[Security Solution] Declutter the ThreeWayDiff UI

[banderror]

Epic: #179907

Summary

We should "declutter" the Updates tab of the Rule Upgrade flyout that shows fields updated by Elastic and customized by the user.

Currently, if the user has many rule fields customized, we will show all of them in the flyout, along with the fields that have updates from Elastic. This looks a bit messy and the user can loose focus on updates and resolving conflicts between the updates and their customizations.

Here in green you can see fields that have updates from Elastic, and in orange fields that only have customizations made by the user.

We should ensure that users get a clear focus on updates from Elastic and conflicts between these updates and user customizations. Fields that have only user customizations but don't have updates from Elastic should be available for review and modification, but should be the lowest priority/focus.

User stories

• User can review field updates in the Upgrade flyout in the following order, in order to focus on the most important information first:

  1. Fields with non-solvable conflicts.
  2. Fields with solvable conflicts.
  3. Fields only with updates from Elastic.
  4. Fields only with user customizations.

• User can skip reviewing those fields that only contain user customizations; these fields should be hidden by default.

• User can unhide the fields that only contain user customizations, to be able to review and edit them if needed.

Background

Currently, if the user has many rule fields customized, we will show all of them in the flyout, along with the fields that have updates from Elastic.

Something that might be not clear to people is why do we need to show the fields that only contain user customizations?

Let's look at this simple example:

• Elastic updated the list of index patterns
• User updated the list of index patterns AND also changed the rule query

We will always be able to auto-merge changes to index patterns, so in this case it's gonna always be a solvable conflict. However, the user's customization to the query field might not be compatible with the auto-merged value of index patterns. That's why we should allow the user to edit the query field as well, if it's needed in a particular upgrade case.

Related issues

• Sorting was implemented in [Security Solution] Sort rule upgrade flyout fields according to the state #208553

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)