Failing test: X-Pack Detection Engine API Integration Tests.x-pack/test/detection_engine_api_integration/security_and_spaces/group10/import_export_rules·ts - detection engine api security and spaces enabled - Group 10 import_export_rules_flow should be able to reimport a rule referencing an exception list with existing comments

[kibanamachine]

A test failed on a tracked branch

Error: Unexpected non 200 ok when attempting to create a rule: 403,{
    "req": {
        "method": "POST",
        "url": "http://elastic:changeme@localhost:5620/api/detection_engine/rules",
        "data": {
            "name": "Simple Rule Query",
            "description": "Simple Rule Query",
            "enabled": false,
            "risk_score": 1,
            "rule_id": "rule-1",
            "severity": "high",
            "index": [
                "auditbeat-*"
            ],
            "type": "query",
            "query": "user.name: root or user.name: admin",
            "exceptions_list": [
                {
                    "id": "9f11fae0-e530-11ed-8ec4-9157ace8e71c",
                    "list_id": "some-list-id",
                    "type": "endpoint",
                    "namespace_type": "single"
                }
            ]
        },
        "headers": {
            "user-agent": "node-superagent/3.8.3",
            "kbn-xsrf": "true",
            "content-type": "application/json",
            "authorization": "Basic ZWxhc3RpYzpjaGFuZ2VtZQ=="
        }
    },
    "header": {
        "content-type": "application/json; charset=utf-8",
        "x-content-type-options": "nosniff",
        "referrer-policy": "no-referrer-when-downgrade",
        "cross-origin-opener-policy": "same-origin",
        "content-security-policy": "script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
        "kbn-name": "kb-n2-4-spot-c5448ec158486c98",
        "kbn-license-sig": "95103c165661b14d96da5f48d024df92ad6366294b1ec1b0d4f53aecb68fffd5",
        "cache-control": "private, no-cache, no-store, must-revalidate",
        "content-length": "93",
        "date": "Thu, 27 Apr 2023 19:20:53 GMT",
        "connection": "close"
    },
    "status": 403,
    "text": "{\"message\":\"Unauthorized to create a \\\"siem.queryRule\\\" rule for \\\"siem\\\"\",\"status_code\":403}"
}
    at createRule (create_rule.ts:61:11)
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at Context.<anonymous> (import_export_rules.ts:83:7)
    at Object.apply (wrap_function.js:73:16)

First failure: CI Build - 8.8

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[WafaaNasr]

After successfully running this test through the Flaky Test Runner for 100 iterations without any failures, it has been determined that the test is not truly flaky or failing. As a result, the ticket can be closed.