Skip to content

[9.0] [Security Solution] Implement prebuilt rules export test plan (#224611)#226666

Merged
maximpn merged 1 commit intoelastic:9.0from
maximpn:backport/9.0/pr-224611
Jul 7, 2025
Merged

[9.0] [Security Solution] Implement prebuilt rules export test plan (#224611)#226666
maximpn merged 1 commit intoelastic:9.0from
maximpn:backport/9.0/pr-224611

Conversation

@maximpn
Copy link
Copy Markdown
Contributor

@maximpn maximpn commented Jul 4, 2025

Backport

This will backport the following commits from main to 9.0:

Questions ?

Please refer to the Backport tool documentation

@maximpn maximpn requested a review from kibanamachine as a code owner July 4, 2025 20:56
@maximpn maximpn added the backport This PR is a backport of another PR label Jul 4, 2025
@maximpn maximpn enabled auto-merge (squash) July 4, 2025 20:56
…c#224611)

**Addresses:** elastic#202079
**Relates to:** elastic#222796

## Summary

This PR implements Prebuilt Rules export [test plan](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/docs/testing/test_plans/detection_response/prebuilt_rules/prebuilt_rule_export.md).

Existing tests were adjusted and extended to match the test plan.

## Caveats

The test plan describes a scenario to verify prebuilt rules export fails for 10K+ rules but this scenario is tricky to implement. Due to ES limitations on filtering more than 10K the majority of utility functions like `deleteAllRules()` fail. The proper implementation requires proper setup and cleanup to make sure the test doesn't block the testing workflow.

As the result of the mentioned complexities implementation of the test scenario for 10K+ rules is skipped in this PR.

(cherry picked from commit 6120cae)

# Conflicts:
#	x-pack/solutions/security/plugins/security_solution/docs/testing/test_plans/detection_response/prebuilt_rules/prebuilt_rule_export.md
@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

@maximpn maximpn merged commit f9cb650 into elastic:9.0 Jul 7, 2025
9 checks passed
@maximpn maximpn deleted the backport/9.0/pr-224611 branch July 7, 2025 09:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants