[truncated]
        │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:57:46.115+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (6.9s)
                 └-> "after each" hook for "should show "legacy_notifications_disabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "disabled"/"in-active""
                 └-> should show "legacy_notifications_enabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "enabled"/"active"
                   └-> "before each" hook: global before each for "should show "legacy_notifications_enabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "enabled"/"active""
                   └-> "before each" hook for "should show "legacy_notifications_enabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "enabled"/"active""
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:57:51.199+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:57:56.089+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 163.0B\nPOST /*/_search?allow_no_indices=true&size=10000&ignore_unavailable=true\n{\"query\":{\"bool\":{\"filter\":[{\"bool\":{\"must\":[{\"term\":{\"signal.rule.rule_id\":\"threshold-rule\"}},{\"range\":{\"signal.original_time\":{\"gte\":\"1900-01-01T00:00:00.000Z\"}}},{\"term\":{\"signal.rule.threshold.field\":\"keyword\"}}]}},{\"bool\":{\"filter\":[{\"bool\":{\"should\":[{\"range\":{\"@timestamp\":{\"lte\":\"2024-07-15T21:57:56.086Z\",\"gte\":\"1900-01-01T00:00:00.000Z\",\"format\":\"strict_date_optional_time\"}}}],\"minimum_should_match\":1}}]}},{\"match_all\":{}}]}},\"fields\":[{\"field\":\"*\",\"include_unmapped\":true},{\"field\":\"@timestamp\",\"format\":\"strict_date_optional_time\"}],\"sort\":[{\"@timestamp\":{\"order\":\"asc\",\"unmapped_type\":\"date\"}}]}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:57:57.697+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (6.9s)
                 └-> "after each" hook for "should show "legacy_notifications_enabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "enabled"/"active""
                 └-> "after all" hook: afterTestSuite.trigger for "should show "legacy_notifications_enabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "enabled"/"active""
               └-: "ml" rule type
                 └-> "before all" hook: beforeTestSuite.trigger for "should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "disabled"/"in-active" rule that does not have any actions"
                 └-> should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "disabled"/"in-active" rule that does not have any actions
                   └-> "before each" hook: global before each for "should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "disabled"/"in-active" rule that does not have any actions"
                   └-> "before each" hook for "should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "disabled"/"in-active" rule that does not have any actions"
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:05.279+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:06.215+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (1.9s)
                 └-> "after each" hook for "should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "disabled"/"in-active" rule that does not have any actions"
                 └-> should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "enabled"/"active" rule that does not have any actions
                   └-> "before each" hook: global before each for "should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "enabled"/"active" rule that does not have any actions"
                   └-> "before each" hook for "should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "enabled"/"active" rule that does not have any actions"
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:08.300+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:10.260+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (2.9s)
                 └-> "after each" hook for "should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "enabled"/"active" rule that does not have any actions"
                 └-> should show "notifications_disabled" to be "1" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active"
                   └-> "before each" hook: global before each for "should show "notifications_disabled" to be "1" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active""
                   └-> "before each" hook for "should show "notifications_disabled" to be "1" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active""
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:13.325+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:15.299+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (2.9s)
                 └-> "after each" hook for "should show "notifications_disabled" to be "1" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active""
                 └-> should show "notifications_enabled" to be "1" for rule that has at least "1" action(s) and the alert is "enabled"/"active"
                   └-> "before each" hook: global before each for "should show "notifications_enabled" to be "1" for rule that has at least "1" action(s) and the alert is "enabled"/"active""
                   └-> "before each" hook for "should show "notifications_enabled" to be "1" for rule that has at least "1" action(s) and the alert is "enabled"/"active""
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:17.354+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:20.330+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (3.9s)
                 └-> "after each" hook for "should show "notifications_enabled" to be "1" for rule that has at least "1" action(s) and the alert is "enabled"/"active""
                 └-> should show "legacy_notifications_disabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "disabled"/"in-active"
                   └-> "before each" hook: global before each for "should show "legacy_notifications_disabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "disabled"/"in-active""
                   └-> "before each" hook for "should show "legacy_notifications_disabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "disabled"/"in-active""
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:24.395+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:29.361+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (5.9s)
                 └-> "after each" hook for "should show "legacy_notifications_disabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "disabled"/"in-active""
                 └-> should show "legacy_notifications_enabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "enabled"/"active"
                   └-> "before each" hook: global before each for "should show "legacy_notifications_enabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "enabled"/"active""
