[Security] Realign CCS functional tests (#115795)

* Realign CCS functional tests
* Reduce the diff with plain functional tests

x-pack/plugins/security_solution/cypress/ccs_integration/detection_alerts/alerts_details.spec.ts

@@ -5,18 +5,18 @@
  * 2.0.
  */
 
-import { ALERT_FLYOUT, JSON_LINES } from '../../screens/alerts_details';
+import { JSON_TEXT } from '../../screens/alerts_details';
 
 import {
   expandFirstAlert,
   waitForAlertsIndexToBeCreated,
   waitForAlertsPanelToBeLoaded,
 } from '../../tasks/alerts';
-import { openJsonView, scrollJsonViewToBottom } from '../../tasks/alerts_details';
+import { openJsonView } from '../../tasks/alerts_details';
 import { createCustomRuleActivated } from '../../tasks/api_calls/rules';
 import { cleanKibana } from '../../tasks/common';
+import { esArchiverCCSLoad } from '../../tasks/es_archiver';
 import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
-import { esArchiverCCSLoad, esArchiverCCSUnload } from '../../tasks/es_archiver';
 
 import { getUnmappedCCSRule } from '../../objects/rule';
 
@@ -35,24 +35,14 @@ describe('Alert details with unmapped fields', () => {
     expandFirstAlert();
   });
 
-  afterEach(() => {
-    esArchiverCCSUnload('unmapped_fields');
-  });
-
   it('Displays the unmapped field on the JSON view', () => {
-    const expectedUnmappedField = { line: 2, text: '  "unmapped": "This is the unmapped field"' };
+    const expectedUnmappedValue = 'This is the unmapped field';
 
     openJsonView();
-    scrollJsonViewToBottom();
-
-    cy.get(ALERT_FLYOUT)
-      .find(JSON_LINES)
-      .then((elements) => {
-        const length = elements.length;
-        cy.wrap(elements)
-          .eq(length - expectedUnmappedField.line)
-          .invoke('text')
-          .should('include', expectedUnmappedField.text);
-      });
+
+    cy.get(JSON_TEXT).then((x) => {
+      const parsed = JSON.parse(x.text());
+      expect(parsed._source.unmapped).to.equal(expectedUnmappedValue);
+    });
   });
 });