[Security Solution] Prebuilt Rule Incorrectly Marked as Customized After Adding a Rule Exception

[pborgonovi]

Describe the bug:

Adding an exception to a prebuilt rule causes it to be incorrectly marked as “customized.”

Kibana/Elasticsearch Stack version:

8.x

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Prebuilt Rules

Pre requisites:

1. Feature flag prebuiltRulesCustomizationEnabled is enabled
2. Prebuilt rules are installed

Steps to reproduce:

1. Select a prebuilt rule
2. Add a rule exception

Current behavior:

• The prebuilt rule is marked as “Customized” after adding a rule exception.
• The is_customized flag is set to true.

Expected behavior:

• Adding a rule exception should not mark the prebuilt rule as customized.
• The rule should remain marked as “Prebuilt” with is_customized set to false.
• Rule exceptions should be managed independently without affecting the rule’s customization status.

Screenshots (if relevant):

Screen.Recording.2024-12-04.at.11.26.21.AM.mov

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[banderror]

@pborgonovi Thank you!

@dplumlee Could you please look into this? I'm not sure if it's the same as #201631 and #202575 or a different one.

[dplumlee]

@pborgonovi I'm not able to repro this on a fresh pull of main or 8.x using the same data you have in the attached video, can you validate?

[pborgonovi]

Hey @dplumlee

As per what I've observed, this seems to be happening when an update is available for the rule. Take a look at this evidence:

Screen.Recording.2024-12-06.at.9.13.17.AM.mov