[Security Solution] Support filtering by "Modified rules" and "Unmodified rules"

[jpdjere]

Epics: https://github.com/elastic/security-team/issues/1974 (internal), #174168
Design Discussion context: #178211

Summary

Update table

• Support filtering by "Modified rules" and "Unmodified rules" in the update rules table using a new dropdown filer.
• 

Rules table

• Keep existing filtering with existing options of Elastic rules and Custom rules.
• Show if the Elastic rule is modified but having a badge on the rule details page.
• Change Integrations badge to just icon and number count as in the design below.
  

Designs

Update table

Rule table

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[nikitaindik]

Transitioning this back in "Todo" as I need to switch to another ticket.

Here's some info for future reference. I came up with this KQL query to filter by "prebuilt non-customized":

(alert.attributes.params.immutable: true AND NOT alert.attributes.params.ruleSource.isCustomized: *) OR alert.attributes.params.ruleSource.isCustomized: false

[ARWNightingale]

@approksiu please edit or add any information that I may have missed.

[ARWNightingale]

Hey @dplumlee, we made some changes to the design to decrease scope and insure we are aligned with what data we have to show. any questions please reach out.

[jpdjere]

Hi @approksiu and @ARWNightingale, we discussed this yesterday with @dplumlee and some questions came up:

Add a new column to show if a rule has been modified. (Modified will only be shown when a rule gets custom on the same field that would previously trigger it to a "elastic customised rule".)

This is technically possible but we were having doubts about adding a whole new column to show if the rule is customized. It makes sense for Prebuilt Rules, since they are either modified or not, but what about Custom rules? The column doesn't make sense at all for Custom rules (would it ever show a value?) and seems a waste of space in the table. We were thinking instead that we could have a Badge either before or after the rule's name that shows it as Customised/Modified. WDYT?

show what fields have been modified with an icon.

This is currently not possible without some planning: the rule currently does not save the information of which fields were modified, only if the whole rule was modified or not (with a change to at least 1 field). It is possible to calculate this on the fly every time that we need it, but it requires some planning since it would affect the Rules Details page performance. We should answer some questions before like:

• do we want to show which fields are customized as soon as the page loads? or maybe in a flyout that the user has to click additionally? The second option makes more sense from a point of view of performance, not affecting load times of the Rules Detail page.
• how do we handle cases were the base rule is missing? We might know that the rule is customized (because that's saved in the rule itself) but if the base rule is missing (very possible) we cannot calculate which fields are customized. That would be very weird UX for the user.
  I suggest we create an Enhancement ticket for this and add it to the Milestone 4+ ticket to plan it for the future.

[approksiu]

@jpdjere thanks for the questions!

We were thinking instead that we could have a Badge either before or after the rule's name that shows it as Customised/Modified.

I was thinking we could sort the column to see the modified rules on top, with badge it will not be possible.

I suggest we create an Enhancement ticket for this and add it to the Milestone 4+ ticket to plan it for the future.

Yes, it is included in Milestone 4, but needs a ticket.

[dplumlee]

@approksiu what about @jpdjere's comment about the modified column and custom rules? Is the thought there to just show nothing the same as non-customized prebuilt rules?

I think our initial confusion was around having a binary value in the table that's already pretty full and doesn't apply to one of the 3 existing rule types (custom/prebuilt/customized prebuilt). And even if we don't do the badge approach - for sorting that column, what's the benefit of sorting instead of filtering like we do for prebuilt vs custom right now?

[approksiu]

@dplumlee @jpdjere having a badge is a sensible approach at this time since a suggestion we had is a compromise. We will improve it in the future when we add proper filters. Thanks! Alex is updating the designs.

[ARWNightingale]

Hey,@jpdjere @dplumlee designs have been amended.

[dplumlee]

Completed by #197340