[8.18] [Security Solution] Fix flakiness in `prebuilt_rules_prev…

…iew.cy.ts` (#211034) (#211227)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Fix flakiness in
`prebuilt_rules_preview.cy.ts`
(#211034)](#211034)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"maxim.palenov@elastic.co"},"sourceCommit":{"committedDate":"2025-02-14T14:13:32Z","message":"[Security
Solution] Fix flakiness in `prebuilt_rules_preview.cy.ts`
(#211034)\n\n## Summary\r\n\r\nThis PR fixes Rule Management Prebuilt
Rules preview Cypress tests flakiness. The flakiness was localized to
`prebuilt_rules_preview.cy.ts`.\r\n\r\n## Problem details\r\n\r\nQuite
recently Rule Management Prebuilt Cypress tests group started failing
due to exceeding 1 hour execution limit. In normal conditions the group
takes up to 45 minutes to run all the tests.\r\n\r\nInvestigation
revealed the problem. It turned out the real prebuilt rules get
installed while it's not expected. The absolute majority of the tests
interact with a few prebuilt rule assets mocks to avoid heavy prebuilt
rules package installation and installing more than 1K rules from the
package. \r\n\r\n\r\nIn particular
`/internal/detection_engine/prebuilt_rules/_bootstrap` endpoint is
invoked upon loading any Security Solution plugin's page and leads to
installing a prebuilt rules package. The Cypress test code was organized
in way that first the Rule Management page is opened and then API calls
interception is set up. Since page loading may vary sometimes real calls
to `/internal/detection_engine/prebuilt_rules/_bootstrap` went
through.\r\n\r\nTests set up prebuilt rule assets mocks but real
prebuilt rules package installation wiped out the mocks leading to
failing tests. Since Cypress reruns failed tests execution time
increases and exceeds the
limit.\r\n\r\n![image](https://github.com/user-attachments/assets/19f86316-a2bb-438d-a8b9-fe6985a5e88f)\r\n\r\n*`installPrebuiltRuleAssets()`
sets up `/internal/detection_engine/prebuilt_rules/_bootstrap` calls
interception.\r\n\r\n## Flaky test runs\r\n\r\n**Before:**\r\n\r\n-
`prebuilt_rules_preview.cy.ts` was run in Flaky test runner with 100
iterations. The CI is green but it's easy to notice some jobs took
approximately 1 hour to run.\r\n 🔴
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7870\r\n\r\n**After:**\r\n\r\n-
`prebuilt_rules_preview.cy.ts` with the fix was run in Flaky test runner
with 100 iterations. Execution time approximately 15 minutes for each
job.\r\n ✅
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7873\r\n\r\n-
Rule Management Prebuilt Cypress tests group was run with 100
iterations\r\n ✅
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7875","sha":"67163cb80231ad78cab96f091203660d4da7559f","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["test","release_note:skip","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution] Fix flakiness in
`prebuilt_rules_preview.cy.ts`","number":211034,"url":"https://github.com/elastic/kibana/pull/211034","mergeCommit":{"message":"[Security
Solution] Fix flakiness in `prebuilt_rules_preview.cy.ts`
(#211034)\n\n## Summary\r\n\r\nThis PR fixes Rule Management Prebuilt
Rules preview Cypress tests flakiness. The flakiness was localized to
`prebuilt_rules_preview.cy.ts`.\r\n\r\n## Problem details\r\n\r\nQuite
recently Rule Management Prebuilt Cypress tests group started failing
due to exceeding 1 hour execution limit. In normal conditions the group
takes up to 45 minutes to run all the tests.\r\n\r\nInvestigation
revealed the problem. It turned out the real prebuilt rules get
installed while it's not expected. The absolute majority of the tests
interact with a few prebuilt rule assets mocks to avoid heavy prebuilt
rules package installation and installing more than 1K rules from the
package. \r\n\r\n\r\nIn particular
`/internal/detection_engine/prebuilt_rules/_bootstrap` endpoint is
invoked upon loading any Security Solution plugin's page and leads to
installing a prebuilt rules package. The Cypress test code was organized
in way that first the Rule Management page is opened and then API calls
interception is set up. Since page loading may vary sometimes real calls
to `/internal/detection_engine/prebuilt_rules/_bootstrap` went
through.\r\n\r\nTests set up prebuilt rule assets mocks but real
prebuilt rules package installation wiped out the mocks leading to
failing tests. Since Cypress reruns failed tests execution time
increases and exceeds the
limit.\r\n\r\n![image](https://github.com/user-attachments/assets/19f86316-a2bb-438d-a8b9-fe6985a5e88f)\r\n\r\n*`installPrebuiltRuleAssets()`
sets up `/internal/detection_engine/prebuilt_rules/_bootstrap` calls
interception.\r\n\r\n## Flaky test runs\r\n\r\n**Before:**\r\n\r\n-
`prebuilt_rules_preview.cy.ts` was run in Flaky test runner with 100
iterations. The CI is green but it's easy to notice some jobs took
approximately 1 hour to run.\r\n 🔴
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7870\r\n\r\n**After:**\r\n\r\n-
`prebuilt_rules_preview.cy.ts` with the fix was run in Flaky test runner
with 100 iterations. Execution time approximately 15 minutes for each
job.\r\n ✅
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7873\r\n\r\n-
Rule Management Prebuilt Cypress tests group was run with 100
iterations\r\n ✅
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7875","sha":"67163cb80231ad78cab96f091203660d4da7559f"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/211034","number":211034,"mergeCommit":{"message":"[Security
Solution] Fix flakiness in `prebuilt_rules_preview.cy.ts`
(#211034)\n\n## Summary\r\n\r\nThis PR fixes Rule Management Prebuilt
Rules preview Cypress tests flakiness. The flakiness was localized to
`prebuilt_rules_preview.cy.ts`.\r\n\r\n## Problem details\r\n\r\nQuite
recently Rule Management Prebuilt Cypress tests group started failing
due to exceeding 1 hour execution limit. In normal conditions the group
takes up to 45 minutes to run all the tests.\r\n\r\nInvestigation
revealed the problem. It turned out the real prebuilt rules get
installed while it's not expected. The absolute majority of the tests
interact with a few prebuilt rule assets mocks to avoid heavy prebuilt
rules package installation and installing more than 1K rules from the
package. \r\n\r\n\r\nIn particular
`/internal/detection_engine/prebuilt_rules/_bootstrap` endpoint is
invoked upon loading any Security Solution plugin's page and leads to
installing a prebuilt rules package. The Cypress test code was organized
in way that first the Rule Management page is opened and then API calls
interception is set up. Since page loading may vary sometimes real calls
to `/internal/detection_engine/prebuilt_rules/_bootstrap` went
through.\r\n\r\nTests set up prebuilt rule assets mocks but real
prebuilt rules package installation wiped out the mocks leading to
failing tests. Since Cypress reruns failed tests execution time
increases and exceeds the
limit.\r\n\r\n![image](https://github.com/user-attachments/assets/19f86316-a2bb-438d-a8b9-fe6985a5e88f)\r\n\r\n*`installPrebuiltRuleAssets()`
sets up `/internal/detection_engine/prebuilt_rules/_bootstrap` calls
interception.\r\n\r\n## Flaky test runs\r\n\r\n**Before:**\r\n\r\n-
`prebuilt_rules_preview.cy.ts` was run in Flaky test runner with 100
iterations. The CI is green but it's easy to notice some jobs took
approximately 1 hour to run.\r\n 🔴
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7870\r\n\r\n**After:**\r\n\r\n-
`prebuilt_rules_preview.cy.ts` with the fix was run in Flaky test runner
with 100 iterations. Execution time approximately 15 minutes for each
job.\r\n ✅
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7873\r\n\r\n-
Rule Management Prebuilt Cypress tests group was run with 100
iterations\r\n ✅
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7875","sha":"67163cb80231ad78cab96f091203660d4da7559f"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>

