Skip to content

[Security Solution] Make importing prebuilt rules with missing base version tests matching the test scenario #234735

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Sep 15, 2025
Merged

[Security Solution] Make importing prebuilt rules with missing base version tests matching the test scenario #234735

merged 3 commits into from
Sep 15, 2025

Conversation

maximpn
Copy link
Contributor

@maximpn maximpn commented Sep 11, 2025 •
edited by kibanamachine
Loading

Relates to: #223421

Summary

This PR makes little adjustments to Importing Prebuilt Rules with missing base version test scenario implementation to make it matching test scenario steps. In particular it makes sure an installed prebuilt rule gets customized before testing import.

@maximpn maximpn self-assigned this Sep 11, 2025
@maximpn maximpn added test release_note:skip Skip the PR/issue when compiling release notes Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area backport:version Backport to applied version labels v9.2.0 v9.1.3 v8.19.3 v9.0.6 v8.18.7 labels Sep 11, 2025
@maximpn maximpn marked this pull request as ready for review September 11, 2025 10:12
@maximpn maximpn requested a review from a team as a code owner September 11, 2025 10:12
@maximpn maximpn requested a review from jkelas September 11, 2025 10:12
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

jkelas
jkelas reviewed Sep 11, 2025
View reviewed changes
...y_solution/docs/testing/test_plans/detection_response/prebuilt_rules/prebuilt_rule_import.md
- [**Scenario: Importing a prebuilt rule with a missing base version when it's already installed but not equal to the import payload**](#scenario-importing-a-prebuilt-rule-with-a-missing-base-version-when-its-already-installed-but-not-equal-to-the-import-payload)
- [**Scenario: Importing a prebuilt rule with a missing base version when it's already installed and not customized but not equal to the import payload**](#scenario-importing-a-prebuilt-rule-with-a-missing-base-version-when-its-already-installed-and-not-customized-but-not-equal-to-the-import-payload)
- [**Scenario: Importing a prebuilt rule with a missing base version when it's already installed, is not customized, and is equal to the import payload**](#scenario-importing-a-prebuilt-rule-with-a-missing-base-version-when-its-already-installed-is-not-customized-and-is-equal-to-the-import-payload)
- [**Scenario: Importing a prebuilt rule with a missing base version when it's already installed, is customized, and is equal to the import payload**](#scenario-importing-a-prebuilt-rule-with-a-missing-base-version-when-its-already-installed-is-customized-and-is-equal-to-the-import-payload)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a question: Shouldn't we have additional case, for:

Importing a prebuilt rule with a missing base version when it's already installed, is customized, and is NOT equal to the import payload**

Now we have a test in which we check that if a rule was customized, the flag is_customized remains true even after importing a rule with the same payload. But shouldn't we also check that the same applies when payload is different? I believe the flag is_customized should still be true in that case.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, ideally we need it for full coverage. I've updated the test plan and added this test scenario implementation.

@maximpn maximpn force-pushed the fix-importing-prebuilt-rules-with-missing-base-version branch from 5683e1e to 8f643e2 Compare September 12, 2025 08:22
@maximpn maximpn requested a review from jkelas September 12, 2025 08:22
jkelas
jkelas approved these changes Sep 12, 2025
View reviewed changes
Copy link

@jkelas jkelas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @maximpn
Thank you for addressing my comment.
The changes LGTM. Approving.

@maximpn maximpn enabled auto-merge (squash) September 15, 2025 09:36
@maximpn maximpn merged commit 10533eb into elastic:main Sep 15, 2025
12 checks passed
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.18, 8.19, 9.0, 9.1

https://github.com/elastic/kibana/actions/runs/17740144506

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

Saved Objects .kibana field count

Every field in each saved object type adds overhead to Elasticsearch. Kibana needs to keep the total field count below Elasticsearch's default limit of 1000 fields. Only specify field mappings for the fields you wish to search on or query. See https://www.elastic.co/guide/en/kibana/master/saved-objects-service.html#_mappings

