[Security Solution] Importing Prebuilt Rules Results in Rule ID Conflict Error

[pborgonovi]

Describe the bug:

When attempting to import an exported prebuilt rule (after customization), the system throws an error:
rule_id: "<rule_id>" already exists.

Kibana/Elasticsearch Stack version:

8.x

Current branch: 8.x  
Latest commit: 26bfdaef960 - [8.x] feat: update OTEL Node.js metrics dashboard (#199353) (#200810)  
Remote tracking: origin/8.x  
Status relative to remote: up to date (no pending commits)  

Steps to reproduce:

1. Export a prebuilt rule.
2. Customize the exported rule (e.g., modify its fields or parameters).
3. Import the customized rule back into Kibana.

Current behavior:

The import process throws an error: rule_id: "<rule_id>" already exists.

Expected behavior:

The import logic should:

• Recognize that the rule_id matches an existing prebuilt rule.
• Compare the imported rule’s version with the existing rule’s version.
• Dynamically calculate the rule_source and immutable fields as follows:
  -- If the rule_id and version match, allow the import and update the rule accordingly.
  -- If the rule_id matches but the version does not, treat the rule as prebuilt with an older version and mark it as:

{
  "immutable": true,
  "ruleSource": {
    "type": "external",
    "isCustomized": false
  }
}

-- If the rule has diverged (customized fields differ from the base version), mark it as:

{
  "immutable": true,
  "ruleSource": {
    "type": "external",
    "isCustomized": true
  }
}

-- If the rule_id does not match any known rule, treat it as a custom rule:

{
  "immutable": false,
  "ruleSource": {
    "type": "internal"
  }
}
}

Screenshots (if relevant):

Screen.Recording.2024-11-19.at.2.41.01.PM.mov

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[banderror]

@pborgonovi You should check the Overwrite existing detection rules with conflicting "rule_id" checkbox in order for it to work as expected.