Skip to content

[Security Solution] Actualize prebuilt rule customization test plan#222188

Merged
maximpn merged 3 commits intoelastic:mainfrom
maximpn:actualize_prebuilt_rule_customization_test_plan
Jun 20, 2025
Merged

[Security Solution] Actualize prebuilt rule customization test plan#222188
maximpn merged 3 commits intoelastic:mainfrom
maximpn:actualize_prebuilt_rule_customization_test_plan

Conversation

@maximpn
Copy link
Copy Markdown
Contributor

@maximpn maximpn commented Jun 2, 2025

Addresses: #202068

Summary

This PR actualizes prebuilt rule customization test plan with the current feature state and desired test coverage we expect for prebuilt rule customization sub-feature.

Details

The changes include

  • Adding an extra test scenario for prebuilt rule customization via public API
  • Fixing a scenario under Licensing section
  • Fixing wording to make scenarios simpler

@maximpn maximpn self-assigned this Jun 2, 2025
@maximpn maximpn requested a review from a team as a code owner June 2, 2025 11:15
@maximpn maximpn requested a review from jkelas June 2, 2025 11:15
@maximpn maximpn added release_note:skip Skip the PR/issue when compiling release notes test-plan Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area backport:version Backport to applied version labels 9.1 candidate 8.19 candidate labels Jun 2, 2025
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@maximpn maximpn force-pushed the actualize_prebuilt_rule_customization_test_plan branch from 0b2b8a9 to 18dfdca Compare June 2, 2025 14:02
@maximpn maximpn requested review from nikitaindik and removed request for jkelas June 2, 2025 15:52
Copy link
Copy Markdown
Contributor

@nikitaindik nikitaindik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice job refining it, @maximpn! I've taken a look and posted a few comments. Please check it out.

And should bring the user to the prebuilt rule edit page when clicked on
```

#### **Scenario: User can bulk edit prebuilt rules from rules management page**
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have separate scenarios for editing a customized and non-cust. prebuilt rules:

  • User can edit a customized prebuilt rule from the rule edit page
  • User can edit a non-customized prebuilt rule from the rule edit page

Do we want to treat bulk actions the same way? Like:

  • User can bulk edit prebuilt rules that weren't customized
  • User can bulk edit prebuilt rules that were previosly customized

wdyt?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ideally, bulk editing would require 3 scenarios to test all the cases

  • bulk edit non-customized prebuilt rules
  • bulk edit customized prebuilt rules
  • bulk edit a mix of customized and non-customized prebuilt rules

But it's sufficient to have only the last one to reduce maintainability costs. So I've updated the test scenario accordingly.

@@ -246,20 +272,74 @@ Examples:
**Automation**: 1 integration test.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we test this with different endpoints: single update, single patch, bulk update?

@@ -293,7 +373,7 @@ Then the Modified badge should NOT be present on the page
**Automation**: 1 cypress test.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to change the last "modified" to "customized" in scenario title for consistency with other scenarios.

"Modified badge should appear on the rule management table when prebuilt rule is modified customized"

And the "Modified" badge should NOT be present in the table row
```

#### **Scenario: User should be able to see only customized rules in the rule updates table**
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
#### **Scenario: User should be able to see only customized rules in the rule updates table**
#### **Scenario: User should be able to filter by customized rules in the rule updates table**