id before after diff
_data_stream_timestamp 1 - -1
_doc_count 1 - -1
_ignored_source 1 - -1
_index_mode 1 - -1
_inference_fields 1 - -1
_tier 1 - -1
apm-custom-dashboards 5 - -5
apm-server-schema 2 - -2
apm-service-group 5 - -5
application_usage_daily 2 - -2
config 2 - -2
config-global 2 - -2
coreMigrationVersion 1 - -1
created_at 1 - -1
created_by 1 - -1
entity-definition 9 - -9
entity-discovery-api-key 2 - -2
event_loop_delays_daily 2 - -2
favorites 4 - -4
file 11 - -11
file-upload-usage-collection-telemetry 3 - -3
fileShare 5 - -5
infra-custom-dashboards 4 - -4
infrastructure-monitoring-log-view 2 - -2
intercept_trigger_record 5 - -5
legacy-url-alias 7 - -7
managed 1 - -1
ml-job 6 - -6
ml-module 13 - -13
ml-trained-model 7 - -7
monitoring-telemetry 2 - -2
namespace 1 - -1
namespaces 1 - -1
observability-onboarding-state 2 - -2
originId 1 - -1
product-doc-install-status 7 - -7
references 4 - -4
sample-data-telemetry 3 - -3
security-ai-prompt 8 - -8
slo 11 - -11
space 5 - -5
synthetics-monitor 34 - -34
synthetics-monitor-multi-space 34 - -34
tag 4 - -4
type 1 - -1
typeMigrationVersion 1 - -1
ui-metric 2 - -2
updated_at 1 - -1
updated_by 1 - -1
upgrade-assistant-ml-upgrade-operation 3 - -3
upgrade-assistant-reindex-operation 3 - -3
uptime-synthetics-api-key 2 - -2
url 5 - -5
usage-counters 2 - -2
total -246

History

cc @maximpn

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Sep 15, 2025
@maximpn
[Security Solution] Make importing prebuilt rules with missing base v…
354c700 
…ersion tests matching the test scenario (elastic#234735)

**Relates to:** elastic#223421

## Summary

This PR makes little adjustments to [Importing Prebuilt
Rules](elastic#223421) with missing base
version test scenario implementation to make it matching test scenario
steps. In particular it makes sure an installed prebuilt rule gets
customized before testing import.

(cherry picked from commit 10533eb)
@kibanamachine kibanamachine mentioned this pull request Sep 15, 2025
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Sep 15, 2025
@maximpn
[Security Solution] Make importing prebuilt rules with missing base v…
26be003 
…ersion tests matching the test scenario (elastic#234735)

**Relates to:** elastic#223421

## Summary

This PR makes little adjustments to [Importing Prebuilt
Rules](elastic#223421) with missing base
version test scenario implementation to make it matching test scenario
steps. In particular it makes sure an installed prebuilt rule gets
customized before testing import.

(cherry picked from commit 10533eb)
@kibanamachine kibanamachine mentioned this pull request Sep 15, 2025
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Sep 15, 2025
@maximpn
[Security Solution] Make importing prebuilt rules with missing base v…
b140cdb 
…ersion tests matching the test scenario (elastic#234735)

**Relates to:** elastic#223421

## Summary

This PR makes little adjustments to [Importing Prebuilt
Rules](elastic#223421) with missing base
version test scenario implementation to make it matching test scenario
steps. In particular it makes sure an installed prebuilt rule gets
customized before testing import.

(cherry picked from commit 10533eb)
@kibanamachine kibanamachine mentioned this pull request Sep 15, 2025
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Sep 15, 2025
@maximpn
[Security Solution] Make importing prebuilt rules with missing base v…
a184453 
…ersion tests matching the test scenario (elastic#234735)

**Relates to:** elastic#223421

## Summary

This PR makes little adjustments to [Importing Prebuilt
Rules](elastic#223421) with missing base
version test scenario implementation to make it matching test scenario
steps. In particular it makes sure an installed prebuilt rule gets
customized before testing import.

(cherry picked from commit 10533eb)
@kibanamachine kibanamachine mentioned this pull request Sep 15, 2025
Merged
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
✅ 8.18
✅ 8.19
✅ 9.0
✅ 9.1

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Sep 15, 2025
@kibanamachine @maximpn
[9.1] [Security Solution] Make importing prebuilt rules with missing …
6f8e39d 
…base version tests matching the test scenario (#234735) (#235114)

