[Security Solution] Adds extra cypress and integration tests for setup guide field

x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/model/rule_assets/prebuilt_rule_asset.ts

@@ -9,7 +9,6 @@ import * as z from 'zod';
 import {
   RelatedIntegrationArray,
   RequiredFieldArray,
-  SetupGuide,
   RuleSignatureId,
   RuleVersion,
   BaseCreateProps,
@@ -37,6 +36,5 @@ export const PrebuiltRuleAsset = BaseCreateProps.and(TypeSpecificCreateProps).an
     version: RuleVersion,
     related_integrations: RelatedIntegrationArray.optional(),
     required_fields: RequiredFieldArray.optional(),
-    setup: SetupGuide.optional(),
   })
 );

x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/basic_license_essentials_tier/export_rules.ts

@@ -8,6 +8,7 @@
 import expect from 'expect';
 
 import { DETECTION_ENGINE_RULES_URL } from '@kbn/security-solution-plugin/common/constants';
+import { BaseDefaultableFields } from '@kbn/security-solution-plugin/common/api/detection_engine';
 import { FtrProviderContext } from '../../../../../ftr_provider_context';
 import { binaryToString, getCustomQueryRuleParams } from '../../../utils';
 import {
@@ -20,6 +21,7 @@ export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const log = getService('log');
   const es = getService('es');
+  const securitySolutionApi = getService('securitySolutionApi');
 
   describe('@ess @serverless export_rules', () => {
     describe('exporting rules', () => {
@@ -63,6 +65,24 @@ export default ({ getService }: FtrProviderContext): void => {
         expect(exportedRule).toMatchObject(ruleToExport);
       });
 
+      it('should export defaultable fields when values are set', async () => {
+        const defaultableFields: BaseDefaultableFields = {
+          setup: '# some setup markdown',
+        };
+        const ruleToExport = getCustomQueryRuleParams(defaultableFields);
+
+        await securitySolutionApi.createRule({ body: ruleToExport });
+
+        const { body } = await securitySolutionApi
+          .exportRules({ query: {}, body: null })
+          .expect(200)
+          .parse(binaryToString);
+
+        const exportedRule = JSON.parse(body.toString().split(/\n/)[0]);
+
+        expect(exportedRule).toMatchObject(defaultableFields);
+      });
+
       it('should have export summary reflecting a number of rules', async () => {
         await createRule(supertest, log, getCustomQueryRuleParams());
 

x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_import_export/basic_license_essentials_tier/import_rules.ts

@@ -8,6 +8,7 @@
 import expect from 'expect';
 
 import { DETECTION_ENGINE_RULES_URL } from '@kbn/security-solution-plugin/common/constants';
+import { BaseDefaultableFields } from '@kbn/security-solution-plugin/common/api/detection_engine';
 import { FtrProviderContext } from '../../../../../ftr_provider_context';
 import { getCustomQueryRuleParams, combineToNdJson, fetchRule } from '../../../utils';
 import {
@@ -21,6 +22,7 @@ export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const log = getService('log');
   const es = getService('es');
+  const securitySolutionApi = getService('securitySolutionApi');
 
   describe('@ess @serverless import_rules', () => {
     describe('importing rules with an index', () => {
@@ -135,6 +137,30 @@ export default ({ getService }: FtrProviderContext): void => {
         expect(body.errors[0].error.message).toBe('from: Failed to parse date-math expression');
       });
 
+      it('should be able to import rules with defaultable fields', async () => {
+        const defaultableFields: BaseDefaultableFields = {
+          setup: '# some setup markdown',
+        };
+        const ruleToImport = getCustomQueryRuleParams({
+          ...defaultableFields,
+          rule_id: 'rule-1',
+        });
+        const ndjson = combineToNdJson(ruleToImport);
+
+        await securitySolutionApi
+          .importRules({ query: {} })
+          .attach('file', Buffer.from(ndjson), 'rules.ndjson')
+          .expect(200);
+
+        const { body: importedRule } = await securitySolutionApi
+          .readRule({
+            query: { rule_id: 'rule-1' },
+          })
+          .expect(200);
+
+        expect(importedRule).toMatchObject(ruleToImport);
+      });
+
       it('should be able to import two rules', async () => {
         const ndjson = combineToNdJson(
           getCustomQueryRuleParams({

x-pack/test/security_solution_cypress/cypress/data/detection_engine.ts

@@ -25,6 +25,7 @@ import type {
   RuleName,
   RuleReferenceArray,
   RuleTagArray,
+  SetupGuide,
 } from '@kbn/security-solution-plugin/common/api/detection_engine';
 
