Failing test: Rule Bulk Actions API Integration Tests - ESS - Rule bulk actions logic.x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_bulk_actions/perform_bulk_action_ess·ts - Rule Bulk Action API @ess perform_bulk_action - ESS specific logic legacy investigation fields should export rules with legacy investigation_fields and transform legacy field in response

[kibanamachine]

A test failed on a tracked branch

Error: expected undefined to sort of equal { field_names: [ 'client.address', 'agent.name' ] }
    at Assertion.assert (expect.js:100:11)
    at Assertion.eql (expect.js:244:8)
    at Context.<anonymous> (perform_bulk_action_ess.ts:509:83)
    at processTicksAndRejections (node:internal/process/task_queues:95:5)
    at Object.apply (wrap_function.js:73:16) {
  actual: undefined,
  expected: { field_names: [ 'client.address', 'agent.name' ] },
  showDiff: true
}

First failure: CI Build - main

[banderror]

@MadameSheema Could you please skip this one?

[MadameSheema]

/skip

[kibanamachine]

Skipped

main: 42353e7

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[nikitaindik]

I tried reproducing the flakiness by running the bad test through the flaky test runner a couple times (one, two), but it was all green. Either I am doing it wrong or we fixed it in one of the other tickets (or it's a Christmas miracle and it fixed itself!).

Shall I close it for now? @banderror @MadameSheema

[banderror]

@nikitaindik I think we discussed a couple of options what can be checked over zoom, any updates on that?

[nikitaindik]

@banderror

1. I added logging to the test to see what are the values of objects when the test fails. Ran the Flaky Test Runner a few more times - with the bad test isolated (1, 2) and also with all the tests enabled (1, 2) in the suite. All green.
   But the rule (that has investigation_fields equal to undefined) is at least a legit JSON object (otherwise it would throw here). So probably a rule is returned, it just doesn't have investigation fields for some reason.
2. The only possible place where rule's investigation_fields can be set undefined is a function called migrateLegacyInvestigationFields.
   We pass rule.params.investigationFields into it. Rule object is read from ES using rulesClient. Nothing interesting there.

export const migrateLegacyInvestigationFields = (
  investigationFields: InvestigationFieldsCombined | undefined
): InvestigationFields | undefined => {
  if (investigationFields && Array.isArray(investigationFields)) {
    if (investigationFields.length) {
      return {
        field_names: investigationFields,
      };
    }

    return undefined;
  }

  return investigationFields;
};

It would return undefined in two cases:

• you pass undefined into it
• you pass it an empty array

Currently checking if there's a way to end up with a rule that has investigationFields equal to [] or undefined in the test env.