From d7a913f183cfe35efe7f42bb2d46990abc07296d Mon Sep 17 00:00:00 2001
From: Graham Hudgins <graham@elastic.co>
Date: Thu, 14 Nov 2024 08:30:10 -0500
Subject: [PATCH 1/7] [Discover] mailto links in data view urls (#200070)

Adds `mailto:` as an allowed URL Url formatters in data views.
---
 src/plugins/field_formats/common/converters/url.test.ts | 8 ++++++++
 src/plugins/field_formats/common/converters/url.ts      | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/plugins/field_formats/common/converters/url.test.ts b/src/plugins/field_formats/common/converters/url.test.ts
index 7e465829e1eb1..d1c89575b2d4d 100644
--- a/src/plugins/field_formats/common/converters/url.test.ts
+++ b/src/plugins/field_formats/common/converters/url.test.ts
@@ -19,6 +19,14 @@ describe('UrlFormat', () => {
     );
   });
 
+  test('outputs a mailto: link when URL starts with mailto:', () => {
+    const url = new UrlFormat({});
+
+    expect(url.convert('mailto:test@example.com', HTML_CONTEXT_TYPE)).toBe(
+      '<a href="mailto:test@example.com" target="_blank" rel="noopener noreferrer">mailto:test@example.com</a>'
+    );
+  });
+
   test('outputs an <audio> if type === "audio"', () => {
     const url = new UrlFormat({ type: 'audio' });
 
diff --git a/src/plugins/field_formats/common/converters/url.ts b/src/plugins/field_formats/common/converters/url.ts
index ef40bde8d6433..a0b423a737f08 100644
--- a/src/plugins/field_formats/common/converters/url.ts
+++ b/src/plugins/field_formats/common/converters/url.ts
@@ -21,7 +21,7 @@ import {
 } from '../types';
 
 const templateMatchRE = /{{([\s\S]+?)}}/g;
-const allowedUrlSchemes = ['http://', 'https://'];
+const allowedUrlSchemes = ['http://', 'https://', 'mailto:'];
 
 const URL_TYPES = [
   {

From bb68f92ec02ad4f9da2f15c978842685159012e1 Mon Sep 17 00:00:00 2001
From: Irene Blanco <irene.blanco@elastic.co>
Date: Thu, 14 Nov 2024 14:33:32 +0100
Subject: [PATCH 2/7] [APM] Migrate inspect API tests to be deployment-agnostic
 (#199963)

### How to test
Closes https://github.com/elastic/kibana/issues/198977
Part of https://github.com/elastic/kibana/issues/193245

This PR contains the changes to migrate `inspect` test folder to
deployment-agnostic testing strategy.

### How to test


- Serverless

```
node scripts/functional_tests_server --config x-pack/test/api_integration/deployment_agnostic/configs/serverless/oblt.serverless.config.ts
node scripts/functional_test_runner --config x-pack/test/api_integration/deployment_agnostic/configs/serverless/oblt.serverless.config.ts --grep="APM"
```

It's recommended to be run against
[MKI](https://github.com/crespocarlos/kibana/blob/main/x-pack/test_serverless/README.md#run-tests-on-mki)

- Stateful
```
node scripts/functional_tests_server --config x-pack/test/api_integration/deployment_agnostic/configs/stateful/oblt.stateful.config.ts
node scripts/functional_test_runner --config x-pack/test/api_integration/deployment_agnostic/configs/stateful/oblt.stateful.config.ts --grep="APM"
```

## Checks

- [ ] (OPTIONAL, only if a test has been unskipped) Run flaky test suite
- [x] local run for serverless
- [x] local run for stateful
- [x] MKI run for serverless
---
 .../apm/constants/archives_metadata.ts        | 10 ++
 .../apis/observability/apm/index.ts           |  1 +
 .../apis/observability/apm/inspect/index.ts   | 14 +++
 .../observability/apm/inspect/inspect.spec.ts | 94 +++++++++++++++++++
 .../tests/inspect/inspect.spec.ts             | 64 -------------
 5 files changed, 119 insertions(+), 64 deletions(-)
 create mode 100644 x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/constants/archives_metadata.ts
 create mode 100644 x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/inspect/index.ts
 create mode 100644 x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/inspect/inspect.spec.ts

diff --git a/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/constants/archives_metadata.ts b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/constants/archives_metadata.ts
new file mode 100644
index 0000000000000..37a5dc2aa9a6f
--- /dev/null
+++ b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/constants/archives_metadata.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import archivesMetadata from '../../../../../../apm_api_integration/common/fixtures/es_archiver/archives_metadata';
+
+export default archivesMetadata;
diff --git a/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/index.ts b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/index.ts
index c09e1dd4b99b4..af8cc32783c20 100644
--- a/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/index.ts
+++ b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/index.ts
@@ -28,6 +28,7 @@ export default function apmApiIntegrationTests({
     loadTestFile(require.resolve('./observability_overview'));
     loadTestFile(require.resolve('./latency'));
     loadTestFile(require.resolve('./infrastructure'));
+    loadTestFile(require.resolve('./inspect'));
     loadTestFile(require.resolve('./service_groups'));
   });
 }
diff --git a/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/inspect/index.ts b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/inspect/index.ts
new file mode 100644
index 0000000000000..8169a30a04d0f
--- /dev/null
+++ b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/inspect/index.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { DeploymentAgnosticFtrProviderContext } from '../../../../ftr_provider_context';
+
+export default function ({ loadTestFile }: DeploymentAgnosticFtrProviderContext) {
+  describe('inspect', () => {
+    loadTestFile(require.resolve('./inspect.spec.ts'));
+  });
+}
diff --git a/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/inspect/inspect.spec.ts b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/inspect/inspect.spec.ts
new file mode 100644
index 0000000000000..b2f93635b79f0
--- /dev/null
+++ b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/inspect/inspect.spec.ts
@@ -0,0 +1,94 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+
+import { DeploymentAgnosticFtrProviderContext } from '../../../../ftr_provider_context';
+import { ARCHIVER_ROUTES } from '../constants/archiver';
+import archives_metadata from '../constants/archives_metadata';
+
+export default function inspectFlagTests({ getService }: DeploymentAgnosticFtrProviderContext) {
+  const apmApiClient = getService('apmApi');
+  const esArchiver = getService('esArchiver');
+
+  const archiveName = '8.0.0';
+  const metadata = archives_metadata['apm_8.0.0'];
+
+  describe('Inspect feature', () => {
+    before(async () => {
+      await esArchiver.load(ARCHIVER_ROUTES[archiveName]);
+    });
+    after(async () => {
+      await esArchiver.unload(ARCHIVER_ROUTES[archiveName]);
+    });
+
+    describe('when omitting `_inspect` query param', () => {
+      it('returns response without `_inspect`', async () => {
+        const { status, body } = await apmApiClient.readUser({
+          endpoint: 'GET /internal/apm/environments',
+          params: {
+            query: {
+              start: metadata.start,
+              end: metadata.end,
+            },
+          },
+        });
+
+        expect(status).to.be(200);
+        expect(body._inspect).to.be(undefined);
+      });
+    });
+
+    describe('when passing `_inspect` as query param', () => {
+      describe('elasticsearch calls made with end-user auth are returned', () => {
+        it('for environments', async () => {
+          const { status, body } = await apmApiClient.readUser({
+            endpoint: 'GET /internal/apm/environments',
+            params: {
+              query: {
+                start: metadata.start,
+                end: metadata.end,
+                _inspect: true,
+              },
+            },
+          });
+          expect(status).to.be(200);
+          expect(body._inspect).not.to.be.empty();
+
+          // @ts-expect-error
+          expect(Object.keys(body._inspect[0])).to.eql([
+            'id',
+            'json',
+            'name',
+            'response',
+            'startTime',
+            'stats',
+            'status',
+          ]);
+        });
+      });
+
+      describe('elasticsearch calls made with internal user should not leak internal queries', () => {
+        it('for custom links', async () => {
+          const { status, body } = await apmApiClient.readUser({
+            endpoint: 'GET /internal/apm/settings/custom_links',
+            params: {
+              query: {
+                'service.name': 'opbeans-node',
+                'transaction.type': 'request',
+                _inspect: true,
+              },
+            },
+          });
+
+          expect(status).to.be(200);
+          expect(body._inspect).to.eql([]);
+        });
+      });
+    });
+  });
+}
diff --git a/x-pack/test/apm_api_integration/tests/inspect/inspect.spec.ts b/x-pack/test/apm_api_integration/tests/inspect/inspect.spec.ts
index f15c9900488a0..b2e0931971a6e 100644
--- a/x-pack/test/apm_api_integration/tests/inspect/inspect.spec.ts
+++ b/x-pack/test/apm_api_integration/tests/inspect/inspect.spec.ts
@@ -8,79 +8,15 @@
 import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../common/ftr_provider_context';
 
