[8.19] [Detection Engine] Prevent test data from rolling outside of Cypress rules' query (#220923) (#221439)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Detection Engine] Prevent test data from rolling outside of Cypress
rules' query (#220923)](#220923)

<!--- Backport version: 10.0.0 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Ryland
Herrick","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-05-23T20:16:26Z","message":"[Detection
Engine] Prevent test data from rolling outside of Cypress rules' query
(#220923)\n\n## Summary\n\nOur tests rely on static test data, and our
cypress suite was running\nrules with a large lookback (50000h) against
them. Recently, tests have\nbegun failing because we've exceeded 50000h
since the data's\n`@timestamp`. This PR updates the cypress rules to use
a fixed `from`\nfield wherever possible, in order to \"fix\" that query
window's starting\npoint, ensuring that this issue does not recur. This
is already how our\nintegration tests are creating similar rules, so as
an added bonus we're\nnow more consistent across test suites, as
well.\n\nThis unskips and thus resolves the following issues:\n\n*
https://github.com/elastic/kibana/issues/201334\n*
https://github.com/elastic/kibana/issues/220822\n*
https://github.com/elastic/kibana/issues/207913\n*
https://github.com/elastic/kibana/issues/199905\n\nNote that there may
be more instances of skipped tests that were failing\ndue to this issue
(with e.g. data with an earlier date than the\n`2019-09-02` here); the
above tests were just the most obvious and most\nrecent (within the last
week).\n\n### Flaky Runner\n* Detection Engine Cypress
(x150):\nhttps://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8291\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios","sha":"1f6777c40130e9804faa1b7a4a33f5e1655053a7","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","backport:prev-minor","backport:prev-major","Team:Detection
Engine","backport:current-major","Test:Cypress","v9.1.0"],"title":"[Detection
Engine] Prevent test data from rolling outside of Cypress rules'
query","number":220923,"url":"https://github.com/elastic/kibana/pull/220923","mergeCommit":{"message":"[Detection
Engine] Prevent test data from rolling outside of Cypress rules' query
(#220923)\n\n## Summary\n\nOur tests rely on static test data, and our
cypress suite was running\nrules with a large lookback (50000h) against
them. Recently, tests have\nbegun failing because we've exceeded 50000h
since the data's\n`@timestamp`. This PR updates the cypress rules to use
a fixed `from`\nfield wherever possible, in order to \"fix\" that query
window's starting\npoint, ensuring that this issue does not recur. This
is already how our\nintegration tests are creating similar rules, so as
an added bonus we're\nnow more consistent across test suites, as
well.\n\nThis unskips and thus resolves the following issues:\n\n*
https://github.com/elastic/kibana/issues/201334\n*
https://github.com/elastic/kibana/issues/220822\n*
https://github.com/elastic/kibana/issues/207913\n*
https://github.com/elastic/kibana/issues/199905\n\nNote that there may
be more instances of skipped tests that were failing\ndue to this issue
(with e.g. data with an earlier date than the\n`2019-09-02` here); the
above tests were just the most obvious and most\nrecent (within the last
week).\n\n### Flaky Runner\n* Detection Engine Cypress
(x150):\nhttps://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8291\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios","sha":"1f6777c40130e9804faa1b7a4a33f5e1655053a7"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/220923","number":220923,"mergeCommit":{"message":"[Detection
Engine] Prevent test data from rolling outside of Cypress rules' query
(#220923)\n\n## Summary\n\nOur tests rely on static test data, and our
cypress suite was running\nrules with a large lookback (50000h) against
them. Recently, tests have\nbegun failing because we've exceeded 50000h
since the data's\n`@timestamp`. This PR updates the cypress rules to use
a fixed `from`\nfield wherever possible, in order to \"fix\" that query
window's starting\npoint, ensuring that this issue does not recur. This
is already how our\nintegration tests are creating similar rules, so as
an added bonus we're\nnow more consistent across test suites, as
well.\n\nThis unskips and thus resolves the following issues:\n\n*
https://github.com/elastic/kibana/issues/201334\n*
https://github.com/elastic/kibana/issues/220822\n*
https://github.com/elastic/kibana/issues/207913\n*
https://github.com/elastic/kibana/issues/199905\n\nNote that there may
be more instances of skipped tests that were failing\ndue to this issue
(with e.g. data with an earlier date than the\n`2019-09-02` here); the
above tests were just the most obvious and most\nrecent (within the last
week).\n\n### Flaky Runner\n* Detection Engine Cypress
(x150):\nhttps://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8291\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common
scenarios","sha":"1f6777c40130e9804faa1b7a4a33f5e1655053a7"}}]}]
BACKPORT-->

Author: rylnd

x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/exceptions/alerts_table_flow/rule_exceptions/closing_all_matching_alerts.cy.ts

@@ -48,9 +48,7 @@ const getExceptionList1 = () => ({
   list_id: 'exception_list_1',
 });
 
-// Failing: See https://github.com/elastic/kibana/issues/199905
-// Failing: See https://github.com/elastic/kibana/issues/199905
-describe.skip('Close matching Alerts ', { tags: ['@ess', '@serverless'] }, () => {
+describe('Close matching Alerts ', { tags: ['@ess', '@serverless'] }, () => {
   const ITEM_NAME = 'Sample Exception Item';
 
   beforeEach(() => {

x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/exceptions/entry/match_any.cy.ts

@@ -45,7 +45,6 @@ describe('Exceptions match_any', { tags: ['@ess', '@serverless'] }, () => {
         index: ['auditbeat-exceptions-*'],
         enabled: false,
         query: '*',
-        from: 'now-438300h',
       })
     ).then((rule) => visitRuleDetailsPage(rule.body.id, { tab: 'rule_exceptions' }));
     cy.get(RULE_STATUS).should('have.text', '—');

x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/exceptions/rule_details_flow/add_edit_exception.cy.ts

@@ -58,10 +58,7 @@ import {
 } from '../../../../../tasks/api_calls/exceptions';
 import { waitForAlertsToPopulate } from '../../../../../tasks/create_new_rule';
 
-// TODO: https://github.com/elastic/kibana/issues/161539
-// Failing: See https://github.com/elastic/kibana/issues/220822
-// Failing: See https://github.com/elastic/kibana/issues/220822
-describe.skip(
+describe(
   'Add/edit exception from rule details',
   { tags: ['@ess', '@serverless', '@skipInServerless'] },
   () => {

x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/exceptions/rule_details_flow/add_edit_exception_data_view.cy.ts

@@ -47,9 +47,7 @@ import { waitForAlertsToPopulate } from '../../../../../tasks/create_new_rule';
 
 const DATAVIEW = 'auditbeat-exceptions-*';
 
-// Failing: See https://github.com/elastic/kibana/issues/207913
-// Failing: See https://github.com/elastic/kibana/issues/207913
-describe.skip(
+describe(
   'Add exception using data views from rule details',
   { tags: ['@ess', '@serverless'] },
   () => {

x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/indicator_match_rule.cy.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { formatMitreAttackDescription, getHumanizedDuration } from '../../../../helpers/rules';
+import { formatMitreAttackDescription } from '../../../../helpers/rules';
 import {
   getIndexPatterns,
   getNewThreatIndicatorRule,
@@ -31,7 +31,6 @@ import {
   ABOUT_DETAILS,
   ABOUT_INVESTIGATION_NOTES,
   ABOUT_RULE_DESCRIPTION,
-  ADDITIONAL_LOOK_BACK_DETAILS,
   CUSTOM_QUERY_DETAILS,
   DEFINITION_DETAILS,
   FALSE_POSITIVES_DETAILS,
@@ -488,13 +487,6 @@ describe(
             getDetails(RUNS_EVERY_DETAILS)
               .find(INTERVAL_ABBR_VALUE)
               .should('have.text', `${rule.interval}`);
-            const humanizedDuration = getHumanizedDuration(
-              rule.from ?? 'now-6m',
-              rule.interval ?? '5m'
-            );
-            getDetails(ADDITIONAL_LOOK_BACK_DETAILS)
-              .find(INTERVAL_ABBR_VALUE)
-              .should('have.text', `${humanizedDuration}`);
           });
 
           waitForTheRuleToBeExecuted();