# Backport

This will backport the following commits from `main` to `9.1`:
- [[Security Solution] Make importing prebuilt rules with missing base
version tests matching the test scenario
(#234735)](#234735)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-09-15T16:36:35Z","message":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test scenario (#234735)\n\n**Relates to:**
https://github.com/elastic/kibana/pull/223421\n\n## Summary\n\nThis PR
makes little adjustments to [Importing
Prebuilt\nRules](#223421) with
missing base\nversion test scenario implementation to make it matching
test scenario\nsteps. In particular it makes sure an installed prebuilt
rule gets\ncustomized before testing
import.","sha":"10533ebfa440c6ac91166cc1d6d33b72d7102dc9","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["test","release_note:skip","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.2.0","v9.1.3","v8.19.3","v9.0.6","v8.18.7"],"title":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test
scenario","number":234735,"url":"https://github.com/elastic/kibana/pull/234735","mergeCommit":{"message":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test scenario (#234735)\n\n**Relates to:**
https://github.com/elastic/kibana/pull/223421\n\n## Summary\n\nThis PR
makes little adjustments to [Importing
Prebuilt\nRules](#223421) with
missing base\nversion test scenario implementation to make it matching
test scenario\nsteps. In particular it makes sure an installed prebuilt
rule gets\ncustomized before testing
import.","sha":"10533ebfa440c6ac91166cc1d6d33b72d7102dc9"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19","9.0","8.18"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/234735","number":234735,"mergeCommit":{"message":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test scenario (#234735)\n\n**Relates to:**
https://github.com/elastic/kibana/pull/223421\n\n## Summary\n\nThis PR
makes little adjustments to [Importing
Prebuilt\nRules](#223421) with
missing base\nversion test scenario implementation to make it matching
test scenario\nsteps. In particular it makes sure an installed prebuilt
rule gets\ncustomized before testing
import.","sha":"10533ebfa440c6ac91166cc1d6d33b72d7102dc9"}},{"branch":"9.1","label":"v9.1.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.6","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.7","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
kibanamachine added a commit that referenced this pull request Sep 15, 2025
@kibanamachine @maximpn
[8.19] [Security Solution] Make importing prebuilt rules with missing…
f603a32 
… base version tests matching the test scenario (#234735) (#235112)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Security Solution] Make importing prebuilt rules with missing base
version tests matching the test scenario
(#234735)](#234735)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-09-15T16:36:35Z","message":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test scenario (#234735)\n\n**Relates to:**
https://github.com/elastic/kibana/pull/223421\n\n## Summary\n\nThis PR
makes little adjustments to [Importing
Prebuilt\nRules](#223421) with
missing base\nversion test scenario implementation to make it matching
test scenario\nsteps. In particular it makes sure an installed prebuilt
rule gets\ncustomized before testing
import.","sha":"10533ebfa440c6ac91166cc1d6d33b72d7102dc9","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["test","release_note:skip","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.2.0","v9.1.3","v8.19.3","v9.0.6","v8.18.7"],"title":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test
scenario","number":234735,"url":"https://github.com/elastic/kibana/pull/234735","mergeCommit":{"message":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test scenario (#234735)\n\n**Relates to:**
https://github.com/elastic/kibana/pull/223421\n\n## Summary\n\nThis PR
makes little adjustments to [Importing
Prebuilt\nRules](#223421) with
missing base\nversion test scenario implementation to make it matching
test scenario\nsteps. In particular it makes sure an installed prebuilt
rule gets\ncustomized before testing
import.","sha":"10533ebfa440c6ac91166cc1d6d33b72d7102dc9"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19","9.0","8.18"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/234735","number":234735,"mergeCommit":{"message":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test scenario (#234735)\n\n**Relates to:**
https://github.com/elastic/kibana/pull/223421\n\n## Summary\n\nThis PR
makes little adjustments to [Importing
Prebuilt\nRules](#223421) with
missing base\nversion test scenario implementation to make it matching
test scenario\nsteps. In particular it makes sure an installed prebuilt
rule gets\ncustomized before testing
import.","sha":"10533ebfa440c6ac91166cc1d6d33b72d7102dc9"}},{"branch":"9.1","label":"v9.1.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.6","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.7","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
kibanamachine added a commit that referenced this pull request Sep 15, 2025
@kibanamachine @maximpn
[9.0] [Security Solution] Make importing prebuilt rules with missing …
7e643b0 
…base version tests matching the test scenario (#234735) (#235113)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security Solution] Make importing prebuilt rules with missing base
version tests matching the test scenario
(#234735)](#234735)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-09-15T16:36:35Z","message":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test scenario (#234735)\n\n**Relates to:**
https://github.com/elastic/kibana/pull/223421\n\n## Summary\n\nThis PR
makes little adjustments to [Importing
Prebuilt\nRules](#223421) with
missing base\nversion test scenario implementation to make it matching
test scenario\nsteps. In particular it makes sure an installed prebuilt
rule gets\ncustomized before testing
import.","sha":"10533ebfa440c6ac91166cc1d6d33b72d7102dc9","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["test","release_note:skip","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.2.0","v9.1.3","v8.19.3","v9.0.6","v8.18.7"],"title":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test
scenario","number":234735,"url":"https://github.com/elastic/kibana/pull/234735","mergeCommit":{"message":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test scenario (#234735)\n\n**Relates to:**
https://github.com/elastic/kibana/pull/223421\n\n## Summary\n\nThis PR
makes little adjustments to [Importing
Prebuilt\nRules](#223421) with
missing base\nversion test scenario implementation to make it matching
test scenario\nsteps. In particular it makes sure an installed prebuilt
rule gets\ncustomized before testing
import.","sha":"10533ebfa440c6ac91166cc1d6d33b72d7102dc9"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19","9.0","8.18"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/234735","number":234735,"mergeCommit":{"message":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test scenario (#234735)\n\n**Relates to:**
https://github.com/elastic/kibana/pull/223421\n\n## Summary\n\nThis PR
makes little adjustments to [Importing
Prebuilt\nRules](#223421) with
missing base\nversion test scenario implementation to make it matching
test scenario\nsteps. In particular it makes sure an installed prebuilt
rule gets\ncustomized before testing
import.","sha":"10533ebfa440c6ac91166cc1d6d33b72d7102dc9"}},{"branch":"9.1","label":"v9.1.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.6","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.7","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
banderror pushed a commit to kibanamachine/kibana that referenced this pull request Sep 16, 2025
@maximpn @banderror
[Security Solution] Make importing prebuilt rules with missing base v…
0d4069d 
…ersion tests matching the test scenario (elastic#234735)

**Relates to:** elastic#223421

## Summary

This PR makes little adjustments to [Importing Prebuilt
Rules](elastic#223421) with missing base
version test scenario implementation to make it matching test scenario
steps. In particular it makes sure an installed prebuilt rule gets
customized before testing import.

(cherry picked from commit 10533eb)
kibanamachine added a commit that referenced this pull request Sep 16, 2025
@kibanamachine @maximpn
[8.18] [Security Solution] Make importing prebuilt rules with missing…
5fbbcb3 
… base version tests matching the test scenario (#234735) (#235111)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Make importing prebuilt rules with missing base
version tests matching the test scenario
(#234735)](#234735)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-09-15T16:36:35Z","message":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test scenario (#234735)\n\n**Relates to:**
https://github.com/elastic/kibana/pull/223421\n\n## Summary\n\nThis PR
makes little adjustments to [Importing
Prebuilt\nRules](#223421) with
missing base\nversion test scenario implementation to make it matching
test scenario\nsteps. In particular it makes sure an installed prebuilt
rule gets\ncustomized before testing
import.","sha":"10533ebfa440c6ac91166cc1d6d33b72d7102dc9","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["test","release_note:skip","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.2.0","v9.1.3","v8.19.3","v9.0.6","v8.18.7"],"title":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test
scenario","number":234735,"url":"https://github.com/elastic/kibana/pull/234735","mergeCommit":{"message":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test scenario (#234735)\n\n**Relates to:**
https://github.com/elastic/kibana/pull/223421\n\n## Summary\n\nThis PR
makes little adjustments to [Importing
Prebuilt\nRules](#223421) with
missing base\nversion test scenario implementation to make it matching
test scenario\nsteps. In particular it makes sure an installed prebuilt
rule gets\ncustomized before testing
import.","sha":"10533ebfa440c6ac91166cc1d6d33b72d7102dc9"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19","9.0","8.18"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/234735","number":234735,"mergeCommit":{"message":"[Security
Solution] Make importing prebuilt rules with missing base version tests
matching the test scenario (#234735)\n\n**Relates to:**
https://github.com/elastic/kibana/pull/223421\n\n## Summary\n\nThis PR
makes little adjustments to [Importing
Prebuilt\nRules](#223421) with
missing base\nversion test scenario implementation to make it matching
test scenario\nsteps. In particular it makes sure an installed prebuilt
rule gets\ncustomized before testing
import.","sha":"10533ebfa440c6ac91166cc1d6d33b72d7102dc9"}},{"branch":"9.1","label":"v9.1.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.6","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.7","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Sep 24, 2025
@maximpn @CAWilson94
[Security Solution] Make importing prebuilt rules with missing base v…
394692e 
…ersion tests matching the test scenario (elastic#234735)

**Relates to:** elastic#223421

## Summary

This PR makes little adjustments to [Importing Prebuilt
Rules](elastic#223421) with missing base
version test scenario implementation to make it matching test scenario
steps. In particular it makes sure an installed prebuilt rule gets
customized before testing import.
niros1 pushed a commit that referenced this pull request Sep 30, 2025
@maximpn @niros1
[Security Solution] Make importing prebuilt rules with missing base v…
94e34f7 
…ersion tests matching the test scenario (#234735)

**Relates to:** #223421

## Summary

This PR makes little adjustments to [Importing Prebuilt
Rules](#223421) with missing base
version test scenario implementation to make it matching test scenario
steps. In particular it makes sure an installed prebuilt rule gets
customized before testing import.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@jkelas jkelas jkelas approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@maximpn maximpn

Labels

backport:version Backport to applied version labels Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area release_note:skip Skip the PR/issue when compiling release notes Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. test v8.18.7 v8.19.4 v9.0.7 v9.1.4 v9.2.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@maximpn @elasticmachine @kibanamachine @jkelas @banderror