[Security Solution] Prebuilt rules marked as customized after applying updates

[xcrzx]

Summary

Non-customized rules are incorrectly marked as customized after applying an update.

Steps to Reproduce

1. Enable the rule customization feature flag
2. Install rules from an older package version.
3. Upgrade the rules package to the latest version.
4. Find any upgradable rule without conflicts.
5. Update the rule to the latest version accepting all incoming changes.

Expected Result

The rule is upgraded and remains marked as non-customized.

Actual Result

The rule is upgraded but is incorrectly marked as customized.

Initial analysis shows a difference in the lookback field between the saved updated rule and the target version. The value changes from -60s to 240s.

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[banderror]

@xcrzx Is it with the feature flag ON or OFF?

[xcrzx]

@xcrzx Is it with the feature flag ON or OFF?

This is with the feature flag enabled. Updated ticket description

[xcrzx]

The bug caused the from field of the rule to be less than the interval, which resulted in a negative lookback value and subsequently crashed Kibana. Here’s the Git diff with a possible fix:

index 7caa0469eeb..ba23bff67be 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/api/perform_rule_upgrade/diffable_rule_fields_mappings.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/api/perform_rule_upgrade/diffable_rule_fields_mappings.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 import { get, has } from 'lodash';
+import moment from 'moment';
 import type {
   RuleSchedule,
   DataSourceIndexPatterns,
@@ -15,6 +16,7 @@ import type {
 } from '../../../../../../common/api/detection_engine';
 import { type AllFieldsDiff } from '../../../../../../common/api/detection_engine';
 import type { PrebuiltRuleAsset } from '../../model/rule_assets/prebuilt_rule_asset';
+import { parseInterval } from '../../../rule_types/utils/utils';
 
 /**
  * Retrieves and transforms the value for a specific field from a DiffableRule group.
@@ -201,7 +203,11 @@ export const transformDiffableFieldValues = (
   diffableFieldValue: RuleSchedule | InlineKqlQuery | unknown
 ): TransformValuesReturnType => {
   if (fieldName === 'from' && isRuleSchedule(diffableFieldValue)) {
-    return { type: 'TRANSFORMED_FIELD', value: `now-${diffableFieldValue.lookback}` };
+    const interval = parseInterval(diffableFieldValue.interval) ?? moment.duration(0);
+    const parsedFrom = parseInterval(diffableFieldValue.lookback) ?? moment.duration(0);
+
+    const from = parsedFrom.asSeconds() + interval.asSeconds();
+    return { type: 'TRANSFORMED_FIELD', value: `now-${from}s` };
   } else if (fieldName === 'to') {
     return { type: 'TRANSFORMED_FIELD', value: `now` };
   } else if (fieldName === 'saved_id' && isInlineQuery(diffableFieldValue)) {