[Security Solution] Rule incorrectly retains customized status after reverting MITRE ATT&CK changes

[pborgonovi]

Description:

A prebuilt rule remains marked as “Customized” even after reverting a change to its MITRE ATT&CK technique, returning it to its original state.

Kibana/Elasticsearch Stack version:

VERSION: 9.0.0
BUILD: 82999
COMMIT: 00c67c3

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Prebuilt Rules

Pre requisites:

1. prebuiltRulesCustomizationEnabled feature flag is enabled
2. Prebuilt rules are available
3. At least 1 prebuilt rule has MITRE ATT&CK

Steps to reproduce:

1. Start with a prebuilt rule that includes a MITRE ATT&CK tactic and technique.
2. Edit the rule and remove the technique, then save the changes.

• The rule is now correctly marked as Customized.

3. Edit the rule again and add back the same technique that was removed, returning the rule to its original state.
4. Save the changes.

Current behavior:

The rule remains marked as Customized, even though its configuration matches the original prebuilt version.

Expected behavior:

Once the rule’s configuration matches the original prebuilt version (with no modifications), the rule should revert to its initial status as not customized.

Screenshots:

Screen.Recording.2025-01-24.at.9.28.30.AM.mov

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)