[9.1] [Security Solution] Transfer rule preview tests to Detection Engine (API Integration) (elastic#230267) (elastic#231631)

# Backport

This will backport the following commits from `main` to `9.1`:
- [[Security Solution] Transfer rule preview tests to Detection Engine
(API Integration)
(elastic#230267)](elastic#230267)

<!--- Backport version: 10.0.1 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Georgii
Gorbachev","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-08-11T17:16:22Z","message":"[Security
Solution] Transfer rule preview tests to Detection Engine (API
Integration) (elastic#230267)\n\n**Partially addresses:
https://github.com/elastic/kibana/issues/229688**\n**Addresses:\n[builds/3018](https://buildkite.com/elastic/kibana-serverless-security-solution-quality-gate-rule-management/builds/3018)**\n\n##
Summary\n\nThis PR transfers some API Integration tests for Rule Preview
under the\nownership of @elastic/security-detection-engine who own this
area of\nfeatures. Tests being
transferred:\n\nFrom:\n\n-\n`x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_creation/trial_license_complete_tier/preview_rules.ts`\n\nTo:\n\n-\n`x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_preview/preview_rules.ts`\n\n##
Flaky test runs\n\n1. [50x ESS +
50x\nServerless](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8968)\n🟢\n\n###
Checklist\n\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"a995d8a3718f057b21852fd72a72b68a724b13d6","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["test","technical
debt","release_note:skip","test-api-integration","Team:Detections and
Resp","Team: SecuritySolution","Feature:Detection Rule
Preview","Team:Detection Rule Management","Team:Detection
Engine","backport:version","v9.2.0","v9.0.5","v8.18.5","v9.1.2","v8.19.2"],"title":"[Security
Solution] Transfer rule preview tests to Detection Engine (API
Integration)","number":230267,"url":"https://github.com/elastic/kibana/pull/230267","mergeCommit":{"message":"[Security
Solution] Transfer rule preview tests to Detection Engine (API
Integration) (elastic#230267)\n\n**Partially addresses:
https://github.com/elastic/kibana/issues/229688**\n**Addresses:\n[builds/3018](https://buildkite.com/elastic/kibana-serverless-security-solution-quality-gate-rule-management/builds/3018)**\n\n##
Summary\n\nThis PR transfers some API Integration tests for Rule Preview
under the\nownership of @elastic/security-detection-engine who own this
area of\nfeatures. Tests being
transferred:\n\nFrom:\n\n-\n`x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_creation/trial_license_complete_tier/preview_rules.ts`\n\nTo:\n\n-\n`x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_preview/preview_rules.ts`\n\n##
Flaky test runs\n\n1. [50x ESS +
50x\nServerless](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8968)\n🟢\n\n###
Checklist\n\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"a995d8a3718f057b21852fd72a72b68a724b13d6"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","9.1","8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/230267","number":230267,"mergeCommit":{"message":"[Security
Solution] Transfer rule preview tests to Detection Engine (API
Integration) (elastic#230267)\n\n**Partially addresses:
https://github.com/elastic/kibana/issues/229688**\n**Addresses:\n[builds/3018](https://buildkite.com/elastic/kibana-serverless-security-solution-quality-gate-rule-management/builds/3018)**\n\n##
Summary\n\nThis PR transfers some API Integration tests for Rule Preview
under the\nownership of @elastic/security-detection-engine who own this
area of\nfeatures. Tests being
transferred:\n\nFrom:\n\n-\n`x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_creation/trial_license_complete_tier/preview_rules.ts`\n\nTo:\n\n-\n`x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_preview/preview_rules.ts`\n\n##
Flaky test runs\n\n1. [50x ESS +
50x\nServerless](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8968)\n🟢\n\n###
Checklist\n\n- [x] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"a995d8a3718f057b21852fd72a72b68a724b13d6"}},{"branch":"9.0","label":"v9.0.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.2","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.2","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Author: banderror

.buildkite/ftr_security_serverless_configs.yml

@@ -73,6 +73,7 @@ disabled:
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/query/trial_license_complete_tier/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/threshold/trial_license_complete_tier/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_gaps/trial_license_complete_tier/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_preview/configs/serverless_complete_tier.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_creation/basic_license_essentials_tier/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_creation/trial_license_complete_tier/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_patch/trial_license_complete_tier/configs/serverless.config.ts

.buildkite/ftr_security_stateful_configs.yml

@@ -62,6 +62,7 @@ enabled:
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/query/trial_license_complete_tier/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/threshold/trial_license_complete_tier/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_gaps/trial_license_complete_tier/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_preview/configs/ess_trial_license.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_creation/basic_license_essentials_tier/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_creation/trial_license_complete_tier/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_patch/trial_license_complete_tier/configs/ess.config.ts

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_preview/configs/ess_trial_license.config.ts

@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../config/ess/config.base.trial')
+  );
+
+  return {
+    ...functionalConfig.getAll(),
+    testFiles: [require.resolve('..')],
+    junit: {
+      reportName: 'Detection Engine - Rule Preview Integration Tests - ESS Env - Trial License',
+    },
+  };
+}

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_preview/configs/serverless_complete_tier.config.ts

@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { createTestConfig } from '../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  testFiles: [require.resolve('..')],
+  junit: {
+    reportName:
+      'Detection Engine - Rule Preview Integration Tests - Serverless Env - Complete Tier',
+  },
+});

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_preview/index.ts

@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { FtrProviderContext } from '../../../../ftr_provider_context';
+
+export default function ({ loadTestFile }: FtrProviderContext) {
+  describe('Detection Engine - Rule preview API', function () {
+    loadTestFile(require.resolve('./preview_rules'));
+  });
+}

x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_creation/trial_license_complete_tier/preview_rules.ts renamed to x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_preview/preview_rules.ts

@@ -9,13 +9,13 @@ import expect from '@kbn/expect';
 
 import { DETECTION_ENGINE_RULES_PREVIEW } from '@kbn/security-solution-plugin/common/constants';
 import { ROLES } from '@kbn/security-solution-plugin/common/test';
-import { getSimplePreviewRule, getSimpleRulePreviewOutput } from '../../../utils';
-import { deleteAllRules } from '../../../../../config/services/detections_response';
+import { getSimplePreviewRule, getSimpleRulePreviewOutput } from '../../utils';
+import { deleteAllRules } from '../../../../config/services/detections_response';
 
-import { createUserAndRole, deleteUserAndRole } from '../../../../../config/services/common';
+import { createUserAndRole, deleteUserAndRole } from '../../../../config/services/common';
 
-import { FtrProviderContext } from '../../../../../ftr_provider_context';
-import { EsArchivePathBuilder } from '../../../../../es_archive_path_builder';
+import { FtrProviderContext } from '../../../../ftr_provider_context';
+import { EsArchivePathBuilder } from '../../../../es_archive_path_builder';
 
 export default ({ getService }: FtrProviderContext) => {
   const esArchiver = getService('esArchiver');

x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_creation/trial_license_complete_tier/index.ts

@@ -10,6 +10,5 @@ export default function ({ loadTestFile }: FtrProviderContext) {
   describe('Rules Management - Rule creation APIs', function () {
     loadTestFile(require.resolve('./create_rules'));
     loadTestFile(require.resolve('./create_new_terms'));
-    loadTestFile(require.resolve('./preview_rules'));
   });
 }