[Security Solution][API testing] Move and restructures rule preview test and actions legacy utils

.buildkite/ftr_configs.yml

@@ -455,8 +455,8 @@ enabled:
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/ess.config.ts
-  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/configs/serverless.config.ts
-  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation_preview/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation_preview/configs/ess.config.ts
 
 
 

x-pack/test/security_solution_api_integration/package.json

@@ -27,10 +27,10 @@
     "exception_operators_ips_text_array:qa:serverless": "npm run run-tests exceptions/operators_data_types/ips_text_array serverless qaEnv",
     "exception_operators_ips_text_array:server:ess": "npm run initialize-server exceptions/operators_data_types/ips_text_array ess",
     "exception_operators_ips_text_array:runner:ess": "npm run run-tests exceptions/operators_data_types/ips_text_array ess essEnv",
-    "rule_creation:server:serverless": "npm run initialize-server rule_creation serverless",
-    "rule_creation:runner:serverless": "npm run run-tests rule_creation serverless serverlessEnv",
-    "rule_creation:qa:serverless": "npm run run-tests rule_creation serverless qaEnv",
-    "rule_creation:server:ess": "npm run initialize-server rule_creation ess",
-    "rule_creation:runner:ess": "npm run run-tests rule_creation ess essEnv"
+    "rule_creation_preview:server:serverless": "npm run initialize-server rule_creation_preview serverless",
+    "rule_creation_preview:runner:serverless": "npm run run-tests rule_creation_preview serverless serverlessEnv",
+    "rule_creation_preview:qa:serverless": "npm run run-tests rule_creation_preview serverless qaEnv",
+    "rule_creation_preview:server:ess": "npm run initialize-server rule_creation_preview ess",
+    "rule_creation_preview:runner:ess": "npm run run-tests rule_creation_preview ess essEnv"
   }
 }

x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/index.ts → x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation_preview/index.ts

@@ -10,5 +10,6 @@ export default function ({ loadTestFile }: FtrProviderContext) {
   describe('Rule creation API', function () {
     loadTestFile(require.resolve('./create_rules'));
     loadTestFile(require.resolve('./create_new_terms'));
+    loadTestFile(require.resolve('./preview_rules'));
   });
 }

x-pack/test/detection_engine_api_integration/security_and_spaces/group1/preview_rules.ts → x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation_preview/preview_rules.ts

@@ -9,25 +9,35 @@ import expect from '@kbn/expect';
 
 import { DETECTION_ENGINE_RULES_PREVIEW } from '@kbn/security-solution-plugin/common/constants';
 import { ROLES } from '@kbn/security-solution-plugin/common/test';
-import { FtrProviderContext } from '../../common/ftr_provider_context';
 import { deleteAllRules, getSimplePreviewRule, getSimpleRulePreviewOutput } from '../../utils';
-import { createUserAndRole, deleteUserAndRole } from '../../../common/services/security_solution';
 
-// eslint-disable-next-line import/no-default-export
+import {
+  createUserAndRole,
+  deleteUserAndRole,
+} from '../../../../../common/services/security_solution';
+
+import { FtrProviderContext } from '../../../../ftr_provider_context';
+import { EsArchivePathBuilder } from '../../../../es_archive_path_builder';
+
 export default ({ getService }: FtrProviderContext) => {
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
   const log = getService('log');
+  // TODO: add a new service
+  const config = getService('config');
+  const isServerless = config.get('serverless');
+  const dataPathBuilder = new EsArchivePathBuilder(isServerless);
+  const path = dataPathBuilder.getPath('auditbeat/hosts');
 
-  describe('preview_rules', () => {
+  describe('@serverless @ess preview_rules', () => {
     describe('previewing rules', () => {
       before(async () => {
-        await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
+        await esArchiver.load(path);
       });
 
       after(async () => {
-        await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
+        await esArchiver.unload(path);
       });
 
       afterEach(async () => {
@@ -84,7 +94,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
       });
 
-      describe('t1_analyst', () => {
+      describe('@brokenInServerless t1_analyst', () => {
         const role = ROLES.t1_analyst;
 
         beforeEach(async () => {
@@ -105,7 +115,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
       });
 
-      describe('hunter', () => {
+      describe('@brokenInServerless hunter', () => {
         const role = ROLES.hunter;
 
         beforeEach(async () => {

x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_preview_rule.ts

@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { PreviewRulesSchema } from '@kbn/security-solution-plugin/common/api/detection_engine';
+
+/**
+ * This is a typical simple preview rule for testing that is easy for most basic testing
+ * @param ruleId
+ * @param invocationCount The number of times the rule will be run through the executors. Defaulted to 12,
+ * the execution time for the default interval time of 5m.
+ */
+export const getSimplePreviewRule = (
+  ruleId = 'preview-rule-1',
+  invocationCount = 12
+): PreviewRulesSchema => ({
+  name: 'Simple Rule Query',
+  description: 'Simple Rule Query',
+  risk_score: 1,
+  rule_id: ruleId,
+  severity: 'high',
+  index: ['auditbeat-*'],
+  type: 'query',
+  query: 'user.name: root or user.name: admin',
+  invocationCount,
+  timeframeEnd: new Date().toISOString(),
+});

x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule_preview_output.ts

@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RulePreviewLogs } from '@kbn/security-solution-plugin/common/api/detection_engine';
+
+/**
+ * This is the typical output of a simple rule preview, with errors and warnings coming up from the rule
+ * execution process and a `previewId` generated server side for later preview querying
+ *
+ * @param previewId Rule id generated by the server itself
+ * @param logs Errors and warnings returned by executor and route file, defaults to empty array
+ */
+export const getSimpleRulePreviewOutput = (
+  previewId = undefined,
+  logs: RulePreviewLogs[] = []
+) => ({
+  logs,
+  previewId,
+  isAborted: false,
+});

x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/index.ts

@@ -26,5 +26,7 @@ export * from './find_immutable_rule_by_id';
 export * from './create_rule_with_exception_entries';
 export * from './downgrade_immutable_rule';
 export * from './get_eql_rule_for_alert_testing';
+export * from './get_simple_preview_rule';
+export * from './get_simple_rule_preview_output';
 
 export * from './prebuilt_rules';