Allow security_rule objects to have rule IDs different from the object IDs

[xcrzx]

What does this PR do?

Change validation check that enforces saved object ID to match rule_id for security solution prebuilt detection rules. Allow saved object IDs to have arbitrary suffixes.

Why is it important?

Security Solution migrates the detection rules package from storing a single saved object per rule to multiple saved objects. See elastic/kibana#137420 for more context regarding the change.

The package will contain rule saved objects with rule id and version in the name (security_rule/[ruleId]_[ruleVersion].json) with the following content:

{
  "id": "[ruleId]_[ruleVersion]",
  "type": "security-rule",
  "attributes": {
    "rule_id": "[ruleId]",
    "version": "[ruleVersion]",
    // Other rule attributes
  }
}

So the saved object ID and the rule ID do not match anymore, making this validation check always return an error.

Checklist

• I have added test packages to test/packages that prove my change is effective.
• I have added an entry in spec/changelog.yml.

Related issues

• Closes [Change Proposal] Allow security_rule objects to have rule IDs different from the object IDs #459

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-01-17T17:38:38.161+0000

• Duration: 8 min 54 sec

Test stats 🧪

Test	Results
Failed	0
Passed	682
Skipped	0
Total	682

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (7/7)	💚
Files	68.0% (17/25)	👍
Classes	76.471% (26/34)	👍
Methods	56.075% (60/107)	👍
Lines	41.933% (538/1283)	👎 -0.296
Conditionals	100.0% (0/0)	💚

[banderror]

LGTM!

[mrodm]

LGTM, just a note about avoiding possible panics in some type assertions.

[mrodm]

Thanks!

LGTM! 👍

[spong]

LGTM! Thanks for adding in the .HasPrefix() check @xcrzx 🙂

[xcrzx]

@mrodm It seems like this PR has all the required approves. How could I merge it? The merge button is inactive, saying, You're not authorized to merge this pull request.

[mrodm]

@mrodm It seems like this PR has all the required approves. How could I merge it? The merge button is inactive, saying, You're not authorized to merge this pull request.

@xcrzx As all the required approves are there, I'll merge it.