…s script (elastic#234905)

**Partially resolves: elastic#140369**

## Summary

This PR is a follow up for the elastic#234571, where I am introducing telemetry
event with array of primitive string values.
In order to display these values in Kibana Lens, a runtime mapping needs
to be done in the `security-solution-ebt-kibana-server` data view.
Before that, it was done manually. I am introducing support for arrays,
so that manual intervention is not needed for them.

### Checklist

- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
(cherry picked from commit f0e38a3)

…s script (elastic#234905)

**Partially resolves: elastic#140369**

## Summary

This PR is a follow up for the elastic#234571, where I am introducing telemetry
event with array of primitive string values.
In order to display these values in Kibana Lens, a runtime mapping needs
to be done in the `security-solution-ebt-kibana-server` data view.
Before that, it was done manually. I am introducing support for arrays,
so that manual intervention is not needed for them.

### Checklist

- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
(cherry picked from commit f0e38a3)

…s script (elastic#234905)

**Partially resolves: elastic#140369**

## Summary

This PR is a follow up for the elastic#234571, where I am introducing telemetry
event with array of primitive string values.
In order to display these values in Kibana Lens, a runtime mapping needs
to be done in the `security-solution-ebt-kibana-server` data view.
Before that, it was done manually. I am introducing support for arrays,
so that manual intervention is not needed for them.

### Checklist

- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
(cherry picked from commit f0e38a3)

…s script (elastic#234905)

**Partially resolves: elastic#140369**

## Summary

This PR is a follow up for the elastic#234571, where I am introducing telemetry
event with array of primitive string values.
In order to display these values in Kibana Lens, a runtime mapping needs
to be done in the `security-solution-ebt-kibana-server` data view.
Before that, it was done manually. I am introducing support for arrays,
so that manual intervention is not needed for them.

### Checklist

- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
(cherry picked from commit f0e38a3)

…de API (elastic#234571)

**Partially resolves: elastic#140369**

## Summary

This is another PR from of a series of PRs I am planning to create to
cover the requirements in the elastic#140369 ticket.

The requirement covered in this ticket is req. elastic#6: "Events for
performing update (EBT backend)" and req. elastic#7 "Missing base versions".

I am adding sending telemetry events in handling of rule update request.
Each rule updated will send its own event with information about:
- ruleId
- ruleName
- if missing base version
- final result of the update
- updated fields (with breakdown per conflict type).

I tried to make the changes as little invasive as possible, and decided
to create a separate file, `update_rule_telemetry.ts`, where the logic
of building the events and sending them is encapsulated.

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [ ] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

(cherry picked from commit a2b7329)

# Conflicts:
#	x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts

…de API (elastic#234571)

**Partially resolves: elastic#140369**

## Summary

This is another PR from of a series of PRs I am planning to create to
cover the requirements in the elastic#140369 ticket.

The requirement covered in this ticket is req. elastic#6: "Events for
performing update (EBT backend)" and req. elastic#7 "Missing base versions".

I am adding sending telemetry events in handling of rule update request.
Each rule updated will send its own event with information about:
- ruleId
- ruleName
- if missing base version
- final result of the update
- updated fields (with breakdown per conflict type).

I tried to make the changes as little invasive as possible, and decided
to create a separate file, `update_rule_telemetry.ts`, where the logic
of building the events and sending them is encapsulated.

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [ ] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

(cherry picked from commit a2b7329)

# Conflicts:
#	x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts

…de API (elastic#234571)

**Partially resolves: elastic#140369**

## Summary

This is another PR from of a series of PRs I am planning to create to
cover the requirements in the elastic#140369 ticket.

The requirement covered in this ticket is req. elastic#6: "Events for
performing update (EBT backend)" and req. elastic#7 "Missing base versions".

I am adding sending telemetry events in handling of rule update request.
Each rule updated will send its own event with information about:
- ruleId
- ruleName
- if missing base version
- final result of the update
- updated fields (with breakdown per conflict type).

I tried to make the changes as little invasive as possible, and decided
to create a separate file, `update_rule_telemetry.ts`, where the logic
of building the events and sending them is encapsulated.

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [ ] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

(cherry picked from commit a2b7329)

# Conflicts:
#	x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts

…de API (elastic#234571)

**Partially resolves: elastic#140369**

## Summary

This is another PR from of a series of PRs I am planning to create to
cover the requirements in the elastic#140369 ticket.

