[7.x] [Security Solution] [Detections] Multiple timestamp fields (#86368) (#86926)

* [Security Solution] [Detections] Multiple timestamp fields (#86368) * query timestamp override and default @timestamp field, adds functional test for this * fix logic for when to filter out timestamp override documents * update the total hits field of the search result if we find hits within the secondary search. Without updating the total hits field, we could be finding events but not indexing them based on the bulk create logic * update integration test, updates logic for performing second search and excluding documents with timestamp override field * cleanup comments, remove commented out console logs, fix logic to break out of loop during secondary search after * default param to 'succeeded' * remove commented out code * always perform a secondary search when timestamp override field is present * perf improvement and fix bug where sortIds were being mixed between search after calls * set sortIds to undefined when not present on search result * exit loop and prevent extraneous searches from occurring if we exhaust sort ids * skips test that was skipped in 8.0 / master
2021-01-05 08:16:45 -05:00 · 2021-01-05 08:16:45 -05:00 · 3e50b5f50f
parent 22c1302b98
commit 3e50b5f50f
34 changed files with 692 additions and 479 deletions
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.test.ts
@ -16,6 +16,7 @@ describe('create_signals', () => {
      size: 100,
      searchAfterSortId: undefined,
      timestampOverride: undefined,
+      excludeDocsWithTimestampOverride: false,
    });
    expect(query).toEqual({
      allowNoIndices: true,
@ -95,6 +96,7 @@ describe('create_signals', () => {
      size: 100,
      searchAfterSortId: '',
      timestampOverride: undefined,
+      excludeDocsWithTimestampOverride: false,
    });
    expect(query).toEqual({
      allowNoIndices: true,
@ -175,6 +177,7 @@ describe('create_signals', () => {
      size: 100,
      searchAfterSortId: fakeSortId,
      timestampOverride: undefined,
+      excludeDocsWithTimestampOverride: false,
    });
    expect(query).toEqual({
      allowNoIndices: true,
@ -256,6 +259,7 @@ describe('create_signals', () => {
      size: 100,
      searchAfterSortId: fakeSortIdNumber,
      timestampOverride: undefined,
+      excludeDocsWithTimestampOverride: false,
    });
    expect(query).toEqual({
      allowNoIndices: true,
@ -336,6 +340,7 @@ describe('create_signals', () => {
      size: 100,
      searchAfterSortId: undefined,
      timestampOverride: undefined,
+      excludeDocsWithTimestampOverride: false,
    });
    expect(query).toEqual({
      allowNoIndices: true,
@ -423,6 +428,7 @@ describe('create_signals', () => {
      size: 100,
      searchAfterSortId: undefined,
      timestampOverride: undefined,
+      excludeDocsWithTimestampOverride: false,
    });
    expect(query).toEqual({
      allowNoIndices: true,
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.ts
@ -19,6 +19,7 @@ interface BuildEventsSearchQuery {
  sortOrder?: SortOrderOrUndefined;
  searchAfterSortId: string | number | undefined;
  timestampOverride: TimestampOverrideOrUndefined;
+  excludeDocsWithTimestampOverride: boolean;
 }

 export const buildEventsSearchQuery = ({
@ -31,66 +32,65 @@ export const buildEventsSearchQuery = ({
  searchAfterSortId,
  sortOrder,
  timestampOverride,
+  excludeDocsWithTimestampOverride,
 }: BuildEventsSearchQuery) => {
-  const timestamp = timestampOverride ?? '@timestamp';
-  const docFields =
-    timestampOverride != null
-      ? [
-          {
-            field: '@timestamp',
-            format: 'strict_date_optional_time',
-          },
-          {
-            field: timestampOverride,
-            format: 'strict_date_optional_time',
-          },
-        ]
-      : [
-          {
-            field: '@timestamp',
-            format: 'strict_date_optional_time',
-          },
-        ];
+  const defaultTimeFields = ['@timestamp'];
+  const timestamps =
+    timestampOverride != null ? [timestampOverride, ...defaultTimeFields] : defaultTimeFields;
+  const docFields = timestamps.map((tstamp) => ({
+    field: tstamp,
+    format: 'strict_date_optional_time',
+  }));

