[Security Solution][API testing] Move and restructures Telemetry logic (

#171159)

## Summary

Following the initial work in this
#166755
- Addresses part of #151902 for
Telemetry
- Moved the utility files associated with telemetry to the new directory
`security_solution_api_integration`. Files not actively used in the
previous folder were moved, while duplicate files remained in their
original positions.
- Updated the CodeOwner file for the newly moved tests
- Old/new group details, decisions, and execution time are mentioned in
this
[document](https://docs.google.com/document/d/1CRFfDWMzw3ob03euWIvT4-IoiLXjoiPWI8mTBqP4Zks/edit)

| Action | File | New Path if moved |
|--------|------|----------|
| Delete| security_and_spaces/group4| - |
|
Move|detection_engine_api_integration/security_and_spaces/group4|detections_response/default_license/telemetry/keyword_family|

.buildkite/ftr_configs.yml

@@ -225,7 +225,6 @@ enabled:
   - x-pack/test/dataset_quality_api_integration/basic/config.ts
   - x-pack/test/detection_engine_api_integration/basic/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/group1/config.ts
-  - x-pack/test/detection_engine_api_integration/security_and_spaces/group4/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/group10/config.ts
   - x-pack/test/disable_ems/config.ts
   - x-pack/test/encrypted_saved_objects_api_integration/config.ts
@@ -477,3 +476,5 @@ enabled:
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/user_roles/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/user_roles/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/telemetry/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/telemetry/configs/ess.config.ts

.github/CODEOWNERS

@@ -1410,7 +1410,7 @@ x-pack/test/security_solution_api_integration/test_suites/detections_response/de
 /x-pack/plugins/security_solution/server/routes @elastic/security-detections-response @elastic/security-threat-hunting
 /x-pack/plugins/security_solution/server/utils @elastic/security-detections-response @elastic/security-threat-hunting
 x-pack/test/security_solution_api_integration/test_suites/detections_response/utils @elastic/security-detections-response
-
+x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/telemetry @elastic/security-detections-response
 
 ## Security Solution sub teams - security-defend-workflows
 /x-pack/plugins/security_solution/public/management/ @elastic/security-defend-workflows

x-pack/test/detection_engine_api_integration/utils/index.ts

@@ -13,7 +13,6 @@ export * from './create_container_with_entries';
 export * from './create_exception_list';
 export * from './create_exception_list_item';
 export * from './create_legacy_rule_action';
-export * from './create_new_action';
 export * from './create_rule';
 export * from './create_rule_with_exception_entries';
 export * from './create_rule_saved_object';
@@ -25,12 +24,10 @@ export * from './delete_all_alerts';
 export * from './delete_all_timelines';
 export * from './delete_exception_list';
 export * from './delete_rule';
-export * from './downgrade_immutable_rule';
 export * from './finalize_signals_migration';
 export * from './find_immutable_rule_by_id';
 export * from './get_complex_rule';
 export * from './get_complex_rule_output';
-export * from './get_detection_metrics_from_body';
 export * from './get_eql_rule_for_signal_testing';
 export * from './get_event_log_execute_complete_by_id';
 export * from './get_legacy_action_notification_so';
@@ -47,7 +44,6 @@ export * from './get_rule_for_signal_testing_with_timestamp_override';
 export * from './get_rule_with_web_hook_action';
 export * from './get_rule_with_legacy_investigation_fields';
 export * from './get_saved_query_rule_for_signal_testing';
-export * from './get_security_telemetry_stats';
 export * from './get_signal_status';
 export * from './get_signals_by_id';
 export * from './get_signals_by_ids';
@@ -62,9 +58,6 @@ export * from './get_simple_rule_output_without_rule_id';
 export * from './get_simple_rule_update';
 export * from './get_simple_rule_without_rule_id';
 export * from './get_simple_saved_query_rule';
-export * from './get_simple_threat_match';
-export * from './get_stats';
-export * from './get_stats_url';
 export * from './get_threat_match_rule_for_signal_testing';
 export * from './get_threshold_rule_for_signal_testing';
 export * from './get_slack_action';
@@ -76,7 +69,6 @@ export * from './preview_rule_with_exception_entries';
 export * from './preview_rule';
 export * from './refresh_index';
 export * from './route_with_namespace';
-export * from './remove_time_fields_from_telemetry_stats';
 export * from './remove_server_generated_properties';
 export * from './remove_server_generated_properties_including_rule_id';
 export * from './resolve_simple_rule_output';

