feat(tests): make Expected Detection editable when creating a test from template

Leads can now edit Expected Detection in the create-from-template
form, same as Suggested Attack Procedure — the edit seeds the new
test's detect_procedure via a detect_procedure_override, without
touching the template itself. The template only updates later through
the existing procedure-suggestion approval flow, once a round is
actually submitted — same mechanism as the red side, no new bypass.

backend/app/routers/tests.py

@@ -402,6 +402,7 @@ def create_test_from_template(
             platform_override=payload.platform,
             procedure_text_override=payload.procedure_text,
             tool_used_override=payload.tool_used,
+            detect_procedure_override=payload.detect_procedure,
         )
         # Call log_action()
         log_action(

backend/app/schemas/test_template.py

@@ -130,3 +130,4 @@ class TestTemplateInstantiate(BaseModel):
     platform: str | None = None
     procedure_text: str | None = None
     tool_used: str | None = None
+    detect_procedure: str | None = None

backend/app/services/test_crud_service.py

@@ -304,6 +304,7 @@ def create_test_from_template(
     platform_override: str | None = None,
     procedure_text_override: str | None = None,
     tool_used_override: str | None = None,
+    detect_procedure_override: str | None = None,
 ) -> Test:
     """Instantiate a Test from a TestTemplate.
 
@@ -364,7 +365,7 @@ def create_test_from_template(
         platform=platform_override if platform_override is not None else template.platform,
         procedure_text=procedure_text_override if procedure_text_override is not None else template.attack_procedure,
         tool_used=tool_used_override if tool_used_override is not None else template.tool_suggested,
-        detect_procedure=template.expected_detection,
+        detect_procedure=detect_procedure_override if detect_procedure_override is not None else template.expected_detection,
         remediation_steps=template.suggested_remediation,
         # Keyword argument: created_by
         created_by=creator_id,

backend/tests/test_procedure_suggestions.py

@@ -272,3 +272,37 @@ def test_duplicate_submission_does_not_create_a_second_pending_suggestion(
 
     listed = api("get", "/api/v1/procedure-suggestions", red_lead_headers).json()
     assert len(listed) == 1
+
+
+def test_lead_can_override_detect_procedure_when_creating_from_template(
+    client, db, api, red_lead_headers, technique, template,
+):
+    """A lead editing Expected Detection in the create-from-template form
+    seeds the new test's detect_procedure with their edit — same mechanism
+    as procedure_text_override on the red side — without touching the
+    template itself. The template only updates later, through the normal
+    procedure-suggestion approval flow once a round is actually submitted."""
+    resp = api(
+        "post", "/api/v1/tests/from-template", red_lead_headers,
+        json={
+            "template_id": template["id"],
+            "technique_id": technique,
+            "detect_procedure": "Check Sysmon Event ID 1 for mimikatz.exe process creation.",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    assert resp.json()["detect_procedure"] == "Check Sysmon Event ID 1 for mimikatz.exe process creation."
+
+    reloaded_template = api("get", f"/api/v1/test-templates/{template['id']}", red_lead_headers)
+    assert reloaded_template.json()["expected_detection"] == "Check process creation logs."
+
+
+def test_detect_procedure_defaults_to_template_expected_detection(
+    client, db, api, red_lead_headers, technique, template,
+):
+    resp = api(
+        "post", "/api/v1/tests/from-template", red_lead_headers,
+        json={"template_id": template["id"], "technique_id": technique},
+    )
+    assert resp.status_code == 201, resp.text
+    assert resp.json()["detect_procedure"] == "Check process creation logs."