The requirement covered in this ticket is req. elastic#6: "Events for
performing update (EBT backend)" and req. elastic#7 "Missing base versions".

I am adding sending telemetry events in handling of rule update request.
Each rule updated will send its own event with information about:
- ruleId
- ruleName
- if missing base version
- final result of the update
- updated fields (with breakdown per conflict type).

I tried to make the changes as little invasive as possible, and decided
to create a separate file, `update_rule_telemetry.ts`, where the logic
of building the events and sending them is encapsulated.

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [ ] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

(cherry picked from commit a2b7329)

# Conflicts:
#	x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/event_based/events.ts

…ta_views script (#234905) (#235312)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Security Solution] Add support for arrays in the
build_ebt_data_views script
(#234905)](#234905)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jacek
Kolezynski","email":"jacek.kolezynski@elastic.co"},"sourceCommit":{"committedDate":"2025-09-17T07:58:32Z","message":"[Security
Solution] Add support for arrays in the build_ebt_data_views script
(#234905)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis PR is
a follow up for the #234571, where I am introducing telemetry\nevent
with array of primitive string values.\nIn order to display these values
in Kibana Lens, a runtime mapping needs\nto be done in the
`security-solution-ebt-kibana-server` data view.\nBefore that, it was
done manually. I am introducing support for arrays,\nso that manual
intervention is not needed for them.\n\n\n### Checklist\n\n- [x] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n\n---------\n\nCo-authored-by:
Maxim Palenov
<maxim.palenov@elastic.co>","sha":"f0e38a357dfbfe535ca77438d7afabde9c9b9cf2","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.2.0","v8.18.8","v8.19.5","v9.0.8","v9.1.5"],"title":"[Security
Solution] Add support for arrays in the build_ebt_data_views
script","number":234905,"url":"https://github.com/elastic/kibana/pull/234905","mergeCommit":{"message":"[Security
Solution] Add support for arrays in the build_ebt_data_views script
(#234905)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis PR is
a follow up for the #234571, where I am introducing telemetry\nevent
with array of primitive string values.\nIn order to display these values
in Kibana Lens, a runtime mapping needs\nto be done in the
`security-solution-ebt-kibana-server` data view.\nBefore that, it was
done manually. I am introducing support for arrays,\nso that manual
intervention is not needed for them.\n\n\n### Checklist\n\n- [x] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n\n---------\n\nCo-authored-by:
Maxim Palenov
<maxim.palenov@elastic.co>","sha":"f0e38a357dfbfe535ca77438d7afabde9c9b9cf2"}},"sourceBranch":"main","suggestedTargetBranches":["8.18","8.19","9.0","9.1"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/234905","number":234905,"mergeCommit":{"message":"[Security
Solution] Add support for arrays in the build_ebt_data_views script
(#234905)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis PR is
a follow up for the #234571, where I am introducing telemetry\nevent
with array of primitive string values.\nIn order to display these values
in Kibana Lens, a runtime mapping needs\nto be done in the
`security-solution-ebt-kibana-server` data view.\nBefore that, it was
done manually. I am introducing support for arrays,\nso that manual
intervention is not needed for them.\n\n\n### Checklist\n\n- [x] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n\n---------\n\nCo-authored-by:
Maxim Palenov
<maxim.palenov@elastic.co>","sha":"f0e38a357dfbfe535ca77438d7afabde9c9b9cf2"}},{"branch":"8.18","label":"v8.18.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Jacek Kolezynski <jacek.kolezynski@elastic.co>
Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>

…a_views script (#234905) (#235314)

