[Security Solution] Allow to udate rule version for prebuilt rules

[xcrzx]

Resolves: #139095
Resolves: #138876

Summary

Fixed logic that prevented rule version update for prebuilt rules and caused the rule upgrade banner to persist on the page.

Screen.Recording.2022-08-23.at.13.53.10.mov

Version update logic before:

version: nextParams.version ?? existingParams.immutable
    ? existingParams.version
    : shouldUpdateVersion(nextParams)
    ? existingParams.version + 1
    : existingParams.version,

After:

version: nextParams.version
    ? nextParams.version
    : shouldUpdateVersion(nextParams)
    ? existingParams.version + 1
    : existingParams.version,

Now, if a new version is passed with the rule params, it gets applied unconditionally. As a result, rule converters are no more aware of the rule immutability concept. Therefore, prebuilt rule immutability should be enforced on the business logic layer where needed.

How to test

1. Install pre-packaged rules.
2. In x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules, modify a rule: update name, risk_score and any other fields, and bump up the version.
3. Navigate to the Rules page. The update callout should be visible on top.
4. Click on the Update 1 Elastic prebuilt rule button.
5. The rule should have all fields updated. The callout should disappear.

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[banderror]

Checked out, reviewed the changes, and tested locally. LGTM 👍

Tested the fix twice in two different ways:

• by upgrading from 8.4 to 8.5 while having some prebuilt rules installed in 8.4
• by bumping the version in a filesystem rule

Left a few minor comments/nits.

@xcrzx do you think it's possible to write an integration test that would cover the logic of updating versions of prebuilt rules when addPrepackedRulesRoute is called?

[banderror]

It looks like currently, our users are able to modify the rule version of prebuilt rules via CRUD endpoints. I think we need to create some follow-up tickets for disallowing that. Version updates should be done internally and controlled by the app on the server side.

Also, I believe this logic of incrementing the version should move to the routes like the add_prepackaged_rules_route.ts one. Here in the convertPatchAPIToInternalSchema it would become version: nextParams.version ?? existingParams.version. We can leave it as is in this PR.

[xcrzx]

Ideally, we should disallow users to modify prebuilt rules via API. But given that we're working actively on the prebuilt rule customization epic and the immutability flag will be removed, probably it's not worth spending time to add extra validation to the routes 🤷‍♂️

[xcrzx]

And as for the version increment logic, I hope we'll remove it once this task is finished.

[xcrzx]

@xcrzx do you think it's possible to write an integration test that would cover the logic of updating versions of prebuilt rules when addPrepackedRulesRoute is called?

++ We definitely need to cover that part with tests. Do you mind if we do it separately?

UPD: added issue #139533

[banderror]

Looks perfect! Thank you for addressing the comments.

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: f4bd7b7

Failed CI Steps

• FTR Configs #14

Test Failures

• [job] [logs] FTR Configs #14 / endpoint When on the Endpoint Policy Details Page and the save button is clicked should have cleared the advanced section when the user deletes the value

Metrics [docs]

✅ unchanged

History

• 💚 Build #67331 succeeded d3799273f22072c0ede00bd0e9b44e441f3aafe9
• 💚 Build #66798 succeeded d3e11f0df6b2a96718e48c38c2d2fc7a60a23c43
• 💔 Build #66731 failed fa07fc2a9e48a9b8f4356465f4a3856a3809949e
• 💔 Build #66713 failed 69b45d284bfde6f27c46ef93889e81a1daee7710

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @xcrzx

[kibanamachine]

💚 All backports created successfully

Status	Branch	Result
✅	8.4

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation