Epic: elastic/kibana#174168
Related to: #5061
PR: elastic/kibana#210817

Summary

Description

We are introducing the ability for users to customize prebuilt Elastic rules and adjusting the rule upgrade workflow to adapt to that change. This includes ability to:

• edit and customize prebuilt rules (modify almost all rule parameters, besides rule actions);
• export and import prebuilt rules, including customized ones;
• upgrade prebuilt rules while keeping the user customizations whenever possible.

More information in the main docs ticket: #5061.

Related links / assets

• Figma design
• Github epic

Collaborators

• PM: @approksiu
• Designer: @ARWNightingale
• Engineers: @banderror @xcrzx @maximpn @nikitaindik @dplumlee

Please reach out via the team channel.

UI copies

Prebuilt rule customization workflow

• Tooltips for the Author and License fields. Displayed on the Rule Editing page.

• "Modified Elastic rule" badge. Displayed on the Rule Details page, Rule Management page - Installed Rules table, and Rule Management page - Rule Updates table.

• "Modifications" filter. Displayed on the Rule Management page - Rule Updates table.

Prebuilt rule upgrade workflow - Rule Updates table

• Tooltips about rules having conflicts.

• Modal about rules having conflicts.

Prebuilt rule upgrade workflow - Rule Upgrade flyout

• Flyout header and footer.

• Updates tab: title and status bar.

• Updates tab: overall update status callouts.

• Rule field view: update status indicators.

Field has an update from Elastic, but it hasn't been customized by the user:

Field has been customized by the user, but there's no update from Elastic:

Field has been customized by the user AND it has an update from Elastic. The app was able to auto-merge these changes and suggest a final field value to upgrade to. This represents a potential conflict. The user has to review the conflict between their changes and the update from Elastic, review the "final update" value and either accept the suggested value or edit it before accepting:

Field has been customized by the user AND it has an update from Elastic. The app was NOT able to auto-merge these changes and suggest a final field value to upgrade to. This represents a conflict. The user has to review the conflict between their changes and the update from Elastic, edit the field value and resolve the conflict manually:

Conflict has been resolved by the user:

"Modified" badge and its tooltips:

• Rule field view: diff view and diff selector.

@pborgonovi had a concern about explanation wording for "My changes" in this tooltip. Please take a look and feel free to suggest an improvement.

• Rule field view: final update view, readonly mode.

• Rule field view: final update view, editing mode.

• Edge case: rule type change.

If it's a stock, non-customized prebuilt rule:

If it's a customized prebuilt rule:

Licensing restrictions

TBD. Details will be added by @xcrzx.