[7.x] [Security Solution][Detection Engine] - Update exceptions logic (#71512)

[cnasikas]

Backports the following commits to 7.x:

• [Security Solution][Detection Engine] - Update exceptions logic ([Security Solution][Detection Engine] - Update exceptions logic #71512)

[kibanamachine]

💛 Build succeeded, but was flaky

• continuous-integration/kibana-ci/pull-request
• Commit: ddb0de3
• Flaky suites:
  • xpack-kibana-ciGroup1

---

Test Failures

Kibana Pipeline / kibana-xpack-agent / X-Pack Detection Engine API Integration Tests.x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules·ts.detection engine api security and spaces enabled add_prepackaged_rules creating prepackaged rules should be possible to call the API twice and the second time the number of rules installed should be zero

Link to Jenkins

Standard Out

Failed Tests Reporter:
  - Test has not failed recently on tracked branches

[00:00:00]       │
[00:00:00]         └-: detection engine api security and spaces enabled
[00:00:00]           └-> "before all" hook
[00:00:00]           └-: add_prepackaged_rules
[00:00:00]             └-> "before all" hook
[00:00:01]             └-: creating prepackaged rules
[00:00:01]               └-> "before all" hook
[00:00:01]               └-> should contain two output keys of rules_installed and rules_updated
[00:00:01]                 └-> "before each" hook: global before each
[00:00:01]                 └-> "before each" hook
[00:00:01]                   │ info [o.e.x.i.a.TransportPutLifecycleAction] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] adding index lifecycle policy [.siem-signals-default]
[00:00:01]                   │ info [o.e.c.m.MetadataIndexTemplateService] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] adding template [.siem-signals-default] for index patterns [.siem-signals-default-*]
[00:00:01]                   │ info [o.e.c.m.MetadataCreateIndexService] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] [.siem-signals-default-000001] creating index, cause [api], templates [.siem-signals-default], shards [1]/[1]
[00:00:01]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] moving index [.siem-signals-default-000001] from [null] to [{"phase":"new","action":"complete","name":"complete"}] in policy [.siem-signals-default]
[00:00:01]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] moving index [.siem-signals-default-000001] from [{"phase":"new","action":"complete","name":"complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] in policy [.siem-signals-default]
[00:00:01]                 │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] moving index [.siem-signals-default-000001] from [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-follow-shard-tasks"}] in policy [.siem-signals-default]
[00:00:02]                 │ info [o.e.c.m.MetadataMappingService] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] [.kibana_1/vN4KMOfRRQu4EidCA_35uw] update_mapping [_doc]
[00:00:04]                 └- ✓ pass  (3.2s) "detection engine api security and spaces enabled add_prepackaged_rules creating prepackaged rules should contain two output keys of rules_installed and rules_updated"
[00:00:04]               └-> "after each" hook
[00:00:04]                 │ info [o.e.c.m.MetadataDeleteIndexService] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] [.siem-signals-default-000001/0bjUrLjxT3Og6em0VuVsUw] deleting index
[00:00:04]                 │ info [o.e.c.m.MetadataIndexTemplateService] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] removing template [.siem-signals-default]
[00:00:05]               └-> should create the prepackaged rules and return a count greater than zero
[00:00:05]                 └-> "before each" hook: global before each
[00:00:05]                 └-> "before each" hook
[00:00:05]                   │ info [o.e.x.i.a.TransportPutLifecycleAction] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] adding index lifecycle policy [.siem-signals-default]
[00:00:05]                   │ info [o.e.c.m.MetadataIndexTemplateService] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] adding template [.siem-signals-default] for index patterns [.siem-signals-default-*]
[00:00:05]                   │ info [o.e.c.m.MetadataCreateIndexService] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] [.siem-signals-default-000001] creating index, cause [api], templates [.siem-signals-default], shards [1]/[1]
[00:00:05]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] moving index [.siem-signals-default-000001] from [null] to [{"phase":"new","action":"complete","name":"complete"}] in policy [.siem-signals-default]
[00:00:05]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] moving index [.siem-signals-default-000001] from [{"phase":"new","action":"complete","name":"complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] in policy [.siem-signals-default]
[00:00:05]                 │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] moving index [.siem-signals-default-000001] from [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-follow-shard-tasks"}] in policy [.siem-signals-default]
[00:00:07]                 └- ✓ pass  (2.1s) "detection engine api security and spaces enabled add_prepackaged_rules creating prepackaged rules should create the prepackaged rules and return a count greater than zero"
[00:00:07]               └-> "after each" hook
[00:00:07]                 │ info [o.e.c.m.MetadataDeleteIndexService] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] [.siem-signals-default-000001/OOThiiKwSnaQ_AvTJ4JiAw] deleting index
[00:00:07]                 │ info [o.e.c.m.MetadataIndexTemplateService] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] removing template [.siem-signals-default]
[00:00:07]               └-> should create the prepackaged rules that the rules_updated is of size zero
[00:00:07]                 └-> "before each" hook: global before each
[00:00:07]                 └-> "before each" hook
[00:00:07]                   │ info [o.e.x.i.a.TransportPutLifecycleAction] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] adding index lifecycle policy [.siem-signals-default]
[00:00:07]                   │ info [o.e.c.m.MetadataIndexTemplateService] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] adding template [.siem-signals-default] for index patterns [.siem-signals-default-*]
[00:00:07]                   │ info [o.e.c.m.MetadataCreateIndexService] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] [.siem-signals-default-000001] creating index, cause [api], templates [.siem-signals-default], shards [1]/[1]
[00:00:07]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] moving index [.siem-signals-default-000001] from [null] to [{"phase":"new","action":"complete","name":"complete"}] in policy [.siem-signals-default]
[00:00:08]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] moving index [.siem-signals-default-000001] from [{"phase":"new","action":"complete","name":"complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] in policy [.siem-signals-default]
[00:00:08]                 │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] moving index [.siem-signals-default-000001] from [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-follow-shard-tasks"}] in policy [.siem-signals-default]
[00:00:09]                 └- ✓ pass  (1.9s) "detection engine api security and spaces enabled add_prepackaged_rules creating prepackaged rules should create the prepackaged rules that the rules_updated is of size zero"
[00:00:09]               └-> "after each" hook
[00:00:09]                 │ info [o.e.c.m.MetadataDeleteIndexService] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] [.siem-signals-default-000001/k88tOQ10ROyiEdEAFB_jYA] deleting index
[00:00:10]                 │ info [o.e.c.m.MetadataIndexTemplateService] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] removing template [.siem-signals-default]
[00:00:10]               └-> should be possible to call the API twice and the second time the number of rules installed should be zero
[00:00:10]                 └-> "before each" hook: global before each
[00:00:10]                 └-> "before each" hook
[00:00:10]                   │ info [o.e.x.i.a.TransportPutLifecycleAction] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] adding index lifecycle policy [.siem-signals-default]
[00:00:10]                   │ info [o.e.c.m.MetadataIndexTemplateService] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] adding template [.siem-signals-default] for index patterns [.siem-signals-default-*]
[00:00:10]                   │ info [o.e.c.m.MetadataCreateIndexService] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] [.siem-signals-default-000001] creating index, cause [api], templates [.siem-signals-default], shards [1]/[1]
[00:00:10]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] moving index [.siem-signals-default-000001] from [null] to [{"phase":"new","action":"complete","name":"complete"}] in policy [.siem-signals-default]
[00:00:10]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] moving index [.siem-signals-default-000001] from [{"phase":"new","action":"complete","name":"complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] in policy [.siem-signals-default]
[00:00:10]                 │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-16-tests-xl-1594812518416221991] moving index [.siem-signals-default-000001] from [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-follow-shard-tasks"}] in policy [.siem-signals-default]
[00:00:12]                 └- ✖ fail: detection engine api security and spaces enabled add_prepackaged_rules creating prepackaged rules should be possible to call the API twice and the second time the number of rules installed should be zero
[00:00:12]                 │       Error: expected 1 to sort of equal 0
[00:00:12]                 │       + expected - actual
[00:00:12]                 │ 
[00:00:12]                 │       -1
[00:00:12]                 │       +0
[00:00:12]                 │       
[00:00:12]                 │       at Assertion.assert (/dev/shm/workspace/kibana/packages/kbn-expect/expect.js:100:11)
[00:00:12]                 │       at Assertion.eql (/dev/shm/workspace/kibana/packages/kbn-expect/expect.js:244:8)
[00:00:12]                 │       at Context.it (test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts:99:41)
[00:00:12]                 │ 
[00:00:12]                 │ 

Stack Trace

{ Error: expected 1 to sort of equal 0
    at Assertion.assert (/dev/shm/workspace/kibana/packages/kbn-expect/expect.js:100:11)
    at Assertion.eql (/dev/shm/workspace/kibana/packages/kbn-expect/expect.js:244:8)
    at Context.it (test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts:99:41) actual: '1', expected: '0', showDiff: true }

---

Build metrics

@kbn/optimizer bundle module count

id	value	diff	baseline
securitySolution	934	+1	933

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream