[Security Solution] “Author” and “License” Fields Are Editable in UI but Result in Errors When Updated

[pborgonovi]

Describe the bug: In the rule editing UI, the fields “Author” and “License” for prebuilt rules are currently enabled, allowing users to make edits. However, when the user attempts to save the changes, errors occur:

For the Author field: “Cannot update ‘author’ field for prebuilt rules (400)” For the License field: “Cannot update ‘license’ field for prebuilt rules (400)”

The backend validation correctly blocks these changes, as these fields are not meant to be edited for prebuilt rules. However, the UI behavior is misleading, as it suggests that these fields can be modified.

Kibana/Elasticsearch Stack version: 8.x

Current branch: 8.x  
Latest commit: d0c9a2f1f52 - [8.x] [Stack Monitoring / Logs] Fix Stack Monitoring logs links (#200043) (#200227)  
Remote tracking: origin/8.x  
Status relative to remote: up to date (no pending commits)  

Server OS version:

Browser and Browser OS versions:

Elastic Endpoint version:

Original install method (e.g. download page, yum, from source, etc.):

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Steps to reproduce:

1. Open the Edit Rule page for a prebuilt rule.
2. Modify the “Author” or “License” field.
3. Attempt to save the changes.
4. Observe the following errors in the UI: • For “Author”: “Cannot update ‘author’ field for prebuilt rules (400)” • For “License”: “Cannot update ‘license’ field for prebuilt rules (400)”

Current behavior: The “Author” and “License” fields are enabled and editable in the UI.

Expected behavior: The “Author” and “License” fields should be disabled (read-only) in the UI for prebuilt rules, preventing users from attempting to edit them.

Screenshots (if relevant):

https://github.com/user-attachments/assets/334ad2f4-4459-4749-ad68-a0de1a8f0a83

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context (logs, chat logs, magical formulas, etc.):

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)