[7.x] Fixes migration bug where I was deleting attributes (#115098)

x-pack/plugins/security_solution/server/lib/detection_engine/rule_actions/legacy_migrations.test.ts

@@ -20,6 +20,8 @@ describe('legacy_migrations', () => {
     test('it migrates both a "ruleAlertId" and a actions array with 1 element into the references array', () => {
       const doc = {
         attributes: {
+          ruleThrottle: '1d',
+          alertThrottle: '1d',
           ruleAlertId: '123',
           actions: [
             {
@@ -37,6 +39,8 @@ describe('legacy_migrations', () => {
         )
       ).toEqual({
         attributes: {
+          ruleThrottle: '1d',
+          alertThrottle: '1d',
           actions: [
             {
               actionRef: 'action_0',

x-pack/plugins/security_solution/server/lib/detection_engine/rule_actions/legacy_migrations.ts

@@ -245,7 +245,7 @@ export const legacyMigrateRuleAlertId = (
     return {
       ...doc,
       attributes: {
-        ...attributesWithoutRuleAlertId.attributes,
+        ...attributesWithoutRuleAlertId,
         actions: actionsWithRef,
       },
       references: [...existingReferences, ...alertReferences, ...actionsReferences],

x-pack/test/detection_engine_api_integration/security_and_spaces/tests/migrations.ts

@@ -65,6 +65,27 @@ export default ({ getService }: FtrProviderContext): void => {
           undefined
         );
       });
+
+      it('migrates legacy siem-detection-engine-rule-actions and retains "ruleThrottle" and "alertThrottle" as the same attributes as before', async () => {
+        const response = await es.get<{
+          'siem-detection-engine-rule-actions': {
+            ruleThrottle: string;
+            alertThrottle: string;
+          };
+        }>({
+          index: '.kibana',
+          id: 'siem-detection-engine-rule-actions:fce024a0-0452-11ec-9b15-d13d79d162f3',
+        });
+        expect(response.statusCode).to.eql(200);
+
+        // "alertThrottle" and "ruleThrottle" should still exist
+        expect(response.body._source?.['siem-detection-engine-rule-actions'].alertThrottle).to.eql(
+          '7d'
+        );
+        expect(response.body._source?.['siem-detection-engine-rule-actions'].ruleThrottle).to.eql(
+          '7d'
+        );
+      });
     });
   });
 };