Failing test: X-Pack Detection Engine API Integration Tests.x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/threat_match·ts - detection engine api security and spaces enabled - rule execution logic Threat match type rules indicator enrichment: event-first search generates multiple signals with multiple matches

[kibanamachine]

A test failed on a tracked branch

Error: expected [
  {
    "indicator": {
      "first_seen": "2021-01-26T11:09:04.000Z",
      "provider": "geenensp",
      "domain": "159.89.119.67",
      "description": "domain should match the auditbeat hosts' data's source.ip",
      "type": "url",
      "url": {
        "full": "http://159.89.119.67:59600/bin.sh",
        "scheme": "http"
      }
    },
    "feed": {},
    "matched": {
      "atomic": "159.89.119.67",
      "field": "destination.ip",
      "id": "978783",
      "index": "filebeat-8.0.0-2021.01.26-000001",
      "type": "indicator_match_rule"
    }
  }
] to contain {
  "feed": {},
  "indicator": {
    "description": "this should match auditbeat/hosts on both port and ip",
    "first_seen": "2021-01-26T11:06:03.000Z",
    "ip": "45.115.45.3",
    "port": 57324,
    "provider": "geenensp",
    "type": "url"
  },
  "matched": {
    "atomic": "45.115.45.3",
    "id": "978785",
    "index": "filebeat-8.0.0-2021.01.26-000001",
    "field": "source.ip",
    "type": "indicator_match_rule"
  }
}
    at Assertion.assert (node_modules/@kbn/expect/expect.js:100:11)
    at Assertion.eql (node_modules/@kbn/expect/expect.js:244:8)
    at /var/lib/buildkite-agent/builds/kb-n2-4-spot-e51ed7fa0923c1e6/elastic/kibana-on-merge/kibana/x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/threat_match.ts:26:172
    at Array.forEach (<anonymous>)
    at assertContains (x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/threat_match.ts:26:56)
    at Context.<anonymous> (x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/threat_match.ts:1126:9)
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at Object.apply (node_modules/@kbn/test/target_node/src/functional_test_runner/lib/mocha/wrap_function.js:78:16) {
  actual: 'false',
  expected: 'true',
  showDiff: true
}

First failure: CI Build - main

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[WafaaNasr]

After successfully running this test through the Flaky Test Runner for 100 iterations without any failures, it has been determined that the test is not truly flaky or failing. As a result, the ticket can be closed.