-import archives_metadata from '../../common/fixtures/es_archiver/archives_metadata';
-
 export default function inspectFlagTests({ getService }: FtrProviderContext) {
   const registry = getService('registry');
   const apmApiClient = getService('apmApiClient');
 
   const archiveName = 'apm_8.0.0';
-  const metadata = archives_metadata[archiveName];
 
   registry.when('Inspect feature', { config: 'trial', archives: [archiveName] }, () => {
-    describe('when omitting `_inspect` query param', () => {
-      it('returns response without `_inspect`', async () => {
-        const { status, body } = await apmApiClient.readUser({
-          endpoint: 'GET /internal/apm/environments',
-          params: {
-            query: {
-              start: metadata.start,
-              end: metadata.end,
-            },
-          },
-        });
-
-        expect(status).to.be(200);
-        expect(body._inspect).to.be(undefined);
-      });
-    });
-
     describe('when passing `_inspect` as query param', () => {
-      describe('elasticsearch calls made with end-user auth are returned', () => {
-        it('for environments', async () => {
-          const { status, body } = await apmApiClient.readUser({
-            endpoint: 'GET /internal/apm/environments',
-            params: {
-              query: {
-                start: metadata.start,
-                end: metadata.end,
-                _inspect: true,
-              },
-            },
-          });
-          expect(status).to.be(200);
-          expect(body._inspect).not.to.be.empty();
-
-          // @ts-expect-error
-          expect(Object.keys(body._inspect[0])).to.eql([
-            'id',
-            'json',
-            'name',
-            'response',
-            'startTime',
-            'stats',
-            'status',
-          ]);
-        });
-      });
-
       describe('elasticsearch calls made with internal user should not leak internal queries', () => {
-        it('for custom links', async () => {
-          const { status, body } = await apmApiClient.readUser({
-            endpoint: 'GET /internal/apm/settings/custom_links',
-            params: {
-              query: {
-                'service.name': 'opbeans-node',
-                'transaction.type': 'request',
-                _inspect: true,
-              },
-            },
-          });
-
-          expect(status).to.be(200);
-          expect(body._inspect).to.eql([]);
-        });
-
         it('for agent configs', async () => {
           const { status, body } = await apmApiClient.readUser({
             endpoint: 'GET /api/apm/settings/agent-configuration 2023-10-31',

From ac32a056ef6897d0b685da8b444c399294a5e53e Mon Sep 17 00:00:00 2001
From: Pablo Machado <pablo.nevesmachado@elastic.co>
Date: Thu, 14 Nov 2024 14:55:21 +0100
Subject: [PATCH 3/7] [SecuritySolution] Update file validation because the
 file type is empty on windows (#199791)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

Bug: On Windows, we can't select TSV files or drag them to the file
picker. This error happens because we have a validation for the file
type, and for some reason, on Windows, it is an empty string 🤡 .

I updated the file validation logic to allow empty strings for file
types and added one extra value to the acceptable types, `.tsv`. So,
when the mime type checks fail, it will accept any files with the `tsv`
extension.


I desk-tested it on Windows-edge, Windows-chrome, Mac-chrome and it
works.

### How to test it?
* ON A WINDOWS MACHINE
* Open the security solution app and navigate to the entity store page
* Drag a TSV file created on a Windows machine; the file should be
accepted
* Click on the "select file" button and select a TSV file created on a
Windows machine
* Both methods should allow you to select the file, and you should be
able to proceed with the bulk upload

#### Do I need to checkout your code and start kibana?
If you are a lazy person like me, you can test the feature using the
cloud deployment
[here](https://kibana-pr-199791.kb.us-west2.gcp.elastic-cloud.com/app/security/entity_analytics_entity_store).
You can get the login/password using Vault. The instructions are on the
latest Cloud Deployment link, or ask me for credentials.

#### What if I don't have a Windows machine?
Buy one. I am kidding. 🤡
You can follow [this
tutorial](https://github.com/elastic/security-team/blob/main/tools/sec-eng-prod/sep-vms/README.md#setup)
to deploy it to gcloud, and connect to it using RDP.
But If you are lazy like me, you can ask me for my Windows 11 cloud
deployment credentials.

_Obs. You need an app to access the cloud deployment via RDP. The
"Windows App" can be easily downloaded from the App Store on Mac._

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)
---
 .../asset_criticality_file_uploader/constants.ts          | 8 +++++++-
 .../asset_criticality_file_uploader/hooks.test.ts         | 3 ++-
 .../asset_criticality_file_uploader/validations.test.ts   | 8 ++++++++
 .../asset_criticality_file_uploader/validations.ts        | 5 ++++-
 4 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/constants.ts b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/constants.ts
index c64128274aa3d..966068eb4c074 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/constants.ts
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/constants.ts
@@ -5,5 +5,11 @@
  * 2.0.
  */
 
-export const SUPPORTED_FILE_TYPES = ['text/csv', 'text/plain', 'text/tab-separated-values'];
+export const SUPPORTED_FILE_TYPES = [
+  'text/csv',
+  'text/plain',
+  'text/tab-separated-values',
+  '.tsv', // Useful for Windows when it can't recognise the file extension.
+  '.csv', // Useful for Windows when it can't recognise the file extension.
+];
 export const SUPPORTED_FILE_EXTENSIONS = ['CSV', 'TXT', 'TSV'];
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/hooks.test.ts b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/hooks.test.ts
index 675535365a0b0..a3b9a2e0ce24e 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/hooks.test.ts
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/hooks.test.ts
@@ -37,12 +37,13 @@ describe('useFileValidation', () => {
   test('should call onError when an error occurs', () => {
     const onErrorMock = jest.fn();
     const onCompleteMock = jest.fn();
+    const invalidFileType = 'invalid file type';
 
     const { result } = renderHook(
       () => useFileValidation({ onError: onErrorMock, onComplete: onCompleteMock }),
       { wrapper: TestProviders }
     );
-    result.current(new File([invalidLine], 'test.csv'));
+    result.current(new File([invalidLine], 'test.csv', { type: invalidFileType }));
 
     expect(onErrorMock).toHaveBeenCalled();
     expect(onCompleteMock).not.toHaveBeenCalled();
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.test.ts b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.test.ts
index 4e742d4d92505..4a77e024528dd 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.test.ts
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.test.ts
@@ -56,6 +56,14 @@ describe('validateFile', () => {
     expect(result.valid).toBe(true);
   });
 
+  it('should return valid if the mime type is empty (Windows)', () => {
+    const file = new File(['file content'], 'test.csv', { type: '' });
+
+    const result = validateFile(file, formatBytes);
+
+    expect(result.valid).toBe(true);
+  });
+
   it('should return an error message if the file type is invalid', () => {
     const file = new File(['file content'], 'test.txt', { type: 'invalid-type' });
 
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.ts b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.ts
index 06018a2496768..6f8bd8fb816bf 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.ts
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.ts
@@ -53,7 +53,10 @@ export const validateFile = (
   file: File,
   formatBytes: (bytes: number) => string
 ): { valid: false; errorMessage: string; code: string } | { valid: true } => {
-  if (!SUPPORTED_FILE_TYPES.includes(file.type)) {
+  if (
+    file.type !== '' && // file.type might be an empty string on windows
+    !SUPPORTED_FILE_TYPES.includes(file.type)
+  ) {
     return {
       valid: false,
       code: 'unsupported_file_type',

From 714382dc4ba3a8a68b719a320fe7eb71812a4066 Mon Sep 17 00:00:00 2001
From: Robert Oskamp <robert.oskamp@elastic.co>
Date: Thu, 14 Nov 2024 14:59:28 +0100
Subject: [PATCH 4/7] kbn-expect - add .eql support for sets (#200034)

## Summary

This PR adds support for asserting test equality with kbn-expect. It
also introduces some unit tests to kbn-expect in order to verify the
changes are working.
---
 packages/kbn-expect/expect.js      |  9 ++++++
 packages/kbn-expect/expect.test.ts | 47 ++++++++++++++++++++++++++++++
 packages/kbn-expect/jest.config.js | 14 +++++++++
 packages/kbn-expect/tsconfig.json  |  8 +++--
 4 files changed, 76 insertions(+), 2 deletions(-)
 create mode 100644 packages/kbn-expect/expect.test.ts
 create mode 100644 packages/kbn-expect/jest.config.js

diff --git a/packages/kbn-expect/expect.js b/packages/kbn-expect/expect.js
index 1a48d75a4615d..f2538c5a10fb5 100644
--- a/packages/kbn-expect/expect.js
+++ b/packages/kbn-expect/expect.js
@@ -647,6 +647,11 @@ function i (obj, showHidden, depth) {
       return stylize('null', 'null');
     }
 
