[8.x] [Security Solution] Integration tests for rule `type`…

… field diff algorithms (#193375) (#195518)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution] Integration tests for rule `type` field
diff algorithms
(#193375)](#193375)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-10-08T22:46:33Z","message":"[Security
Solution] Integration tests for rule `type` field diff algorithms
(#193375)\n\n## Summary\r\n\r\nCompletes
https://github.com/elastic/kibana/issues/190482\r\n\r\n\r\nSwitches rule
`type` field to use the implemented diff algorithms\r\nassigned to them
in https://github.com/elastic/kibana/pull/193369\r\n\r\n\r\nAdds
integration tests in accordance
to\r\nhttps://github.com//pull/193372 for the
`upgrade/_review`\r\nAPI endpoint for the rule `type` field diff
algorithm.\r\n\r\nAlso fixes some nested bracket misalignment that
occurred in earlier PRs\r\nwith some test files\r\n\r\n###
Checklist\r\n\r\nDelete any items that are not applicable to this
PR.\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n- [x] [Flaky
Test\r\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\r\nused on any tests changed\r\n\r\n\r\n### For maintainers\r\n\r\n-
[ ] This was checked for breaking API changes and was
[labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"e119d83c26387e85e9fdf3cc5d5eeceeebb04edb","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["test","release_note:skip","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:prev-minor","v8.16.0"],"title":"[Security Solution]
Integration tests for rule `type` field diff
algorithms","number":193375,"url":"https://github.com/elastic/kibana/pull/193375","mergeCommit":{"message":"[Security
Solution] Integration tests for rule `type` field diff algorithms
(#193375)\n\n## Summary\r\n\r\nCompletes
https://github.com/elastic/kibana/issues/190482\r\n\r\n\r\nSwitches rule
`type` field to use the implemented diff algorithms\r\nassigned to them
in https://github.com/elastic/kibana/pull/193369\r\n\r\n\r\nAdds
integration tests in accordance
to\r\nhttps://github.com//pull/193372 for the
`upgrade/_review`\r\nAPI endpoint for the rule `type` field diff
algorithm.\r\n\r\nAlso fixes some nested bracket misalignment that
occurred in earlier PRs\r\nwith some test files\r\n\r\n###
Checklist\r\n\r\nDelete any items that are not applicable to this
PR.\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n- [x] [Flaky
Test\r\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\r\nused on any tests changed\r\n\r\n\r\n### For maintainers\r\n\r\n-
[ ] This was checked for breaking API changes and was
[labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"e119d83c26387e85e9fdf3cc5d5eeceeebb04edb"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/193375","number":193375,"mergeCommit":{"message":"[Security
Solution] Integration tests for rule `type` field diff algorithms
(#193375)\n\n## Summary\r\n\r\nCompletes
https://github.com/elastic/kibana/issues/190482\r\n\r\n\r\nSwitches rule
`type` field to use the implemented diff algorithms\r\nassigned to them
in https://github.com/elastic/kibana/pull/193369\r\n\r\n\r\nAdds
integration tests in accordance
to\r\nhttps://github.com//pull/193372 for the
`upgrade/_review`\r\nAPI endpoint for the rule `type` field diff
algorithm.\r\n\r\nAlso fixes some nested bracket misalignment that
occurred in earlier PRs\r\nwith some test files\r\n\r\n###
Checklist\r\n\r\nDelete any items that are not applicable to this
PR.\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n- [x] [Flaky
Test\r\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\r\nused on any tests changed\r\n\r\n\r\n### For maintainers\r\n\r\n-
[ ] This was checked for breaking API changes and was
[labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"e119d83c26387e85e9fdf3cc5d5eeceeebb04edb"}},{"branch":"8.x","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Davis Plumlee <[email protected]>
Co-authored-by: Elastic Machine <[email protected]>

x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/calculate_rule_fields_diff.ts

