[Security Solution] Allow exporting of prebuilt rules via the API (#1…

…94498)

## Summary

This PR introduces the backend functionality necessary to export
prebuilt rules via our existing export APIs:

1. Export Rules - POST /rules/_export 
2. Bulk Actions - POST /rules/_bulk_action 

The [Prebuilt Rule Customization
RFC](https://github.com/elastic/kibana/blob/main/x-pack/plugins/security_solution/docs/rfcs/detection_response/prebuilt_rules_customization.md)
goes into detail, and the export-specific issue is described
[here](#180167 (comment)).


## Steps to Review
1. Enable the Feature Flag: `prebuiltRulesCustomizationEnabled`
1. Install the prebuilt rules package via fleet  
1. Install some prebuilt rules, and obtain a prebuilt rule's `rule_id`,
e.g. `ac8805f6-1e08-406c-962e-3937057fa86f`
1. Export the rule via the export route, e.g. (in Dev Tools):

        POST kbn:api/detection_engine/rules/_export
        
Note that you may need to use the CURL equivalent for these requests, as
the dev console does not seem to handle file responses:

curl --location --request POST
'http://localhost:5601/api/detection_engine/rules/_export?exclude_export_details=true&file_name=exported_rules.ndjson'
\
        --header 'kbn-xsrf: true' \
        --header 'elastic-api-version: 2023-10-31' \
        --header 'Authorization: Basic waefoijawoefiajweo=='

1. Export the rule via bulk actions, e.g. (in Dev Tools):

        POST kbn:api/detection_engine/rules/_bulk_action
        {
          "action": "export"
        }
        
1. Observe that the exported rules' fields are correct, especially
`rule_source` and `immutable` (see tests added here for examples).

### Checklist

- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/bulk_actions/route.ts

@@ -281,7 +281,8 @@ export const performBulkActionRoute = (
                 rules.map(({ params }) => params.ruleId),
                 exporter,
                 request,
-                actionsClient
+                actionsClient,
+                config.experimentalFeatures.prebuiltRulesCustomizationEnabled
               );
 
               const responseBody = `${exported.rulesNdjson}${exported.exceptionLists}${exported.actionConnectors}${exported.exportDetails}`;

x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/export_rules/route.ts

@@ -15,7 +15,10 @@ import {
 } from '../../../../../../../common/api/detection_engine/rule_management';
 import type { SecuritySolutionPluginRouter } from '../../../../../../types';
 import type { ConfigType } from '../../../../../../config';
-import { getNonPackagedRulesCount } from '../../../logic/search/get_existing_prepackaged_rules';
+import {
+  getNonPackagedRulesCount,
+  getRulesCount,
+} from '../../../logic/search/get_existing_prepackaged_rules';
 import { getExportByObjectIds } from '../../../logic/export/get_export_by_object_ids';
 import { getExportAll } from '../../../logic/export/get_export_all';
 import { buildSiemResponse } from '../../../../routes/utils';
@@ -57,6 +60,8 @@ export const exportRulesRoute = (
 
         const client = getClient({ includedHiddenTypes: ['action'] });
         const actionsExporter = getExporter(client);
+        const { prebuiltRulesCustomizationEnabled } = config.experimentalFeatures;
+
         try {
           const exportSizeLimit = config.maxRuleImportExportSize;
           if (request.body?.objects != null && request.body.objects.length > exportSizeLimit) {
@@ -65,10 +70,19 @@ export const exportRulesRoute = (
               body: `Can't export more than ${exportSizeLimit} rules`,
             });
           } else {
-            const nonPackagedRulesCount = await getNonPackagedRulesCount({
-              rulesClient,
-            });
-            if (nonPackagedRulesCount > exportSizeLimit) {
+            let rulesCount = 0;
+
+            if (prebuiltRulesCustomizationEnabled) {
+              rulesCount = await getRulesCount({
+                rulesClient,
+                filter: '',
+              });
+            } else {
+              rulesCount = await getNonPackagedRulesCount({
+                rulesClient,
+              });
+            }
+            if (rulesCount > exportSizeLimit) {
               return siemResponse.error({
                 statusCode: 400,
                 body: `Can't export more than ${exportSizeLimit} rules`,
@@ -84,14 +98,16 @@ export const exportRulesRoute = (
                   request.body.objects.map((obj) => obj.rule_id),
                   actionsExporter,
                   request,
-                  actionsClient
+                  actionsClient,
+                  prebuiltRulesCustomizationEnabled
                 )
               : await getExportAll(
                   rulesClient,
                   exceptionsClient,
                   actionsExporter,
                   request,
-                  actionsClient
+                  actionsClient,
+                  prebuiltRulesCustomizationEnabled
                 );
 
