…astic#213434)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202079,
elastic#210358

## Summary

We started to rework and introduce functional changes to our existing
test plans for prebuilt rule customization, upgrade, and export/import
workflows.

Specifically, this PR:

- Restructures the test plan, introduces a more fine-grained list of
sections.
- Rewrites almost all the existing scenarios. In most cases it boils
down to splitting a scenario into 2+ more specific scenarios, where each
describes _exactly_ what happens in the GIVEN and THEN sections. This is
very important, as it:
- makes these scenarios ready to be implemented right away: 1 scenario =
1 test to write
  - helps with ensuring that we covered edge cases
- Adds new scenarios for handling missing base versions according to
[elastic#210358](elastic#210358).
- Adds a placeholder section for licensing scenarios according to
[elastic#11502](elastic/security-team#11502).
- Removes scenarios for the `overwrite` request parameter - this is
common importing logic which is not related to prebuilt rules.
- Addresses my own comments from [this
review](elastic#206893 (review)).

The new test plan should be in line with the changes discussed in
elastic#210358.

(cherry picked from commit a9106c6)

…astic#213434)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202079,
elastic#210358

## Summary

We started to rework and introduce functional changes to our existing
test plans for prebuilt rule customization, upgrade, and export/import
workflows.

Specifically, this PR:

- Restructures the test plan, introduces a more fine-grained list of
sections.
- Rewrites almost all the existing scenarios. In most cases it boils
down to splitting a scenario into 2+ more specific scenarios, where each
describes _exactly_ what happens in the GIVEN and THEN sections. This is
very important, as it:
- makes these scenarios ready to be implemented right away: 1 scenario =
1 test to write
  - helps with ensuring that we covered edge cases
- Adds new scenarios for handling missing base versions according to
[elastic#210358](elastic#210358).
- Adds a placeholder section for licensing scenarios according to
[elastic#11502](elastic/security-team#11502).
- Removes scenarios for the `overwrite` request parameter - this is
common importing logic which is not related to prebuilt rules.
- Addresses my own comments from [this
review](elastic#206893 (review)).

The new test plan should be in line with the changes discussed in
elastic#210358.

(cherry picked from commit a9106c6)

…astic#213434)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202079,
elastic#210358

## Summary

We started to rework and introduce functional changes to our existing
test plans for prebuilt rule customization, upgrade, and export/import
workflows.

Specifically, this PR:

- Restructures the test plan, introduces a more fine-grained list of
sections.
- Rewrites almost all the existing scenarios. In most cases it boils
down to splitting a scenario into 2+ more specific scenarios, where each
describes _exactly_ what happens in the GIVEN and THEN sections. This is
very important, as it:
- makes these scenarios ready to be implemented right away: 1 scenario =
1 test to write
  - helps with ensuring that we covered edge cases
- Adds new scenarios for handling missing base versions according to
[elastic#210358](elastic#210358).
- Adds a placeholder section for licensing scenarios according to
[elastic#11502](elastic/security-team#11502).
- Removes scenarios for the `overwrite` request parameter - this is
common importing logic which is not related to prebuilt rules.
- Addresses my own comments from [this
review](elastic#206893 (review)).

The new test plan should be in line with the changes discussed in
elastic#210358.

(cherry picked from commit a9106c6)

