[8.x] [Security Solution] Allow exporting of prebuilt rules via the API (#194498)

x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/bulk_actions/route.ts

@@ -281,7 +281,8 @@ export const performBulkActionRoute = (
                 rules.map(({ params }) => params.ruleId),
                 exporter,
                 request,
-                actionsClient
+                actionsClient,
+                config.experimentalFeatures.prebuiltRulesCustomizationEnabled
               );
 
               const responseBody = `${exported.rulesNdjson}${exported.exceptionLists}${exported.actionConnectors}${exported.exportDetails}`;

x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/export_rules/route.ts

@@ -15,7 +15,10 @@ import {
 } from '../../../../../../../common/api/detection_engine/rule_management';
 import type { SecuritySolutionPluginRouter } from '../../../../../../types';
 import type { ConfigType } from '../../../../../../config';
-import { getNonPackagedRulesCount } from '../../../logic/search/get_existing_prepackaged_rules';
+import {
+  getNonPackagedRulesCount,
+  getRulesCount,
+} from '../../../logic/search/get_existing_prepackaged_rules';
 import { getExportByObjectIds } from '../../../logic/export/get_export_by_object_ids';
 import { getExportAll } from '../../../logic/export/get_export_all';
 import { buildSiemResponse } from '../../../../routes/utils';
@@ -57,6 +60,8 @@ export const exportRulesRoute = (
 
         const client = getClient({ includedHiddenTypes: ['action'] });
         const actionsExporter = getExporter(client);
+        const { prebuiltRulesCustomizationEnabled } = config.experimentalFeatures;
+
         try {
           const exportSizeLimit = config.maxRuleImportExportSize;
           if (request.body?.objects != null && request.body.objects.length > exportSizeLimit) {
@@ -65,10 +70,19 @@ export const exportRulesRoute = (
               body: `Can't export more than ${exportSizeLimit} rules`,
             });
           } else {
-            const nonPackagedRulesCount = await getNonPackagedRulesCount({
-              rulesClient,
-            });
-            if (nonPackagedRulesCount > exportSizeLimit) {
+            let rulesCount = 0;
+
+            if (prebuiltRulesCustomizationEnabled) {
+              rulesCount = await getRulesCount({
+                rulesClient,
+                filter: '',
+              });
+            } else {
+              rulesCount = await getNonPackagedRulesCount({
+                rulesClient,
+              });
+            }
+            if (rulesCount > exportSizeLimit) {
               return siemResponse.error({
                 statusCode: 400,
                 body: `Can't export more than ${exportSizeLimit} rules`,
@@ -84,14 +98,16 @@ export const exportRulesRoute = (
                   request.body.objects.map((obj) => obj.rule_id),
                   actionsExporter,
                   request,
-                  actionsClient
+                  actionsClient,
+                  prebuiltRulesCustomizationEnabled
                 )
               : await getExportAll(
                   rulesClient,
                   exceptionsClient,
                   actionsExporter,
                   request,
-                  actionsClient
+                  actionsClient,
+                  prebuiltRulesCustomizationEnabled
                 );
 
           const responseBody = request.query.exclude_export_details

x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_all.ts

@@ -11,7 +11,7 @@ import type { ISavedObjectsExporter, KibanaRequest } from '@kbn/core/server';
 import type { ExceptionListClient } from '@kbn/lists-plugin/server';
 import type { RulesClient } from '@kbn/alerting-plugin/server';
 import type { ActionsClient } from '@kbn/actions-plugin/server';
-import { getNonPackagedRules } from '../search/get_existing_prepackaged_rules';
+import { getNonPackagedRules, getRules } from '../search/get_existing_prepackaged_rules';
 import { getExportDetailsNdjson } from './get_export_details_ndjson';
 import { transformAlertsToRules } from '../../utils/utils';
 import { getRuleExceptionsForExport } from './get_export_rule_exceptions';
@@ -23,14 +23,18 @@ export const getExportAll = async (
   exceptionsClient: ExceptionListClient | undefined,
   actionsExporter: ISavedObjectsExporter,
   request: KibanaRequest,
-  actionsClient: ActionsClient
+  actionsClient: ActionsClient,
+  prebuiltRulesCustomizationEnabled?: boolean
 ): Promise<{
   rulesNdjson: string;
   exportDetails: string;
   exceptionLists: string | null;
   actionConnectors: string;
+  prebuiltRulesCustomizationEnabled?: boolean;
 }> => {
-  const ruleAlertTypes = await getNonPackagedRules({ rulesClient });
+  const ruleAlertTypes = prebuiltRulesCustomizationEnabled
+    ? await getRules({ rulesClient, filter: '' })
+    : await getNonPackagedRules({ rulesClient });
   const rules = transformAlertsToRules(ruleAlertTypes);
 
   const exportRules = rules.map((r) => transformRuleToExportableFormat(r));

x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_by_object_ids.ts

@@ -29,15 +29,21 @@ export const getExportByObjectIds = async (
   ruleIds: string[],
   actionsExporter: ISavedObjectsExporter,
   request: KibanaRequest,
-  actionsClient: ActionsClient
+  actionsClient: ActionsClient,
+  prebuiltRulesCustomizationEnabled?: boolean
 ): Promise<{
   rulesNdjson: string;
   exportDetails: string;
   exceptionLists: string | null;
   actionConnectors: string;
+  prebuiltRulesCustomizationEnabled?: boolean;
 }> =>
   withSecuritySpan('getExportByObjectIds', async () => {
-    const rulesAndErrors = await fetchRulesByIds(rulesClient, ruleIds);
+    const rulesAndErrors = await fetchRulesByIds(
+      rulesClient,
+      ruleIds,
+      prebuiltRulesCustomizationEnabled
+    );
     const { rules, missingRuleIds } = rulesAndErrors;
 
     // Retrieve exceptions
@@ -76,7 +82,8 @@ interface FetchRulesResult {
 
 const fetchRulesByIds = async (
   rulesClient: RulesClient,
-  ruleIds: string[]
+  ruleIds: string[],
+  prebuiltRulesCustomizationEnabled?: boolean
 ): Promise<FetchRulesResult> => {
   // It's important to avoid too many clauses in the request otherwise ES will fail to process the request
   // with `too_many_clauses` error (see https://github.com/elastic/kibana/issues/170015). The clauses limit
@@ -110,7 +117,7 @@ const fetchRulesByIds = async (
 
         return matchingRule != null &&
           hasValidRuleType(matchingRule) &&
-          matchingRule.params.immutable !== true
+          (prebuiltRulesCustomizationEnabled || matchingRule.params.immutable !== true)
           ? {
               rule: transformRuleToExportableFormat(internalRuleToAPIResponse(matchingRule)),
             }

x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/trial_license_complete_tier/index.ts

@@ -10,5 +10,6 @@ import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 export default ({ loadTestFile }: FtrProviderContext): void => {
   describe('Rules Management - Prebuilt Rules - Update Prebuilt Rules Package', function () {
     loadTestFile(require.resolve('./is_customized_calculation'));
+    loadTestFile(require.resolve('./rules_export'));
   });
 };