[Security Solution] Rule execution fails after importing a rule with Security Solution data view in a different space

[MadameSheema]

Describe the bug:

• Rule execution fails after importing a rule with Security Solution data view in a different space.

Kibana/Elasticsearch Stack version:

• 8.4.0 BC1

Initial setup:

• To have a detection rule created with the Security Solution data view on the default space exported.
• To have more than one space.

Steps to reproduce:

1. Import the exported rule in a different space
2. Wait for the rule to be executed

Current behavior:

• The execution of the rule fails, even if you import the security solution default data view to the space where the rule was imported. After re-enabling the rule, still fails.

Expected behavior:

• The rule execution does not fail

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[dhurley14]

I'll look into this but I believe this could be due to the saved object id's being different between the two spaces? Or something with the saved object references for the exported rule..

[yctercero]

This is similar to the experience we deal with currently with rule action connectors. On export, we only export the id, so if the saved object does not exist where this is being re-imported, it will fail.

Would love some input here on what the experience should be. Ideally, a user would be able to completely export all their SOs with their rules and reimport into a new environment with no problem. In a more tiered approach I could see first updating the import/export UI to inform users of the behavior around data views and connectors. I'm not sure how portable the Kibana core import/export API is and if we can in any way begin to leverage it and move away from our own API as it is growing in complexity.

Given that we do still allow the rule to be imported and a pretty clear error message is displayed, I think we can think of some updates for 8.5+.

cc @peluja1012 @rylnd @jethr0null

[jethr0null]

Can we chat about this to explore options during the advanced correlation sync perhaps?

[yctercero]

@jethr0null added it to next week's advanced correlation sync agenda.

[rylnd]

Note: users can share data views between spaces via the SOM. If the data view is shared between the exported space and the imported space, the newly-imported rule will behave as expected. NB that this won't work with cross-instance import/export.

[pborgonovi]

If the data view is previously shared with the other space, then importing the rule will work as expected:

Screen.Recording.2024-07-24.at.10.37.55.AM.mov

Closing this bug as invalid.