# Backport

This will backport the following commits from `main` to `9.1`:
- [[Security Solution] Add support for arrays in the
build_ebt_data_views script
(#234905)](#234905)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jacek
Kolezynski","email":"jacek.kolezynski@elastic.co"},"sourceCommit":{"committedDate":"2025-09-17T07:58:32Z","message":"[Security
Solution] Add support for arrays in the build_ebt_data_views script
(#234905)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis PR is
a follow up for the #234571, where I am introducing telemetry\nevent
with array of primitive string values.\nIn order to display these values
in Kibana Lens, a runtime mapping needs\nto be done in the
`security-solution-ebt-kibana-server` data view.\nBefore that, it was
done manually. I am introducing support for arrays,\nso that manual
intervention is not needed for them.\n\n\n### Checklist\n\n- [x] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n\n---------\n\nCo-authored-by:
Maxim Palenov
<maxim.palenov@elastic.co>","sha":"f0e38a357dfbfe535ca77438d7afabde9c9b9cf2","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.2.0","v8.18.8","v8.19.5","v9.0.8","v9.1.5"],"title":"[Security
Solution] Add support for arrays in the build_ebt_data_views
script","number":234905,"url":"https://github.com/elastic/kibana/pull/234905","mergeCommit":{"message":"[Security
Solution] Add support for arrays in the build_ebt_data_views script
(#234905)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis PR is
a follow up for the #234571, where I am introducing telemetry\nevent
with array of primitive string values.\nIn order to display these values
in Kibana Lens, a runtime mapping needs\nto be done in the
`security-solution-ebt-kibana-server` data view.\nBefore that, it was
done manually. I am introducing support for arrays,\nso that manual
intervention is not needed for them.\n\n\n### Checklist\n\n- [x] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n\n---------\n\nCo-authored-by:
Maxim Palenov
<maxim.palenov@elastic.co>","sha":"f0e38a357dfbfe535ca77438d7afabde9c9b9cf2"}},"sourceBranch":"main","suggestedTargetBranches":["8.18","8.19","9.0","9.1"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/234905","number":234905,"mergeCommit":{"message":"[Security
Solution] Add support for arrays in the build_ebt_data_views script
(#234905)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis PR is
a follow up for the #234571, where I am introducing telemetry\nevent
with array of primitive string values.\nIn order to display these values
in Kibana Lens, a runtime mapping needs\nto be done in the
`security-solution-ebt-kibana-server` data view.\nBefore that, it was
done manually. I am introducing support for arrays,\nso that manual
intervention is not needed for them.\n\n\n### Checklist\n\n- [x] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n\n---------\n\nCo-authored-by:
Maxim Palenov
<maxim.palenov@elastic.co>","sha":"f0e38a357dfbfe535ca77438d7afabde9c9b9cf2"}},{"branch":"8.18","label":"v8.18.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Jacek Kolezynski <jacek.kolezynski@elastic.co>
Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>

…a_views script (#234905) (#235313)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security Solution] Add support for arrays in the
build_ebt_data_views script
(#234905)](#234905)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jacek
Kolezynski","email":"jacek.kolezynski@elastic.co"},"sourceCommit":{"committedDate":"2025-09-17T07:58:32Z","message":"[Security
Solution] Add support for arrays in the build_ebt_data_views script
(#234905)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis PR is
a follow up for the #234571, where I am introducing telemetry\nevent
with array of primitive string values.\nIn order to display these values
in Kibana Lens, a runtime mapping needs\nto be done in the
`security-solution-ebt-kibana-server` data view.\nBefore that, it was
done manually. I am introducing support for arrays,\nso that manual
intervention is not needed for them.\n\n\n### Checklist\n\n- [x] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n\n---------\n\nCo-authored-by:
Maxim Palenov
<maxim.palenov@elastic.co>","sha":"f0e38a357dfbfe535ca77438d7afabde9c9b9cf2","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.2.0","v8.18.8","v8.19.5","v9.0.8","v9.1.5"],"title":"[Security
Solution] Add support for arrays in the build_ebt_data_views
script","number":234905,"url":"https://github.com/elastic/kibana/pull/234905","mergeCommit":{"message":"[Security
Solution] Add support for arrays in the build_ebt_data_views script
(#234905)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis PR is
a follow up for the #234571, where I am introducing telemetry\nevent
with array of primitive string values.\nIn order to display these values
in Kibana Lens, a runtime mapping needs\nto be done in the
`security-solution-ebt-kibana-server` data view.\nBefore that, it was
done manually. I am introducing support for arrays,\nso that manual
intervention is not needed for them.\n\n\n### Checklist\n\n- [x] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n\n---------\n\nCo-authored-by:
Maxim Palenov
<maxim.palenov@elastic.co>","sha":"f0e38a357dfbfe535ca77438d7afabde9c9b9cf2"}},"sourceBranch":"main","suggestedTargetBranches":["8.18","8.19","9.0","9.1"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/234905","number":234905,"mergeCommit":{"message":"[Security
Solution] Add support for arrays in the build_ebt_data_views script
(#234905)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis PR is
a follow up for the #234571, where I am introducing telemetry\nevent
with array of primitive string values.\nIn order to display these values
in Kibana Lens, a runtime mapping needs\nto be done in the
`security-solution-ebt-kibana-server` data view.\nBefore that, it was
done manually. I am introducing support for arrays,\nso that manual
intervention is not needed for them.\n\n\n### Checklist\n\n- [x] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n\n---------\n\nCo-authored-by:
Maxim Palenov
<maxim.palenov@elastic.co>","sha":"f0e38a357dfbfe535ca77438d7afabde9c9b9cf2"}},{"branch":"8.18","label":"v8.18.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Jacek Kolezynski <jacek.kolezynski@elastic.co>
Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>

…e upgrade API (#234571) (#235318)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Security Solution] Add event-based telemetry for prebuilt rule
upgrade API (#234571)](#234571)

<!--- Backport version: 10.0.2 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jacek
Kolezynski","email":"jacek.kolezynski@elastic.co"},"sourceCommit":{"committedDate":"2025-09-17T07:45:06Z","message":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade API
(#234571)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis is
another PR from of a series of PRs I am planning to create to\ncover the
requirements in the #140369 ticket.\n\nThe requirement covered in this
ticket is req. #6: \"Events for\nperforming update (EBT backend)\" and
req. #7 \"Missing base versions\".\n\nI am adding sending telemetry
events in handling of rule update request.\nEach rule updated will send
its own event with information about:\n- ruleId\n- ruleName\n- if
missing base version\n- final result of the update\n- updated fields
(with breakdown per conflict type). \n\nI tried to make the changes as
little invasive as possible, and decided\nto create a separate file,
`update_rule_telemetry.ts`, where the logic\nof building the events and
sending them is encapsulated.\n\n### Checklist\n\nCheck the PR satisfies
following conditions. \n\nReviewers should verify this PR satisfies this
list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"a2b7329e26fe9031d387138cf0f019aa4c53cd93","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.2.0","v8.18.8","v8.19.5","v9.0.8","v9.1.5"],"title":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade
API","number":234571,"url":"https://github.com/elastic/kibana/pull/234571","mergeCommit":{"message":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade API
(#234571)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis is
another PR from of a series of PRs I am planning to create to\ncover the
requirements in the #140369 ticket.\n\nThe requirement covered in this
ticket is req. #6: \"Events for\nperforming update (EBT backend)\" and
req. #7 \"Missing base versions\".\n\nI am adding sending telemetry
events in handling of rule update request.\nEach rule updated will send
its own event with information about:\n- ruleId\n- ruleName\n- if
missing base version\n- final result of the update\n- updated fields
(with breakdown per conflict type). \n\nI tried to make the changes as
little invasive as possible, and decided\nto create a separate file,
`update_rule_telemetry.ts`, where the logic\nof building the events and
sending them is encapsulated.\n\n### Checklist\n\nCheck the PR satisfies
following conditions. \n\nReviewers should verify this PR satisfies this
list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"a2b7329e26fe9031d387138cf0f019aa4c53cd93"}},"sourceBranch":"main","suggestedTargetBranches":["8.18","8.19","9.0","9.1"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/234571","number":234571,"mergeCommit":{"message":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade API
(#234571)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis is
another PR from of a series of PRs I am planning to create to\ncover the
requirements in the #140369 ticket.\n\nThe requirement covered in this
ticket is req. #6: \"Events for\nperforming update (EBT backend)\" and
req. #7 \"Missing base versions\".\n\nI am adding sending telemetry
events in handling of rule update request.\nEach rule updated will send
its own event with information about:\n- ruleId\n- ruleName\n- if
missing base version\n- final result of the update\n- updated fields
(with breakdown per conflict type). \n\nI tried to make the changes as
little invasive as possible, and decided\nto create a separate file,
`update_rule_telemetry.ts`, where the logic\nof building the events and
sending them is encapsulated.\n\n### Checklist\n\nCheck the PR satisfies
following conditions. \n\nReviewers should verify this PR satisfies this
list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"a2b7329e26fe9031d387138cf0f019aa4c53cd93"}},{"branch":"8.18","label":"v8.18.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

… upgrade API (#234571) (#235317)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security Solution] Add event-based telemetry for prebuilt rule
upgrade API (#234571)](#234571)

<!--- Backport version: 10.0.2 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jacek
Kolezynski","email":"jacek.kolezynski@elastic.co"},"sourceCommit":{"committedDate":"2025-09-17T07:45:06Z","message":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade API
(#234571)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis is
another PR from of a series of PRs I am planning to create to\ncover the
requirements in the #140369 ticket.\n\nThe requirement covered in this
ticket is req. #6: \"Events for\nperforming update (EBT backend)\" and
req. #7 \"Missing base versions\".\n\nI am adding sending telemetry
events in handling of rule update request.\nEach rule updated will send
its own event with information about:\n- ruleId\n- ruleName\n- if
missing base version\n- final result of the update\n- updated fields
(with breakdown per conflict type). \n\nI tried to make the changes as
little invasive as possible, and decided\nto create a separate file,
`update_rule_telemetry.ts`, where the logic\nof building the events and
sending them is encapsulated.\n\n### Checklist\n\nCheck the PR satisfies
following conditions. \n\nReviewers should verify this PR satisfies this
list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"a2b7329e26fe9031d387138cf0f019aa4c53cd93","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.2.0","v8.18.8","v8.19.5","v9.0.8","v9.1.5"],"title":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade
API","number":234571,"url":"https://github.com/elastic/kibana/pull/234571","mergeCommit":{"message":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade API
(#234571)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis is
another PR from of a series of PRs I am planning to create to\ncover the
requirements in the #140369 ticket.\n\nThe requirement covered in this
ticket is req. #6: \"Events for\nperforming update (EBT backend)\" and
req. #7 \"Missing base versions\".\n\nI am adding sending telemetry
events in handling of rule update request.\nEach rule updated will send
its own event with information about:\n- ruleId\n- ruleName\n- if
missing base version\n- final result of the update\n- updated fields
(with breakdown per conflict type). \n\nI tried to make the changes as
little invasive as possible, and decided\nto create a separate file,
`update_rule_telemetry.ts`, where the logic\nof building the events and
sending them is encapsulated.\n\n### Checklist\n\nCheck the PR satisfies
following conditions. \n\nReviewers should verify this PR satisfies this
list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"a2b7329e26fe9031d387138cf0f019aa4c53cd93"}},"sourceBranch":"main","suggestedTargetBranches":["8.18","8.19","9.0","9.1"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/234571","number":234571,"mergeCommit":{"message":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade API
(#234571)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis is
another PR from of a series of PRs I am planning to create to\ncover the
requirements in the #140369 ticket.\n\nThe requirement covered in this
ticket is req. #6: \"Events for\nperforming update (EBT backend)\" and
req. #7 \"Missing base versions\".\n\nI am adding sending telemetry
events in handling of rule update request.\nEach rule updated will send
its own event with information about:\n- ruleId\n- ruleName\n- if
missing base version\n- final result of the update\n- updated fields
(with breakdown per conflict type). \n\nI tried to make the changes as
little invasive as possible, and decided\nto create a separate file,
`update_rule_telemetry.ts`, where the logic\nof building the events and
sending them is encapsulated.\n\n### Checklist\n\nCheck the PR satisfies
following conditions. \n\nReviewers should verify this PR satisfies this
list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"a2b7329e26fe9031d387138cf0f019aa4c53cd93"}},{"branch":"8.18","label":"v8.18.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

… upgrade API (#234571) (#235315)

# Backport

This will backport the following commits from `main` to `9.1`:
- [[Security Solution] Add event-based telemetry for prebuilt rule
upgrade API (#234571)](#234571)