-  const filterWithTime = [
-    filter,
+  const sortField =
+    timestampOverride != null && !excludeDocsWithTimestampOverride
+      ? timestampOverride
+      : '@timestamp';
+
+  const rangeFilter: unknown[] = [
    {
      bool: {
-        filter: [
+        should: [
          {
-            bool: {
-              should: [
-                {
-                  range: {
-                    [timestamp]: {
-                      gte: from,
-                      format: 'strict_date_optional_time',
-                    },
-                  },
-                },
-              ],
-              minimum_should_match: 1,
-            },
-          },
-          {
-            bool: {
-              should: [
-                {
-                  range: {
-                    [timestamp]: {
-                      lte: to,
-                      format: 'strict_date_optional_time',
-                    },
-                  },
-                },
-              ],
-              minimum_should_match: 1,
+            range: {
+              [sortField]: {
+                gte: from,
+                format: 'strict_date_optional_time',
+              },
            },
          },
        ],
+        minimum_should_match: 1,
+      },
+    },
+    {
+      bool: {
+        should: [
+          {
+            range: {
+              [sortField]: {
+                lte: to,
+                format: 'strict_date_optional_time',
+              },
+            },
+          },
+        ],
+        minimum_should_match: 1,
      },
    },
  ];
+  if (excludeDocsWithTimestampOverride) {
+    rangeFilter.push({
+      bool: {
+        must_not: {
+          exists: {
+            field: timestampOverride,
+          },
+        },
+      },
+    });
+  }
+  const filterWithTime = [filter, { bool: { filter: rangeFilter } }];

  const searchQuery = {
    allowNoIndices: true,
@ -112,7 +112,7 @@ export const buildEventsSearchQuery = ({
      ...(aggregations ? { aggregations } : {}),
      sort: [
        {
-          [timestamp]: {
+          [sortField]: {
            order: sortOrder ?? 'asc',
          },
        },
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/find_threshold_signals.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/find_threshold_signals.ts
@ -85,5 +85,6 @@ export const findThresholdSignals = async ({
    pageSize: 1,
    sortOrder: 'desc',
    buildRuleMessage,
+    excludeDocsWithTimestampOverride: false,
  });
 };
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.test.ts
@ -183,31 +183,6 @@ describe('searchAfterAndBulkCreate', () => {
          },
        ],
      })
-      .mockResolvedValueOnce(sampleDocSearchResultsNoSortIdNoHits())
-      .mockResolvedValueOnce(repeatedSearchResultsWithSortId(4, 1, someGuids.slice(9, 12)))
-      .mockResolvedValueOnce({
-        took: 100,
-        errors: false,
-        items: [
-          {
-            create: {
-              status: 201,
-            },
-          },
-        ],
-      })
-      .mockResolvedValueOnce(repeatedSearchResultsWithSortId(4, 1, someGuids.slice(0, 3)))
-      .mockResolvedValueOnce({
-        took: 100,
-        errors: false,
-        items: [
-          {
-            create: {
-              status: 201,
-            },
-          },
-        ],
-      })
      .mockResolvedValueOnce(sampleDocSearchResultsNoSortIdNoHits());

    const exceptionItem = getExceptionListItemSchemaMock();
@ -250,8 +225,8 @@ describe('searchAfterAndBulkCreate', () => {
      buildRuleMessage,
    });
    expect(success).toEqual(true);
-    expect(mockService.callCluster).toHaveBeenCalledTimes(12);
-    expect(createdSignalsCount).toEqual(5);
+    expect(mockService.callCluster).toHaveBeenCalledTimes(8);
+    expect(createdSignalsCount).toEqual(3);
    expect(lastLookBackDate).toEqual(new Date('2020-04-20T21:27:45+0000'));
  });

@ -461,7 +436,7 @@ describe('searchAfterAndBulkCreate', () => {
    // I don't like testing log statements since logs change but this is the best
    // way I can think of to ensure this section is getting hit with this test case.
    expect(((mockLogger.debug as unknown) as jest.Mock).mock.calls[8][0]).toContain(
-      'sortIds was empty on searchResult'
+      'ran out of sort ids to sort on name: "fake name" id: "fake id" rule id: "fake rule id" signals index: "fakeindex"'
    );
  });

@ -542,7 +517,7 @@ describe('searchAfterAndBulkCreate', () => {
    // I don't like testing log statements since logs change but this is the best
    // way I can think of to ensure this section is getting hit with this test case.
    expect(((mockLogger.debug as unknown) as jest.Mock).mock.calls[15][0]).toContain(
-      'sortIds was empty on searchResult name: "fake name" id: "fake id" rule id: "fake rule id" signals index: "fakeindex"'
+      'ran out of sort ids to sort on name: "fake name" id: "fake id" rule id: "fake rule id" signals index: "fakeindex"'
    );
  });