           const responseBody = request.query.exclude_export_details

x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_all.ts

@@ -11,7 +11,7 @@ import type { ISavedObjectsExporter, KibanaRequest } from '@kbn/core/server';
 import type { ExceptionListClient } from '@kbn/lists-plugin/server';
 import type { RulesClient } from '@kbn/alerting-plugin/server';
 import type { ActionsClient } from '@kbn/actions-plugin/server';
-import { getNonPackagedRules } from '../search/get_existing_prepackaged_rules';
+import { getNonPackagedRules, getRules } from '../search/get_existing_prepackaged_rules';
 import { getExportDetailsNdjson } from './get_export_details_ndjson';
 import { transformAlertsToRules } from '../../utils/utils';
 import { getRuleExceptionsForExport } from './get_export_rule_exceptions';
@@ -23,14 +23,18 @@ export const getExportAll = async (
   exceptionsClient: ExceptionListClient | undefined,
   actionsExporter: ISavedObjectsExporter,
   request: KibanaRequest,
-  actionsClient: ActionsClient
+  actionsClient: ActionsClient,
+  prebuiltRulesCustomizationEnabled?: boolean
 ): Promise<{
   rulesNdjson: string;
   exportDetails: string;
   exceptionLists: string | null;
   actionConnectors: string;
+  prebuiltRulesCustomizationEnabled?: boolean;
 }> => {
-  const ruleAlertTypes = await getNonPackagedRules({ rulesClient });
+  const ruleAlertTypes = prebuiltRulesCustomizationEnabled
+    ? await getRules({ rulesClient, filter: '' })
+    : await getNonPackagedRules({ rulesClient });
   const rules = transformAlertsToRules(ruleAlertTypes);
 
   const exportRules = rules.map((r) => transformRuleToExportableFormat(r));

x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/export/get_export_by_object_ids.ts

@@ -29,15 +29,21 @@ export const getExportByObjectIds = async (
   ruleIds: string[],
   actionsExporter: ISavedObjectsExporter,
   request: KibanaRequest,
-  actionsClient: ActionsClient
+  actionsClient: ActionsClient,
+  prebuiltRulesCustomizationEnabled?: boolean
 ): Promise<{
   rulesNdjson: string;
   exportDetails: string;
   exceptionLists: string | null;
   actionConnectors: string;
+  prebuiltRulesCustomizationEnabled?: boolean;
 }> =>
   withSecuritySpan('getExportByObjectIds', async () => {
-    const rulesAndErrors = await fetchRulesByIds(rulesClient, ruleIds);
+    const rulesAndErrors = await fetchRulesByIds(
+      rulesClient,
+      ruleIds,
+      prebuiltRulesCustomizationEnabled
+    );
     const { rules, missingRuleIds } = rulesAndErrors;
 
     // Retrieve exceptions
@@ -76,7 +82,8 @@ interface FetchRulesResult {
 
 const fetchRulesByIds = async (
   rulesClient: RulesClient,
-  ruleIds: string[]
+  ruleIds: string[],
+  prebuiltRulesCustomizationEnabled?: boolean
 ): Promise<FetchRulesResult> => {
   // It's important to avoid too many clauses in the request otherwise ES will fail to process the request
   // with `too_many_clauses` error (see https://github.com/elastic/kibana/issues/170015). The clauses limit
@@ -110,7 +117,7 @@ const fetchRulesByIds = async (
 
         return matchingRule != null &&
           hasValidRuleType(matchingRule) &&
-          matchingRule.params.immutable !== true
+          (prebuiltRulesCustomizationEnabled || matchingRule.params.immutable !== true)
           ? {
               rule: transformRuleToExportableFormat(internalRuleToAPIResponse(matchingRule)),
             }

x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/prebuilt_rule_customization/trial_license_complete_tier/index.ts

@@ -10,5 +10,6 @@ import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 export default ({ loadTestFile }: FtrProviderContext): void => {
   describe('Rules Management - Prebuilt Rules - Update Prebuilt Rules Package', function () {
     loadTestFile(require.resolve('./is_customized_calculation'));
+    loadTestFile(require.resolve('./rules_export'));
   });
 };