For consistency with scenario below

And a button to proceed with applying the action only to custom rules should be displayed
```

#### **Scenario: User can't edit prebuilt rules via bulk edit API under an insufficient license**
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we then also want an integration test for a single rule edit? Or do we consider it covered by a Cypress test?

@maximpn maximpn force-pushed the actualize_prebuilt_rule_customization_test_plan branch from 836c452 to 182f335 Compare June 18, 2025 07:13
@maximpn maximpn force-pushed the actualize_prebuilt_rule_customization_test_plan branch from 182f335 to 1ebfca1 Compare June 18, 2025 07:20
@maximpn maximpn requested a review from nikitaindik June 18, 2025 07:22
@maximpn
Copy link
Copy Markdown
Contributor Author

maximpn commented Jun 18, 2025

Hi @nikitaindik, I've addressed your comments. Could you have a look?

Copy link
Copy Markdown
Contributor

@nikitaindik nikitaindik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for addressing my feedback! LGTM now. 👍

@maximpn maximpn enabled auto-merge (squash) June 20, 2025 14:43
@maximpn maximpn merged commit 98aaf50 into elastic:main Jun 20, 2025
10 checks passed
@kibanamachine
Copy link
Copy Markdown
Contributor

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/15782141307

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jun 20, 2025
…lastic#222188)

**Addresses:** elastic#202068

## Summary

This PR actualizes prebuilt rule customization test plan with the current feature state and desired test coverage we expect for prebuilt rule customization sub-feature.

## Details

The changes include

- Adding an extra test scenario for prebuilt rule customization via public API
- Fixing a scenario under Licensing section
- Fixing wording to make scenarios simpler

(cherry picked from commit 98aaf50)
@kibanamachine
Copy link
Copy Markdown
Contributor

💚 All backports created successfully

Status Branch Result
8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Jun 20, 2025
… plan (#222188) (#224727)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Security Solution] Actualize prebuilt rule customization test plan
(#222188)](#222188)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-06-20T15:16:59Z","message":"[Security
Solution] Actualize prebuilt rule customization test plan
(#222188)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/202068\n\n## Summary\n\nThis PR
actualizes prebuilt rule customization test plan with the current
feature state and desired test coverage we expect for prebuilt rule
customization sub-feature.\n\n## Details\n\nThe changes include\n\n-
Adding an extra test scenario for prebuilt rule customization via public
API\n- Fixing a scenario under Licensing section\n- Fixing wording to
make scenarios
simpler","sha":"98aaf50be2e002e645ac1cd081bfaba2e04714a3","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","test-plan","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.1.0","v8.19.0"],"title":"[Security
Solution] Actualize prebuilt rule customization test
plan","number":222188,"url":"https://github.com/elastic/kibana/pull/222188","mergeCommit":{"message":"[Security
Solution] Actualize prebuilt rule customization test plan
(#222188)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/202068\n\n## Summary\n\nThis PR
actualizes prebuilt rule customization test plan with the current
feature state and desired test coverage we expect for prebuilt rule
customization sub-feature.\n\n## Details\n\nThe changes include\n\n-
Adding an extra test scenario for prebuilt rule customization via public
API\n- Fixing a scenario under Licensing section\n- Fixing wording to
make scenarios
simpler","sha":"98aaf50be2e002e645ac1cd081bfaba2e04714a3"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/222188","number":222188,"mergeCommit":{"message":"[Security
Solution] Actualize prebuilt rule customization test plan
(#222188)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/202068\n\n## Summary\n\nThis PR
actualizes prebuilt rule customization test plan with the current
feature state and desired test coverage we expect for prebuilt rule
customization sub-feature.\n\n## Details\n\nThe changes include\n\n-
Adding an extra test scenario for prebuilt rule customization via public
API\n- Fixing a scenario under Licensing section\n- Fixing wording to
make scenarios
simpler","sha":"98aaf50be2e002e645ac1cd081bfaba2e04714a3"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
akowalska622 pushed a commit to akowalska622/kibana that referenced this pull request Jun 25, 2025
…lastic#222188)

**Addresses:** elastic#202068

## Summary

This PR actualizes prebuilt rule customization test plan with the current feature state and desired test coverage we expect for prebuilt rule customization sub-feature.

## Details

The changes include

- Adding an extra test scenario for prebuilt rule customization via public API
- Fixing a scenario under Licensing section
- Fixing wording to make scenarios simpler
