[Security Solution] Adding Actions to Prebuilt Rules Incorrectly Marks Them as Customized

[pborgonovi]

Description:

When adding an action (e.g., Case) to a prebuilt rule, the rule is incorrectly marked as Customized (is_customized: true). Adding actions should not categorize a prebuilt rule as customized.

Kibana/Elasticsearch Stack version:

8.x

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Prebuilt Rules

Pre requisites:

1. prebuiltRulesCustomizationEnabled flag is enabled
2. Prebuilt rules are available

Steps to reproduce:

1. Navigate to the Rules Management page.
2. Select a Prebuilt Rule.
3. Click Edit Rule Settings or directly add an action via Bulk (e.g., Add Cases).
4. Save the changes.

Current behavior:

The rule is marked as Customized (is_customized: true) after adding an action.

Expected behavior:

Adding actions to prebuilt rules should not categorize the rule as customized.

Evidences:

Screen.Recording.2024-12-09.at.10.41.58.AM.mov

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[banderror]

@dplumlee I guess it's caused by the same reason as #203315

[dplumlee]

I guess it's caused by the same reason as #203315

I'm unable to repro with the new package version which leads me to believe its the same bug