[Security Solution] Tags filter in updates table does not reflect newly added tags

[pborgonovi]

Description:

When a user selects a rule with available updates in the Updates Table, adds new tags, and saves them in the Update flyout, the changes are saved locally in the flyout but the rule is not yet updated (user clicks Dismiss instead of updating the rule). Despite the new tags being added in the flyout, the Tags filter in the updates table does not include the newly added tags.

Kibana/Elasticsearch Stack version:

VERSION: 9.0.0
BUILD: 82604
COMMIT: 6ec7c37

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Rules Update

Pre requisites:

1. prebuiltRulesCustomizationEnabled flag is enabled
2. Prebuilt rules are available
3. Rules have updates available
4. At least one rule has tags update available

Steps to reproduce:

1. Go to the Rule Updates table.
2. Select a rule that has an update to the Tags field.
3. Open the Update flyout for the rule.
4. Add new tags to the rule and save the changes.
5. Click Dismiss in the flyout to close it without updating the rule.
6. Check the Tags filter in the updates table.

Current behavior:

The newly added tags are not included in the Tags filter options in the updates table.

Expected behavior:

The newly added tags should be included in the Tags filter options in the updates table.

Screenshots:

Screen.Recording.2025-01-14.at.9.48.24.AM.mov

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[banderror]

@pborgonovi The Rule Updates table shows the currently installed prebuilt rules that can be upgraded, and the Tags filter there aggregates the tags of these installed and stored in Elasticsearch rules. On the other hand, the Rule Upgrade flyout includes the tags that are yet to be applied to an installed prebuilt rule and yet to be saved to Elasticsearch. I'm not sure why this temporary data from the flyout should affect the table filters.

@approksiu Thoughts?

[approksiu]

I don't think we should update the (tag) filters with the data yet to be applied. It could also create odd collisions/unexpected data present for other users working on updates.
cc @banderror @pborgonovi