Skip to content

[Security Solution] Test plan for reverting customized prebuilt rules to their base version#219628

Merged
maximpn merged 6 commits intoelastic:mainfrom
dplumlee:revert-base-version-test-plan
Jun 26, 2025
Merged

[Security Solution] Test plan for reverting customized prebuilt rules to their base version#219628
maximpn merged 6 commits intoelastic:mainfrom
dplumlee:revert-base-version-test-plan

Conversation

@dplumlee
Copy link
Copy Markdown
Contributor

@dplumlee dplumlee commented Apr 29, 2025

Summary

Test plan for: #215506 and #207172

Adds test cases to cover when writing implementation for the reverting customized prebuilt rules to their base version enhancement

@dplumlee dplumlee added release_note:skip Skip the PR/issue when compiling release notes test-plan Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area backport:version Backport to applied version labels v9.1.0 v8.19.0 labels Apr 29, 2025
@dplumlee dplumlee self-assigned this Apr 29, 2025
@dplumlee dplumlee requested a review from a team as a code owner April 29, 2025 19:31
@dplumlee dplumlee requested a review from maximpn April 29, 2025 19:31
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@dplumlee dplumlee marked this pull request as draft May 23, 2025 13:16
@dplumlee dplumlee force-pushed the revert-base-version-test-plan branch from 5755904 to 7d96479 Compare May 29, 2025 00:23
@dplumlee dplumlee marked this pull request as ready for review May 29, 2025 00:25
Copy link
Copy Markdown
Contributor

@maximpn maximpn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dplumlee Thanks for adding a test plan for prebuilt rules customization reverting 🙏

I recently actualized Prebuilt Rules Customization test plans and it makes sense to keep wording consistent. On top of that there are comments regarding test scenarios expliciness and compaction.

