarios structure and wording.\n\n##
Review tip\n\nIt might be easier to review this PR commit-by-commit as
each of them\ncontains logically cohesive
changes.","sha":"c9616593c1deeb52f73fa5720f16288073943f3e"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/212420","number":212420,"mergeCommit":{"message":"[Security
Solution] Refactor prebuilt rule customization test plans, part 3
(elastic#212420)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com/elastic/issues/202068,\nhttps://github.com/elastic/issues/202078,\nhttps://github.com/elastic/issues/202079\n**Follow-up
to:** https://github.com/elastic/kibana/pull/211472\n\n##
Summary\n\nWe're cleaning up and refactoring our existing test plans for
prebuilt\nrule customization, upgrade, and export/import
workflows.\n\nSpecifically, this PR:\n\n- Updates the common structure
of test plans:\n- Adds a tip to each test plan's header to help with
navigating all our\ntest plans for prebuilt rules.\n- Introduces a new
`Requirements` section to each one and consolidates\nassumptions,
technical requirements and product requirements under it.\n- Each
`Product requirements` section now contains relevant user stories\nand
other product details. In the document flow this is kept close to\nthe
`Scenarios` section.\n - Updates the test plan template according to the
updated structure.\n- Moves the documentation about customizable and
non-customizable rule\nfields to the common info document.\n- Restores
the lost changes from
commit\nhttps://github.com/elastic/kibana/commit/bde4612e5256b3b779961736291ccae2e328c310.\n\nNo
\"functional\" changes have been made to any test plans, such
as\nadding, removing, or updating any scenarios. The only
functional-like\nchanges were made to the user stories when
creating/updating the product\nrequirements sections.\n\nThis PR wraps
up the refactoring efforts aimed to prepare the test plans\nfor being
\"functionally\" changed and improved in follow-up PRs. In
the\nfollowing PRs, we're going to cover the logic described
in\nhttps://github.com/elastic/issues/210358, address any gaps in
the\ncoverage, and improve the scenarios structure and wording.\n\n##
Review tip\n\nIt might be easier to review this PR commit-by-commit as
each of them\ncontains logically cohesive
changes.","sha":"c9616593c1deeb52f73fa5720f16288073943f3e"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>

…part 3 (elastic#212420)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202068,
elastic#202078,
elastic#202079
**Follow-up to:** elastic#211472

## Summary

We're cleaning up and refactoring our existing test plans for prebuilt
rule customization, upgrade, and export/import workflows.

Specifically, this PR:

- Updates the common structure of test plans:
- Adds a tip to each test plan's header to help with navigating all our
test plans for prebuilt rules.
- Introduces a new `Requirements` section to each one and consolidates
assumptions, technical requirements and product requirements under it.
- Each `Product requirements` section now contains relevant user stories
and other product details. In the document flow this is kept close to
the `Scenarios` section.
  - Updates the test plan template according to the updated structure.
- Moves the documentation about customizable and non-customizable rule
fields to the common info document.
- Restores the lost changes from commit
elastic@bde4612.

No "functional" changes have been made to any test plans, such as
adding, removing, or updating any scenarios. The only functional-like
changes were made to the user stories when creating/updating the product
requirements sections.

This PR wraps up the refactoring efforts aimed to prepare the test plans
for being "functionally" changed and improved in follow-up PRs. In the
following PRs, we're going to cover the logic described in
elastic#210358, address any gaps in the
coverage, and improve the scenarios structure and wording.

## Review tip

It might be easier to review this PR commit-by-commit as each of them
contains logically cohesive changes.