<!--- Backport version: 10.0.2 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jacek
Kolezynski","email":"jacek.kolezynski@elastic.co"},"sourceCommit":{"committedDate":"2025-09-17T07:45:06Z","message":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade API
(#234571)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis is
another PR from of a series of PRs I am planning to create to\ncover the
requirements in the #140369 ticket.\n\nThe requirement covered in this
ticket is req. #6: \"Events for\nperforming update (EBT backend)\" and
req. #7 \"Missing base versions\".\n\nI am adding sending telemetry
events in handling of rule update request.\nEach rule updated will send
its own event with information about:\n- ruleId\n- ruleName\n- if
missing base version\n- final result of the update\n- updated fields
(with breakdown per conflict type). \n\nI tried to make the changes as
little invasive as possible, and decided\nto create a separate file,
`update_rule_telemetry.ts`, where the logic\nof building the events and
sending them is encapsulated.\n\n### Checklist\n\nCheck the PR satisfies
following conditions. \n\nReviewers should verify this PR satisfies this
list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"a2b7329e26fe9031d387138cf0f019aa4c53cd93","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.2.0","v8.18.8","v8.19.5","v9.0.8","v9.1.5"],"title":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade
API","number":234571,"url":"https://github.com/elastic/kibana/pull/234571","mergeCommit":{"message":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade API
(#234571)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis is
another PR from of a series of PRs I am planning to create to\ncover the
requirements in the #140369 ticket.\n\nThe requirement covered in this
ticket is req. #6: \"Events for\nperforming update (EBT backend)\" and
req. #7 \"Missing base versions\".\n\nI am adding sending telemetry
events in handling of rule update request.\nEach rule updated will send
its own event with information about:\n- ruleId\n- ruleName\n- if
missing base version\n- final result of the update\n- updated fields
(with breakdown per conflict type). \n\nI tried to make the changes as
little invasive as possible, and decided\nto create a separate file,
`update_rule_telemetry.ts`, where the logic\nof building the events and
sending them is encapsulated.\n\n### Checklist\n\nCheck the PR satisfies
following conditions. \n\nReviewers should verify this PR satisfies this
list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"a2b7329e26fe9031d387138cf0f019aa4c53cd93"}},"sourceBranch":"main","suggestedTargetBranches":["8.18","8.19","9.0","9.1"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/234571","number":234571,"mergeCommit":{"message":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade API
(#234571)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis is
another PR from of a series of PRs I am planning to create to\ncover the
requirements in the #140369 ticket.\n\nThe requirement covered in this
ticket is req. #6: \"Events for\nperforming update (EBT backend)\" and
req. #7 \"Missing base versions\".\n\nI am adding sending telemetry
events in handling of rule update request.\nEach rule updated will send
its own event with information about:\n- ruleId\n- ruleName\n- if
missing base version\n- final result of the update\n- updated fields
(with breakdown per conflict type). \n\nI tried to make the changes as
little invasive as possible, and decided\nto create a separate file,
`update_rule_telemetry.ts`, where the logic\nof building the events and
sending them is encapsulated.\n\n### Checklist\n\nCheck the PR satisfies
following conditions. \n\nReviewers should verify this PR satisfies this
list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"a2b7329e26fe9031d387138cf0f019aa4c53cd93"}},{"branch":"8.18","label":"v8.18.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

…ta_views script (#234905) (#235311)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Add support for arrays in the
build_ebt_data_views script
(#234905)](#234905)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jacek
Kolezynski","email":"jacek.kolezynski@elastic.co"},"sourceCommit":{"committedDate":"2025-09-17T07:58:32Z","message":"[Security
Solution] Add support for arrays in the build_ebt_data_views script
(#234905)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis PR is
a follow up for the #234571, where I am introducing telemetry\nevent
with array of primitive string values.\nIn order to display these values
in Kibana Lens, a runtime mapping needs\nto be done in the
`security-solution-ebt-kibana-server` data view.\nBefore that, it was
done manually. I am introducing support for arrays,\nso that manual
intervention is not needed for them.\n\n\n### Checklist\n\n- [x] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n\n---------\n\nCo-authored-by:
Maxim Palenov
<maxim.palenov@elastic.co>","sha":"f0e38a357dfbfe535ca77438d7afabde9c9b9cf2","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.2.0","v8.18.8","v8.19.5","v9.0.8","v9.1.5"],"title":"[Security
Solution] Add support for arrays in the build_ebt_data_views
script","number":234905,"url":"https://github.com/elastic/kibana/pull/234905","mergeCommit":{"message":"[Security
Solution] Add support for arrays in the build_ebt_data_views script
(#234905)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis PR is
a follow up for the #234571, where I am introducing telemetry\nevent
with array of primitive string values.\nIn order to display these values
in Kibana Lens, a runtime mapping needs\nto be done in the
`security-solution-ebt-kibana-server` data view.\nBefore that, it was
done manually. I am introducing support for arrays,\nso that manual
intervention is not needed for them.\n\n\n### Checklist\n\n- [x] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n\n---------\n\nCo-authored-by:
Maxim Palenov
<maxim.palenov@elastic.co>","sha":"f0e38a357dfbfe535ca77438d7afabde9c9b9cf2"}},"sourceBranch":"main","suggestedTargetBranches":["8.18","8.19","9.0","9.1"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/234905","number":234905,"mergeCommit":{"message":"[Security
Solution] Add support for arrays in the build_ebt_data_views script
(#234905)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis PR is
a follow up for the #234571, where I am introducing telemetry\nevent
with array of primitive string values.\nIn order to display these values
in Kibana Lens, a runtime mapping needs\nto be done in the
`security-solution-ebt-kibana-server` data view.\nBefore that, it was
done manually. I am introducing support for arrays,\nso that manual
intervention is not needed for them.\n\n\n### Checklist\n\n- [x] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n\n---------\n\nCo-authored-by:
Maxim Palenov
<maxim.palenov@elastic.co>","sha":"f0e38a357dfbfe535ca77438d7afabde9c9b9cf2"}},{"branch":"8.18","label":"v8.18.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Jacek Kolezynski <jacek.kolezynski@elastic.co>
Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>