--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts
@ -3,6 +3,7 @@
 * or more contributor license agreements. Licensed under the Elastic License;
 * you may not use this file except in compliance with the Elastic License.
 */
+/* eslint-disable complexity */

 import { singleSearchAfter } from './single_search_after';
 import { singleBulkCreate } from './single_bulk_create';
@ -10,10 +11,12 @@ import { filterEventsAgainstList } from './filters/filter_events_against_list';
 import { sendAlertTelemetryEvents } from './send_telemetry_events';
 import {
  createSearchAfterReturnType,
+  createSearchResultReturnType,
  createSearchAfterReturnTypeFromResponse,
  createTotalHitsFromSearchResult,
  getSignalTimeTuples,
  mergeReturns,
+  mergeSearchResults,
 } from './utils';
 import { SearchAfterAndBulkCreateParams, SearchAfterAndBulkCreateReturnType } from './types';

@ -49,6 +52,9 @@ export const searchAfterAndBulkCreate = async ({

  // sortId tells us where to start our next consecutive search_after query
  let sortId: string | undefined;
+  let hasSortId = true; // default to true so we execute the search on initial run
+  let backupSortId: string | undefined;
+  let hasBackupSortId = ruleParams.timestampOverride ? true : false;

  // signalsCreatedCount keeps track of how many signals we have created,
  // to ensure we don't exceed maxSignals
@ -78,10 +84,11 @@ export const searchAfterAndBulkCreate = async ({
    signalsCreatedCount = 0;
    while (signalsCreatedCount < tuple.maxSignals) {
      try {
+        let mergedSearchResults = createSearchResultReturnType();
        logger.debug(buildRuleMessage(`sortIds: ${sortId}`));

        // perform search_after with optionally undefined sortId
-        const { searchResult, searchDuration, searchErrors } = await singleSearchAfter({
+        const singleSearchAfterPromise = singleSearchAfter({
          buildRuleMessage,
          searchAfterSortId: sortId,
          index: inputIndexPattern,
@ -92,23 +99,92 @@ export const searchAfterAndBulkCreate = async ({
          filter,
          pageSize: tuple.maxSignals < pageSize ? Math.ceil(tuple.maxSignals) : pageSize, // maximum number of docs to receive per search result.
          timestampOverride: ruleParams.timestampOverride,
+          excludeDocsWithTimestampOverride: false,
        });
-        toReturn = mergeReturns([
-          toReturn,
-          createSearchAfterReturnTypeFromResponse({
-            searchResult,
+
+        // if there is a timestampOverride param we always want to do a secondary search against @timestamp
+        if (ruleParams.timestampOverride != null && hasBackupSortId) {
+          // only execute search if we have something to sort on or if it is the first search
+          const singleSearchAfterDefaultTimestamp = singleSearchAfter({
+            buildRuleMessage,
+            searchAfterSortId: backupSortId,
+            index: inputIndexPattern,
+            from: tuple.from.toISOString(),
+            to: tuple.to.toISOString(),
+            services,
+            logger,
+            filter,
+            pageSize: tuple.maxSignals < pageSize ? Math.ceil(tuple.maxSignals) : pageSize, // maximum number of docs to receive per search result.
            timestampOverride: ruleParams.timestampOverride,
-          }),
-          createSearchAfterReturnType({
-            searchAfterTimes: [searchDuration],
-            errors: searchErrors,
-          }),
-        ]);
+            excludeDocsWithTimestampOverride: true,
+          });
+          const {
+            searchResult: searchResultB,
+            searchDuration: searchDurationB,
+            searchErrors: searchErrorsB,
+          } = await singleSearchAfterDefaultTimestamp;
+
+          // call this function setSortIdOrExit()
+          const lastSortId = searchResultB?.hits?.hits[searchResultB.hits.hits.length - 1]?.sort;
+          if (lastSortId != null && lastSortId.length !== 0) {
+            backupSortId = lastSortId[0];
+            hasBackupSortId = true;
+          } else {
+            // if no sort id on backup search and the initial search result was also empty
+            logger.debug(buildRuleMessage('backupSortIds was empty on searchResultB'));
+            hasBackupSortId = false;
+          }
+
+          mergedSearchResults = mergeSearchResults([mergedSearchResults, searchResultB]);
+
+          // merge the search result from the secondary search with the first
+          toReturn = mergeReturns([
+            toReturn,
+            createSearchAfterReturnTypeFromResponse({
+              searchResult: mergedSearchResults,
+              timestampOverride: undefined,
+            }),
+            createSearchAfterReturnType({
+              searchAfterTimes: [searchDurationB],
+              errors: searchErrorsB,
+            }),
+          ]);
+        }
+
+        if (hasSortId) {
+          // only execute search if we have something to sort on or if it is the first search
+          const { searchResult, searchDuration, searchErrors } = await singleSearchAfterPromise;
+          mergedSearchResults = mergeSearchResults([mergedSearchResults, searchResult]);
+          toReturn = mergeReturns([
+            toReturn,
+            createSearchAfterReturnTypeFromResponse({
+              searchResult: mergedSearchResults,
+              timestampOverride: ruleParams.timestampOverride,
+            }),
+            createSearchAfterReturnType({
+              searchAfterTimes: [searchDuration],
+              errors: searchErrors,
+            }),
+          ]);
+
+          // we are guaranteed to have searchResult hits at this point
+          // because we check before if the totalHits or
+          // searchResult.hits.hits.length is 0
+          // call this function setSortIdOrExit()
+          const lastSortId = searchResult.hits.hits[searchResult.hits.hits.length - 1]?.sort;
+          if (lastSortId != null && lastSortId.length !== 0) {
+            sortId = lastSortId[0];
+            hasSortId = true;
+          } else {
+            hasSortId = false;
+          }
+        }
+
        // determine if there are any candidate signals to be processed
-        const totalHits = createTotalHitsFromSearchResult({ searchResult });
+        const totalHits = createTotalHitsFromSearchResult({ searchResult: mergedSearchResults });
        logger.debug(buildRuleMessage(`totalHits: ${totalHits}`));
        logger.debug(
-          buildRuleMessage(`searchResult.hit.hits.length: ${searchResult.hits.hits.length}`)
+          buildRuleMessage(`searchResult.hit.hits.length: ${mergedSearchResults.hits.hits.length}`)
        );

