[Detection Engine] Adds 8.6 rules

[terrancedejesus]

Summary

Pull updates to detection rules from https://github.com/elastic/detection-rules/tree/0600b575650f3bec81720da72b1cea7481978576.

Checklist

Delete any items that are not applicable to this PR.

• Any text added follows EUI's writing guidelines,
  uses sentence case text and includes i18n support

[terrancedejesus]

Although we added rule updates in ##145256 and would expect a decrease in rule updates, it seems there was some bulk updates with tags.

[terrancedejesus]

@xcrzx or @banderror - Any chance you have some time to review these errors? The seem related to the Kibana CI job and some TS files.

Buildkite Job - https://buildkite.com/elastic/kibana-pull-request/builds/91038#0184bead-77f7-4df7-aefe-62a1c7542dca

The build API docs and check types seem to be failing with a similar error message

Build API Docs and Check Types Error

proc [tsc] x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/content/prepackaged_rules/notice.ts:1:1 - error TS1208: 'notice.ts' cannot be compiled under '--isolatedModules' because it is considered a global script file. Add an import, export, or an empty 'export {}' statement to make it a module.
--
  | proc [tsc]
  | proc [tsc] 1 /* eslint-disable @kbn/eslint/require-license-header */
  | proc [tsc]
  | proc [tsc]
  | proc [tsc]
  | proc [tsc] Found 1 error.
  | proc [tsc]
  | ERROR Unable to build TS project refs
  | 🚨 Error: The command exited with status 1
  | Running local post-command hook | 0s
  | Agent Debug Info | 5s
  | Agent Metrics:
  | https://kibana-ops-buildkite-monitoring.kb.us-central1.gcp.cloud.es.io:9243/app/metrics/link-to/host-detail/kb-n2-4-spot-483f3b754c18dc73?to=1669653726615&from=1669646526615
  | Agent Logs:
  | https://kibana-ops-buildkite-monitoring.kb.us-central1.gcp.cloud.es.io:9243/app/logs/link-to/host-logs/kb-n2-4-spot-483f3b754c18dc73?time=1669646526615
  | 2022-11-28 14:59:35 WARN   No meta-data value exists with key `0184bead-77f7-4df7-aefe-62a1c7542dca_is_test_execution_step`, returning the supplied default ""
  | user command error: exit status 1

From your review does it seem like this is a problem with our rules that TRaDE can adjust on our end?

[xcrzx]

@terrancedejesus With regards to the types error, an export statement was removed from the notice.ts file:

It looks like notice.ts is an autogenerated file, but recently, it was modified manually (see this commit).

So I believe this CLI command should be updated to paste an empty export {} to the generated file to make it a module, so Typescript wouldn't complain anymore.

Meanwhile, I've manually added an empty export statement in this PR as a workaround.

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: cf3af4a
• Storybooks Preview

Failed CI Steps

• Security Solution Tests #1
• Security Solution Tests #2

Test Failures

• [job] [logs] Security Solution Tests #2 / Alerts detection rules table auto-refresh should disable auto refresh when any rule selected and enable it after rules unselected
• [job] [logs] Security Solution Tests #1 / Cases Creates a new case with timeline and opens the timeline

Metrics [docs]

Unknown metric groups

ESLint disabled in files

id	before	after	diff
osquery	1	2	+1

ESLint disabled line counts

id	before	after	diff
enterpriseSearch	19	21	+2
fleet	59	65	+6
osquery	109	115	+6
securitySolution	442	448	+6
total			+20

Total ESLint disabled count

id	before	after	diff
enterpriseSearch	20	22	+2
fleet	68	74	+6
osquery	110	117	+7
securitySolution	519	525	+6
total			+21

History

• 💔 Build #91229 failed 9f287bb
• 💔 Build #91190 failed 9ca1dcb
• 💔 Build #91165 failed 56725a8
• 💔 Build #91038 failed 94b1de0

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @terrancedejesus

[terrancedejesus]

@terrancedejesus With regards to the types error, an export statement was removed from the notice.ts file:

It looks like notice.ts is an autogenerated file, but recently, it was modified manually (see this commit).

So I believe this CLI command should be updated to paste an empty export {} to the generated file to make it a module, so Typescript wouldn't complain anymore.

Meanwhile, I've manually added an empty export statement in this PR as a workaround.

Thank you for pointing this out and taking the time to dig into it! I will get this updated on our end temporarily as we look to adjust the kibana PR CLI command on our end to align with the removal of FS rules.

[kibanamachine]

💔 All backports failed

Status	Branch	Result
❌	8.6	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 146402

Questions ?

Please refer to the Backport tool documentation and see the Github Action logs for details

[xcrzx]

💚 All backports created successfully

Status	Branch	Result
✅	8.6

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation