Ignore intermediate records in ML Rule anomalies query (#90316)

We were incorrectly including records with is_interim: true in our
query, which lead to false positive signals if the rule executed while
an anomaly's score was (temporarily) above the specified threshold, but
then dipped below after it was finalized.

Co-authored-by: Kibana Machine <[email protected]>

x-pack/plugins/security_solution/server/lib/machine_learning/index.test.ts

@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { ESFilter } from '../../../../../typings/elasticsearch';
 import { getExceptionListItemSchemaMock } from '../../../../lists/common/schemas/response/exception_list_item_schema.mock';
 import { getAnomalies, AnomaliesSearchParams } from '.';
 
@@ -13,8 +14,8 @@ const getFiltersFromMock = (mock: jest.Mock) => {
   return searchParams.body.query.bool.filter;
 };
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const getBoolCriteriaFromFilters = (filters: any[]) => filters[1].bool.must;
+const getBoolCriteriaFromFilters = (filters: ESFilter[]) =>
+  filters.find((filter) => filter?.bool?.must)?.bool?.must;
 
 describe('getAnomalies', () => {
   let searchParams: AnomaliesSearchParams;
@@ -104,4 +105,20 @@ describe('getAnomalies', () => {
       ])
     );
   });
+
+  it('ignores anomalies that do not have finalized scores', () => {
+    const mockMlAnomalySearch = jest.fn();
+    getAnomalies(searchParams, mockMlAnomalySearch);
+    const filters = getFiltersFromMock(mockMlAnomalySearch);
+
+    expect(filters).toEqual(
+      expect.arrayContaining([
+        {
+          term: {
+            is_interim: false,
+          },
+        },
+      ])
+    );
+  });
 });

x-pack/plugins/security_solution/server/lib/machine_learning/index.ts

@@ -47,6 +47,7 @@ export const getAnomalies = async (
                   analyze_wildcard: false,
                 },
               },
+              { term: { is_interim: false } },
               {
                 bool: {
                   must: boolCriteria,