maximpn added a commit to maximpn/kibana that referenced this pull request Jul 7, 2025
…lastic#222188)

**Addresses:** elastic#202068

## Summary

This PR actualizes prebuilt rule customization test plan with the current feature state and desired test coverage we expect for prebuilt rule customization sub-feature.

## Details

The changes include

- Adding an extra test scenario for prebuilt rule customization via public API
- Fixing a scenario under Licensing section
- Fixing wording to make scenarios simpler

(cherry picked from commit 98aaf50)
maximpn added a commit to maximpn/kibana that referenced this pull request Jul 7, 2025
…lastic#222188)

**Addresses:** elastic#202068

## Summary

This PR actualizes prebuilt rule customization test plan with the current feature state and desired test coverage we expect for prebuilt rule customization sub-feature.

## Details

The changes include

- Adding an extra test scenario for prebuilt rule customization via public API
- Fixing a scenario under Licensing section
- Fixing wording to make scenarios simpler

(cherry picked from commit 98aaf50)
@maximpn
Copy link
Copy Markdown
Contributor Author

maximpn commented Jul 7, 2025

💚 All backports created successfully

Status Branch Result
9.0
8.18

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

maximpn added a commit that referenced this pull request Jul 7, 2025
… plan (#222188) (#226783)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Actualize prebuilt rule customization test plan
(#222188)](#222188)

<!--- Backport version: 10.0.1 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-06-20T15:16:59Z","message":"[Security
Solution] Actualize prebuilt rule customization test plan
(#222188)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/202068\n\n## Summary\n\nThis PR
actualizes prebuilt rule customization test plan with the current
feature state and desired test coverage we expect for prebuilt rule
customization sub-feature.\n\n## Details\n\nThe changes include\n\n-
Adding an extra test scenario for prebuilt rule customization via public
API\n- Fixing a scenario under Licensing section\n- Fixing wording to
make scenarios
simpler","sha":"98aaf50be2e002e645ac1cd081bfaba2e04714a3","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","test-plan","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.1.0","v8.19.0"],"title":"[Security
Solution] Actualize prebuilt rule customization test
plan","number":222188,"url":"https://github.com/elastic/kibana/pull/222188","mergeCommit":{"message":"[Security
Solution] Actualize prebuilt rule customization test plan
(#222188)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/202068\n\n## Summary\n\nThis PR
actualizes prebuilt rule customization test plan with the current
feature state and desired test coverage we expect for prebuilt rule
customization sub-feature.\n\n## Details\n\nThe changes include\n\n-
Adding an extra test scenario for prebuilt rule customization via public
API\n- Fixing a scenario under Licensing section\n- Fixing wording to
make scenarios
simpler","sha":"98aaf50be2e002e645ac1cd081bfaba2e04714a3"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/222188","number":222188,"mergeCommit":{"message":"[Security
Solution] Actualize prebuilt rule customization test plan
(#222188)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/202068\n\n## Summary\n\nThis PR
actualizes prebuilt rule customization test plan with the current
feature state and desired test coverage we expect for prebuilt rule
customization sub-feature.\n\n## Details\n\nThe changes include\n\n-
Adding an extra test scenario for prebuilt rule customization via public
API\n- Fixing a scenario under Licensing section\n- Fixing wording to
make scenarios
simpler","sha":"98aaf50be2e002e645ac1cd081bfaba2e04714a3"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/224727","number":224727,"state":"MERGED","mergeCommit":{"sha":"296c3b0a4d5ed79611260674a917f08cb726fec3","message":"[8.19]
[Security Solution] Actualize prebuilt rule customization test plan
(#222188) (#224727)\n\n# Backport\n\nThis will backport the following
commits from `main` to `8.19`:\n- [[Security Solution] Actualize
prebuilt rule customization test
plan\n(#222188)](https://github.com/elastic/kibana/pull/222188)\n\n\n\n###
Questions ?\nPlease refer to the [Backport
tool\ndocumentation](https://github.com/sorenlouv/backport)\n\n\n\nCo-authored-by:
Maxim Palenov <maxim.palenov@elastic.co>"}}]}] BACKPORT-->
maximpn added a commit that referenced this pull request Jul 7, 2025
…plan (#222188) (#226781)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security Solution] Actualize prebuilt rule customization test plan
(#222188)](#222188)

<!--- Backport version: 10.0.1 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-06-20T15:16:59Z","message":"[Security
Solution] Actualize prebuilt rule customization test plan
(#222188)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/202068\n\n## Summary\n\nThis PR
