[Security Solution] Warning is shown for updated Prebuilt rule with filter containing "AND" or "OR" condition

[jkelas]

Follow-up to: #178908

Summary

When updating a Prebuilt rule which has a filter with AND or OR condition, in the Rule Update Flyout there is a Warning displayed in the "Custom query" field.

Steps to reproduce

0. Launch a clean Kibana + ES environment.
1. Create some valid indices with source events. Locally, one easy way to do this would be using the resolver_generator script that generates fake endpoint events (events generated by Endpoint Security aka Elastic Defend): node x-pack/plugins/security_solution/scripts/endpoint/resolver_generator.js --node http://elastic:changeme@127.0.0.1:9200 --kibana http://elastic:changeme@0.0.0.0:5601/kbn --numHosts=5 --numDocs=2.
2. Install at least one predefined rule, e.g. "Malware - Detected - Elastic Endgame".
3. Using Kibana API create an earlier version of the rule, adding a filter containing "AND" condition (see the curl command below).
4. A new tab "Rules Updates" will appear in the Rules page. Click it.
5. Click the updated rule.
6. Expand the "KQL query" tab. In the "Filters" there should be no issue with the Warning.
7. Click "Edit" button. The filters displayed in the "Custom query" field will display a Warning. See the screenshot and recording below.

Expected behavior: There should be no Warning flashing in the "Custom query" field.

Screenshots

Screen.Recording.2024-12-10.at.13.58.34.mov

More details

Curl command to trigger rule update:

curl --location --request PATCH 'http://localhost:5601/kbn/api/detection_engine/rules' \
--header 'kbn-xsrf: 123' \
--header 'Content-Type: application/json' \
--header 'elastic-api-version: 2023-10-31' \
--header 'Authorization: Basic ZWxhc3RpYzpjaGFuZ2VtZQ==' \
--data '{
    "rule_id": "0a97b20f-4144-49ea-be32-b540ecc445de",
    "version": 102,
    "tags": [
        "test"
    ],
    "filters": [
        {
            "$state": {
                "store": "appState"
            },
            "meta": {
                "type": "combined",
                "relation": "AND",
                "params": [
                    {
                        "query": {
                            "match_phrase": {
                                "host.name": "Host-1rt0y8ynu8"
                            }
                        },
                        "meta": {
                            "negate": false,
                            "index": "logs-*",
                            "key": "host.name",
                            "field": "host.name",
                            "params": {
                                "query": "Host-1rt0y8ynu8"
                            },
                            "type": "phrase",
                            "disabled": false,
                            "alias": null
                        }
                    },
                    {
                        "meta": {
                            "negate": false,
                            "index": "logs-*",
                            "key": "host.os.family",
                            "field": "host.os.family",
                            "params": {
                                "query": "windows"
                            },
                            "type": "phrase",
                            "disabled": false,
                            "alias": null
                        },
                        "query": {
                            "match_phrase": {
                                "host.os.family": "windows"
                            }
                        }
                    }
                ],
                "index": "logs-*",
                "disabled": false,
                "negate": false,
                "alias": null
            },
            "query": {}
        }
    ]
}'

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)