**Automation**: 1 cypress test and 1 unit test per field.

```Gherkin
Given a space with at least one prebuilt rule
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've made changes to this test plan in #222188. For consistency this and the other test scenarios could be simplified and aligned to look like

Given an installed prebuilt rule
And this prebuilt rule is customized
And this prebuilt rule has an existing base version
When user navigates to that rule's details page
Then the <field_name> field should be marked with a modified rule badge

Where examples could be moved out and formatted like (in that case prettier is able to auto-format examples)

**Examples:**

`<field_name>` = all customizable rule fields

@dplumlee dplumlee requested a review from maximpn June 23, 2025 15:48
@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

History

cc @dplumlee

@maximpn maximpn force-pushed the revert-base-version-test-plan branch from 4c6e715 to 8068d38 Compare June 26, 2025 13:34
@maximpn maximpn enabled auto-merge (squash) June 26, 2025 13:35
Copy link
Copy Markdown
Contributor

@maximpn maximpn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dplumlee Thanks for addressing my comments 🙏

I've pushed some little changes to the PR to fix wording and make the scenarios shorter.

@maximpn maximpn merged commit f44a765 into elastic:main Jun 26, 2025
10 checks passed
@kibanamachine
Copy link
Copy Markdown
Contributor

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/15904054294

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jun 26, 2025
… to their base version (elastic#219628)

## Summary

Test plan for: elastic#215506 and elastic#207172

Adds test cases to cover when writing implementation for the reverting customized prebuilt rules to their base version enhancement

(cherry picked from commit f44a765)
@kibanamachine
Copy link
Copy Markdown
Contributor

💚 All backports created successfully

Status Branch Result
8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Jun 26, 2025
…t rules to their base version (#219628) (#225466)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Security Solution] Test plan for reverting customized prebuilt rules
to their base version
(#219628)](#219628)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"56367316+dplumlee@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-06-26T14:04:47Z","message":"[Security
Solution] Test plan for reverting customized prebuilt rules to their
base version (#219628)\n\n## Summary\n\nTest plan for:
#215506 and
https://github.com/elastic/kibana/issues/207172\n\nAdds test cases to
cover when writing implementation for the reverting customized prebuilt
rules to their base version
enhancement","sha":"f44a7655d91f6150cd7b014ae312cef1ed6c8073","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","test-plan","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.1.0","v8.19.0"],"title":"[Security
Solution] Test plan for reverting customized prebuilt rules to their
base
version","number":219628,"url":"https://github.com/elastic/kibana/pull/219628","mergeCommit":{"message":"[Security
Solution] Test plan for reverting customized prebuilt rules to their
base version (#219628)\n\n## Summary\n\nTest plan for:
#215506 and
https://github.com/elastic/kibana/issues/207172\n\nAdds test cases to
cover when writing implementation for the reverting customized prebuilt
rules to their base version
enhancement","sha":"f44a7655d91f6150cd7b014ae312cef1ed6c8073"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/219628","number":219628,"mergeCommit":{"message":"[Security
Solution] Test plan for reverting customized prebuilt rules to their
base version (#219628)\n\n## Summary\n\nTest plan for:
#215506 and
https://github.com/elastic/kibana/issues/207172\n\nAdds test cases to
cover when writing implementation for the reverting customized prebuilt
rules to their base version
enhancement","sha":"f44a7655d91f6150cd7b014ae312cef1ed6c8073"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>
@dplumlee dplumlee deleted the revert-base-version-test-plan branch June 30, 2025 14:51
dplumlee added a commit that referenced this pull request Jul 8, 2025
…rules (#225939)

## Summary

Addresses #207172

Follow-up to: #219628

Adds per-field badges to the rule details page so that users can see
which fields are modified on their customized prebuilt rules. Clicking
on the badges opens a rule diff flyout that displays more extensive
information.

Also switches the concurrency controls in the flyout to a static view in
which data doesn't change when it is stale, we just now display a
callout informing the user that the information they're viewing is
outdated.

### Screenshots

**Modified fields from the Rule Details page**
![Screenshot 2025-07-02 at 5 38
43 PM](https://github.com/user-attachments/assets/ae1d2865-f3bd-4d5b-a109-213f78ea194c)

**Flyout opened when those badges are clicked**
![Screenshot 2025-07-02 at 1 33
26 PM](https://github.com/user-attachments/assets/793371ae-7a7d-4b39-8889-d16bd7dff9ba)


### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jul 8, 2025
…rules (elastic#225939)

## Summary

Addresses elastic#207172

Follow-up to: elastic#219628

Adds per-field badges to the rule details page so that users can see
which fields are modified on their customized prebuilt rules. Clicking
on the badges opens a rule diff flyout that displays more extensive
information.

Also switches the concurrency controls in the flyout to a static view in
which data doesn't change when it is stale, we just now display a
callout informing the user that the information they're viewing is
outdated.

### Screenshots

**Modified fields from the Rule Details page**
![Screenshot 2025-07-02 at 5 38
43 PM](https://github.com/user-attachments/assets/ae1d2865-f3bd-4d5b-a109-213f78ea194c)

**Flyout opened when those badges are clicked**
![Screenshot 2025-07-02 at 1 33
26 PM](https://github.com/user-attachments/assets/793371ae-7a7d-4b39-8889-d16bd7dff9ba)

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

(cherry picked from commit b261abb)
kertal pushed a commit to kertal/kibana that referenced this pull request Jul 25, 2025
…rules (elastic#225939)

## Summary

Addresses elastic#207172

Follow-up to: elastic#219628

Adds per-field badges to the rule details page so that users can see
which fields are modified on their customized prebuilt rules. Clicking
on the badges opens a rule diff flyout that displays more extensive
information.

Also switches the concurrency controls in the flyout to a static view in
which data doesn't change when it is stale, we just now display a
callout informing the user that the information they're viewing is
outdated.

### Screenshots

**Modified fields from the Rule Details page**
![Screenshot 2025-07-02 at 5 38
43 PM](https://github.com/user-attachments/assets/ae1d2865-f3bd-4d5b-a109-213f78ea194c)

**Flyout opened when those badges are clicked**
![Screenshot 2025-07-02 at 1 33
26 PM](https://github.com/user-attachments/assets/793371ae-7a7d-4b39-8889-d16bd7dff9ba)


### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:version Backport to applied version labels Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area release_note:skip Skip the PR/issue when compiling release notes Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. test-plan v8.19.0 v9.1.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants