[Security Solution] Incorrect Rule Status Displayed in Details Flyout After Reinstalling a Prebuilt Rule

[pborgonovi]

Describe the bug:

When a prebuilt rule is deleted and then reinstalled, clicking View Details shows the correct status in the Flyout. However, clicking the rule name in the Alerts table incorrectly shows the rule as “deleted” in the Details flyout.

Kibana/Elasticsearch Stack version:

8.17

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Alerts table

Steps to reproduce:

1. Navigate to Rules Management and identify a prebuilt rule that has generated alerts.
2. Delete the rule.
3. Reinstall the same rule.
4. Go to the Alerts tab and locate alerts generated by the reinstalled rule.
5. Perform the following actions:

• Click View Details.
• Click the rule name directly from the Alerts table.

Current behavior:

• Clicking View Details correctly shows the rule status.
• Clicking the rule name directly in the Alerts table causes the View Details flyout to incorrectly display the rule as “deleted.”

Expected behavior:

• The View Details flyout should not display the rule as “deleted” if it has been reinstalled.

Screenshots (if relevant):

Screen.Recording.2024-12-04.at.10.54.20.AM.mov

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-detection-engine (Team:Detection Engine)

[yctercero]

Hey @pborgonovi - I think this would be @elastic/security-detection-rule-management

[banderror]

@pborgonovi We don't own this flyout either 🙂

It looks like the flyout references rules by their object ids. When you reinstall it, the id changes, and you technically get a new rule, not the same one. That said, the UX could be improved for prebuilt rules.

I'll reassign to @elastic/security-threat-hunting-investigations.