[Security Solution] Users unable to upgrade prebuilt rules after switching to save query

[maximpn]

Epic: #174168

Summary

Users unable to upgrade custom query prebuilt rules after customizing rule's query by saving it's query i.e. converting rule to saved_query type.

Both UI and API don't support upgrading custom query rules converted to saved query rules.

Steps to reproduce

• Ensure the prebuiltRulesCustomizationEnabled feature flag is enabled
• Allow internal APIs via adding server.restrictInternalApis: false to kibana.dev.yaml
• Clear Elasticsearch data
• Run Elasticsearch and Kibana locally (do not open Kibana in a web browser)
• Install an outdated version of the security_detection_engine Fleet package

curl -X POST --user elastic:changeme  -H 'Content-Type: application/json' -H 'kbn-xsrf: 123' -H "elastic-api-version: 2023-10-31" -d '{"force":true}' http://localhost:5601/kbn/api/fleet/epm/packages/security_detection_engine/8.14.1

• Install prebuilt rules

curl -X POST --user elastic:changeme  -H 'Content-Type: application/json' -H 'kbn-xsrf: 123' -H "elastic-api-version: 1" -d '{"mode":"ALL_RULES"}' http://localhost:5601/kbn/internal/detection_engine/prebuilt_rules/installation/_perform

• Open some custom query rule for editing, for example AdminSDHolder Backdoor and covert it to saved_query rule type by saving its KQL query and check Load saved query "<saved query name>" dynamically on each rule execution checkbox.

• Try to upgrade the rule via UI

ER: Rule upgrades without issues. It has saved_query or query type depending on what user selected in rule upgrade flyout while editing KQL query.
AR:

• Rule Upgrade flyout doesn't allow to save resolved conflict for KQL query. A error appears in the console.
• API fails with an error when KQL query doesn't have conflicts and UI allows to upgrade the rule.

Screenshots

Screen.Recording.2025-02-03.at.15.35.57.mov

API errors

{"statusCode":400,"error":"Bad Request","message":"[request body]: rules.0.fields.kql_query.resolved_value.type: Invalid literal value, expected \"inline_query\", rules.0.fields.kql_query.resolved_value.query: Required, rules.0.fields.kql_query.resolved_value.language: Required, rules.0.fields.kql_query.resolved_value.filters: Required"}

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[banderror]

@maximpn Thanks for catching this bug. I don't think it's a critical one since the affected feature hasn't been released yet. But I think it's a high impact one that we should try to fix before the first release of Milestone 3. Fixing it would be the 2nd priority right after finalizing the upgrade test coverage.