                   └-> "before each" hook for "should show "legacy_notifications_enabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "enabled"/"active""
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:34.451+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:40.440+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (6.9s)
                 └-> "after each" hook for "should show "legacy_notifications_enabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "enabled"/"active""
                 └-> "after all" hook: afterTestSuite.trigger for "should show "legacy_notifications_enabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "enabled"/"active""
               └-: "indicator_match/threat_match" rule type
                 └-> "before all" hook: beforeTestSuite.trigger for "should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "disabled"/"in-active" rule that does not have any actions"
                 └-> should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "disabled"/"in-active" rule that does not have any actions
                   └-> "before each" hook: global before each for "should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "disabled"/"in-active" rule that does not have any actions"
                   └-> "before each" hook for "should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "disabled"/"in-active" rule that does not have any actions"
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:48.534+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:49.467+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (1.9s)
                 └-> "after each" hook for "should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "disabled"/"in-active" rule that does not have any actions"
                 └-> should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "enabled"/"active" rule that does not have any actions
                   └-> "before each" hook: global before each for "should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "enabled"/"active" rule that does not have any actions"
                   └-> "before each" hook for "should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "enabled"/"active" rule that does not have any actions"
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:51.549+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {}, status: 200
Try number 0 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {}, status: 200
Try number 1 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {}, status: 200
Try number 2 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {}, status: 200
Try number 3 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:58:54.112Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 4 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:58:54.112Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 5 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:58:54.112Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 6 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:58:54.112Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 7 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:58:54.422Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 8 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:58:54.422Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 9 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:58:54.422Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 10 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"6bdcfc00-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:58:54.422Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 11 out of 3200 for function waitForRuleSuccessOrStatus
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:58:57.168+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (5.9s)
                 └-> "after each" hook for "should show "notifications_enabled", "notifications_disabled" "legacy_notifications_enabled", "legacy_notifications_disabled", all to be "0" for "enabled"/"active" rule that does not have any actions"
                 └-> should show "notifications_disabled" to be "1" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active"
                   └-> "before each" hook: global before each for "should show "notifications_disabled" to be "1" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active""
                   └-> "before each" hook for "should show "notifications_disabled" to be "1" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active""
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:59:00.606+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:59:02.530+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (2.9s)
                 └-> "after each" hook for "should show "notifications_disabled" to be "1" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active""
                 └-> should show "notifications_enabled" to be "1" for rule that has at least "1" action(s) and the alert is "enabled"/"active"
                   └-> "before each" hook: global before each for "should show "notifications_enabled" to be "1" for rule that has at least "1" action(s) and the alert is "enabled"/"active""
                   └-> "before each" hook for "should show "notifications_enabled" to be "1" for rule that has at least "1" action(s) and the alert is "enabled"/"active""
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:59:04.633+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {}, status: 200
Try number 0 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {}, status: 200
Try number 1 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {}, status: 200
Try number 2 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {}, status: 200
Try number 3 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {}, status: 200
Try number 4 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {}, status: 200
Try number 5 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {}, status: 200
Try number 6 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {}, status: 200
Try number 7 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"742afdd0-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:59:09.118Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 8 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"742afdd0-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:59:09.118Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 9 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"742afdd0-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:59:09.118Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 10 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"742afdd0-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:59:09.118Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 11 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"742afdd0-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:59:09.502Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 12 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"742afdd0-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:59:09.502Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 13 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"742afdd0-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:59:09.502Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 14 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 742afdd0-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"742afdd0-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:59:09.502Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 15 out of 3200 for function waitForRuleSuccessOrStatus
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:59:12.329+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (7.9s)
                 └-> "after each" hook for "should show "notifications_enabled" to be "1" for rule that has at least "1" action(s) and the alert is "enabled"/"active""
                 └-> should show "legacy_notifications_disabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "disabled"/"in-active"
                   └-> "before each" hook: global before each for "should show "legacy_notifications_disabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "disabled"/"in-active""
                   └-> "before each" hook for "should show "legacy_notifications_disabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "disabled"/"in-active""
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:59:15.694+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:59:20.643+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (5.9s)
                 └-> "after each" hook for "should show "legacy_notifications_disabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "disabled"/"in-active""
                 └-> should show "legacy_notifications_enabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "enabled"/"active"
                   └-> "before each" hook: global before each for "should show "legacy_notifications_enabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "enabled"/"active""
                   └-> "before each" hook for "should show "legacy_notifications_enabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "enabled"/"active""
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:59:25.760+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 8040b600-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"8040b600-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:59:30.636Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 0 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 8040b600-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"8040b600-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:59:30.636Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 1 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 8040b600-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"8040b600-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:59:30.636Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 2 out of 3200 for function waitForRuleSuccessOrStatus
Did not get an expected status of succeeded while waiting for a rule success or status for rule id 8040b600-42f5-11ef-b7a6-dd5d7f65f268 (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: {"8040b600-42f5-11ef-b7a6-dd5d7f65f268":{"current_status":{"status_date":"2024-07-15T21:59:30.636Z","status":"going to run","last_failure_at":null,"last_success_at":null,"last_failure_message":null,"last_success_message":null,"gap":null,"bulk_create_time_durations":[],"search_after_time_durations":[],"last_look_back_date":null},"failures":[]}}, status: 200
Try number 3 out of 3200 for function waitForRuleSuccessOrStatus
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:59:33.353+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (7.9s)
                 └-> "after each" hook for "should show "legacy_notifications_enabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "enabled"/"active""
                 └-> "after all" hook: afterTestSuite.trigger for "should show "legacy_notifications_enabled" to be "1" for rule that has at least "1" legacy action(s) and the alert is "enabled"/"active""
               └-: "pre-packaged"/"immutable" rules
                 └-> "before all" hook: beforeTestSuite.trigger for "should show stats for totals for in-active pre-packaged rules"
                 └-> should show stats for totals for in-active pre-packaged rules
                   └-> "before each" hook: global before each for "should show stats for totals for in-active pre-packaged rules"
                   └-> "before each" hook for "should show stats for totals for in-active pre-packaged rules"
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:59:40.840+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T21:59:45.955+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (6.0s)
                 └-> "after each" hook for "should show stats for totals for in-active pre-packaged rules"
                 └-> should show stats for the detection_rule_details for a specific pre-packaged rule
                   └-> "before each" hook: global before each for "should show stats for the detection_rule_details for a specific pre-packaged rule"
                   └-> "before each" hook for "should show stats for the detection_rule_details for a specific pre-packaged rule"
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T22:00:03.250+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T22:00:07.137+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (4.8s)
                 └-> "after each" hook for "should show stats for the detection_rule_details for a specific pre-packaged rule"
                 └-> should show "notifications_disabled" to be "1", "has_notification" to be "true, "has_legacy_notification" to be "false" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active"
                   └-> "before each" hook: global before each for "should show "notifications_disabled" to be "1", "has_notification" to be "true, "has_legacy_notification" to be "false" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active""
                   └-> "before each" hook for "should show "notifications_disabled" to be "1", "has_notification" to be "true, "has_legacy_notification" to be "false" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active""
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T22:00:23.459+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T22:00:31.386+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (8.8s)