…es (#213434) (#215796)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security Solution] Rework test plan for importing prebuilt rules
(#213434)](#213434)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Georgii
Gorbachev","email":"georgii.gorbachev@elastic.co"},"sourceCommit":{"committedDate":"2025-03-24T19:00:36Z","message":"[Security
Solution] Rework test plan for importing prebuilt rules
(#213434)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202079,\nhttps://github.com//issues/210358\n\n##
Summary\n\nWe started to rework and introduce functional changes to our
existing\ntest plans for prebuilt rule customization, upgrade, and
export/import\nworkflows.\n\nSpecifically, this PR:\n\n- Restructures
the test plan, introduces a more fine-grained list of\nsections.\n-
Rewrites almost all the existing scenarios. In most cases it boils\ndown
to splitting a scenario into 2+ more specific scenarios, where
each\ndescribes _exactly_ what happens in the GIVEN and THEN sections.
This is\nvery important, as it:\n- makes these scenarios ready to be
implemented right away: 1 scenario =\n1 test to write\n - helps with
ensuring that we covered edge cases\n- Adds new scenarios for handling
missing base versions according
to\n[#210358](https://github.com/elastic/kibana/issues/210358).\n- Adds
a placeholder section for licensing scenarios according
to\n[#11502](https://github.com/elastic/security-team/issues/11502).\n-
Removes scenarios for the `overwrite` request parameter - this
is\ncommon importing logic which is not related to prebuilt rules.\n-
Addresses my own comments from
[this\nreview](https://github.com/elastic/kibana/pull/206893#pullrequestreview-2633863218).\n\nThe
new test plan should be in line with the changes discussed
in\nhttps://github.com//issues/210358.","sha":"a9106c69904e259412df9bbc77b4411507e1d011","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","test-plan","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Rework test plan for importing prebuilt
rules","number":213434,"url":"https://github.com/elastic/kibana/pull/213434","mergeCommit":{"message":"[Security
Solution] Rework test plan for importing prebuilt rules
(#213434)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202079,\nhttps://github.com//issues/210358\n\n##
Summary\n\nWe started to rework and introduce functional changes to our
existing\ntest plans for prebuilt rule customization, upgrade, and
export/import\nworkflows.\n\nSpecifically, this PR:\n\n- Restructures
the test plan, introduces a more fine-grained list of\nsections.\n-
Rewrites almost all the existing scenarios. In most cases it boils\ndown
to splitting a scenario into 2+ more specific scenarios, where
each\ndescribes _exactly_ what happens in the GIVEN and THEN sections.
This is\nvery important, as it:\n- makes these scenarios ready to be
implemented right away: 1 scenario =\n1 test to write\n - helps with
ensuring that we covered edge cases\n- Adds new scenarios for handling
missing base versions according
to\n[#210358](https://github.com/elastic/kibana/issues/210358).\n- Adds
a placeholder section for licensing scenarios according
to\n[#11502](https://github.com/elastic/security-team/issues/11502).\n-
Removes scenarios for the `overwrite` request parameter - this
is\ncommon importing logic which is not related to prebuilt rules.\n-
Addresses my own comments from
[this\nreview](https://github.com/elastic/kibana/pull/206893#pullrequestreview-2633863218).\n\nThe
new test plan should be in line with the changes discussed
in\nhttps://github.com//issues/210358.","sha":"a9106c69904e259412df9bbc77b4411507e1d011"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/213434","number":213434,"mergeCommit":{"message":"[Security
Solution] Rework test plan for importing prebuilt rules
(#213434)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202079,\nhttps://github.com//issues/210358\n\n##
Summary\n\nWe started to rework and introduce functional changes to our
existing\ntest plans for prebuilt rule customization, upgrade, and
export/import\nworkflows.\n\nSpecifically, this PR:\n\n- Restructures
the test plan, introduces a more fine-grained list of\nsections.\n-
Rewrites almost all the existing scenarios. In most cases it boils\ndown
to splitting a scenario into 2+ more specific scenarios, where
each\ndescribes _exactly_ what happens in the GIVEN and THEN sections.
This is\nvery important, as it:\n- makes these scenarios ready to be
implemented right away: 1 scenario =\n1 test to write\n - helps with
ensuring that we covered edge cases\n- Adds new scenarios for handling
missing base versions according
to\n[#210358](https://github.com/elastic/kibana/issues/210358).\n- Adds
a placeholder section for licensing scenarios according
to\n[#11502](https://github.com/elastic/security-team/issues/11502).\n-
Removes scenarios for the `overwrite` request parameter - this
is\ncommon importing logic which is not related to prebuilt rules.\n-
Addresses my own comments from
[this\nreview](https://github.com/elastic/kibana/pull/206893#pullrequestreview-2633863218).\n\nThe
new test plan should be in line with the changes discussed
in\nhttps://github.com//issues/210358.","sha":"a9106c69904e259412df9bbc77b4411507e1d011"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>