+    // format sets like arrays
+    if (value instanceof Set) {
+      value = Array.from(value)
+    }
+
     if (isDOMElement(value)) {
       return getOuterHTML(value);
     }
@@ -930,6 +935,10 @@ expect.eql = function eql(actual, expected) {
   // to determine equivalence.
   } else if (isRegExp(actual) && isRegExp(expected)) {
     return regExpEquiv(actual, expected);
+  // If both are Sets, they should be treated equal if they have the same
+  // entries, independent of the ordering
+  } else if (actual instanceof Set && expected instanceof Set) {
+    return actual.size === expected.size && actual.difference(expected).size === 0;
   // 7.4. For all other Object pairs, including Array objects, equivalence is
   // determined by having the same number of owned properties (as verified
   // with Object.prototype.hasOwnProperty.call), the same set of keys
diff --git a/packages/kbn-expect/expect.test.ts b/packages/kbn-expect/expect.test.ts
new file mode 100644
index 0000000000000..b26d0363eb345
--- /dev/null
+++ b/packages/kbn-expect/expect.test.ts
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+// importing this package's expect as `kbnExpect` to not conflict with Jest's expect
+import kbnExpect from './expect';
+
+it('asserts that sets with same entries but different ordering are equal', async () => {
+  const setA = new Set(['a', 'b', 'c']);
+  const setB = new Set(['c', 'b', 'a']);
+
+  expect(() => {
+    kbnExpect(setA).to.eql(setB);
+  }).not.toThrow();
+  expect(() => {
+    kbnExpect(setB).to.eql(setA);
+  }).not.toThrow();
+});
+
+it('asserts that sets with same size but different entries are not equal', async () => {
+  const setA = new Set(['a', 'b', 'c']);
+  const setB = new Set(['x', 'y', 'z']);
+
+  expect(() => {
+    kbnExpect(setA).to.eql(setB);
+  }).toThrow();
+  expect(() => {
+    kbnExpect(setB).to.eql(setA);
+  }).toThrow();
+});
+
+it('asserts that sets with different size but overlapping items are not equal', async () => {
+  const setA = new Set(['a', 'b', 'c']);
+  const setB = new Set(['a', 'b']);
+
+  expect(() => {
+    kbnExpect(setA).to.eql(setB);
+  }).toThrow();
+  expect(() => {
+    kbnExpect(setB).to.eql(setA);
+  }).toThrow();
+});
diff --git a/packages/kbn-expect/jest.config.js b/packages/kbn-expect/jest.config.js
new file mode 100644
index 0000000000000..4e517d865391a
--- /dev/null
+++ b/packages/kbn-expect/jest.config.js
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+module.exports = {
+  preset: '@kbn/test/jest_node',
+  rootDir: '../..',
+  roots: ['<rootDir>/packages/kbn-expect'],
+};
diff --git a/packages/kbn-expect/tsconfig.json b/packages/kbn-expect/tsconfig.json
index 4346803ced341..bf599d834c806 100644
--- a/packages/kbn-expect/tsconfig.json
+++ b/packages/kbn-expect/tsconfig.json
@@ -1,10 +1,14 @@
 {
   "extends": "../../tsconfig.base.json",
   "compilerOptions": {
-    "outDir": "target/types"
+    "outDir": "target/types",
+    "types": [
+      "jest",
+    ],
   },
   "include": [
-    "expect.d.ts"
+    "expect.d.ts",
+    "**/*.ts"
   ],
   "exclude": [
     "target/**/*",

From ac2e29b7a2d68ed1520bc1a02b8c2a0b1bcd3254 Mon Sep 17 00:00:00 2001
From: Tre <wayne.seymour@elastic.co>
Date: Thu, 14 Nov 2024 14:07:54 +0000
Subject: [PATCH 5/7] [Ownership] Assign test files to Appex QA (#199767)

## Summary
Assign test files to Appex QA

Contributes to: https://github.com/elastic/kibana/issues/192979

---------

Co-authored-by: Robert Oskamp <robert.oskamp@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .github/CODEOWNERS | 85 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 84 insertions(+), 1 deletion(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 06f8a9c6d05a1..745101711171c 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1386,7 +1386,90 @@ x-pack/test_serverless/**/test_suites/observability/ai_assistant @elastic/obs-ai
 /.eslintrc.js @elastic/kibana-operations
 /.eslintignore @elastic/kibana-operations
 
-# Appex QA
+# QA - Appex QA
+/test/server_integration/services/index.js @elastic/appex-qa
+/x-pack/test/stack_functional_integration/configs/config.stack_functional_integration_base.js @elastic/appex-qa
+/x-pack/test/stack_functional_integration/configs/consume_state.js @elastic/appex-qa
+/x-pack/test/functional/services/remote_es/remote_es_archiver.ts @elastic/appex-qa
+/test/functional/services/remote_es/remote_es_archiver.ts @elastic/appex-qa
+/x-pack/test/kibana.jsonc @elastic/appex-qa
+/x-pack/test/functional_with_es_ssl/ftr_provider_context.d.ts @elastic/appex-qa
+/x-pack/test/stack_functional_integration/apps @elastic/appex-qa
+/x-pack/test/plugin_functional/config.ts @elastic/appex-qa
+/x-pack/test/plugin_functional/ftr_provider_context.d.ts @elastic/appex-qa
+/x-pack/test/plugin_functional/page_objects.ts @elastic/appex-qa
+/x-pack/test/upgrade/services/index.ts @elastic/appex-qa
+/x-pack/test/upgrade/ftr_provider_context.d.ts @elastic/appex-qa
+/x-pack/test/upgrade/config.ts @elastic/appex-qa
+/x-pack/test/functional_basic/ftr_provider_context.d.ts @elastic/appex-qa
+/x-pack/test/functional/services/remote_es/remote_es.ts @elastic/appex-qa
+/x-pack/test/functional/services/random.js @elastic/appex-qa
+/x-pack/test/functional/services/index.ts @elastic/appex-qa
+/x-pack/test/functional/page_objects/index.ts @elastic/appex-qa
+/x-pack/test/functional/ftr_provider_context.ts @elastic/appex-qa
+/x-pack/test/functional/README.md @elastic/appex-qa
+/x-pack/test/examples/config.ts @elastic/appex-qa
+/x-pack/test/common/services/index.ts @elastic/appex-qa
+/x-pack/test/common/services/bsearch_secure.ts @elastic/appex-qa
+/x-pack/test/common/ftr_provider_context.ts @elastic/appex-qa
+/x-pack/test/api_integration_basic/ftr_provider_context.d.ts @elastic/appex-qa
+/x-pack/test/api_integration_basic/config.ts @elastic/appex-qa
+/x-pack/test/api_integration_basic/apis/index.ts @elastic/appex-qa
+/x-pack/test/api_integration/services/index.ts @elastic/appex-qa
+/x-pack/test/api_integration/services/es_supertest_without_auth.js @elastic/appex-qa
+/x-pack/test/api_integration/config.ts @elastic/appex-qa
+/x-pack/test/api_integration/apis/kibana/config.ts @elastic/appex-qa
+/x-pack/test/tsconfig.json @elastic/appex-qa
+/x-pack/test/load @elastic/appex-qa
+/test/tsconfig.json @elastic/appex-qa
+/test/plugin_functional/services/index.ts @elastic/appex-qa
+/test/plugin_functional/README.md @elastic/appex-qa
+/test/plugin_functional/config.ts @elastic/appex-qa
+/test/kibana.jsonc @elastic/appex-qa
+/test/harden @elastic/appex-qa
+/test/functional/services/supertest.ts @elastic/appex-qa
+/test/functional/services/remote_es/remote_es.ts @elastic/appex-qa
+/test/functional/services/query_bar.ts @elastic/appex-qa
+/test/functional/services/menu_toggle.ts @elastic/appex-qa
+/test/functional/services/listing_table.ts @elastic/appex-qa
+/test/common/fixtures/plugins/coverage @elastic/appex-qa
+/test/functional/services/index.ts @elastic/appex-qa
+/test/functional/services/global_nav.ts @elastic/appex-qa
+/test/functional/services/flyout.ts @elastic/appex-qa
+/test/functional/services/filter_bar.ts @elastic/appex-qa
+/test/functional/services/field_editor.ts @elastic/appex-qa
+/test/functional/services/embedding.ts @elastic/appex-qa
+/test/functional/services/doc_table.ts @elastic/appex-qa
+/test/functional/services/data_grid.ts @elastic/appex-qa
+/test/functional/services/combo_box.ts @elastic/appex-qa
+/test/functional/page_objects/unified_field_list.ts @elastic/appex-qa
+/test/functional/page_objects/time_picker.ts @elastic/appex-qa
+/test/functional/page_objects/index.ts @elastic/appex-qa
+/test/functional/page_objects/header_page.ts @elastic/appex-qa
+/test/functional/page_objects/error_page.ts @elastic/appex-qa
+/test/functional/page_objects/common_page.ts @elastic/appex-qa
+/test/functional/jest.config.js @elastic/appex-qa
+/test/functional/ftr_provider_context.ts @elastic/appex-qa
+/test/functional/fixtures/es_archiver/README.md @elastic/appex-qa
+/test/functional/firefox/config.base.ts @elastic/appex-qa
+/test/functional/config.* @elastic/appex-qa
+/test/functional/README.md @elastic/appex-qa
+/test/examples/config.js @elastic/appex-qa
+/test/examples/README.md @elastic/appex-qa
+/test/common/services/index.ts @elastic/appex-qa
+/test/common/fixtures/plugins/coverage/*.ts @elastic/appex-qa
+/test/common/config.js @elastic/appex-qa
+/test/api_integration/services/index.ts @elastic/appex-qa
+/test/api_integration/jest.config.js @elastic/appex-qa
+/test/api_integration/ftr_provider_context.d.ts @elastic/appex-qa
+/test/api_integration/config.js @elastic/appex-qa
+/test/api_integration/apis/index.ts @elastic/appex-qa
+/test/accessibility/services/index.ts @elastic/appex-qa
+/test/accessibility/services/a11y @elastic/appex-qa
+/test/accessibility/page_objects.ts @elastic/appex-qa
+/test/accessibility/ftr_provider_context.ts @elastic/appex-qa
+/test/accessibility/config.ts @elastic/appex-qa
+/test/accessibility/apps/index.ts @elastic/appex-qa
 /x-pack/test/scalability @elastic/appex-qa
 /src/dev/performance @elastic/appex-qa
 /x-pack/test/functional/config.*.* @elastic/appex-qa

From 7ef9773d626c21556361d85578b039773e33ffb5 Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Thu, 14 Nov 2024 15:09:24 +0100
Subject: [PATCH 6/7] [Observability Onboarding] Fix kustomize command
 (#199758)

## Summary

Closes https://github.com/elastic/kibana/issues/199754 by introducing
more fine-grained version getters to get the base version (to resolve to
the git tag in the repo), the actual version which might include the IAR
suffix and the docker version which replaces + with .

For testing, EA host and kubernetes as well as OTel host should be
tested. See here:
https://github.com/elastic/kibana/pull/199758#issuecomment-2473753175

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 .../services/agents/agent_service.mock.ts     |  2 ++
 .../services/agents/agent_service.test.ts     | 24 +++++++++++++
 .../server/services/agents/agent_service.ts   | 18 ++++++++++
 .../observability_onboarding/common/types.ts  | 12 +++++++
 .../auto_detect/get_auto_detect_command.tsx   |  2 +-
 .../custom_logs/install_elastic_agent.tsx     |  2 +-
 .../kubernetes/build_kubectl_command.ts       | 10 +++---
 .../kubernetes/command_snippet.tsx            |  7 ++--
 .../quickstart_flows/kubernetes/index.tsx     |  2 +-
 .../quickstart_flows/otel_logs/index.tsx      |  8 +++--
 .../server/lib/get_agent_version.ts           | 17 +++++++--
 .../server/routes/flow/route.ts               | 35 ++++++++++---------
 .../server/routes/kubernetes/route.ts         | 11 +++---
 .../server/routes/logs/route.ts               |  9 ++---
 14 files changed, 118 insertions(+), 41 deletions(-)
 create mode 100644 x-pack/plugins/observability_solution/observability_onboarding/common/types.ts

diff --git a/x-pack/plugins/fleet/server/services/agents/agent_service.mock.ts b/x-pack/plugins/fleet/server/services/agents/agent_service.mock.ts
index 316bfaa228b09..ba85785a1f4c8 100644
--- a/x-pack/plugins/fleet/server/services/agents/agent_service.mock.ts
+++ b/x-pack/plugins/fleet/server/services/agents/agent_service.mock.ts
@@ -15,6 +15,8 @@ const createClientMock = (): jest.Mocked<AgentClient> => ({
   getAgentStatusForAgentPolicy: jest.fn(),
   listAgents: jest.fn(),
   getLatestAgentAvailableVersion: jest.fn(),
+  getLatestAgentAvailableBaseVersion: jest.fn(),
+  getLatestAgentAvailableDockerImageVersion: jest.fn(),
   getByIds: jest.fn(async (..._) => []),
 });
 
diff --git a/x-pack/plugins/fleet/server/services/agents/agent_service.test.ts b/x-pack/plugins/fleet/server/services/agents/agent_service.test.ts
index 95d61060c7e66..b480631188c22 100644
--- a/x-pack/plugins/fleet/server/services/agents/agent_service.test.ts
+++ b/x-pack/plugins/fleet/server/services/agents/agent_service.test.ts
@@ -267,4 +267,28 @@ function expectApisToCallServicesSuccessfully(
     );
     expect(mockgetLatestAvailableAgentVersion).toHaveBeenCalledTimes(1);
   });
+
+  test('client.getLatestAgentAvailableBaseVersion strips away IAR suffix', async () => {
+    mockgetLatestAvailableAgentVersion.mockResolvedValue('1.2.3+build12345678987654321');
+    await expect(agentClient.getLatestAgentAvailableBaseVersion()).resolves.toEqual('1.2.3');
+  });
+
+  test('client.getLatestAgentAvailableBaseVersion does not break on usual version numbers', async () => {
+    mockgetLatestAvailableAgentVersion.mockResolvedValue('8.17.0');
+    await expect(agentClient.getLatestAgentAvailableBaseVersion()).resolves.toEqual('8.17.0');
+  });
+
+  test('client.getLatestAgentAvailableDockerImageVersion transforms IAR suffix', async () => {
+    mockgetLatestAvailableAgentVersion.mockResolvedValue('1.2.3+build12345678987654321');
+    await expect(agentClient.getLatestAgentAvailableDockerImageVersion()).resolves.toEqual(
+      '1.2.3.build12345678987654321'
+    );
+  });
+
+  test('client.getLatestAgentAvailableDockerImageVersion does not break on usual version numbers', async () => {
+    mockgetLatestAvailableAgentVersion.mockResolvedValue('8.17.0');
+    await expect(agentClient.getLatestAgentAvailableDockerImageVersion()).resolves.toEqual(
+      '8.17.0'
+    );
+  });
 }
diff --git a/x-pack/plugins/fleet/server/services/agents/agent_service.ts b/x-pack/plugins/fleet/server/services/agents/agent_service.ts
index b6791b061e985..94583284d87f8 100644
--- a/x-pack/plugins/fleet/server/services/agents/agent_service.ts
+++ b/x-pack/plugins/fleet/server/services/agents/agent_service.ts
@@ -108,6 +108,14 @@ export interface AgentClient {
    * Return the latest agent available version
    */
   getLatestAgentAvailableVersion(includeCurrentVersion?: boolean): Promise<string>;
+  /**
+   * Return the latest agent available version, not taking into account IAR versions
+   */
+  getLatestAgentAvailableBaseVersion(includeCurrentVersion?: boolean): Promise<string>;
+  /**
+   * Return the latest agent available version formatted for the docker image
+   */
+  getLatestAgentAvailableDockerImageVersion(includeCurrentVersion?: boolean): Promise<string>;
 }
 
 /**
@@ -163,6 +171,16 @@ class AgentClientImpl implements AgentClient {
     );
   }
 
+  public async getLatestAgentAvailableBaseVersion(includeCurrentVersion?: boolean) {
+    const fullVersion = await this.getLatestAgentAvailableVersion(includeCurrentVersion);
+    return fullVersion.split('+')[0];
+  }
+
+  public async getLatestAgentAvailableDockerImageVersion(includeCurrentVersion?: boolean) {
+    const fullVersion = await this.getLatestAgentAvailableVersion(includeCurrentVersion);
+    return fullVersion.replace('+', '.');
+  }
+
   public async getLatestAgentAvailableVersion(includeCurrentVersion?: boolean) {
     await this.#runPreflight();
     return getLatestAvailableAgentVersion({ includeCurrentVersion });
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/common/types.ts b/x-pack/plugins/observability_solution/observability_onboarding/common/types.ts
new file mode 100644
index 0000000000000..798af67a988f1
--- /dev/null
+++ b/x-pack/plugins/observability_solution/observability_onboarding/common/types.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export interface ElasticAgentVersionInfo {
+  agentVersion: string;
+  agentBaseVersion: string;
+  agentDockerImageVersion: string;
+}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/auto_detect/get_auto_detect_command.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/auto_detect/get_auto_detect_command.tsx
index d9e695b8c10f0..b3c769030f18b 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/auto_detect/get_auto_detect_command.tsx
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/auto_detect/get_auto_detect_command.tsx
@@ -19,7 +19,7 @@ export function getAutoDetectCommand(
       --kibana-url=${options.kibanaUrl}
       --install-key=${options.installApiKey}
       --ingest-key=${options.ingestApiKey}
-      --ea-version=${options.elasticAgentVersion}
+      --ea-version=${options.elasticAgentVersionInfo.agentVersion}
   `;
 }
 function oneLine(parts: TemplateStringsArray, ...args: string[]) {
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/custom_logs/install_elastic_agent.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/custom_logs/install_elastic_agent.tsx
index 18fdc833483fe..bb44d3ec38458 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/custom_logs/install_elastic_agent.tsx
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/custom_logs/install_elastic_agent.tsx
@@ -312,7 +312,7 @@ export function InstallElasticAgent() {
           apiKeyEncoded,
           apiEndpoint: setup?.apiEndpoint,
           scriptDownloadUrl: setup?.scriptDownloadUrl,
-          elasticAgentVersion: setup?.elasticAgentVersion,
+          elasticAgentVersion: setup?.elasticAgentVersionInfo.agentVersion,
           autoDownloadConfig,
           onboardingId,
         })}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/build_kubectl_command.ts b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/build_kubectl_command.ts
index 59de30111649d..24d7a2ccd92c3 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/build_kubectl_command.ts
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/build_kubectl_command.ts
@@ -5,11 +5,13 @@
  * 2.0.
  */
 
+import { ElasticAgentVersionInfo } from '../../../../common/types';
+
 interface Params {
   encodedApiKey: string;
   onboardingId: string;
   elasticsearchUrl: string;
-  elasticAgentVersion: string;
+  elasticAgentVersionInfo: ElasticAgentVersionInfo;
 }
 
 const KUSTOMIZE_TEMPLATE_URL =
@@ -19,16 +21,16 @@ export function buildKubectlCommand({
   encodedApiKey,
   onboardingId,
   elasticsearchUrl,
-  elasticAgentVersion,
+  elasticAgentVersionInfo,
 }: Params) {
   const escapedElasticsearchUrl = elasticsearchUrl.replace(/\//g, '\\/');
 
   return `
-    kubectl kustomize ${KUSTOMIZE_TEMPLATE_URL}\\?ref\\=v${elasticAgentVersion}
+    kubectl kustomize ${KUSTOMIZE_TEMPLATE_URL}\\?ref\\=v${elasticAgentVersionInfo.agentBaseVersion}
       | sed -e 's/JUFQSV9LRVkl/${encodedApiKey}/g'
             -e "s/%ES_HOST%/${escapedElasticsearchUrl}/g"
             -e "s/%ONBOARDING_ID%/${onboardingId}/g"
-            -e "s/\\(docker.elastic.co\\/beats\\/elastic-agent\:\\).*$/\\1${elasticAgentVersion}/g"
+            -e "s/\\(docker.elastic.co\\/beats\\/elastic-agent\:\\).*$/\\1${elasticAgentVersionInfo.agentDockerImageVersion}/g"
             -e  "/{CA_TRUSTED}/c\\ "
       |  kubectl apply -f-
   `
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/command_snippet.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/command_snippet.tsx
index 2ed3ff80f14bf..ac00190fb268d 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/command_snippet.tsx
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/command_snippet.tsx
@@ -9,6 +9,7 @@ import React from 'react';
 import { EuiCodeBlock, EuiLink, EuiSpacer, EuiText } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { i18n } from '@kbn/i18n';
+import { ElasticAgentVersionInfo } from '../../../../common/types';
 import { buildKubectlCommand } from './build_kubectl_command';
 import { CopyToClipboardButton } from '../shared/copy_to_clipboard_button';
 
@@ -16,7 +17,7 @@ interface Props {
   encodedApiKey: string;
   onboardingId: string;
   elasticsearchUrl: string;
-  elasticAgentVersion: string;
+  elasticAgentVersionInfo: ElasticAgentVersionInfo;
   isCopyPrimaryAction: boolean;
 }
 
@@ -24,14 +25,14 @@ export function CommandSnippet({
   encodedApiKey,
   onboardingId,
   elasticsearchUrl,
-  elasticAgentVersion,
+  elasticAgentVersionInfo,
   isCopyPrimaryAction,
 }: Props) {
   const command = buildKubectlCommand({
     encodedApiKey,
     onboardingId,
     elasticsearchUrl,
-    elasticAgentVersion,
+    elasticAgentVersionInfo,
   });
 
   return (
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/index.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/index.tsx
index 94e5b27e028a8..96b7b5619377b 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/index.tsx
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/index.tsx
@@ -58,7 +58,7 @@ export const KubernetesPanel: React.FC = () => {
               encodedApiKey={data.apiKeyEncoded}
               onboardingId={data.onboardingId}
               elasticsearchUrl={data.elasticsearchUrl}
-              elasticAgentVersion={data.elasticAgentVersion}
+              elasticAgentVersionInfo={data.elasticAgentVersionInfo}
               isCopyPrimaryAction={!isMonitoringStepActive}
             />
           )}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/otel_logs/index.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/otel_logs/index.tsx
index 4d0de71d6faaf..156f980de58df 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/otel_logs/index.tsx
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/otel_logs/index.tsx
@@ -69,7 +69,9 @@ export const OtelLogsPanel: React.FC = () => {
   } = useKibana<ObservabilityOnboardingAppServices>();
 
   const AGENT_CDN_BASE_URL = 'artifacts.elastic.co/downloads/beats/elastic-agent';
-  const agentVersion = isServerless ? setup?.elasticAgentVersion : stackVersion;
+  const agentVersion =
+    isServerless && setup ? setup.elasticAgentVersionInfo.agentVersion : stackVersion;
+  const urlEncodedAgentVersion = encodeURIComponent(agentVersion);
 
   const allDatasetsLocator =
     share.url.locators.get<AllDatasetsLocatorParams>(ALL_DATASETS_LOCATOR_ID);
@@ -96,7 +98,7 @@ export const OtelLogsPanel: React.FC = () => {
       firstStepTitle: HOST_COMMAND,
       content: `arch=$(if ([[ $(arch) == "arm" || $(arch) == "aarch64" ]]); then echo "arm64"; else echo $(arch); fi)
 
-curl --output elastic-distro-${agentVersion}-linux-$arch.tar.gz --url https://${AGENT_CDN_BASE_URL}/elastic-agent-${agentVersion}-linux-$arch.tar.gz --proto '=https' --tlsv1.2 -fOL && mkdir -p elastic-distro-${agentVersion}-linux-$arch && tar -xvf elastic-distro-${agentVersion}-linux-$arch.tar.gz -C "elastic-distro-${agentVersion}-linux-$arch" --strip-components=1 && cd elastic-distro-${agentVersion}-linux-$arch
+curl --output elastic-distro-${agentVersion}-linux-$arch.tar.gz --url https://${AGENT_CDN_BASE_URL}/elastic-agent-${urlEncodedAgentVersion}-linux-$arch.tar.gz --proto '=https' --tlsv1.2 -fOL && mkdir -p elastic-distro-${agentVersion}-linux-$arch && tar -xvf elastic-distro-${agentVersion}-linux-$arch.tar.gz -C "elastic-distro-${agentVersion}-linux-$arch" --strip-components=1 && cd elastic-distro-${agentVersion}-linux-$arch
 
 rm ./otel.yml && cp ./otel_samples/platformlogs_hostmetrics.yml ./otel.yml && mkdir -p ./data/otelcol && sed -i 's#\\\${env:STORAGE_DIR}#'"$PWD"/data/otelcol'#g' ./otel.yml && sed -i 's#\\\${env:ELASTIC_ENDPOINT}#${setup?.elasticsearchUrl}#g' ./otel.yml && sed -i 's/\\\${env:ELASTIC_API_KEY}/${apiKeyData?.apiKeyEncoded}/g' ./otel.yml`,
       start: 'sudo ./otelcol --config otel.yml',
@@ -108,7 +110,7 @@ rm ./otel.yml && cp ./otel_samples/platformlogs_hostmetrics.yml ./otel.yml && mk
       firstStepTitle: HOST_COMMAND,
       content: `arch=$(if [[ $(uname -m) == "arm64" ]]; then echo "aarch64"; else echo $(uname -m); fi)
 
-curl --output elastic-distro-${agentVersion}-darwin-$arch.tar.gz --url https://${AGENT_CDN_BASE_URL}/elastic-agent-${agentVersion}-darwin-$arch.tar.gz --proto '=https' --tlsv1.2 -fOL && mkdir -p "elastic-distro-${agentVersion}-darwin-$arch" && tar -xvf elastic-distro-${agentVersion}-darwin-$arch.tar.gz -C "elastic-distro-${agentVersion}-darwin-$arch" --strip-components=1 && cd elastic-distro-${agentVersion}-darwin-$arch
+curl --output elastic-distro-${agentVersion}-darwin-$arch.tar.gz --url https://${AGENT_CDN_BASE_URL}/elastic-agent-${urlEncodedAgentVersion}-darwin-$arch.tar.gz --proto '=https' --tlsv1.2 -fOL && mkdir -p "elastic-distro-${agentVersion}-darwin-$arch" && tar -xvf elastic-distro-${agentVersion}-darwin-$arch.tar.gz -C "elastic-distro-${agentVersion}-darwin-$arch" --strip-components=1 && cd elastic-distro-${agentVersion}-darwin-$arch
 
 rm ./otel.yml && cp ./otel_samples/platformlogs_hostmetrics.yml ./otel.yml && mkdir -p ./data/otelcol  && sed -i '' 's#\\\${env:STORAGE_DIR}#'"$PWD"/data/otelcol'#g' ./otel.yml && sed -i '' 's#\\\${env:ELASTIC_ENDPOINT}#${setup?.elasticsearchUrl}#g' ./otel.yml && sed -i '' 's/\\\${env:ELASTIC_API_KEY}/${apiKeyData?.apiKeyEncoded}/g' ./otel.yml`,
       start: './otelcol --config otel.yml',
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/server/lib/get_agent_version.ts b/x-pack/plugins/observability_solution/observability_onboarding/server/lib/get_agent_version.ts
index c9dd959e6bb75..6474cc8e776fc 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/server/lib/get_agent_version.ts
+++ b/x-pack/plugins/observability_solution/observability_onboarding/server/lib/get_agent_version.ts
@@ -6,8 +6,12 @@
  */
 
 import type { FleetStartContract } from '@kbn/fleet-plugin/server';
+import { ElasticAgentVersionInfo } from '../../common/types';
 
-export function getAgentVersion(fleetStart: FleetStartContract, kibanaVersion: string) {
+export async function getAgentVersionInfo(
+  fleetStart: FleetStartContract,
+  kibanaVersion: string
+): Promise<ElasticAgentVersionInfo> {
   // If undefined, we will follow fleet's strategy to select latest available version:
   // for serverless we will use the latest published version, for statefull we will use
   // current Kibana version. If false, irrespective of fleet flags and logic, we are
@@ -15,5 +19,14 @@ export function getAgentVersion(fleetStart: FleetStartContract, kibanaVersion: s
   const includeCurrentVersion = kibanaVersion.endsWith('-SNAPSHOT') ? false : undefined;
 
   const agentClient = fleetStart.agentService.asInternalUser;
-  return agentClient.getLatestAgentAvailableVersion(includeCurrentVersion);
+  const [agentVersion, agentBaseVersion, agentDockerImageVersion] = await Promise.all([
+    agentClient.getLatestAgentAvailableVersion(includeCurrentVersion),
+    agentClient.getLatestAgentAvailableBaseVersion(includeCurrentVersion),
+    agentClient.getLatestAgentAvailableDockerImageVersion(includeCurrentVersion),
+  ]);
+  return {
+    agentVersion,
+    agentBaseVersion,
+    agentDockerImageVersion,
+  };
 }
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/server/routes/flow/route.ts b/x-pack/plugins/observability_solution/observability_onboarding/server/routes/flow/route.ts
index f0663aa27ccad..372eaf7972373 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/server/routes/flow/route.ts
+++ b/x-pack/plugins/observability_solution/observability_onboarding/server/routes/flow/route.ts
@@ -20,7 +20,7 @@ import { ObservabilityOnboardingFlow } from '../../saved_objects/observability_o
 import { createObservabilityOnboardingServerRoute } from '../create_observability_onboarding_server_route';
 import { getHasLogs } from './get_has_logs';
 import { getKibanaUrl } from '../../lib/get_fallback_urls';
-import { getAgentVersion } from '../../lib/get_agent_version';
+import { getAgentVersionInfo } from '../../lib/get_agent_version';
 import { getFallbackESUrl } from '../../lib/get_fallback_urls';
 import { ElasticAgentStepPayload, InstalledIntegration, StepProgressPayloadRT } from '../types';
 import { createShipperApiKey } from '../../lib/api_key/create_shipper_api_key';
@@ -220,21 +220,22 @@ const createFlowRoute = createObservabilityOnboardingServerRoute({
 
     const fleetPluginStart = await plugins.fleet.start();
 
-    const [onboardingFlow, ingestApiKey, installApiKey, elasticAgentVersion] = await Promise.all([
-      saveObservabilityOnboardingFlow({
-        savedObjectsClient,
-        observabilityOnboardingState: {
-          type: 'autoDetect',
-          state: undefined,
-          progress: {},
-        },
-      }),
-      createShipperApiKey(client.asCurrentUser, `onboarding_ingest_${name}`),
-      (
-        await context.resolve(['core'])
-      ).core.security.authc.apiKeys.create(createInstallApiKey(`onboarding_install_${name}`)),
-      getAgentVersion(fleetPluginStart, kibanaVersion),
-    ]);
+    const [onboardingFlow, ingestApiKey, installApiKey, elasticAgentVersionInfo] =
+      await Promise.all([
+        saveObservabilityOnboardingFlow({
+          savedObjectsClient,
+          observabilityOnboardingState: {
+            type: 'autoDetect',
+            state: undefined,
+            progress: {},
+          },
+        }),
+        createShipperApiKey(client.asCurrentUser, `onboarding_ingest_${name}`),
+        (
+          await context.resolve(['core'])
+        ).core.security.authc.apiKeys.create(createInstallApiKey(`onboarding_install_${name}`)),
+        getAgentVersionInfo(fleetPluginStart, kibanaVersion),
+      ]);
 
     if (!installApiKey) {
       throw Boom.notFound('License does not allow API key creation.');
@@ -250,7 +251,7 @@ const createFlowRoute = createObservabilityOnboardingServerRoute({
       onboardingFlow,
       ingestApiKey: ingestApiKey.encoded,
       installApiKey: installApiKey.encoded,
-      elasticAgentVersion,
+      elasticAgentVersionInfo,
       kibanaUrl,
       scriptDownloadUrl,
     };
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/server/routes/kubernetes/route.ts b/x-pack/plugins/observability_solution/observability_onboarding/server/routes/kubernetes/route.ts
index 691c28f5a14e6..b5ea3ef4ee5e6 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/server/routes/kubernetes/route.ts
+++ b/x-pack/plugins/observability_solution/observability_onboarding/server/routes/kubernetes/route.ts
@@ -10,17 +10,18 @@ import * as t from 'io-ts';
 import Boom from '@hapi/boom';
 import { termQuery } from '@kbn/observability-plugin/server';
 import type { estypes } from '@elastic/elasticsearch';
+import { ElasticAgentVersionInfo } from '../../../common/types';
 import { getFallbackESUrl } from '../../lib/get_fallback_urls';
 import { createObservabilityOnboardingServerRoute } from '../create_observability_onboarding_server_route';
 import { hasLogMonitoringPrivileges } from '../../lib/api_key/has_log_monitoring_privileges';
 import { createShipperApiKey } from '../../lib/api_key/create_shipper_api_key';
-import { getAgentVersion } from '../../lib/get_agent_version';
+import { getAgentVersionInfo } from '../../lib/get_agent_version';
 
 export interface CreateKubernetesOnboardingFlowRouteResponse {
   apiKeyEncoded: string;
   onboardingId: string;
   elasticsearchUrl: string;
-  elasticAgentVersion: string;
+  elasticAgentVersionInfo: ElasticAgentVersionInfo;
 }
 
 export interface HasKubernetesDataRouteResponse {
@@ -56,9 +57,9 @@ const createKubernetesOnboardingFlowRoute = createObservabilityOnboardingServerR
     const fleetPluginStart = await plugins.fleet.start();
     const packageClient = fleetPluginStart.packageService.asScoped(request);
 
