[Security Solution] Allow users to edit setup field for custom rules

[dplumlee]

Summary

Addresses #173626

Adds a markdown component in the create and edit rule forms so that users are able to add their own setup guides to custom rules. Also updates the create and update rule schemas and route logic to handle these new cases through the API.

Flaky test run (internal)

Screenshots

Checklist

Delete any items that are not applicable to this PR.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
• This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)

For maintainers

• This was checked for breaking API changes and was labeled appropriately

[dplumlee]

/ci

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[jpdjere]

In x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/actions/duplicate_rule.ts, we have the following check:

export const duplicateRule = async ({ rule }: DuplicateRuleParams): Promise<InternalRuleCreate> => {
  // Generate a new static ruleId
  const ruleId = uuidv4();

  // If it's a prebuilt rule, reset Related Integrations, Required Fields and Setup Guide.
  // We do this because for now we don't allow the users to edit these fields for custom rules.
  const isPrebuilt = rule.params.immutable;
  const relatedIntegrations = isPrebuilt ? [] : rule.params.relatedIntegrations;
  const requiredFields = isPrebuilt ? [] : rule.params.requiredFields;
  const setup = isPrebuilt ? '' : rule.params.setup;
[...]

We can get rid of that check for setup now.

[jpdjere]

In https://github.com/elastic/kibana/blob/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/normalization/rule_converters.ts

The types of the arguments of convertCreateAPIToInternalSchema and convertPatchAPIToInternalSchema can be simplified:

export const convertCreateAPIToInternalSchema = (
  input: RuleCreateProps & {
    related_integrations?: RelatedIntegrationArray;
    required_fields?: RequiredFieldArray;
    setup?: SetupGuide; /// <------- this can be removed since setup is now part of RuleCreateProps
  },
  immutable = false,
  defaultEnabled = true
): InternalRuleCreate => {

export const convertPatchAPIToInternalSchema = (
  nextParams: PatchRuleRequestBody & {
    related_integrations?: RelatedIntegrationArray;
    required_fields?: RequiredFieldArray;
    setup?: SetupGuide; /// <------- this can be removed since setup is now part of PatchRuleRequestBody
  },
  existingRule: SanitizedRule<RuleParams>
): InternalRuleUpdate => {

[rylnd]

@jpdjere asked the hard questions, here, but beyond those this LGTM!

[approksiu]

Looks good! Thanks @dplumlee!

[banderror]

@elasticmachine merge upstream

[dplumlee]

@elasticmachine merge upstream

[banderror]

@elasticmachine merge upstream

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 6a22680
• Cloud Deployment
• Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-178131-6a2268025423
• Security Deployment

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	17.0MB	17.0MB	+4.7KB

Canvas Sharable Runtime

The Canvas "shareable runtime" is an bundle produced to enable running Canvas workpads outside of Kibana. This bundle is included in third-party webpages that embed canvas and therefor should be as slim as possible.

id	before	after	diff
module count	-	5847	+5847
total size	-	6.7MB	+6.7MB

History

• 💔 Build #201655 failed eaa847d
• 💚 Build #201174 succeeded bfce090
• 💔 Build #200415 failed 7266ec8
• 💔 Build #200400 failed 7df93dc

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @dplumlee

[jpdjere]

Crossposting #179680 (comment). Follow up PR needed for a schema update.

cc @dplumlee