x-pack/test/security_solution_api_integration/package.json

@@ -93,6 +93,11 @@
     "user_roles:runner:serverless": "npm run run-tests:dr:default user_roles serverless serverlessEnv",
     "user_roles:qa:serverless": "npm run run-tests:dr:default user_roles serverless qaEnv",
     "user_roles:server:ess": "npm run initialize-server:dr:default user_roles ess",
-    "user_roles:runner:ess": "npm run run-tests:dr:default user_roles ess essEnv"
+    "user_roles:runner:ess": "npm run run-tests:dr:default user_roles ess essEnv",
+    "telemetry:server:serverless": "npm run initialize-server:dr:default telemetry serverless",
+    "telemetry:runner:serverless": "npm run run-tests:dr:default telemetry serverless serverlessEnv",
+    "telemetry:qa:serverless": "npm run run-tests:dr:default telemetry serverless qaEnv",
+    "telemetry:server:ess": "npm run initialize-server:dr:default telemetry ess",
+    "telemetry:runner:ess": "npm run run-tests:dr:default telemetry ess essEnv"
   }
 }

x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/prebuilt_rules/bundled_prebuilt_rules_package/install_latest_bundled_prebuilt_rules.ts

@@ -66,7 +66,7 @@ export default ({ getService }: FtrProviderContext): void => {
       expect(bundledInstallResponse._meta.install_source).toBe('bundled');
 
       // Refresh ES indices to avoid race conditions between write and reading of indeces
-      // See implementation utility function at x-pack/test/detection_engine_api_integration/utils/prebuilt_rules/install_prebuilt_rules_fleet_package.ts
+      // See implementation utility function at x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/install_prebuilt_rules_fleet_package.ts
       await es.indices.refresh({ index: ALL_SAVED_OBJECT_INDICES });
 
       // Verify that status is updated after package installation

x-pack/test/detection_engine_api_integration/security_and_spaces/group4/config.ts → x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/telemetry/configs/ess.config.ts

@@ -7,12 +7,16 @@
 
 import { FtrConfigProviderContext } from '@kbn/test';
 
-// eslint-disable-next-line import/no-default-export
 export default async function ({ readConfigFile }: FtrConfigProviderContext) {
-  const functionalConfig = await readConfigFile(require.resolve('../config.base.ts'));
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../config/ess/config.base.trial')
+  );
 
   return {
     ...functionalConfig.getAll(),
-    testFiles: [require.resolve('.')],
+    testFiles: [require.resolve('..')],
+    junit: {
+      reportName: 'Detection Engine API Integration Tests - ESS - Telemetry',
+    },
   };
 }

x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/telemetry/configs/serverless.config.ts

@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  testFiles: [require.resolve('..')],
+  junit: {
+    reportName: 'Detection Engine API Integration Tests - Serverless - Telemetry',
+  },
+  kbnTestServerArgs: [
+    `--xpack.securitySolution.enableExperimental=${JSON.stringify(['previewTelemetryUrlEnabled'])}`,
+  ],
+});

x-pack/test/detection_engine_api_integration/security_and_spaces/group4/telemetry/index.ts → x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/telemetry/index.ts

@@ -4,15 +4,14 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { FtrProviderContext } from '../../../../ftr_provider_context';
 
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
-
-// eslint-disable-next-line import/no-default-export
 export default ({ loadTestFile }: FtrProviderContext): void => {
   describe('Detection rule type telemetry', function () {
     loadTestFile(require.resolve('./usage_collector/all_types'));
     loadTestFile(require.resolve('./usage_collector/detection_rules'));
     loadTestFile(require.resolve('./usage_collector/detection_rule_status'));
+    loadTestFile(require.resolve('./usage_collector/detection_rules_legacy_action'));
 
     loadTestFile(require.resolve('./task_based/all_types'));
     loadTestFile(require.resolve('./task_based/detection_rules'));

x-pack/test/detection_engine_api_integration/security_and_spaces/group4/telemetry/task_based/all_types.ts → x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/telemetry/task_based/all_types.ts

@@ -6,25 +6,26 @@
  */
 
 import expect from '@kbn/expect';
-import { FtrProviderContext } from '../../../../common/ftr_provider_context';
+
 import {
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
   getSecurityTelemetryStats,
   removeTimeFieldsFromTelemetryStats,
-} from '../../../../utils';
-import { deleteAllExceptions } from '../../../../../lists_api_integration/utils';
+} from '../../../utils';
+import { deleteAllExceptions } from '../../../../../../lists_api_integration/utils';
+
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const retry = getService('retry');
   const es = getService('es');
 
-  describe('All task telemetry types generically', async () => {
+  describe('@ess @serverless All task telemetry types generically', async () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/security_solution/telemetry');
     });
@@ -34,7 +35,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
     });
 
     afterEach(async () => {
@@ -43,7 +44,7 @@ export default ({ getService }: FtrProviderContext) => {
       await deleteAllExceptions(supertest, log);
     });
 
-    it('should only have task metric values when no rules are running', async () => {
+    it('@skipInQA should only have task metric values when no rules are running', async () => {
       await retry.try(async () => {
         const stats = await getSecurityTelemetryStats(supertest, log);
         removeTimeFieldsFromTelemetryStats(stats);