[Security Solution] Fixes incorrect from field transform logic in upgrade/_perform route

x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/api/perform_rule_upgrade/diffable_rule_fields_mappings.test.ts

@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { transformDiffableFieldValues } from './diffable_rule_fields_mappings';
+
+describe('transformDiffableFieldValues', () => {
+  it('transforms rule_schedule into "from" value', () => {
+    const result = transformDiffableFieldValues('from', { interval: '5m', lookback: '4m' });
+    expect(result).toEqual({ type: 'TRANSFORMED_FIELD', value: 'now-540s' });
+  });
+});

x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/api/perform_rule_upgrade/diffable_rule_fields_mappings.ts

@@ -5,6 +5,7 @@
  * 2.0.
  */
 import { get, has } from 'lodash';
+import moment from 'moment';
 import type {
   RuleSchedule,
   DataSourceIndexPatterns,
@@ -15,6 +16,7 @@ import type {
 } from '../../../../../../common/api/detection_engine';
 import { type AllFieldsDiff } from '../../../../../../common/api/detection_engine';
 import type { PrebuiltRuleAsset } from '../../model/rule_assets/prebuilt_rule_asset';
+import { parseInterval } from '../../../rule_types/utils/utils';
 
 /**
  * Retrieves and transforms the value for a specific field from a DiffableRule group.
@@ -201,7 +203,10 @@ export const transformDiffableFieldValues = (
   diffableFieldValue: RuleSchedule | InlineKqlQuery | unknown
 ): TransformValuesReturnType => {
   if (fieldName === 'from' && isRuleSchedule(diffableFieldValue)) {
-    return { type: 'TRANSFORMED_FIELD', value: `now-${diffableFieldValue.lookback}` };
+    const interval = parseInterval(diffableFieldValue.interval) ?? moment.duration(0);
+    const parsedFrom = parseInterval(diffableFieldValue.lookback) ?? moment.duration(0);
+    const from = parsedFrom.asSeconds() + interval.asSeconds();
+    return { type: 'TRANSFORMED_FIELD', value: `now-${from}s` };
   } else if (fieldName === 'to') {
     return { type: 'TRANSFORMED_FIELD', value: `now` };
   } else if (fieldName === 'saved_id' && isInlineQuery(diffableFieldValue)) {