        // search results yielded zero hits so exit
@ -119,7 +195,7 @@ export const searchAfterAndBulkCreate = async ({
        // e.g. totalHits was 156, index 50 of 100 results, do another search-after
        // this time with a new sortId, index 22 of the remaining 56, get another sortId
        // search with that sortId, total is still 156 but the hits.hits array is empty.
-        if (totalHits === 0 || searchResult.hits.hits.length === 0) {
+        if (totalHits === 0 || mergedSearchResults.hits.hits.length === 0) {
          logger.debug(
            buildRuleMessage(
              `${
@ -137,7 +213,7 @@ export const searchAfterAndBulkCreate = async ({
          listClient,
          exceptionsList,
          logger,
-          eventSearchResult: searchResult,
+          eventSearchResult: mergedSearchResults,
          buildRuleMessage,
        });

@ -205,14 +281,8 @@ export const searchAfterAndBulkCreate = async ({
          );
        }

-        // we are guaranteed to have searchResult hits at this point
-        // because we check before if the totalHits or
-        // searchResult.hits.hits.length is 0
-        const lastSortId = searchResult.hits.hits[searchResult.hits.hits.length - 1].sort;
-        if (lastSortId != null && lastSortId.length !== 0) {
-          sortId = lastSortId[0];
-        } else {
-          logger.debug(buildRuleMessage('sortIds was empty on searchResult'));
+        if (!hasSortId && !hasBackupSortId) {
+          logger.debug(buildRuleMessage('ran out of sort ids to sort on'));
          break;
        }
      } catch (exc: unknown) {
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/single_search_after.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/single_search_after.test.ts
@ -40,6 +40,7 @@ describe('singleSearchAfter', () => {
      filter: undefined,
      timestampOverride: undefined,
      buildRuleMessage,
+      excludeDocsWithTimestampOverride: false,
    });
    expect(searchResult).toEqual(sampleDocSearchResultsNoSortId());
  });
@ -56,6 +57,7 @@ describe('singleSearchAfter', () => {
      filter: undefined,
      timestampOverride: undefined,
      buildRuleMessage,
+      excludeDocsWithTimestampOverride: false,
    });
    expect(searchErrors).toEqual([]);
  });
@ -104,9 +106,10 @@ describe('singleSearchAfter', () => {
      filter: undefined,
      timestampOverride: undefined,
      buildRuleMessage,
+      excludeDocsWithTimestampOverride: false,
    });
    expect(searchErrors).toEqual([
-      'reason: "some reason" type: "some type" caused by reason: "some reason" caused by type: "some type"',
+      'index: "index-123" reason: "some reason" type: "some type" caused by reason: "some reason" caused by type: "some type"',
    ]);
  });
  test('if singleSearchAfter works with a given sort id', async () => {
@ -123,6 +126,7 @@ describe('singleSearchAfter', () => {
      filter: undefined,
      timestampOverride: undefined,
      buildRuleMessage,
+      excludeDocsWithTimestampOverride: false,
    });
    expect(searchResult).toEqual(sampleDocSearchResultsWithSortId());
  });
@ -143,6 +147,7 @@ describe('singleSearchAfter', () => {
        filter: undefined,
        timestampOverride: undefined,
        buildRuleMessage,
+        excludeDocsWithTimestampOverride: false,
      })
    ).rejects.toThrow('Fake Error');
  });
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/single_search_after.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/single_search_after.ts
@ -29,6 +29,7 @@ interface SingleSearchAfterParams {
  filter: unknown;
  timestampOverride: TimestampOverrideOrUndefined;
  buildRuleMessage: BuildRuleMessage;
+  excludeDocsWithTimestampOverride: boolean;
 }