…e upgrade API (#234571) (#235319)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Add event-based telemetry for prebuilt rule
upgrade API (#234571)](#234571)

<!--- Backport version: 10.0.2 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jacek
Kolezynski","email":"jacek.kolezynski@elastic.co"},"sourceCommit":{"committedDate":"2025-09-17T07:45:06Z","message":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade API
(#234571)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis is
another PR from of a series of PRs I am planning to create to\ncover the
requirements in the #140369 ticket.\n\nThe requirement covered in this
ticket is req. #6: \"Events for\nperforming update (EBT backend)\" and
req. #7 \"Missing base versions\".\n\nI am adding sending telemetry
events in handling of rule update request.\nEach rule updated will send
its own event with information about:\n- ruleId\n- ruleName\n- if
missing base version\n- final result of the update\n- updated fields
(with breakdown per conflict type). \n\nI tried to make the changes as
little invasive as possible, and decided\nto create a separate file,
`update_rule_telemetry.ts`, where the logic\nof building the events and
sending them is encapsulated.\n\n### Checklist\n\nCheck the PR satisfies
following conditions. \n\nReviewers should verify this PR satisfies this
list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"a2b7329e26fe9031d387138cf0f019aa4c53cd93","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.2.0","v8.18.8","v8.19.5","v9.0.8","v9.1.5"],"title":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade
API","number":234571,"url":"https://github.com/elastic/kibana/pull/234571","mergeCommit":{"message":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade API
(#234571)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis is
another PR from of a series of PRs I am planning to create to\ncover the
requirements in the #140369 ticket.\n\nThe requirement covered in this
ticket is req. #6: \"Events for\nperforming update (EBT backend)\" and
req. #7 \"Missing base versions\".\n\nI am adding sending telemetry
events in handling of rule update request.\nEach rule updated will send
its own event with information about:\n- ruleId\n- ruleName\n- if
missing base version\n- final result of the update\n- updated fields
(with breakdown per conflict type). \n\nI tried to make the changes as
little invasive as possible, and decided\nto create a separate file,
`update_rule_telemetry.ts`, where the logic\nof building the events and
sending them is encapsulated.\n\n### Checklist\n\nCheck the PR satisfies
following conditions. \n\nReviewers should verify this PR satisfies this
list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"a2b7329e26fe9031d387138cf0f019aa4c53cd93"}},"sourceBranch":"main","suggestedTargetBranches":["8.18","8.19","9.0","9.1"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/234571","number":234571,"mergeCommit":{"message":"[Security
Solution] Add event-based telemetry for prebuilt rule upgrade API
(#234571)\n\n**Partially resolves: #140369**\n\n## Summary\n\nThis is
another PR from of a series of PRs I am planning to create to\ncover the
requirements in the #140369 ticket.\n\nThe requirement covered in this
ticket is req. #6: \"Events for\nperforming update (EBT backend)\" and
req. #7 \"Missing base versions\".\n\nI am adding sending telemetry
events in handling of rule update request.\nEach rule updated will send
its own event with information about:\n- ruleId\n- ruleName\n- if
missing base version\n- final result of the update\n- updated fields
(with breakdown per conflict type). \n\nI tried to make the changes as
little invasive as possible, and decided\nto create a separate file,
`update_rule_telemetry.ts`, where the logic\nof building the events and
sending them is encapsulated.\n\n### Checklist\n\nCheck the PR satisfies
following conditions. \n\nReviewers should verify this PR satisfies this
list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"a2b7329e26fe9031d387138cf0f019aa4c53cd93"}},{"branch":"8.18","label":"v8.18.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->