                 └-> "after each" hook for "should show "notifications_disabled" to be "1", "has_notification" to be "true, "has_legacy_notification" to be "false" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active""
                 └-> should show "notifications_enabled" to be "1", "has_notification" to be "true, "has_legacy_notification" to be "false" for rule that has at least "1" action(s) and the alert is "enabled"/"active"
                   └-> "before each" hook: global before each for "should show "notifications_enabled" to be "1", "has_notification" to be "true, "has_legacy_notification" to be "false" for rule that has at least "1" action(s) and the alert is "enabled"/"active""
                   └-> "before each" hook for "should show "notifications_enabled" to be "1", "has_notification" to be "true, "has_legacy_notification" to be "false" for rule that has at least "1" action(s) and the alert is "enabled"/"active""
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T22:00:47.686+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T22:00:54.689+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (7.9s)
                 └-> "after each" hook for "should show "notifications_enabled" to be "1", "has_notification" to be "true, "has_legacy_notification" to be "false" for rule that has at least "1" action(s) and the alert is "enabled"/"active""
                 └-> should show "legacy_notifications_disabled" to be "1", "has_notification" to be "false, "has_legacy_notification" to be "true" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active"
                   └-> "before each" hook: global before each for "should show "legacy_notifications_disabled" to be "1", "has_notification" to be "false, "has_legacy_notification" to be "true" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active""
                   └-> "before each" hook for "should show "legacy_notifications_disabled" to be "1", "has_notification" to be "false, "has_legacy_notification" to be "true" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active""
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T22:01:11.999+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T22:01:23.985+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (12.9s)
                 └-> "after each" hook for "should show "legacy_notifications_disabled" to be "1", "has_notification" to be "false, "has_legacy_notification" to be "true" for rule that has at least "1" action(s) and the alert is "disabled"/"in-active""
                 └-> should show "legacy_notifications_enabled" to be "1", "has_notification" to be "false, "has_legacy_notification" to be "true" for rule that has at least "1" action(s) and the alert is "enabled"/"active"
                   └-> "before each" hook: global before each for "should show "legacy_notifications_enabled" to be "1", "has_notification" to be "false, "has_legacy_notification" to be "true" for rule that has at least "1" action(s) and the alert is "enabled"/"active""
                   └-> "before each" hook for "should show "legacy_notifications_enabled" to be "1", "has_notification" to be "false, "has_legacy_notification" to be "true" for rule that has at least "1" action(s) and the alert is "enabled"/"active""
                     │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T22:01:42.282+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"index name [.siem-signals-default-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices\"\nOrigin:kibana\nQuery:\n200 - 87.0B\nPUT /.siem-signals-default-000001\n{\"aliases\":{\".siem-signals-default\":{\"is_write_index\":true}}}","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   │ proc [kibana] {"ecs":{"version":"1.12.0"},"@timestamp":"2024-07-15T22:01:52.295+00:00","message":"Elasticsearch deprecation: 299 Elasticsearch-7.17.23-SNAPSHOT-a51806accae1ed68496f790ea39d741e4ac9e0fc \"this request accesses system indices: [.security-7, .tasks], but in a future major version, direct access to system indices will be prevented by default\"\nOrigin:kibana\nQuery:\n200 - 230.0B\nGET /*/_mapping?filter_path=*.mappings._meta.beat%2C*.mappings._meta.package.name%2C*.mappings._meta.managed_by%2C*.mappings.properties.ecs.properties.version.type%2C*.mappings.properties.data_stream.properties.type.value%2C*.mappings.properties.data_stream.properties.dataset.value","log":{"level":"DEBUG","logger":"elasticsearch.deprecation"},"process":{"pid":5023}}
                   └- ✓ pass  (11.0s)
                 └-> "after each" hook for "should show "legacy_notifications_enabled" to be "1", "has_notification" to be "false, "has_legacy_notification" to be "true" for rule that has at least "1" action(s) and the alert is "enabled"/"active""
                 └-> "after all" hook: afterTestSuite.trigger for "should show "legacy_notifications_enabled" to be "1", "has_notification" to be "false, "has_legacy_notification" to be "true" for rule that has at least "1" action(s) and the alert is "enabled"/"active""
               └-> "after all" hook for "should have initialized empty/zero values when no rules are running"
               └-> "after all" hook: afterTestSuite.trigger for "should have initialized empty/zero values when no rules are running"
             └-> "after all" hook: afterTestSuite.trigger in ""
           └-> "after all" hook: afterTestSuite.trigger in "Detection rule type telemetry"
         └-> "after all" hook: afterTestSuite.trigger in ""
       └-> "after all" hook: afterTestSuite.trigger in "detection engine api security and spaces enabled"
   │
   │421 passing (39.0m)
   │40 pending
   │
   │ proc [kibana]   log   [22:02:14.557] [info][plugins-system][standard] Stopping all plugins.
   │ proc [kibana]   log   [22:02:14.558] [info][kibana-monitoring][monitoring][monitoring][plugins] Monitoring stats collection is stopped
   │ proc [kibana]   log   [22:02:14.560] [info][eventLog][plugins] event logged: {"@timestamp":"2024-07-15T22:02:14.560Z","event":{"provider":"eventLog","action":"stopping"},"message":"eventLog stopping","ecs":{"version":"1.8.0"},"kibana":{"server_uuid":"5b2de169-2785-441b-ae8c-186a1936b17d","version":"7.17.23"}}
   │ info [kibana] exited with null after 2383.7 seconds
   │ info [es] stopping node ftr
   │ info [o.e.x.m.p.NativeController] [ftr] Native controller process has stopped - no new native processes can be started
   │ info [o.e.n.Node] [ftr] stopping ...
   │ info [o.e.x.w.WatcherService] [ftr] stopping watch service, reason [shutdown initiated]
   │ info [o.e.x.w.WatcherLifeCycleService] [ftr] watcher has stopped and shutdown
   │ info [o.e.n.Node] [ftr] stopped
   │ info [o.e.n.Node] [ftr] closing ...
   │ info [o.e.n.Node] [ftr] closed
   │ info [es] stopped
   │ info [es] no debug files found, assuming es did not write any
   │ info [es] cleanup complete