Skip to content

[8.19] [Security Solution] Implement prebuilt rules import test plan (#223421)#226543

Closed
maximpn wants to merge 1 commit intoelastic:8.19from
maximpn:backport/8.19/pr-223421
Closed

[8.19] [Security Solution] Implement prebuilt rules import test plan (#223421)#226543
maximpn wants to merge 1 commit intoelastic:8.19from
maximpn:backport/8.19/pr-223421

Conversation

@maximpn
Copy link
Copy Markdown
Contributor

@maximpn maximpn commented Jul 4, 2025

Backport

This will backport the following commits from main to 8.19:

Questions ?

Please refer to the Backport tool documentation

…c#223421)

**Addresses:** elastic#202079

## Summary

This PR implement prebuilt rules import [test plan](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/docs/testing/test_plans/detection_response/prebuilt_rules/prebuilt_rule_import.md).

Prior existing tests were superseded by the new ones.

## Discovered issues

It turned out that the current implementation behaves slightly differently than described the test plan. Failed test scenarios are skipped and the following tickets have been created for tracking

- elastic#223099
- elastic#223280
- elastic#223253

## Extra changes

Some diff like in `alert_threat_enrichments.cy.ts` has been caused by disabling errors swallowing upon rule creation. It's important to have tests properly preparing the testing environment to reduce chances of test dependencies and flakiness. In particular some prebuilt rules import test scenarios require custom rules to be created. Swallowing rule creation errors reduces tests coverage.

## Flaky test runner

- ✅  [`detection_engine_security` package related prebuilt rules import integration tests](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8365) (100 iterations)
- ✅ [prebuilt rules import ECH integration tests](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8366) (100 iterations)
- ✅ [prebuilt rules import Serverless integration tests](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8367) (100 iterations)

(cherry picked from commit 87c8b88)

# Conflicts:
#	.buildkite/ftr_security_stateful_configs.yml
#	x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/common/configs/ess_air_gapped.config.ts
#	x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/common/import/import_with_installing_package.ts
#	x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/common/index.ts
#	x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/customization_enabled/index.ts
@maximpn maximpn requested a review from kibanamachine as a code owner July 4, 2025 09:03
@maximpn maximpn added the backport This PR is a backport of another PR label Jul 4, 2025
@maximpn maximpn enabled auto-merge (squash) July 4, 2025 09:03
@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

@maximpn
Copy link
Copy Markdown
Contributor Author

maximpn commented Jul 4, 2025

#223421 has been backported to 8.19 in #225072. This backport is obsolete.

@maximpn maximpn closed this Jul 4, 2025
auto-merge was automatically disabled July 4, 2025 12:55

Pull request was closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants