[Security Solution] Rule Execution Log can display conflicting status when there is a mis-match between platform and solution statuses

[spong]

Related to: #137935, #139889

Summary

Identified in the review of #131675, if there is a mis-match between platform status and solution status, we display the solution status, which may be in conflict with the filters that the user has selected:

Since we query against event.outcome and kibana.alert.rule.execution.status, but display the solution status on the UI (and only fallback to the platform status if there is no solution status), this is where any sort of mis-match is going to surface.

This is impact:low as solution/platform statuses should only mis-match in a few rare cases, like in this instance, when a circuit breaker error interrupts the overall execution, but only after the solution logic was successful.

I'm thinking the best place to fix this is at the UI layer, and if there's a mismatch between platform/solution status, then just fall back to the platform status and switch to error.message instead of message if it's an error. It would be ideal if we could just get #130966 worked, and swap to querying single execution events via the find API (instead of the current complex agg), but we'll at least have this issue for tracking if that takes a bit.

Additional details:

Full set of documents for affected execution UUID:

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[banderror]

This is impact:low as solution/platform statuses should only mis-match in a few rare cases, like in this instance, when a circuit breaker error interrupts the overall execution, but only after the solution logic was successful.

I was under the impression that the platform's execution status is always successful since we don't re-throw execution failures as exceptions from executors and so the Framework doesn't know about them. We have #106482 for fixing that. Maybe I'm just not getting something @spong or something has changed since then?