-    const [{ encoded: apiKeyEncoded }, elasticAgentVersion] = await Promise.all([
+    const [{ encoded: apiKeyEncoded }, elasticAgentVersionInfo] = await Promise.all([
       createShipperApiKey(client.asCurrentUser, `${params.body.pkgName}_onboarding`, true),
-      getAgentVersion(fleetPluginStart, kibanaVersion),
+      getAgentVersionInfo(fleetPluginStart, kibanaVersion),
       // System package is always required
       packageClient.ensureInstalledPackage({ pkgName: 'system' }),
       // Kubernetes package is required for both classic kubernetes and otel
@@ -77,7 +78,7 @@ const createKubernetesOnboardingFlowRoute = createObservabilityOnboardingServerR
       onboardingId: uuidv4(),
       apiKeyEncoded,
       elasticsearchUrl: elasticsearchUrlList.length > 0 ? elasticsearchUrlList[0] : '',
-      elasticAgentVersion,
+      elasticAgentVersionInfo,
     };
   },
 });
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/server/routes/logs/route.ts b/x-pack/plugins/observability_solution/observability_onboarding/server/routes/logs/route.ts
index 017925cc44dee..6302df917469a 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/server/routes/logs/route.ts
+++ b/x-pack/plugins/observability_solution/observability_onboarding/server/routes/logs/route.ts
@@ -7,10 +7,11 @@
 
 import * as t from 'io-ts';
 import Boom from '@hapi/boom';
+import { ElasticAgentVersionInfo } from '../../../common/types';
 import { createObservabilityOnboardingServerRoute } from '../create_observability_onboarding_server_route';
 import { getFallbackESUrl } from '../../lib/get_fallback_urls';
 import { getKibanaUrl } from '../../lib/get_fallback_urls';
-import { getAgentVersion } from '../../lib/get_agent_version';
+import { getAgentVersionInfo } from '../../lib/get_agent_version';
 import { saveObservabilityOnboardingFlow } from '../../lib/state';
 import { createShipperApiKey } from '../../lib/api_key/create_shipper_api_key';
 import { ObservabilityOnboardingFlow } from '../../saved_objects/observability_onboarding_status';
@@ -39,7 +40,7 @@ const installShipperSetupRoute = createObservabilityOnboardingServerRoute({
   async handler(resources): Promise<{
     apiEndpoint: string;
     scriptDownloadUrl: string;
-    elasticAgentVersion: string;
+    elasticAgentVersionInfo: ElasticAgentVersionInfo;
     elasticsearchUrl: string[];
   }> {
     const {
@@ -50,7 +51,7 @@ const installShipperSetupRoute = createObservabilityOnboardingServerRoute({
     } = resources;
 
     const fleetPluginStart = await plugins.fleet.start();
-    const elasticAgentVersion = await getAgentVersion(fleetPluginStart, kibanaVersion);
+    const elasticAgentVersionInfo = await getAgentVersionInfo(fleetPluginStart, kibanaVersion);
     const kibanaUrl = getKibanaUrl(core.setup, plugins.cloud?.setup);
     const scriptDownloadUrl = new URL(
       core.setup.http.staticAssets.getPluginAssetHref('standalone_agent_setup.sh'),
@@ -67,7 +68,7 @@ const installShipperSetupRoute = createObservabilityOnboardingServerRoute({
       apiEndpoint,
       elasticsearchUrl,
       scriptDownloadUrl,
-      elasticAgentVersion,
+      elasticAgentVersionInfo,
     };
   },
 });

From 1862b5914786a207238c650465c3d6b3f04ab172 Mon Sep 17 00:00:00 2001
From: Maxim Palenov <maxim.palenov@elastic.co>
Date: Thu, 14 Nov 2024 15:13:20 +0100
Subject: [PATCH 7/7] [Security Solution] Integrate Prebuilt Rules
 Customization UI with the `_perform` upgrade API (#199761)

**Partially addresses:** https://github.com/elastic/kibana/issues/171520

## Summary

This PR integrates Prebuilt Rules Customization UI functionality with
the `/internal/detection_engine/prebuilt_rules/upgrade/_perform`
Prebuilt Rules Customization upgrade API.

> [!CAUTION]
> This PR doesn't handle rule type changes. Prebuilt rule updates with
rule type change consider having a NON SOLVABLE conflict and won't be
upgraded neither individually nor in bulk. Addressing that task requires
UI and functional changes and will be addressed in a separate PR.

## Details


## How to test

- Clear Elasticsearch data
- Run Elasticsearch and Kibana locally (do not open Kibana in a web
browser)
- Install an outdated version of the `security_detection_engine` Fleet
package
   ```bash
curl -X POST --user elastic:changeme -H 'Content-Type: application/json'
-H 'kbn-xsrf: 123' -H "elastic-api-version: 2023-10-31" -d
'{"force":true}'
http://localhost:5601/kbn/api/fleet/epm/packages/security_detection_engine/8.14.1
   ```
- Install prebuilt rules
   ```bash
curl -X POST --user elastic:changeme -H 'Content-Type: application/json'
-H 'kbn-xsrf: 123' -H "elastic-api-version: 1" -d '{"mode":"ALL_RULES"}'
http://localhost:5601/kbn/internal/detection_engine/prebuilt_rules/installation/_perform
   ```
- Open `Detection Rules (SIEM)` Page -> `Rule Updates`
- [ ] Check update functionality in a flyout
  - Pick a rule
  - Click on rule's name
  - Make changes to fields in incoming rule updates updates
  - Save field(s) changes
  -  Press the `Update` button
- [ ] Check table row rule update
  - Pick a rule
  - Click on rule's name
  - Make changes to fields in incoming rule updates updates
  - Save field(s) changes
  - Close the flyout
  -  Press the `Update rule` button in the rule's table row
- [ ] Check bulk rule update
  - Pick a few rules and for each of them do the next steps
  - Click on rule's name
  - Make changes to fields in incoming rule updates updates
  - Save field(s) changes
  - Close the flyout
  -  After press the `Update All` button on the page
- [ ] Check selected rules bulk update
  - Pick a few rules and for each of them do the next steps
  - Click on rule's name
  - Make changes to fields in incoming rule updates updates
  - Save field(s) changes
  - Close the flyout
  -  After select the modified rule updates
  -  Press the `Update N selected rule(s)` button on the page

Co-authored-by: Dmitrii Shevchenko <dmitrii.shevchenko@elastic.co>
---
 .../upgrade_prebuilt_rules_table_context.tsx  | 106 +++++++++++-------
 .../use_prebuilt_rules_upgrade_state.ts       |   3 +-
 2 files changed, 68 insertions(+), 41 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/upgrade_prebuilt_rules_table_context.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/upgrade_prebuilt_rules_table_context.tsx
index cbb0350da1731..4217fa111786e 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/upgrade_prebuilt_rules_table_context.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/upgrade_prebuilt_rules_table_context.tsx
@@ -8,10 +8,18 @@
 import type { Dispatch, SetStateAction } from 'react';
 import React, { createContext, useCallback, useContext, useMemo, useState } from 'react';
 import { EuiButton, EuiToolTip } from '@elastic/eui';
+import { isNonUpgradeableFieldName } from '../../../../rule_management/model/prebuilt_rule_upgrade/fields';
+import type {
+  RuleFieldsToUpgrade,
+  RuleUpgradeSpecifier,
+  RuleUpgradeInfoForReview,
+} from '../../../../../../common/api/detection_engine';
 import { useIsPrebuiltRulesCustomizationEnabled } from '../../../../rule_management/hooks/use_is_prebuilt_rules_customization_enabled';
 import { useAppToasts } from '../../../../../common/hooks/use_app_toasts';
-import type { RuleUpgradeInfoForReview } from '../../../../../../common/api/detection_engine';
-import type { RulesUpgradeState } from '../../../../rule_management/model/prebuilt_rule_upgrade';
+import type {
+  RuleUpgradeState,
+  RulesUpgradeState,
+} from '../../../../rule_management/model/prebuilt_rule_upgrade';
 import { RuleUpgradeConflictsResolverTab } from '../../../../rule_management/components/rule_details/three_way_diff/rule_upgrade_conflicts_resolver_tab';
 import { PerFieldRuleDiffTab } from '../../../../rule_management/components/rule_details/per_field_rule_diff_tab';
 import { useIsUpgradingSecurityPackages } from '../../../../rule_management/logic/use_upgrade_security_packages';
@@ -26,13 +34,14 @@ import type { UpgradePrebuiltRulesTableFilterOptions } from './use_filter_prebui
 import { useFilterPrebuiltRulesToUpgrade } from './use_filter_prebuilt_rules_to_upgrade';
 import { TabContentPadding } from '../../../../rule_management/components/rule_details/rule_details_flyout';
 import { RuleDiffTab } from '../../../../rule_management/components/rule_details/rule_diff_tab';
+import { FieldUpgradeState } from '../../../../rule_management/model/prebuilt_rule_upgrade/field_upgrade_state';
+import { useRulePreviewFlyout } from '../use_rule_preview_flyout';
 import { MlJobUpgradeModal } from './modals/ml_job_upgrade_modal';
 import { UpgradeConflictsModal } from './modals/upgrade_conflicts_modal';
-import * as ruleDetailsI18n from '../../../../rule_management/components/rule_details/translations';
-import * as i18n from './translations';
 import { usePrebuiltRulesUpgradeState } from './use_prebuilt_rules_upgrade_state';
-import { useRulePreviewFlyout } from '../use_rule_preview_flyout';
 import { useMlJobUpgradeModal, useUpgradeConflictsModal } from './use_upgrade_modals';
+import * as ruleDetailsI18n from '../../../../rule_management/components/rule_details/translations';
+import * as i18n from './translations';
 