@@ -47,6 +47,7 @@ import {
   kqlQueryDiffAlgorithm,
   eqlQueryDiffAlgorithm,
   esqlQueryDiffAlgorithm,
+  ruleTypeDiffAlgorithm,
 } from './algorithms';
 
 const BASE_TYPE_ERROR = `Base version can't be of different rule type`;
@@ -212,7 +213,7 @@ const calculateCustomQueryFieldsDiff = (
 };
 
 const customQueryFieldsDiffAlgorithms: FieldsDiffAlgorithmsFor<DiffableCustomQueryFields> = {
-  type: simpleDiffAlgorithm,
+  type: ruleTypeDiffAlgorithm,
   kql_query: kqlQueryDiffAlgorithm,
   data_source: dataSourceDiffAlgorithm,
   alert_suppression: simpleDiffAlgorithm,
@@ -225,7 +226,7 @@ const calculateSavedQueryFieldsDiff = (
 };
 
 const savedQueryFieldsDiffAlgorithms: FieldsDiffAlgorithmsFor<DiffableSavedQueryFields> = {
-  type: simpleDiffAlgorithm,
+  type: ruleTypeDiffAlgorithm,
   kql_query: kqlQueryDiffAlgorithm,
   data_source: dataSourceDiffAlgorithm,
   alert_suppression: simpleDiffAlgorithm,
@@ -238,7 +239,7 @@ const calculateEqlFieldsDiff = (
 };
 
 const eqlFieldsDiffAlgorithms: FieldsDiffAlgorithmsFor<DiffableEqlFields> = {
-  type: simpleDiffAlgorithm,
+  type: ruleTypeDiffAlgorithm,
   eql_query: eqlQueryDiffAlgorithm,
   data_source: dataSourceDiffAlgorithm,
   event_category_override: singleLineStringDiffAlgorithm,
@@ -254,7 +255,7 @@ const calculateEsqlFieldsDiff = (
 };
 
 const esqlFieldsDiffAlgorithms: FieldsDiffAlgorithmsFor<DiffableEsqlFields> = {
-  type: simpleDiffAlgorithm,
+  type: ruleTypeDiffAlgorithm,
   esql_query: esqlQueryDiffAlgorithm,
   alert_suppression: simpleDiffAlgorithm,
 };
@@ -266,7 +267,7 @@ const calculateThreatMatchFieldsDiff = (
 };
 
 const threatMatchFieldsDiffAlgorithms: FieldsDiffAlgorithmsFor<DiffableThreatMatchFields> = {
-  type: simpleDiffAlgorithm,
+  type: ruleTypeDiffAlgorithm,
   kql_query: kqlQueryDiffAlgorithm,
   data_source: dataSourceDiffAlgorithm,
   threat_query: kqlQueryDiffAlgorithm,
@@ -284,7 +285,7 @@ const calculateThresholdFieldsDiff = (
 };
 
 const thresholdFieldsDiffAlgorithms: FieldsDiffAlgorithmsFor<DiffableThresholdFields> = {
-  type: simpleDiffAlgorithm,
+  type: ruleTypeDiffAlgorithm,
   kql_query: kqlQueryDiffAlgorithm,
   data_source: dataSourceDiffAlgorithm,
   threshold: simpleDiffAlgorithm,
@@ -299,7 +300,7 @@ const calculateMachineLearningFieldsDiff = (
 
 const machineLearningFieldsDiffAlgorithms: FieldsDiffAlgorithmsFor<DiffableMachineLearningFields> =
   {
-    type: simpleDiffAlgorithm,
+    type: ruleTypeDiffAlgorithm,
     machine_learning_job_id: simpleDiffAlgorithm,
     anomaly_threshold: numberDiffAlgorithm,
     alert_suppression: simpleDiffAlgorithm,
@@ -312,7 +313,7 @@ const calculateNewTermsFieldsDiff = (
 };
 
 const newTermsFieldsDiffAlgorithms: FieldsDiffAlgorithmsFor<DiffableNewTermsFields> = {
-  type: simpleDiffAlgorithm,
+  type: ruleTypeDiffAlgorithm,
   kql_query: kqlQueryDiffAlgorithm,
   data_source: dataSourceDiffAlgorithm,
   new_terms_fields: scalarArrayDiffAlgorithm,
@@ -336,5 +337,5 @@ const allFieldsDiffAlgorithms: FieldsDiffAlgorithmsFor<DiffableAllFields> = {
   ...thresholdFieldsDiffAlgorithms,
   ...machineLearningFieldsDiffAlgorithms,
   ...newTermsFieldsDiffAlgorithms,
-  type: simpleDiffAlgorithm,
+  type: ruleTypeDiffAlgorithm,
 };

x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/management/trial_license_complete_tier/index.ts

@@ -17,6 +17,7 @@ export default ({ loadTestFile }: FtrProviderContext): void => {
     loadTestFile(require.resolve('./upgrade_prebuilt_rules'));
     loadTestFile(require.resolve('./upgrade_prebuilt_rules_with_historical_versions'));
     loadTestFile(require.resolve('./fleet_integration'));
+    loadTestFile(require.resolve('./upgrade_review_prebuilt_rules.rule_type_fields'));
     loadTestFile(require.resolve('./upgrade_review_prebuilt_rules.number_fields'));
     loadTestFile(require.resolve('./upgrade_review_prebuilt_rules.single_line_string_fields'));
     loadTestFile(require.resolve('./upgrade_review_prebuilt_rules.scalar_array_fields'));

x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/management/trial_license_complete_tier/upgrade_review_prebuilt_rules.kql_query_fields.ts

@@ -199,12 +199,12 @@ export default ({ getService }: FtrProviderContext): void => {
             });
 
             expect(reviewResponse.rules[0].diff.num_fields_with_updates).toBe(1); // `version` is considered an updated field
-            expect(reviewResponse.rules[0].diff.num_fields_with_conflicts).toBe(0);
-            expect(reviewResponse.rules[0].diff.num_fields_with_non_solvable_conflicts).toBe(0);
+            expect(reviewResponse.rules[0].diff.num_fields_with_conflicts).toBe(1); // `type` is considered to be a conflict
+            expect(reviewResponse.rules[0].diff.num_fields_with_non_solvable_conflicts).toBe(1);
 
             expect(reviewResponse.stats.num_rules_to_upgrade_total).toBe(1);
-            expect(reviewResponse.stats.num_rules_with_conflicts).toBe(0);
-            expect(reviewResponse.stats.num_rules_with_non_solvable_conflicts).toBe(0);
+            expect(reviewResponse.stats.num_rules_with_conflicts).toBe(1);
+            expect(reviewResponse.stats.num_rules_with_non_solvable_conflicts).toBe(1);
           });
         });
 
@@ -273,12 +273,12 @@ export default ({ getService }: FtrProviderContext): void => {
             });
 
             expect(reviewResponse.rules[0].diff.num_fields_with_updates).toBe(1); // `version` is considered an updated field
-            expect(reviewResponse.rules[0].diff.num_fields_with_conflicts).toBe(0);
-            expect(reviewResponse.rules[0].diff.num_fields_with_non_solvable_conflicts).toBe(0);
+            expect(reviewResponse.rules[0].diff.num_fields_with_conflicts).toBe(1); // `type` is considered to be a conflict
+            expect(reviewResponse.rules[0].diff.num_fields_with_non_solvable_conflicts).toBe(1);
 
             expect(reviewResponse.stats.num_rules_to_upgrade_total).toBe(1);
-            expect(reviewResponse.stats.num_rules_with_conflicts).toBe(0);
-            expect(reviewResponse.stats.num_rules_with_non_solvable_conflicts).toBe(0);
+            expect(reviewResponse.stats.num_rules_with_conflicts).toBe(1);
+            expect(reviewResponse.stats.num_rules_with_non_solvable_conflicts).toBe(1);
           });
         });
       });
@@ -611,9 +611,9 @@ export default ({ getService }: FtrProviderContext): void => {
               has_base_version: true,
             });
 
-            expect(reviewResponse.rules[0].diff.num_fields_with_updates).toBe(2); // `version` is considered an updated field
-            expect(reviewResponse.rules[0].diff.num_fields_with_conflicts).toBe(1);
-            expect(reviewResponse.rules[0].diff.num_fields_with_non_solvable_conflicts).toBe(1);
+            expect(reviewResponse.rules[0].diff.num_fields_with_updates).toBe(2); // `version` is also considered an updated field
+            expect(reviewResponse.rules[0].diff.num_fields_with_conflicts).toBe(2); // `type` is also considered to be a conflict
+            expect(reviewResponse.rules[0].diff.num_fields_with_non_solvable_conflicts).toBe(2);
 
             expect(reviewResponse.stats.num_rules_to_upgrade_total).toBe(1);
             expect(reviewResponse.stats.num_rules_with_conflicts).toBe(1);