[Security Solution][Bulk actions]- Fix bulk actions data views behavior

x-pack/plugins/security_solution/server/lib/detection_engine/rules/bulk_actions/rule_params_modifier.test.ts

@@ -127,6 +127,36 @@ describe('ruleParamsModifier', () => {
       expect(editedRuleParams).toHaveProperty('dataViewId', undefined);
     });
 
+    test('should set dataViewId to undefined if overwrite_data_views=true on delete_index_patterns action', () => {
+      const editedRuleParams = ruleParamsModifier(
+        { dataViewId: 'test-data-view', index: ['test-*', 'index'] } as RuleAlertType['params'],
+        [
+          {
+            type: BulkActionEditType.delete_index_patterns,
+            value: ['index'],
+            overwrite_data_views: true,
+          },
+        ]
+      );
+      expect(editedRuleParams).toHaveProperty('dataViewId', undefined);
+      expect(editedRuleParams).toHaveProperty('index', ['test-*']);
+    });
+
+    test('should set dataViewId to undefined and index to undefined if overwrite_data_views=true on delete_index_patterns action and rule had no index patterns to begin with', () => {
+      const editedRuleParams = ruleParamsModifier(
+        { dataViewId: 'test-data-view', index: undefined } as RuleAlertType['params'],
+        [
+          {
+            type: BulkActionEditType.delete_index_patterns,
+            value: ['index'],
+            overwrite_data_views: true,
+          },
+        ]
+      );
+      expect(editedRuleParams).toHaveProperty('dataViewId', undefined);
+      expect(editedRuleParams).toHaveProperty('index', undefined);
+    });
+
     test('should throw error on adding index pattern if rule is of machine learning type', () => {
       expect(() =>
         ruleParamsModifier({ type: 'machine_learning' } as RuleAlertType['params'], [

x-pack/plugins/security_solution/server/lib/detection_engine/rules/bulk_actions/rule_params_modifier.ts

@@ -35,6 +35,10 @@ const applyBulkActionEditToRuleParams = (
         "Index patterns can't be added. Machine learning rule doesn't have index patterns property"
       );
 
+      if (ruleParams.dataViewId != null && !action.overwrite_data_views) {
+        break;
+      }
+
       if (action.overwrite_data_views) {
         ruleParams.dataViewId = undefined;
       }
@@ -48,6 +52,14 @@ const applyBulkActionEditToRuleParams = (
         "Index patterns can't be deleted. Machine learning rule doesn't have index patterns property"
       );
 
+      if (ruleParams.dataViewId != null && !action.overwrite_data_views) {
+        break;
+      }
+
+      if (action.overwrite_data_views) {
+        ruleParams.dataViewId = undefined;
+      }
+
       if (ruleParams.index) {
         ruleParams.index = deleteItemsFromArray(ruleParams.index, action.value);
       }
@@ -59,6 +71,10 @@ const applyBulkActionEditToRuleParams = (
         "Index patterns can't be overwritten. Machine learning rule doesn't have index patterns property"
       );
 
+      if (ruleParams.dataViewId != null && !action.overwrite_data_views) {
+        break;
+      }
+
       if (action.overwrite_data_views) {
         ruleParams.dataViewId = undefined;
       }