[SIEM][Detections Engine] - Update rule.lists to be rule.exceptions_list

[yctercero]

Summary

This PR updates the rules lists param to be exceptions_list. This is done in an attempt to make the terminology less confusing as lists will generally be referring to the big lists values. It should also make it more clear that the exceptions_list logic is being applied as a double not.

The following example does say event.module is not suricata BUT as this is an exceptions list, the logic is not when even.module is not suricata --> query && !(!event.module:suricata) ---> query && event.module:suricata

exceptions_list: [
   {
       field: 'event.module',
       values_operator: 'excluded',
       values_type: 'match',
       values: [
            {
                  name: 'suricata'
             }
       ]
   }
]

Did not update type names (ex lists_values etc...) as they'll also be useful when (maybe) adding such things as inclusion lists.

Tests marked describe.skip due to this being behind a feature flag were checked to be sure they are passing when feature flag is turned on.

Testing

• ./post_rule.sh ./rules/queries/lists/query_with_list.json
• ./update_rule.sh ./rules/updates/update_list.json
• ./patch_rule.sh ./rules/patches/update_list.json

Checklist

• Unit or functional tests were updated or added to match the most common scenarios

For maintainers

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[FrankHassanabad]

Simple enough, LGTM for the name change. Appreciate the time you took to accept feedback and then apply it to this to make it super simple for the API vocabulary to avoid user confusion.

This will save us time in the long run from forum posts and documentation for end users.

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 8d367ed

History

• 💚 Build #41612 succeeded 7724235
• 💚 Build #41444 succeeded fd3d96b
• 💚 Build #41267 succeeded 47f1081

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)