[Security Solution] Fixes exception item comment validation on newline chars \n

[dhurley14]

Summary

Fixes: #201820

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Unit or functional tests were updated or added to match the most common scenarios
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines

[nicpenning]

👀

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[dhurley14]

/ci

[dhurley14]

CI failing due to this test: #203477

[maximpn]

@dhurley14 Thanks for addressing the comments 🙏

It looks good to go. @xcrzx do you have any objections?

[nkhristinin]

LGTM!

[xcrzx]

LGTM 👍

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 560a533

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
integrationAssistant	472	473	+1
inventory	256	257	+1
securitySolution	6348	6349	+1
total			+3

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
@kbn/zod-helpers	10	13	+3

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	14.7MB	14.7MB	+1.1KB

Unknown metric groups

API count

id	before	after	diff
@kbn/zod-helpers	20	23	+3

History

• 💔 Build #258521 failed 624c48c
• 💔 Build #258479 failed 624c48c
• 💔 Build #258420 failed 854b593
• 💔 Build #257216 failed f295332
• 💚 Build #256982 succeeded 09b275e
• 💚 Build #256888 succeeded a8f3428

cc @dhurley14

[pmuellr]

This appears to be a change to some SIEM rule type parameters, where the schema is now a little more lenient? Basically, the schema bits "pattern": "^(?! *$).+$" have been removed from some parameter properties.

In terms of serverless BWC/ZDT, this seems "safe" from an upgrade POV (making this less lenient can be a problem). But roll back? What happens if this updated is deployed for some amount of time, and then we determine we need to roll back to the previous code. I'm guessing they would see the same errors they saw before, which is obviously fine.

Thought I'd double-check those assumptions before approving.

[dhurley14]

@pmuellr great questions!

This appears to be a change to some SIEM rule type parameters, where the schema is now a little more lenient?

Yes we have a better system in place for ensuring strings passed to certain parameters are not empty strings and do not fail validation when newline chars are included. This same regex was used in places where free-text fields were not used, however the team felt it better to replace all of the instances of the regex with this new trim function. Which I suppose could be considered more lenient!

What happens if this updated is deployed for some amount of time, and then we determine we need to roll back to the previous code

Great question - If these changes are deployed and then subsequently rolled back, we would enter into a similar situation as an upgrade from 8.15 to 8.16 where customers who had previously added newline chars would have errors in the UI, specifically in the exceptions UI.

[pmuellr]

What happens if this updated is deployed for some amount of time, and then we determine we need to roll back to the previous code

If these changes are deployed and then subsequently rolled back, we would enter into a similar situation as an upgrade from 8.15 to 8.16 where customers who had previously added newline chars would have errors in the UI, specifically in the exceptions UI.

Ya, so if you go back to the buggy release, you'll see the bugs. Hard to imagine that's fixable, really, even with an "intermediate" release - or it would not be easy (probably involving some backward-compatible migration). Seems fine to me.

thx!

[pmuellr]

ResponseOps changes LGTM, based on comments posted.

[kibanamachine]

Starting backport for target branches: 8.16, 8.17, 8.x

https://github.com/elastic/kibana/actions/runs/12265712482

[kibanamachine]

💔 All backports failed

Status	Branch	Result
❌	8.16	Backport failed because of merge conflicts You might need to backport the following PRs to 8.16: - [Security Assistant] Fix animation border color of security AI assistant (#202319) - [Infra] Fix call to service api (#203451)
❌	8.17	Backport failed because of merge conflicts
❌	8.x	Backport failed because of merge conflicts You might need to backport the following PRs to 8.x: - remove redux tools from presentation_utils plugin (#197891) - [Security Solution][Expandable flyout] Introducing Flyout history in document flyout (#184970) - Support incoming Preconfigured Endpoints (#203473) - [dashboard] remove legacy embeddable client migrations (#203669) - Upgrade express 4.21.1→ 4.21.2 (#203504) - [Infra][ObsUX] Hosts & Container Logs only overview (#202992) - [SecuritySolution] Fix serviceEntityStoreEnabled experimental flag initial value (#203573) - [Security Assistant] Fix animation border color of security AI assistant (#202319)

Manual backport

To create the backport manually run:

node scripts/backport --pr 202063

Questions ?

Please refer to the Backport tool documentation

[dhurley14]

💚 All backports created successfully

Status	Branch	Result
✅	8.x
✅	8.17
✅	8.16

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

[kibanamachine]

Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync.