Skip to content

[9.0] [Security Solution] Implement prebuilt rules import test plan (#223421)#226507

Merged
kibanamachine merged 2 commits intoelastic:9.0from
kibanamachine:backport/9.0/pr-223421
Jul 4, 2025
Merged

[9.0] [Security Solution] Implement prebuilt rules import test plan (#223421)#226507
kibanamachine merged 2 commits intoelastic:9.0from
kibanamachine:backport/9.0/pr-223421

Conversation

@kibanamachine
Copy link
Copy Markdown
Contributor

Backport

This will backport the following commits from main to 9.0:

Questions ?

Please refer to the Backport tool documentation

@kibanamachine kibanamachine added the backport This PR is a backport of another PR label Jul 3, 2025
@kibanamachine kibanamachine enabled auto-merge (squash) July 3, 2025 22:43
…c#223421)

**Addresses:** elastic#202079

## Summary

This PR implement prebuilt rules import [test plan](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/docs/testing/test_plans/detection_response/prebuilt_rules/prebuilt_rule_import.md).

Prior existing tests were superseded by the new ones.

## Discovered issues

It turned out that the current implementation behaves slightly differently than described the test plan. Failed test scenarios are skipped and the following tickets have been created for tracking

- elastic#223099
- elastic#223280
- elastic#223253

## Extra changes

Some diff like in `alert_threat_enrichments.cy.ts` has been caused by disabling errors swallowing upon rule creation. It's important to have tests properly preparing the testing environment to reduce chances of test dependencies and flakiness. In particular some prebuilt rules import test scenarios require custom rules to be created. Swallowing rule creation errors reduces tests coverage.

## Flaky test runner

- ✅  [`detection_engine_security` package related prebuilt rules import integration tests](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8365) (100 iterations)
- ✅ [prebuilt rules import ECH integration tests](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8366) (100 iterations)
- ✅ [prebuilt rules import Serverless integration tests](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8367) (100 iterations)

(cherry picked from commit 87c8b88)
@kibanamachine kibanamachine force-pushed the backport/9.0/pr-223421 branch from 67511aa to 3a66e77 Compare July 3, 2025 22:46
@elasticmachine
Copy link
Copy Markdown
Contributor

💔 Build Failed

Failed CI Steps

cc @maximpn

@kibanamachine kibanamachine merged commit 5e25fc8 into elastic:9.0 Jul 4, 2025
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants