[Security Solution] Bulk editing rule custom highlighted fields

[e40pud]

Resolves: https://github.com/elastic/kibana/issues/164301 Resolves: https://github.com/elastic/security-team/issues/8958

Summary

With these changes we introduce a new feature - Bulk custom highlighted fields update. It works similarly to bulk tags and indices update.

Here is the overview of the work that has been done:

https://github.com/elastic/kibana/assets/2700761/b1ba6670-9984-43c9-9f1e-e18a2b7f071f

Checklist

Delete any items that are not applicable to this PR.

• [x] Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• [ ] Documentation was added for features that require explanation or tutorials
  • [ ] https://github.com/elastic/security-docs/issues/5090
• [x] Unit or functional tests were updated or added to match the most common scenarios
• [ ] Flaky Test Runner was used on any tests changed
  • [ ] ESS 100 times
  • [ ] Serverless 100 times

[e40pud]

/ci

[e40pud]

@elasticmachine merge upstream

[e40pud]

@elasticmachine merge upstream

[e40pud]

/ci

[e40pud]

@elasticmachine merge upstream

[e40pud]

@elasticmachine merge upstream

[e40pud]

@elasticmachine merge upstream

[e40pud]

@elasticmachine merge upstream

[e40pud]

@elasticmachine merge upstream

[e40pud]

@elasticmachine merge upstream

[e40pud]

@elasticmachine merge upstream

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-engine (Team:Detection Engine)

[e40pud]

@elasticmachine merge upstream

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[e40pud]

@elasticmachine merge upstream

[e40pud]

@elasticmachine merge upstream

[e40pud]

@elasticmachine merge upstream

[e40pud]

@elasticmachine merge upstream

[e40pud]

@elasticmachine merge upstream

[e40pud]

@elasticmachine merge upstream

[e40pud]

Left a couple questions and one nit but overall looks good @e40pud! I pulled down and tested all the edge cases I could think of. This is the first time I've seen the feature flag stuff used so heavily for the backend code, I think it's a pretty good way to go about it albeit adding a bit of complexity to the implementation as (correct me if I'm wrong) we aren't able to enable/disable routes themselves using the flags.

Yes, I had to add extra complexity in order to be able to block API behind feature flag. I think we can benefit from ti in future with other features that require adding public API and needs to be hidden for some time.

[e40pud]

Overall looks great! Appreciate the updates to the tests and additional tests too. A few small nits too.

I do believe we could simplify the code and have some performance improvements if we introduce the logic for fetching and gathering the data view titles into the bulk_get_sources route, update the hook useBulkGetRulesSources to reflect the new server-side functionality, and remove the useGetAllIndexPatternsFromSources. This would also have the added benefit of reducing the number of hooks we need to maintain and test.

Hey @dhurley14, we discussed potential performance issue and limitations with ES|QL and ML rules.

To avoid those issues, we decided to go with the next solution for the list of fields available in "custom highlighted fields" flyout: the dropdown will include fields from the index patterns defined in Security Solution advanced settings (more details here).

This means, I will remove the route to fetch all indices for selected rules.

[kibana-ci]

:green_heart: Build Succeeded

• Buildkite Build
• Commit: 9e0524ffe1f880509bdd34dccc71b1be4f7aedc7

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	5466	5467	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	13.7MB	13.7MB	+18.1KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
securitySolution	83.1KB	83.3KB	+268.0B

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
securitySolution	518	519	+1

Total ESLint disabled count

id	before	after	diff
securitySolution	596	597	+1

History

• :broken_heart: Build #207443 failed 450296c5b391f91120f316dec0687d5e11a44573
• :yellow_heart: Build #206612 was flaky 8ad3a67cf3adeddb2508ba287a7a992b37e4ffb7
• :green_heart: Build #206549 succeeded 611c445bf4d30a8c6e1951bf7489e2d17953c93d
• :yellow_heart: Build #206052 was flaky 6c3c65e01d8390077deee2817f0885765f4ee855
• :broken_heart: Build #206030 failed d805d62569952aff3619b42eb16e483aa28524f8
• :yellow_heart: Build #205865 was flaky 411e618ab243cb6cd124c26f6ac99fac75264161

To update your PR or re-run it, just comment with: @elasticmachine merge upstream

cc @e40pud