 interface RuleFields {
@@ -44,6 +45,7 @@ interface RuleFields {
   threat: Threat;
   threatSubtechnique: ThreatSubtechnique;
   threatTechnique: ThreatTechnique;
+  setup: SetupGuide;
 }
 
 export const ruleFields: RuleFields = {
@@ -60,6 +62,7 @@ export const ruleFields: RuleFields = {
   ],
   falsePositives: ['False1', 'False2'],
   investigationGuide: '# test markdown',
+  setup: '# test setup markdown',
   investigationFields: {
     field_names: ['agent.hostname'],
   },

x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/common_flows.cy.ts

@@ -15,7 +15,11 @@ import {
   RULE_NAME_INPUT,
   SCHEDULE_CONTINUE_BUTTON,
 } from '../../../../screens/create_new_rule';
-import { RULE_NAME_HEADER } from '../../../../screens/rule_details';
+import {
+  DESCRIPTION_SETUP_GUIDE_BUTTON,
+  DESCRIPTION_SETUP_GUIDE_CONTENT,
+  RULE_NAME_HEADER,
+} from '../../../../screens/rule_details';
 import { createTimeline } from '../../../../tasks/api_calls/timelines';
 import { deleteAlertsAndRules } from '../../../../tasks/api_calls/common';
 import {
@@ -30,6 +34,7 @@ import {
   fillRiskScore,
   fillRuleName,
   fillRuleTags,
+  fillSetup,
   fillSeverity,
   fillThreat,
   fillThreatSubtechnique,
@@ -75,6 +80,7 @@ describe('Common rule creation flows', { tags: ['@ess', '@serverless'] }, () =>
     fillThreatSubtechnique();
     fillCustomInvestigationFields();
     fillNote();
+    fillSetup();
     cy.get(ABOUT_CONTINUE_BTN).click();
 
     cy.log('Filling schedule section');
@@ -95,5 +101,8 @@ describe('Common rule creation flows', { tags: ['@ess', '@serverless'] }, () =>
 
     // UI redirects to rule creation page of a created rule
     cy.get(RULE_NAME_HEADER).should('contain', ruleFields.ruleName);
+
+    cy.get(DESCRIPTION_SETUP_GUIDE_BUTTON).click();
+    cy.get(DESCRIPTION_SETUP_GUIDE_CONTENT).should('contain', ruleFields.setup);
   });
 });

x-pack/test/security_solution_cypress/cypress/screens/create_new_rule.ts

@@ -132,6 +132,8 @@ export const INPUT = '[data-test-subj="input"]';
 export const INVESTIGATION_NOTES_TEXTAREA =
   '[data-test-subj="detectionEngineStepAboutRuleNote"] textarea';
 
+export const SETUP_GUIDE_TEXTAREA = '[data-test-subj="detectionEngineStepAboutRuleSetup"] textarea';
+
 export const FALSE_POSITIVES_INPUT =
   '[data-test-subj="detectionEngineStepAboutRuleFalsePositives"] input';
 

x-pack/test/security_solution_cypress/cypress/screens/rule_details.ts

@@ -153,3 +153,7 @@ export const ALERT_SUPPRESSION_INSUFFICIENT_LICENSING_ICON =
 
 export const HIGHLIGHTED_ROWS_IN_TABLE =
   '[data-test-subj="euiDataGridBody"] .alertsTableHighlightedRow';
+
+export const DESCRIPTION_SETUP_GUIDE_BUTTON = '[data-test-subj="stepAboutDetailsToggle-setup"]';
+
+export const DESCRIPTION_SETUP_GUIDE_CONTENT = '[data-test-subj="stepAboutDetailsSetupContent"]';

x-pack/test/security_solution_cypress/cypress/tasks/create_new_rule.ts

@@ -125,6 +125,7 @@ import {
   ALERTS_INDEX_BUTTON,
   INVESTIGATIONS_INPUT,
   QUERY_BAR_ADD_FILTER,
+  SETUP_GUIDE_TEXTAREA,
 } from '../screens/create_new_rule';
 import {
   INDEX_SELECTOR,
@@ -203,6 +204,13 @@ export const fillNote = (note: string = ruleFields.investigationGuide) => {
   return note;
 };
 
+export const fillSetup = (setup: string = ruleFields.setup) => {
+  cy.get(SETUP_GUIDE_TEXTAREA).clear({ force: true });
+  cy.get(SETUP_GUIDE_TEXTAREA).type(setup);
+
+  return setup;
+};
+
 export const fillMitre = (mitreAttacks: Threat[]) => {
   let techniqueIndex = 0;
   let subtechniqueInputIndex = 0;