[Bug] Threshold Rule Importing Failures

[eric-forte-elastic]

Issues

#3547

Summary

This PR addresses an issue where threshold rules would not import correctly as the rule prompt would ask for information that was present in the rule file instead of using what was supplied. See the original issue for the steps to reproduce the error. The fix is to remove a hardcoding loading for specifically threshold rules to load them in this way. I expect that this was done due to a historic Kibana issue that is not longer necessary.

Note: If you import a rule and then run unit tests they will fail as we have some additional tags and fields that we enforce on our rules that should not be enforced on customers. In testing this, we also found a minor flaw in one of our unit tests (test_event_override) that is also fixed here. Previously the unit test would fail on the first instance of a test violation and not produce a list of all of the rules violating the test. This fix addresses that.

Testing

1. Export a threshold rule from Kibana
   Example: rules_export_threashold.ndjson.txt

2. Use the importer `python -m detection_rules import-rules <file.ndjson>

3. See that the importer no longer tries to prompt for threshold fields even though they exist in the ndjson

[Mikaayenson]

With the issue to do larger refactors later, I think this makes sense.

[Mikaayenson]

Good catch.

[shashank-elastic]

🟢 Testing Looks Good.

Ran Import Rule of the test file.
threshold fields were not prompted by the importer

python -m detection_rules import-rules ~/Downloads/rules_export_threashold.ndjson 

█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄   ▄      █▀▀▄ ▄  ▄ ▄   ▄▄▄ ▄▄▄
█  █ █▄▄  █  █▄▄ █    █   █  █ █ █▀▄ █      █▄▄▀ █  █ █   █▄▄ █▄▄
█▄▄▀ █▄▄  █  █▄▄ █▄▄  █  ▄█▄ █▄█ █ ▀▄█      █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█

[+] Building rule for /Users/shashankks/elastic_workspace/detection-rules/rules/test_threshold.toml
actions (multi, comma separated): 
alert_suppression: 
author (required)  (multi, comma separated): Elastic
building_block_type: 
data_view_id: 
exceptions_list (multi, comma separated): 
false_positives (multi, comma separated): 
filters (multi, comma separated): 
license: 
note: 
references (multi, comma separated): 
related_integrations (multi, comma separated): 
required_fields (multi, comma separated): 
risk_score_mapping (multi, comma separated): 
rule_name_override: 
setup: 
severity_mapping (multi, comma separated): 
tags (multi, comma separated): 
add mitre tactic? [y/N]: 
throttle: 
timeline_id: 
timeline_title: 
timestamp_override: 
(.venv) 

File creation