x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/prebuilt_rules/notifications.cy.ts

@@ -20,6 +20,7 @@ import {
   installAllPrebuiltRulesRequest,
   installPrebuiltRuleAssets,
   createAndInstallMockedPrebuiltRules,
+  preventPrebuiltRulesPackageInstallation,
 } from '../../../../tasks/api_calls/prebuilt_rules';
 import { resetRulesTableState } from '../../../../tasks/common';
 import { login } from '../../../../tasks/login';
@@ -35,6 +36,8 @@ describe(
   { tags: ['@ess', '@serverless', '@skipInServerlessMKI'] },
   () => {
     beforeEach(() => {
+      preventPrebuiltRulesPackageInstallation();
+
       login();
       /* Make sure persisted rules table state is cleared */
       resetRulesTableState();

x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/prebuilt_rules/prebuilt_rules_preview.cy.ts

@@ -26,6 +26,7 @@ import { RULE_MANAGEMENT_PAGE_BREADCRUMB } from '../../../../screens/breadcrumbs
 import {
   installPrebuiltRuleAssets,
   createAndInstallMockedPrebuiltRules,
+  preventPrebuiltRulesPackageInstallation,
 } from '../../../../tasks/api_calls/prebuilt_rules';
 import { createSavedQuery, deleteSavedQueries } from '../../../../tasks/api_calls/saved_queries';
 import { fetchMachineLearningModules } from '../../../../tasks/api_calls/machine_learning';
@@ -374,6 +375,8 @@ describe(
     };
 
     beforeEach(() => {
+      preventPrebuiltRulesPackageInstallation();
+
       login();
       resetRulesTableState();
       deleteAlertsAndRules();