[9.1] [Security Solution] Install mock prebuilt rules package in Cypress to reduce flakiness (#229689) (#231823)

# Backport

This will backport the following commits from `main` to `9.1`:
- [[Security Solution] Install mock prebuilt rules package in Cypress to
reduce flakiness
(#229689)](#229689)

<!--- Backport version: 10.0.1 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-08-13T12:31:26Z","message":"[Security
Solution] Install mock prebuilt rules package in Cypress to reduce
flakiness (#229689)\n\n**Resolves:
https://github.com/elastic/kibana/issues/182441**\n**Resolves:
https://github.com/elastic/kibana/issues/182442**\n**Resolves:
https://github.com/elastic/kibana/issues/228942**\n**Relates to:
https://github.com/elastic/kibana/pull/227689**\n\n## Summary\n\nThis PR
installs mock prebuilt rules package for e2e Cypress test to\nreduce
flakniess caused by accessing to the real EPR. It's similar to\nthe mock
package installation in integration
tests\n[PR](https://github.com/elastic/kibana/pull/227689).\n\n**Flaky
test runner**\n-
ESS:\nhttps://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/9120\n-
Serverless:\nhttps://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/9121","sha":"980add17c585d370d555e93b9146bbaad5d7a2d4","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["test","release_note:skip","impact:high","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Prebuilt Detection
Rules","backport:version","v9.2.0","v9.1.3","v8.19.3","v9.0.6","v8.18.6"],"title":"[Security
Solution] Install mock prebuilt rules package in Cypress to reduce
flakiness","number":229689,"url":"https://github.com/elastic/kibana/pull/229689","mergeCommit":{"message":"[Security
Solution] Install mock prebuilt rules package in Cypress to reduce
flakiness (#229689)\n\n**Resolves:
https://github.com/elastic/kibana/issues/182441**\n**Resolves:
https://github.com/elastic/kibana/issues/182442**\n**Resolves:
https://github.com/elastic/kibana/issues/228942**\n**Relates to:
https://github.com/elastic/kibana/pull/227689**\n\n## Summary\n\nThis PR
installs mock prebuilt rules package for e2e Cypress test to\nreduce
flakniess caused by accessing to the real EPR. It's similar to\nthe mock
package installation in integration
tests\n[PR](https://github.com/elastic/kibana/pull/227689).\n\n**Flaky
test runner**\n-
ESS:\nhttps://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/9120\n-
Serverless:\nhttps://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/9121","sha":"980add17c585d370d555e93b9146bbaad5d7a2d4"}},"sourceBranch":"main","suggestedTargetBranches":["9.1"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/229689","number":229689,"mergeCommit":{"message":"[Security
Solution] Install mock prebuilt rules package in Cypress to reduce
flakiness (#229689)\n\n**Resolves:
https://github.com/elastic/kibana/issues/182441**\n**Resolves:
https://github.com/elastic/kibana/issues/182442**\n**Resolves:
https://github.com/elastic/kibana/issues/228942**\n**Relates to:
https://github.com/elastic/kibana/pull/227689**\n\n## Summary\n\nThis PR
installs mock prebuilt rules package for e2e Cypress test to\nreduce
flakniess caused by accessing to the real EPR. It's similar to\nthe mock
package installation in integration
tests\n[PR](https://github.com/elastic/kibana/pull/227689).\n\n**Flaky
test runner**\n-
ESS:\nhttps://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/9120\n-
Serverless:\nhttps://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/9121","sha":"980add17c585d370d555e93b9146bbaad5d7a2d4"}},{"branch":"9.1","label":"v9.1.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/231613","number":231613,"state":"OPEN"},{"branch":"9.0","label":"v9.0.6","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/231625","number":231625,"state":"MERGED","mergeCommit":{"sha":"486b8164ee7c6eabf4cd31d183409fe5c366a553","message":"[9.0]
[Security Solution] Install mock prebuilt rules package in Cypress to
reduce flakiness (#229689) (#231625)\n\n# Backport\n\nThis will backport
the following commits from `main` to `9.0`:\n- [[Security Solution]
Install mock prebuilt rules package in Cypress to\nreduce
flakiness\n(#229689)](https://github.com/elastic/kibana/pull/229689)\n\n\n\n###
Questions ?\nPlease refer to the [Backport
tool\ndocumentation](https://github.com/sorenlouv/backport)\n\n"}},{"branch":"8.18","label":"v8.18.6","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/231628","number":231628,"state":"MERGED","mergeCommit":{"sha":"931e5ea6edad4fad74a3b116fea66e8f440eab43","message":"[8.18]
[Security Solution] Install mock prebuilt rules package in Cypress to
reduce flakiness (#229689) (#231628)\n\n# Backport\n\nThis will backport
the following commits from `main` to `8.18`:\n- [[Security Solution]
Install mock prebuilt rules package in Cypress to\nreduce
flakiness\n(#229689)](https://github.com/elastic/kibana/pull/229689)\n\n\n\n###
Questions ?\nPlease refer to the [Backport
tool\ndocumentation](https://github.com/sorenlouv/backport)\n\n"}}]}]
BACKPORT-->

Co-authored-by: Maxim Palenov <[email protected]>

Author: banderror

x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/authorization/all_rules_read_only.cy.ts

@@ -7,7 +7,8 @@
 
 import { ROLES } from '@kbn/security-solution-plugin/common/test';
 
-import { getNewRule } from '../../../../objects/rule';
+import { installMockPrebuiltRulesPackage } from '../../../../tasks/api_calls/prebuilt_rules';
+import { getCustomQueryRuleParams, getNewRule } from '../../../../objects/rule';
 import {
   COLLAPSED_ACTION_BTN,
   RULE_CHECKBOX,
@@ -28,12 +29,16 @@ import { deleteAlertsAndRules } from '../../../../tasks/api_calls/common';
 // TODO: https://github.com/elastic/kibana/issues/164451 We should find a way to make this spec work in Serverless
 // TODO: https://github.com/elastic/kibana/issues/161540
 describe('All rules - read only', { tags: ['@ess', '@serverless', '@skipInServerless'] }, () => {
+  before(() => {
+    installMockPrebuiltRulesPackage();
+  });
+
   beforeEach(() => {
     deleteAlertsAndRules();
-    createRule(getNewRule({ rule_id: '1', enabled: false }));
+    createRule(getCustomQueryRuleParams({ rule_id: '1', enabled: false }));
     login(ROLES.t1_analyst);
     visitRulesManagementTable();
-    cy.get(RULE_NAME).should('have.text', getNewRule().name);
+    cy.get(RULE_NAME).should('have.text', getCustomQueryRuleParams().name);
   });
 
   it('Does not display select boxes for rules', () => {

x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/coverage_overview/coverage_overview.cy.ts

@@ -22,9 +22,10 @@ import { createRule } from '../../../../tasks/api_calls/rules';
 import { visit } from '../../../../tasks/navigation';
 import { RULES_COVERAGE_OVERVIEW_URL } from '../../../../urls/rules_management';
 import { createRuleAssetSavedObject } from '../../../../helpers/rules';
-import { getNewRule } from '../../../../objects/rule';
+import { getCustomQueryRuleParams, getNewRule } from '../../../../objects/rule';
 import {
   createAndInstallMockedPrebuiltRules,
+  installMockPrebuiltRulesPackage,
   preventPrebuiltRulesPackageInstallation,
 } from '../../../../tasks/api_calls/prebuilt_rules';
 import {
@@ -191,6 +192,10 @@ const prebuiltRules = [
 
 // https://github.com/elastic/kibana/issues/179052
 describe('Coverage overview', { tags: ['@ess', '@serverless', '@skipInServerless'] }, () => {
+  before(() => {
+    installMockPrebuiltRulesPackage();
+  });
+
   describe('base cases', () => {
     beforeEach(() => {
       login();
@@ -199,15 +204,15 @@ describe('Coverage overview', { tags: ['@ess', '@serverless', '@skipInServerless
       preventPrebuiltRulesPackageInstallation();
       createAndInstallMockedPrebuiltRules(prebuiltRules);
       createRule(
-        getNewRule({
+        getCustomQueryRuleParams({
           rule_id: 'enabled_custom_rule',
           enabled: true,
           name: 'Enabled custom rule',
           threat: [MockEnabledCustomRuleThreat],
         })
       );
       createRule(
-        getNewRule({
+        getCustomQueryRuleParams({
           rule_id: 'disabled_custom_rule',
           name: 'Disabled custom rule',
           enabled: false,

x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/maintenance_windows/maintenance_window_callout.cy.ts

@@ -8,6 +8,7 @@
 import { INTERNAL_ALERTING_API_MAINTENANCE_WINDOW_PATH } from '@kbn/alerting-plugin/common';
 import type { MaintenanceWindowCreateBody } from '@kbn/alerting-plugin/common';
 import type { AsApiContract } from '@kbn/alerting-plugin/server/routes/lib';
+import { installMockPrebuiltRulesPackage } from '../../../../tasks/api_calls/prebuilt_rules';
 import { login } from '../../../../tasks/login';
 import { visit } from '../../../../tasks/navigation';
 import { RULES_MANAGEMENT_URL } from '../../../../urls/rules_management';
@@ -17,6 +18,10 @@ describe(
   'Maintenance window callout on Rule Management page',
   { tags: ['@ess', '@serverless', '@skipInServerless'] },
   () => {
+    before(() => {
+      installMockPrebuiltRulesPackage();
+    });
+
     let maintenanceWindowId = '';
 
     beforeEach(() => {

x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/prebuilt_rules/customization/revert_prebuilt_rule.cy.ts

@@ -29,6 +29,7 @@ import {
 } from '../../../../../tasks/api_calls/common';
 import {
   createAndInstallMockedPrebuiltRules,
+  installMockPrebuiltRulesPackage,
   preventPrebuiltRulesPackageInstallation,
 } from '../../../../../tasks/api_calls/prebuilt_rules';
 import { createRule, patchRule } from '../../../../../tasks/api_calls/rules';
@@ -44,6 +45,10 @@ describe(
 
   () => {
     describe('Reverting prebuilt rules', () => {
+      before(() => {
+        installMockPrebuiltRulesPackage();
+      });
+
       const PREBUILT_RULE = createRuleAssetSavedObject({
         name: 'Non-customized prebuilt rule',
         rule_id: 'rule_1',
@@ -52,12 +57,13 @@ describe(
       });
 
       beforeEach(() => {
-        login();
         deleteAlertsAndRules();
         deletePrebuiltRulesAssets();
         preventPrebuiltRulesPackageInstallation();
         /* Create a new rule and install it */
         createAndInstallMockedPrebuiltRules([PREBUILT_RULE]);
+
+        login();
         visitRulesManagementTable();
       });