actualizes prebuilt rule customization test plan with the current
feature state and desired test coverage we expect for prebuilt rule
customization sub-feature.\n\n## Details\n\nThe changes include\n\n-
Adding an extra test scenario for prebuilt rule customization via public
API\n- Fixing a scenario under Licensing section\n- Fixing wording to
make scenarios
simpler","sha":"98aaf50be2e002e645ac1cd081bfaba2e04714a3","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","test-plan","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.1.0","v8.19.0"],"title":"[Security
Solution] Actualize prebuilt rule customization test
plan","number":222188,"url":"https://github.com/elastic/kibana/pull/222188","mergeCommit":{"message":"[Security
Solution] Actualize prebuilt rule customization test plan
(#222188)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/202068\n\n## Summary\n\nThis PR
actualizes prebuilt rule customization test plan with the current
feature state and desired test coverage we expect for prebuilt rule
customization sub-feature.\n\n## Details\n\nThe changes include\n\n-
Adding an extra test scenario for prebuilt rule customization via public
API\n- Fixing a scenario under Licensing section\n- Fixing wording to
make scenarios
simpler","sha":"98aaf50be2e002e645ac1cd081bfaba2e04714a3"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/222188","number":222188,"mergeCommit":{"message":"[Security
Solution] Actualize prebuilt rule customization test plan
(#222188)\n\n**Addresses:**
https://github.com/elastic/kibana/issues/202068\n\n## Summary\n\nThis PR
actualizes prebuilt rule customization test plan with the current
feature state and desired test coverage we expect for prebuilt rule
customization sub-feature.\n\n## Details\n\nThe changes include\n\n-
Adding an extra test scenario for prebuilt rule customization via public
API\n- Fixing a scenario under Licensing section\n- Fixing wording to
make scenarios
simpler","sha":"98aaf50be2e002e645ac1cd081bfaba2e04714a3"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/224727","number":224727,"state":"MERGED","mergeCommit":{"sha":"296c3b0a4d5ed79611260674a917f08cb726fec3","message":"[8.19]
[Security Solution] Actualize prebuilt rule customization test plan
(#222188) (#224727)\n\n# Backport\n\nThis will backport the following
commits from `main` to `8.19`:\n- [[Security Solution] Actualize
prebuilt rule customization test
plan\n(#222188)](https://github.com/elastic/kibana/pull/222188)\n\n\n\n###
Questions ?\nPlease refer to the [Backport
tool\ndocumentation](https://github.com/sorenlouv/backport)\n\n\n\nCo-authored-by:
Maxim Palenov <maxim.palenov@elastic.co>"}}]}] BACKPORT-->
@kibanamachine
Copy link
Copy Markdown
Contributor

Starting backport for target branches: 8.18, 8.19, 9.1

https://github.com/elastic/kibana/actions/runs/16118962480

@kibanamachine
Copy link
Copy Markdown
Contributor

Starting backport for target branches: 8.18, 8.19, 9.0, 9.1

https://github.com/elastic/kibana/actions/runs/16118967225

@kibanamachine
Copy link
Copy Markdown
Contributor

Starting backport for target branches: 8.18, 8.19, 9.0, 9.1

https://github.com/elastic/kibana/actions/runs/16118969306

@kibanamachine
Copy link
Copy Markdown
Contributor

💔 All backports failed

Status Branch Result
8.18 Cherrypick failed because the selected commit (98aaf50) is empty. It looks like the commit was already backported in #226783
8.19 Backport failed because of merge conflicts
9.1 Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 222188

Questions ?

Please refer to the Backport tool documentation

@kibanamachine
Copy link
Copy Markdown
Contributor

💔 All backports failed

Status Branch Result
8.18 Cherrypick failed because the selected commit (98aaf50) is empty. It looks like the commit was already backported in #226783
8.19 Backport failed because of merge conflicts
9.0 Cherrypick failed because the selected commit (98aaf50) is empty. It looks like the commit was already backported in #226781
9.1 Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 222188

Questions ?

Please refer to the Backport tool documentation

1 similar comment
@kibanamachine
Copy link
Copy Markdown
Contributor

💔 All backports failed

Status Branch Result
8.18 Cherrypick failed because the selected commit (98aaf50) is empty. It looks like the commit was already backported in #226783
8.19 Backport failed because of merge conflicts
9.0 Cherrypick failed because the selected commit (98aaf50) is empty. It looks like the commit was already backported in #226781
9.1 Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 222188

Questions ?

Please refer to the Backport tool documentation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:version Backport to applied version labels Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area release_note:skip Skip the PR/issue when compiling release notes Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. test-plan v8.18.4 v8.19.0 v9.0.4 v9.1.0 v9.2.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants