[Change History] Follow-up: remaining work after 9.5.0

[sdesalas]

Tracking all change-history work that did not land before the 9.5.0 release cutoff.

Initiative: https://github.com/elastic/security-team/issues/12431

Bugs

• [Security Solution] [Bug] Rule exception activity is not accurately tracked in the rule's change history #272918 — Rule exception activity not accurately tracked (impact:high) #SecuritySolution
• [Security Solution] [Bug] Rule history restore: concurrency guard fails under simultaneous requests #276282 — Concurrency guard fails on simultaneous restore requests (impact:medium) #SecuritySolution
• [Security Solution][Bug]No indicator shown in history diff when a referenced rule action connector has been deleted #275928 — No indicator in history diff when referenced connector is deleted (impact:medium) #SecuritySolution
• [Security Solution] [Bug] Count of changes is not properly aligned for Restored under Version history for Rules. #277177 — Restored entry count misaligned in version history (impact:low) #SecuritySolution
• [Security Solution] Missing pre-tracked rule snapshots in changes history #274925 — Missing pre-tracked rule snapshots in change history #SecuritySolution
• [Change history] sanitizeFields mangles snapshot field names containing dots #270134 — Dot-notation field names mangled in snapshots (fieldsToHash) #Core

Enhancements

• [Security Solution] Provide shared user-profile name resolution inside getHistory method of @kbn/change-history #278422 — Shared user-profile name resolution inside getHistory #Core
• [Security Solution] Forward-compatibility risk for teams using @kbn/change-history to restore historical snapshots #270139 — Forward-compatibility risk for @kbn/change-history consumers (meta/docs) #Core
• [Security Solution] Instrument non-used by Security Solution AF's RulesClient methods with changes history #262665 — Instrument remaining unused Alerting Framework RulesClient methods with change tracking #SecuritySolution
• Logging changed value text for encrypted fields in diffs #271799 — Logging changed value text for encrypted fields in diffs #Core

Open PRs

• [Security Solution] Remove rule changes history feature flags #278197 — Remove rule changes history feature flags (Maxim, review + merge) #SecuritySolution
• [Security Solution] Add test plan for rule changes history #274337 — Add test plan for rule changes history (Maxim, review + merge) #SecuritySolution
• [Alerting V2] Rule versioning using change history datastream #276947 — Alerting V2: Rule versioning using change-history datastream (adcoelho, review + merge) #Core
• [Change History] Shared user-profile name resolution in @kbn/change-history #278439 — Shared user-profile name resolution in @kbn/change-history (review required) #Core
• [Change history] De-duplicate the inlined product-origin header wiring in kbn-change-history tests. #280032 — Test-client privilege cleanup, follow-up to incident-3371 #Core
• [@kbn/change-history] Add getHistoryFieldAggregation for change-history facets #275846 — getHistoryFieldAggregation for change-history facets (Yngrid, review required) #Core

RFC follow-up items

From @maximpn's comment on https://github.com/elastic/security-team/issues/16808:

• https://github.com/elastic/security-team/issues/17281 — Track kibana.session_id in change-history documents #Core
• https://github.com/elastic/security-team/issues/17282 — Fail new ChangeHistoryClient({ module, dataset }) when the pair is already registered #Core
• https://github.com/elastic/security-team/issues/17283 — Prevent DoS and abuse of @kbn/change-history #Core
• https://github.com/elastic/security-team/issues/17284 — Support object.fields.truncated and object.fields.redacted in snapshots #Core (partially addressed, see comment)

Post-9.5 / Platform migration & handover

• Transfer kbn-change-history ownership to Core #266309 — Add Core ownership for kbn-change-history (@jloleysens) #Core — starts package ownership transfer to Kibana Core/Platform. (also raised by @yara on Jul 15 in #security-detection-rule-changes-history).

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-solution (Team: SecuritySolution)

[sdesalas]

Follow-up refactor note from @banderror (from review of #275559):

The await duplicateExceptions() call should probably be encapsulated in the await duplicateRule() call. The current implementation of await duplicateRule() always duplicates the rule without exceptions, which is less safe and consistent. An extra improvement would be to make duplicateRule() a method of the DetectionRulesClient.

@banderror explicitly did not want a separate ticket for this — it should be a quick follow-up PR. Original comment: #275559 (comment)

[infra-vault-gh-plugin-prod]

Pinging @elastic/kibana-core (Team:Core)

[rudolf]

Removed #271703 #271807 as these were only relevant to change history in an earlier design where change history was going to use diffs. Changes are now captured as snapshots.