[Security Solution] [Bug] Rules and alerts are available in second space if user re-create the space with same name again.

[muskangulati-qasource]

Describe the bug
Rules and alerts are available in second space if user re-create the space with same name again.

Kibana/Elasticsearch Stack version

VERSION: 8.18.0
BUILD: 82852
COMMIT: dae17b1f42873e0b3a53fbe6bf3482fc891800db

Pre Conditions

1. Kibana v8.18.0 must be available.
2. Second Space must be available. ( here - Mus1 )

Steps

1. Login with user in Second Space. ( here - Mus1 )
2. Navigate to Security -> Rules
3. Create a custom rule
4. Alerts must be triggered
5. Navigate to Security -> Alerts
6. Validate, alerts must exist
7. Switch to Default Space.
8. Now from Manage Space, delete the Second Space in which Rule was created and alerts were generated earlier. ( here - Mus1 )
9. Now click on Create Space button.
10. Enter the Space name same as for earlier deleted spaces. ( here - Mus1 )
11. Switch to newly created Space. ( here - Mus1 )
12. Navigate to Security -> Rules and Security -> Alerts
13. Observe that rules and alerts are available

Expected Result
The data previously deleted should not be available for the newly re created space as it can expose private data

Screen Recording

Alerts.mp4

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[arvindersingh-qasource]

Reviewed and Assigned to @vgomez-el

[vgomez-el]

Hi @muskangulati-qasource!
I have been able to properly reproduce the bug, but in my case Detection rules were deleted but alerts were not.

REC-20250327152007.mp4

I will check with @PhilippeOberti and Threat hunting investigations team, if the bug belongs to them, or to the team that owns spaces.

[elasticmachine]

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[dhurley14]

I reproduced this using stack rules + alerts:

spaces_bug.mov

[jaredburgettelastic]

Similar bug on Entity Analytics side here, a similar solution should be able to be used for both Alerts/Rules and EA. We may need a way to hook into the "Delete Space" code to remove additional resources.