[8.19] [Security Solution] Get rid of esArchiver in import custom rules integration tests (#229492) (#234561)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Security Solution] Get rid of esArchiver in import custom rules
integration tests
(#229492)](#229492)

<!--- Backport version: 10.0.2 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maxim
Palenov","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-07-31T15:16:08Z","message":"[Security
Solution] Get rid of esArchiver in import custom rules integration tests
(#229492)\n\n**Resolves:
https://github.com/elastic/kibana/issues/227454**\n**Resolves:
https://github.com/elastic/kibana/issues/224511**\n**Resolves:
https://github.com/elastic/kibana/issues/220971**\n**Resolves:
https://github.com/elastic/kibana/issues/220536**\n**Resolves:
https://github.com/elastic/kibana/issues/217903**\n**Resolves:
https://github.com/elastic/kibana/issues/205777**\n\n## Summary\n\nThis
PR fixes import custom rules flaky integration tests. This is done by
refactoring the tests and getting rid of `esArchiver`.\n\n##
Details\n\nInvestigation of the flakes specified in the tickets above
revealed that the culprit is `esArchiver`. It removes the target indexes
before loading the documents and applies migrations. In fact it turns
out it removes just installed mock prebuilt rules package forcing
installing a real prebuilt rules package from the production EPR. Where
usage of production EPR has been known to cause flakiness.\n\nOn top of
just getting rid of `esArchiver` this PR refactors the importing custom
rules integrations tests. The main goal is to make the tests structure
clear and transparent. Previously flaky tests were moved to the
different sections. And some of the tests testing Kibana v7.14
connectors were removed since `esArchiver` performs connectors migration
so importing rules tests interact with the migrated connections.\n\n##
Flaky test runner\n\n- ✅ [ESS 200
runs](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8883)\n-
✅ [Serverless 200
runs](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8884)\n\n##
How to test the fix?\n\n- Add
`--xpack.fleet.registryUrl=http://non-existent` to
[config.base.ts](https://github.com/elastic/kibana/blob/main/x-pack/test/security_solution_api_integration/config/ess/config.base.ts)
for ESS or
[config.base.ts](https://github.com/elastic/kibana/blob/main/x-pack/test/security_solution_api_integration/config/serverless/config.base.ts)
for Serverless.\n- run import custom rules integration tests in the
`main` branch and observe test failures\n- run import custom rules
integration tests in this PR and observe all tests have
passed","sha":"6403fd42ee060736f849af276b63183db247ea7c","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","impact:high","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Rule
Import/Export","backport:version","v8.19.0","v9.2.0","v9.0.5","v8.18.5","v9.1.2"],"title":"[Security
Solution] Get rid of esArchiver in import custom rules integration
tests","number":229492,"url":"https://github.com/elastic/kibana/pull/229492","mergeCommit":{"message":"[Security
Solution] Get rid of esArchiver in import custom rules integration tests
(#229492)\n\n**Resolves:
https://github.com/elastic/kibana/issues/227454**\n**Resolves:
https://github.com/elastic/kibana/issues/224511**\n**Resolves:
https://github.com/elastic/kibana/issues/220971**\n**Resolves:
https://github.com/elastic/kibana/issues/220536**\n**Resolves:
https://github.com/elastic/kibana/issues/217903**\n**Resolves:
https://github.com/elastic/kibana/issues/205777**\n\n## Summary\n\nThis
PR fixes import custom rules flaky integration tests. This is done by
refactoring the tests and getting rid of `esArchiver`.\n\n##
Details\n\nInvestigation of the flakes specified in the tickets above
revealed that the culprit is `esArchiver`. It removes the target indexes
before loading the documents and applies migrations. In fact it turns
out it removes just installed mock prebuilt rules package forcing
installing a real prebuilt rules package from the production EPR. Where
usage of production EPR has been known to cause flakiness.\n\nOn top of
just getting rid of `esArchiver` this PR refactors the importing custom
rules integrations tests. The main goal is to make the tests structure
clear and transparent. Previously flaky tests were moved to the
different sections. And some of the tests testing Kibana v7.14
connectors were removed since `esArchiver` performs connectors migration
so importing rules tests interact with the migrated connections.\n\n##
Flaky test runner\n\n- ✅ [ESS 200
runs](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8883)\n-
✅ [Serverless 200
runs](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8884)\n\n##
How to test the fix?\n\n- Add
`--xpack.fleet.registryUrl=http://non-existent` to
[config.base.ts](https://github.com/elastic/kibana/blob/main/x-pack/test/security_solution_api_integration/config/ess/config.base.ts)
for ESS or
[config.base.ts](https://github.com/elastic/kibana/blob/main/x-pack/test/security_solution_api_integration/config/serverless/config.base.ts)
for Serverless.\n- run import custom rules integration tests in the
`main` branch and observe test failures\n- run import custom rules
integration tests in this PR and observe all tests have
passed","sha":"6403fd42ee060736f849af276b63183db247ea7c"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/229492","number":229492,"mergeCommit":{"message":"[Security
Solution] Get rid of esArchiver in import custom rules integration tests
(#229492)\n\n**Resolves:
https://github.com/elastic/kibana/issues/227454**\n**Resolves:
https://github.com/elastic/kibana/issues/224511**\n**Resolves:
https://github.com/elastic/kibana/issues/220971**\n**Resolves:
https://github.com/elastic/kibana/issues/220536**\n**Resolves:
https://github.com/elastic/kibana/issues/217903**\n**Resolves:
https://github.com/elastic/kibana/issues/205777**\n\n## Summary\n\nThis
PR fixes import custom rules flaky integration tests. This is done by
refactoring the tests and getting rid of `esArchiver`.\n\n##
Details\n\nInvestigation of the flakes specified in the tickets above
revealed that the culprit is `esArchiver`. It removes the target indexes
before loading the documents and applies migrations. In fact it turns
out it removes just installed mock prebuilt rules package forcing
installing a real prebuilt rules package from the production EPR. Where
usage of production EPR has been known to cause flakiness.\n\nOn top of
just getting rid of `esArchiver` this PR refactors the importing custom
rules integrations tests. The main goal is to make the tests structure
clear and transparent. Previously flaky tests were moved to the
different sections. And some of the tests testing Kibana v7.14
connectors were removed since `esArchiver` performs connectors migration
so importing rules tests interact with the migrated connections.\n\n##
Flaky test runner\n\n- ✅ [ESS 200
runs](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8883)\n-
✅ [Serverless 200
runs](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8884)\n\n##
How to test the fix?\n\n- Add
`--xpack.fleet.registryUrl=http://non-existent` to
[config.base.ts](https://github.com/elastic/kibana/blob/main/x-pack/test/security_solution_api_integration/config/ess/config.base.ts)
for ESS or
[config.base.ts](https://github.com/elastic/kibana/blob/main/x-pack/test/security_solution_api_integration/config/serverless/config.base.ts)
for Serverless.\n- run import custom rules integration tests in the
`main` branch and observe test failures\n- run import custom rules
integration tests in this PR and observe all tests have
passed","sha":"6403fd42ee060736f849af276b63183db247ea7c"}},{"branch":"9.0","label":"v9.0.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/230282","number":230282,"state":"MERGED","mergeCommit":{"sha":"c1c72bbe352a0e09417ff5b2a0edb369ce64ae7d","message":"[9.0]
[Security Solution] Get rid of esArchiver in import custom rules
integration tests (#229492) (#230282)\n\n# Backport\n\nThis will
backport the following commits from `main` to `9.0`:\n- [[Security
Solution] Get rid of esArchiver in import custom rules\nintegration
tests\n(#229492)](https://github.com/elastic/kibana/pull/229492)\n\n\n\n###
Questions ?\nPlease refer to the [Backport
tool\ndocumentation](https://github.com/sorenlouv/backport)\n\n\n\n---------\n\nCo-authored-by:
kibanamachine
<[email protected]>"}},{"branch":"8.18","label":"v8.18.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/230287","number":230287,"state":"MERGED","mergeCommit":{"sha":"bdc2a70f4785d3220c78e8d0bc42f0f6e82e9c08","message":"[8.18]
[Security Solution] Get rid of esArchiver in import custom rules
integration tests (#229492) (#230287)\n\n# Backport\n\nThis will
backport the following commits from `main` to `8.18`:\n- [[Security
Solution] Get rid of esArchiver in import custom rules\nintegration
tests\n(#229492)](https://github.com/elastic/kibana/pull/229492)\n\n\n\n###
Questions ?\nPlease refer to the [Backport
tool\ndocumentation](https://github.com/sorenlouv/backport)\n\n"}},{"branch":"9.1","label":"v9.1.2","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/230279","number":230279,"state":"MERGED","mergeCommit":{"sha":"79ac090d20ae5a69043b4ce6886dfeddb1fe5c07","message":"[9.1]
[Security Solution] Get rid of esArchiver in import custom rules
integration tests (#229492) (#230279)\n\n# Backport\n\nThis will
backport the following commits from `main` to `9.1`:\n- [[Security
Solution] Get rid of esArchiver in import custom rules\nintegration
tests\n(#229492)](https://github.com/elastic/kibana/pull/229492)\n\n\n\n###
Questions ?\nPlease refer to the [Backport
tool\ndocumentation](https://github.com/sorenlouv/backport)\n\n\n\n---------\n\nCo-authored-by:
Nikita Indik <[email protected]>"}}]}] BACKPORT-->

Author: maximpn

src/platform/packages/shared/kbn-es-archiver/src/fixtures/override_saved_objects_index/exception_list.json

@@ -25,7 +25,6 @@
   "x-pack/platform/test/fixtures/es_archives/lists",
   "x-pack/solutions/security/test/fixtures/es_archives/rules_scheduled_task_id/rules",
   "x-pack/solutions/security/test/fixtures/es_archives/rules_scheduled_task_id/tasks",
-  "x-pack/solutions/security/test/fixtures/es_archives/security_solution/import_rule_connector",
   "x-pack/solutions/security/test/fixtures/es_archives/security_solution/migrations",
   "x-pack/solutions/security/test/fixtures/es_archives/security_solution/resolve_read_rules/7_14",
   "x-pack/solutions/security/test/fixtures/es_archives/security_solution/timelines/7.15.0",

x-pack/solutions/security/test/common/utils/detections_response/rules/delete_all_rules.ts

@@ -20,7 +20,8 @@ import { countDownTest } from '../count_down_test';
  */
 export const deleteAllRules = async (
   supertest: SuperTest.Agent,
-  log: ToolingLog
+  log: ToolingLog,
+  spaceId?: string
 ): Promise<void> => {
   await countDownTest(
     async () => {
@@ -31,7 +32,11 @@ export const deleteAllRules = async (
         .set('elastic-api-version', '2023-10-31');
 
       const { body: finalCheck } = await supertest
-        .get(`${DETECTION_ENGINE_RULES_URL}/_find`)
+        .get(
+          spaceId
+            ? `/s/${spaceId}${DETECTION_ENGINE_RULES_URL}/_find`
+            : `${DETECTION_ENGINE_RULES_URL}/_find`
+        )
         .set('kbn-xsrf', 'true')
         .set('elastic-api-version', '2023-10-31')
         .send();