x-pack/test/security_solution_cypress/cypress/objects/rule.ts

@@ -132,7 +132,7 @@ export const getDataViewRule = (
   threat: [getMitre1(), getMitre2()],
   note: '# test markdown',
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   max_signals: 100,
   ...rewrites,
 });
@@ -153,7 +153,7 @@ export const getNewRule = (
   threat: [getMitre1(), getMitre2()],
   note: '# test markdown',
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   max_signals: 100,
   ...rewrites,
 });
@@ -168,7 +168,7 @@ export const getSavedQueryRule = (
   name: 'New Rule Test',
   description: 'The new rule description.',
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   severity: 'low',
   risk_score: 21,
   ...rewrites,
@@ -183,7 +183,7 @@ export const getSimpleCustomQueryRule = (
   name: 'New Rule Test',
   description: 'The new rule description.',
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   severity: 'low',
   risk_score: 21,
   ...rewrites,
@@ -205,7 +205,7 @@ export const getBuildingBlockRule = (
   threat: [getMitre1(), getMitre2()],
   note: '# test markdown',
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   max_signals: 100,
   building_block_type: 'default',
   ...rewrites,
@@ -227,7 +227,7 @@ export const getUnmappedRule = (
   threat: [getMitre1(), getMitre2()],
   note: '# test markdown',
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   max_signals: 100,
   ...rewrites,
 });
@@ -248,7 +248,7 @@ export const getUnmappedCCSRule = (
   threat: [getMitre1(), getMitre2()],
   note: '# test markdown',
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   max_signals: 100,
   ...rewrites,
 });
@@ -269,7 +269,7 @@ export const getExistingRule = (
   threat: [],
   note: 'This is my note',
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   // Please do not change, or if you do, needs
   // to be any number other than default value
   max_signals: 500,
@@ -303,7 +303,7 @@ export const getNewOverrideRule = (
   rule_name_override: 'agent.type',
   timestamp_override: '@timestamp',
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   max_signals: 100,
   ...rewrites,
 });
@@ -328,7 +328,7 @@ export const getNewThresholdRule = (
     value: 1,
   },
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   max_signals: 100,
   ...rewrites,
 });
@@ -349,9 +349,9 @@ export const getNewTermsRule = (
   threat: [getMitre1(), getMitre2()],
   note: '# test markdown',
   new_terms_fields: ['host.name'],
-  history_window_start: 'now-51000h',
+  history_window_start: `now-${365 * 150}d`,
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   max_signals: 100,
   ...rewrites,
 });
@@ -375,7 +375,7 @@ export const getMachineLearningRule = (
   threat: [getMitre1()],
   note: '# test markdown',
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   ...rewrites,
 });
 
@@ -396,7 +396,7 @@ export const getEqlRule = (
   threat: [getMitre1(), getMitre2()],
   note: '# test markdown',
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   max_signals: 100,
   ...rewrites,
 });
@@ -417,7 +417,7 @@ export const getEsqlRule = (
   threat: [getMitre1(), getMitre2()],
   note: '# test markdown',
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   max_signals: 100,
   ...rewrites,
 });
@@ -439,7 +439,7 @@ export const getCCSEqlRule = (
   threat: [getMitre1(), getMitre2()],
   note: '# test markdown',
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   max_signals: 100,
   ...rewrites,
 });
@@ -464,7 +464,7 @@ export const getEqlSequenceRule = (
   threat: [getMitre1(), getMitre2()],
   note: '# test markdown',
   interval: '100m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   max_signals: 100,
   ...rewrites,
 });
@@ -487,7 +487,7 @@ export const getNewThreatIndicatorRule = (
   threat: [getMitre1(), getMitre2()],
   note: '# test markdown',
   interval: '100m',
-  from: 'now-50000h',
+  from: '2000-01-01T00:00:00.000Z',
   threat_index: ['filebeat-*'],
   threat_mapping: [
     {
@@ -673,7 +673,7 @@ export const getEndpointRule = (): QueryRuleCreateProps => ({
   severity: 'high',
   risk_score: 17,
   interval: '1m',
-  from: 'now-50000h',
+  from: '1900-01-01T00:00:00.000Z',
   max_signals: 100,
   exceptions_list: [
     {