 export interface UpgradePrebuiltRulesTableState {
   /**
@@ -160,20 +169,6 @@ export const UpgradePrebuiltRulesTableContextProvider = ({
   } = useUpgradeConflictsModal();
 
   const shouldConfirmMLJobs = legacyJobsInstalled.length > 0;
-  const getRulesWithConflicts = useCallback(
-    (ruleIds?: RuleSignatureId[]) => {
-      const rulesToUpgrade =
-        ruleIds?.map((ruleId) => {
-          const rule = rulesUpgradeState[ruleId];
-          invariant(rule, `Rule with ID ${ruleId} not found.`);
-
-          return rule;
-        }) ?? [];
-
-      return rulesToUpgrade.filter((rule) => rule.diff.num_fields_with_conflicts > 0);
-    },
-    [rulesUpgradeState]
-  );
 
   const { mutateAsync: upgradeSpecificRulesRequest } = usePerformUpgradeSpecificRules({
     pickVersion: isPrebuiltRulesCustomizationEnabled ? 'MERGED' : 'TARGET',
@@ -181,49 +176,57 @@ export const UpgradePrebuiltRulesTableContextProvider = ({
 
   const upgradeRules = useCallback(
     async (ruleIds: RuleSignatureId[]) => {
-      const rulesToUpgrade = ruleIds.map((ruleId) => ({
-        rule_id: ruleId,
-        version:
-          rulesUpgradeState[ruleId].diff.fields.version?.target_version ??
-          rulesUpgradeState[ruleId].current_rule.version,
-        revision: rulesUpgradeState[ruleId].revision,
-      }));
-      setLoadingRules((prev) => [...prev, ...rulesToUpgrade.map((r) => r.rule_id)]);
+      const conflictRuleIdsSet = new Set(
+        isPrebuiltRulesCustomizationEnabled
+          ? ruleIds.filter(
+              (ruleId) =>
+                rulesUpgradeState[ruleId].diff.num_fields_with_conflicts > 0 &&
+                rulesUpgradeState[ruleId].hasUnresolvedConflicts
+            )
+          : []
+      );
+      const ruleUpgradeSpecifiers: RuleUpgradeSpecifier[] = ruleIds
+        .filter((ruleId) => !conflictRuleIdsSet.has(ruleId))
+        .map((ruleId) => ({
+          rule_id: ruleId,
+          version:
+            rulesUpgradeState[ruleId].diff.fields.version?.target_version ??
+            rulesUpgradeState[ruleId].current_rule.version,
+          revision: rulesUpgradeState[ruleId].revision,
+          fields: isPrebuiltRulesCustomizationEnabled
+            ? constructRuleFieldsToUpgrade(rulesUpgradeState[ruleId])
+            : undefined,
+        }));
+
+      setLoadingRules((prev) => [...prev, ...ruleUpgradeSpecifiers.map((x) => x.rule_id)]);
+
       try {
         // Handle MLJobs modal
         if (shouldConfirmMLJobs && !(await confirmLegacyMLJobs())) {
           return;
         }
 
-        // Handle Rule Upgrades modal
-        const rulesWithConflicts = getRulesWithConflicts(ruleIds);
         if (
           isPrebuiltRulesCustomizationEnabled &&
-          rulesWithConflicts.length > 0 &&
+          conflictRuleIdsSet.size > 0 &&
           !(await confirmConflictsUpgrade())
         ) {
           return;
         }
 
-        // Prepare payload for upgrade with rules with no conflicts
-        const ruleIdsWithConflicts = new Set(rulesWithConflicts.map((rule) => rule.rule_id));
-        const rulesToUpgradeWithNoConflicts = isPrebuiltRulesCustomizationEnabled
-          ? rulesToUpgrade.filter((rule) => !ruleIdsWithConflicts.has(rule.rule_id))
-          : rulesToUpgrade;
-        await upgradeSpecificRulesRequest(rulesToUpgradeWithNoConflicts);
+        await upgradeSpecificRulesRequest(ruleUpgradeSpecifiers);
       } catch (err) {
         addError(err, { title: i18n.UPDATE_ERROR });
       } finally {
-        setLoadingRules((prev) =>
-          prev.filter((id) => !rulesToUpgrade.some((r) => r.rule_id === id))
-        );
+        const upgradedRuleIdsSet = new Set(ruleUpgradeSpecifiers.map((x) => x.rule_id));
+
+        setLoadingRules((prev) => prev.filter((id) => !upgradedRuleIdsSet.has(id)));
       }
     },
     [
       confirmLegacyMLJobs,
       confirmConflictsUpgrade,
       shouldConfirmMLJobs,
-      getRulesWithConflicts,
       rulesUpgradeState,
       upgradeSpecificRulesRequest,
       isPrebuiltRulesCustomizationEnabled,
@@ -408,3 +411,26 @@ export const useUpgradePrebuiltRulesTableContext = (): UpgradePrebuiltRulesConte
 
   return rulesTableContext;
 };
+
+function constructRuleFieldsToUpgrade(ruleUpgradeState: RuleUpgradeState): RuleFieldsToUpgrade {
+  const finalRule = ruleUpgradeState.finalRule as Record<string, unknown>;
+  const ruleFieldsToUpgrade: Record<string, unknown> = {};
+
+  for (const fieldName of Object.keys(ruleUpgradeState.fieldsUpgradeState)) {
+    const fieldUpgradeState = ruleUpgradeState.fieldsUpgradeState[fieldName];
+
+    if (!isNonUpgradeableFieldName(fieldName) && fieldUpgradeState === FieldUpgradeState.Accepted) {
+      invariant(
+        fieldName in finalRule,
+        `Ready to upgrade field "${fieldName}" is not found in final rule`
+      );
+
+      ruleFieldsToUpgrade[fieldName] = {
+        pick_version: 'RESOLVED',
+        resolved_value: finalRule[fieldName],
+      };
+    }
+  }
+
+  return ruleFieldsToUpgrade;
+}
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/use_prebuilt_rules_upgrade_state.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/use_prebuilt_rules_upgrade_state.ts
index 8c97a4ef52e2b..b50ca7da1849d 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/use_prebuilt_rules_upgrade_state.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/use_prebuilt_rules_upgrade_state.ts
@@ -19,11 +19,12 @@ import {
   type DiffableRule,
   type RuleUpgradeInfoForReview,
   ThreeWayDiffConflict,
+  type RuleSignatureId,
 } from '../../../../../../common/api/detection_engine';
 import { convertRuleToDiffable } from '../../../../../../common/detection_engine/prebuilt_rules/diff/convert_rule_to_diffable';
 
 type RuleResolvedConflicts = Partial<DiffableAllFields>;
-type RulesResolvedConflicts = Record<string, RuleResolvedConflicts>;
+type RulesResolvedConflicts = Record<RuleSignatureId, RuleResolvedConflicts>;
 
 interface UseRulesUpgradeStateResult {
   rulesUpgradeState: RulesUpgradeState;