[8.19] [Security solution] Add github label for evals for prompt changes (elastic#224488) (elastic#224977)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Security solution] Add github label for evals for prompt changes
(elastic#224488)](elastic#224488)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Steph
Milovic","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-06-23T23:25:05Z","message":"[Security
solution] Add github label for evals for prompt changes
(elastic#224488)","sha":"63134aa8eb8a1ad1cb06356eada5af9dfca338e4","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:
SecuritySolution","Team:Security Generative
AI","backport:version","v9.1.0","v8.19.0","ci:security-genai-run-evals-local-prompts"],"title":"[Security
solution] Add github label for evals for prompt
changes","number":224488,"url":"https://github.com/elastic/kibana/pull/224488","mergeCommit":{"message":"[Security
solution] Add github label for evals for prompt changes
(elastic#224488)","sha":"63134aa8eb8a1ad1cb06356eada5af9dfca338e4"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/224488","number":224488,"mergeCommit":{"message":"[Security
solution] Add github label for evals for prompt changes
(elastic#224488)","sha":"63134aa8eb8a1ad1cb06356eada5af9dfca338e4"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Steph Milovic <[email protected]>

Author: kibanamachine

.buildkite/scripts/common/env.sh

@@ -83,6 +83,11 @@ if is_pr; then
     export ELASTIC_APM_CONTEXT_PROPAGATION_ONLY=true
   fi
 
+  # value for security genai prompts evals
+  if is_pr_with_label "ci:security-genai-run-evals-local-prompts"; then
+    export IS_SECURITY_AI_PROMPT_TEST=true
+  fi
+
   # These can be removed once we're not supporting Jenkins and Buildkite at the same time
   # These are primarily used by github checks reporter and can be configured via /github_checks_api.json
   export ghprbGhRepository="elastic/kibana"

.buildkite/scripts/pipelines/pull_request/pipeline.ts

@@ -407,7 +407,10 @@ const getPipeline = (filename: string, removeSteps = true) => {
       pipeline.push(getPipeline('.buildkite/pipelines/pull_request/scout_tests.yml'));
     }
 
-    if (GITHUB_PR_LABELS.includes('ci:security-genai-run-evals')) {
+    if (
+      GITHUB_PR_LABELS.includes('ci:security-genai-run-evals') ||
+      GITHUB_PR_LABELS.includes('ci:security-genai-run-evals-local-prompts')
+    ) {
       pipeline.push(
         getPipeline('.buildkite/pipelines/pull_request/security_solution/gen_ai_evals.yml')
       );

x-pack/test/security_solution_api_integration/test_suites/genai/evaluations/trial_license_complete_tier/evaluations.ts

@@ -35,6 +35,7 @@ export default ({ getService }: FtrProviderContext) => {
   const es = getService('es');
   const ml = getService('ml') as ReturnType<typeof MachineLearningProvider>;
   const esArchiver = getService('esArchiver');
+  const isEvalLocalPrompts = process.env.IS_SECURITY_AI_PROMPT_TEST === 'true';
 
   /**
    * Results will be written to LangSmith for project associated with the langSmithAPIKey, then later
@@ -63,6 +64,12 @@ export default ({ getService }: FtrProviderContext) => {
       await esArchiver.load(
         'x-pack/test/functional/es_archives/security_solution/attack_discovery_alerts'
       );
+      // if run is to test prompt changes, uninstall prompt integration to default to local prompts
+      if (isEvalLocalPrompts) {
+        // delete integration prompt saved objects
+        const route = routeWithNamespace(`/api/saved_objects/epm-packages/security_ai_prompts`);
+        await supertest.delete(route).set('kbn-xsrf', 'foo');
+      }
     });
 
     after(async () => {
@@ -78,9 +85,12 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('Run Evaluations', () => {
       const buildNumber = process.env.BUILDKITE_BUILD_NUMBER || os.hostname();
+      const prNumber = process.env.BUILDKITE_PULL_REQUEST;
       const config = getSecurityGenAIConfigFromEnvVar();
       const defaultEvalPayload: PostEvaluateBody = {
-        runName: `Eval Automation${buildNumber ? ' - ' + buildNumber : ''}`,
+        runName: `Eval Automation${buildNumber ? ' | Build ' + buildNumber : ''}${
+          prNumber ? ' | PR ' + prNumber : ''
+        }${isEvalLocalPrompts ? ' | [Local Prompts]' : ''}`,
         graphs: ['DefaultAssistantGraph'],
         datasetName: 'Sample Dataset',
         connectorIds: Object.keys(config.connectors),