[Security Solution]'Export Selected' button is enabled for Pre-built elastic Rules

[ghost]

Description:
'Export Selected' button is enabled for Pre-built elastic Rules

Build Details:
Version: 7.14.0 BC1
Commit: 071a74e
Build: 42292
Artifact Page : https://staging.elastic.co/7.14.0-8eba2f5f/summary-7.14.0.html

Browser Details:
All

Preconditions:

• Kibana Environment should exist.
• Endpoint Security and elastic agent should be installed
• Alerts should be generated

Steps to Reproduce:

1. Navigate to 'Rules' tab under Security Solutions
2. Click on 'Select all 553 rules' and click on 'Bulk Action' drop down menu.
3. Observe that 'Export Selected' button is enabled for Pre-built elastic Rules

Actual Result:
'Export Selected' button is enabled for Pre-built elastic Rules.
Success message "Successfully exported 0 of 553 rules. Prebuilt rules were excluded from the resulting file." is getting displayed by clicking on 'Export Selected' button.

Screen-Cast

Expected Result:
'Export Selected' button should be disabled for Pre-built elastic Rules.

What's not working:

• This issue is not occurring if user selects single or few Pre-built elastic rules.

What's working:

• NA

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[ghost]

@manishgupta-qasource Please review!!

[manishgupta-qasource]

Reviewed & assigned to @MadameSheema

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[MadameSheema]

@peluja1012 @spong please note that this question is listed on elastic/security-team#1412 ticket, can we confirm if this is a bug or an expected behaviour? Thanks

ping @MikePaquette

[peluja1012]

@spong @MadameSheema This is expected behavior as discussed in the original PR here. When users use the "select all" feature, we don't have an easy way to determine if "all" of the selected rules are prebuilt. However, when users select the current page or select individual rules, the "export" option should still be disabled appropriately for prebuilt rules.

[ghost]

Hi @madamsheema,

Thanks for the update!! We are considering this as expected behavior as mentioned in the comments!!