[Security Solution][Detections] Updating a FileSystem rule fails to update rule version

[jpdjere]

Related to: #139095

Summary

When a pre-built File System (In-memory) rule is updated (in x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules), the UI correctly displays the callout for the user to update the rule.

However, when the button is clicked, the API call fails to update the version of the rules (other fields are correctly updated), and therefore our business logic understands that the rule still needs updating, and the callout is still displayed.

API request:

PUT /api/detection_engine/rules/prepackaged

Steps to reproduce:

1. Install pre-packaged rules.
2. In x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules, modify a rule: update name, risk_score and any other fields, and bump up the version.
3. Navigate to the Rules page. The update callout should be visible on top.
4. Click on the Update 1 Elastic prebuilt rule button.
5. The rule should have all fields (except for version) updated. The callout should still be visible.

Expected behavior:

Once the update callout is displayed, and the user clicks on the Update 1 Elastic prebuilt rule button, the Rule should update all fields, including the bumped-up version.

The callout should then not be displayed anymore, as the rule needs no further update.

The saved object should have all fields (including version) correctly updated. Check with:

GET .kibana/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "type": "alert"
          }
        },
        {
          "term": {
            "alert.consumer": "siem"
          }
        },
        {
          "term": {
            "alert.params.ruleId": "{your-rule-id}"
          }
        }
      ]
    }
  }
}

Screenshots (if relevant):

Original unmodified rule and update callout:

Rule after updating, with updated name and risk score (but same version number)
Notice callout still visible.

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)