…les (#213434) (#215794)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Rework test plan for importing prebuilt rules
(#213434)](#213434)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Georgii
Gorbachev","email":"georgii.gorbachev@elastic.co"},"sourceCommit":{"committedDate":"2025-03-24T19:00:36Z","message":"[Security
Solution] Rework test plan for importing prebuilt rules
(#213434)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202079,\nhttps://github.com//issues/210358\n\n##
Summary\n\nWe started to rework and introduce functional changes to our
existing\ntest plans for prebuilt rule customization, upgrade, and
export/import\nworkflows.\n\nSpecifically, this PR:\n\n- Restructures
the test plan, introduces a more fine-grained list of\nsections.\n-
Rewrites almost all the existing scenarios. In most cases it boils\ndown
to splitting a scenario into 2+ more specific scenarios, where
each\ndescribes _exactly_ what happens in the GIVEN and THEN sections.
This is\nvery important, as it:\n- makes these scenarios ready to be
implemented right away: 1 scenario =\n1 test to write\n - helps with
ensuring that we covered edge cases\n- Adds new scenarios for handling
missing base versions according
to\n[#210358](https://github.com/elastic/kibana/issues/210358).\n- Adds
a placeholder section for licensing scenarios according
to\n[#11502](https://github.com/elastic/security-team/issues/11502).\n-
Removes scenarios for the `overwrite` request parameter - this
is\ncommon importing logic which is not related to prebuilt rules.\n-
Addresses my own comments from
[this\nreview](https://github.com/elastic/kibana/pull/206893#pullrequestreview-2633863218).\n\nThe
new test plan should be in line with the changes discussed
in\nhttps://github.com//issues/210358.","sha":"a9106c69904e259412df9bbc77b4411507e1d011","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","test-plan","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Rework test plan for importing prebuilt
rules","number":213434,"url":"https://github.com/elastic/kibana/pull/213434","mergeCommit":{"message":"[Security
Solution] Rework test plan for importing prebuilt rules
(#213434)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202079,\nhttps://github.com//issues/210358\n\n##
Summary\n\nWe started to rework and introduce functional changes to our
existing\ntest plans for prebuilt rule customization, upgrade, and
export/import\nworkflows.\n\nSpecifically, this PR:\n\n- Restructures
the test plan, introduces a more fine-grained list of\nsections.\n-
Rewrites almost all the existing scenarios. In most cases it boils\ndown
to splitting a scenario into 2+ more specific scenarios, where
each\ndescribes _exactly_ what happens in the GIVEN and THEN sections.
This is\nvery important, as it:\n- makes these scenarios ready to be
implemented right away: 1 scenario =\n1 test to write\n - helps with
ensuring that we covered edge cases\n- Adds new scenarios for handling
missing base versions according
to\n[#210358](https://github.com/elastic/kibana/issues/210358).\n- Adds
a placeholder section for licensing scenarios according
to\n[#11502](https://github.com/elastic/security-team/issues/11502).\n-
Removes scenarios for the `overwrite` request parameter - this
is\ncommon importing logic which is not related to prebuilt rules.\n-
Addresses my own comments from
[this\nreview](https://github.com/elastic/kibana/pull/206893#pullrequestreview-2633863218).\n\nThe
new test plan should be in line with the changes discussed
in\nhttps://github.com//issues/210358.","sha":"a9106c69904e259412df9bbc77b4411507e1d011"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/213434","number":213434,"mergeCommit":{"message":"[Security
Solution] Rework test plan for importing prebuilt rules
(#213434)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202079,\nhttps://github.com//issues/210358\n\n##
Summary\n\nWe started to rework and introduce functional changes to our
existing\ntest plans for prebuilt rule customization, upgrade, and
export/import\nworkflows.\n\nSpecifically, this PR:\n\n- Restructures
the test plan, introduces a more fine-grained list of\nsections.\n-
Rewrites almost all the existing scenarios. In most cases it boils\ndown
to splitting a scenario into 2+ more specific scenarios, where
each\ndescribes _exactly_ what happens in the GIVEN and THEN sections.
This is\nvery important, as it:\n- makes these scenarios ready to be
implemented right away: 1 scenario =\n1 test to write\n - helps with
ensuring that we covered edge cases\n- Adds new scenarios for handling
missing base versions according
to\n[#210358](https://github.com/elastic/kibana/issues/210358).\n- Adds
a placeholder section for licensing scenarios according
to\n[#11502](https://github.com/elastic/security-team/issues/11502).\n-
Removes scenarios for the `overwrite` request parameter - this
is\ncommon importing logic which is not related to prebuilt rules.\n-
Addresses my own comments from
[this\nreview](https://github.com/elastic/kibana/pull/206893#pullrequestreview-2633863218).\n\nThe
new test plan should be in line with the changes discussed
in\nhttps://github.com//issues/210358.","sha":"a9106c69904e259412df9bbc77b4411507e1d011"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>

…es (#213434) (#215795)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution] Rework test plan for importing prebuilt rules
(#213434)](#213434)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Georgii
Gorbachev","email":"georgii.gorbachev@elastic.co"},"sourceCommit":{"committedDate":"2025-03-24T19:00:36Z","message":"[Security
Solution] Rework test plan for importing prebuilt rules
(#213434)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202079,\nhttps://github.com//issues/210358\n\n##
Summary\n\nWe started to rework and introduce functional changes to our
existing\ntest plans for prebuilt rule customization, upgrade, and
export/import\nworkflows.\n\nSpecifically, this PR:\n\n- Restructures
the test plan, introduces a more fine-grained list of\nsections.\n-
Rewrites almost all the existing scenarios. In most cases it boils\ndown
to splitting a scenario into 2+ more specific scenarios, where
each\ndescribes _exactly_ what happens in the GIVEN and THEN sections.
This is\nvery important, as it:\n- makes these scenarios ready to be
implemented right away: 1 scenario =\n1 test to write\n - helps with
ensuring that we covered edge cases\n- Adds new scenarios for handling
missing base versions according
to\n[#210358](https://github.com/elastic/kibana/issues/210358).\n- Adds
a placeholder section for licensing scenarios according
to\n[#11502](https://github.com/elastic/security-team/issues/11502).\n-
Removes scenarios for the `overwrite` request parameter - this
is\ncommon importing logic which is not related to prebuilt rules.\n-
Addresses my own comments from
[this\nreview](https://github.com/elastic/kibana/pull/206893#pullrequestreview-2633863218).\n\nThe
new test plan should be in line with the changes discussed
in\nhttps://github.com//issues/210358.","sha":"a9106c69904e259412df9bbc77b4411507e1d011","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","test-plan","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Rework test plan for importing prebuilt
rules","number":213434,"url":"https://github.com/elastic/kibana/pull/213434","mergeCommit":{"message":"[Security
Solution] Rework test plan for importing prebuilt rules
(#213434)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202079,\nhttps://github.com//issues/210358\n\n##
Summary\n\nWe started to rework and introduce functional changes to our
existing\ntest plans for prebuilt rule customization, upgrade, and
export/import\nworkflows.\n\nSpecifically, this PR:\n\n- Restructures
the test plan, introduces a more fine-grained list of\nsections.\n-
Rewrites almost all the existing scenarios. In most cases it boils\ndown
to splitting a scenario into 2+ more specific scenarios, where
each\ndescribes _exactly_ what happens in the GIVEN and THEN sections.
This is\nvery important, as it:\n- makes these scenarios ready to be
implemented right away: 1 scenario =\n1 test to write\n - helps with
ensuring that we covered edge cases\n- Adds new scenarios for handling
missing base versions according
to\n[#210358](https://github.com/elastic/kibana/issues/210358).\n- Adds
a placeholder section for licensing scenarios according
to\n[#11502](https://github.com/elastic/security-team/issues/11502).\n-
Removes scenarios for the `overwrite` request parameter - this
is\ncommon importing logic which is not related to prebuilt rules.\n-
Addresses my own comments from
[this\nreview](https://github.com/elastic/kibana/pull/206893#pullrequestreview-2633863218).\n\nThe
new test plan should be in line with the changes discussed
in\nhttps://github.com//issues/210358.","sha":"a9106c69904e259412df9bbc77b4411507e1d011"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/213434","number":213434,"mergeCommit":{"message":"[Security
Solution] Rework test plan for importing prebuilt rules
(#213434)\n\n**Epic:**
https://github.com/elastic/kibana/issues/174168\n**Partially
addresses:**\nhttps://github.com//issues/202079,\nhttps://github.com//issues/210358\n\n##
Summary\n\nWe started to rework and introduce functional changes to our
existing\ntest plans for prebuilt rule customization, upgrade, and
export/import\nworkflows.\n\nSpecifically, this PR:\n\n- Restructures
the test plan, introduces a more fine-grained list of\nsections.\n-
Rewrites almost all the existing scenarios. In most cases it boils\ndown
to splitting a scenario into 2+ more specific scenarios, where
each\ndescribes _exactly_ what happens in the GIVEN and THEN sections.
This is\nvery important, as it:\n- makes these scenarios ready to be
implemented right away: 1 scenario =\n1 test to write\n - helps with
ensuring that we covered edge cases\n- Adds new scenarios for handling
missing base versions according
to\n[#210358](https://github.com/elastic/kibana/issues/210358).\n- Adds
a placeholder section for licensing scenarios according
to\n[#11502](https://github.com/elastic/security-team/issues/11502).\n-
Removes scenarios for the `overwrite` request parameter - this
is\ncommon importing logic which is not related to prebuilt rules.\n-
Addresses my own comments from
[this\nreview](https://github.com/elastic/kibana/pull/206893#pullrequestreview-2633863218).\n\nThe
new test plan should be in line with the changes discussed
in\nhttps://github.com//issues/210358.","sha":"a9106c69904e259412df9bbc77b4411507e1d011"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>

…astic#213434)

**Epic:** elastic#174168
**Partially addresses:**
elastic#202079,
elastic#210358

## Summary

We started to rework and introduce functional changes to our existing
test plans for prebuilt rule customization, upgrade, and export/import
workflows.

Specifically, this PR:

- Restructures the test plan, introduces a more fine-grained list of
sections.
- Rewrites almost all the existing scenarios. In most cases it boils
down to splitting a scenario into 2+ more specific scenarios, where each
describes _exactly_ what happens in the GIVEN and THEN sections. This is
very important, as it:
- makes these scenarios ready to be implemented right away: 1 scenario =
1 test to write
  - helps with ensuring that we covered edge cases
- Adds new scenarios for handling missing base versions according to
[elastic#210358](elastic#210358).
- Adds a placeholder section for licensing scenarios according to
[elastic#11502](elastic/security-team#11502).
- Removes scenarios for the `overwrite` request parameter - this is
common importing logic which is not related to prebuilt rules.
- Addresses my own comments from [this
review](elastic#206893 (review)).

The new test plan should be in line with the changes discussed in
elastic#210358.