[Security Solution] Persistent Background Error During Rule Save

[pborgonovi]

Describe the bug:
When attempting to save a detection rule with a query referencing an unidentified index in the Description tab, a validation warning is displayed, providing the options to Confirm or Cancel.

• If the user clicks Confirm, the rule is saved successfully despite the warning.
• If the user clicks Cancel, the red error message remains visible in the background.

Kibana/Elasticsearch Stack version:
8.x

Current branch: 8.x  
Latest commit: d0c9a2f1f52 - [8.x] [Stack Monitoring / Logs] Fix Stack Monitoring logs links (#200043) (#200227)  
Remote tracking: origin/8.x  
Status relative to remote: up to date (no pending commits)  

Server OS version:

Browser and Browser OS versions:

Elastic Endpoint version:

Original install method (e.g. download page, yum, from source, etc.):

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Steps to reproduce:

1. Open a detection rule with an invalid query in the Description tab (e.g., referencing an unknown index such as [.]).
2. Modify any part of the rule (e.g., update the schedule in the Schedule tab).
3. Click Save Changes.
4. Observe the following:

• A validation warning appears, stating the query could cause execution issues.
• Clicking Confirm successfully saves the rule, ignoring the warning.
• Clicking Cancel does not save the rule, and the red error persists in the background.

Current behavior:

• The red background error message is incorrectly displayed while the validation warning popup is active.
• The red error persists even if the user cancels the save operation.

Expected behavior:
The red error message in the background should not appear.

• Confirm: The rule should save successfully after the popup warning is acknowledged.
• Cancel: The popup warning should close, and the UI should reset to its original state with no residual errors displayed.

Screenshots (if relevant):

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context (logs, chat logs, magical formulas, etc.):

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[banderror]

@pborgonovi This was a quick-and-dirty implementation and this UI is not finished yet. It should be improved as part of #191832. I'll post a link to this bug there to share your suggestions, but close it to not have duplicated tickets.