 // utilize search_after for paging results into bulk.
@ -45,6 +46,7 @@ export const singleSearchAfter = async ({
  sortOrder,
  timestampOverride,
  buildRuleMessage,
+  excludeDocsWithTimestampOverride,
 }: SingleSearchAfterParams): Promise<{
  searchResult: SignalSearchResponse;
  searchDuration: string;
@ -61,6 +63,7 @@ export const singleSearchAfter = async ({
      sortOrder,
      searchAfterSortId,
      timestampOverride,
+      excludeDocsWithTimestampOverride,
    });

    const start = performance.now();
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold_find_previous_signals.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold_find_previous_signals.ts
@ -83,5 +83,6 @@ export const findPreviousThresholdSignals = async ({
    filter,
    pageSize: 0,
    buildRuleMessage,
+    excludeDocsWithTimestampOverride: false,
  });
 };
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.test.ts
@ -879,7 +879,7 @@ describe('utils', () => {
      ];
      const createdErrors = createErrorsFromShard({ errors });
      expect(createdErrors).toEqual([
-        'reason: "some reason" type: "some type" caused by reason: "some reason" caused by type: "some type"',
+        'index: "index-123" reason: "some reason" type: "some type" caused by reason: "some reason" caused by type: "some type"',
      ]);
    });

@ -918,8 +918,8 @@ describe('utils', () => {
      ];
      const createdErrors = createErrorsFromShard({ errors });
      expect(createdErrors).toEqual([
-        'reason: "some reason" type: "some type" caused by reason: "some reason" caused by type: "some type"',
-        'reason: "some reason 2" type: "some type 2" caused by reason: "some reason 2" caused by type: "some type 2"',
+        'index: "index-123" reason: "some reason" type: "some type" caused by reason: "some reason" caused by type: "some type"',
+        'index: "index-345" reason: "some reason 2" type: "some type 2" caused by reason: "some reason 2" caused by type: "some type 2"',
      ]);
    });

@ -933,7 +933,7 @@ describe('utils', () => {
        },
      ];
      const createdErrors = createErrorsFromShard({ errors });
-      expect(createdErrors).toEqual(['']);
+      expect(createdErrors).toEqual(['index: "index-123"']);
    });

    test('You can have a single value for the shard errors and get expected output without extra spaces anywhere', () => {
@ -948,7 +948,9 @@ describe('utils', () => {
        },
      ];
      const createdErrors = createErrorsFromShard({ errors });
-      expect(createdErrors).toEqual(['reason: "some reason something went wrong"']);
+      expect(createdErrors).toEqual([
+        'index: "index-123" reason: "some reason something went wrong"',
+      ]);
    });

    test('You can have two values for the shard errors and get expected output with one space exactly between the two values', () => {
@ -965,7 +967,7 @@ describe('utils', () => {
      ];
      const createdErrors = createErrorsFromShard({ errors });
      expect(createdErrors).toEqual([
-        'reason: "some reason something went wrong" caused by type: "some type"',
+        'index: "index-123" reason: "some reason something went wrong" caused by type: "some type"',
      ]);
    });
  });
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.ts
@ -530,6 +530,7 @@ export const getSignalTimeTuples = ({
 export const createErrorsFromShard = ({ errors }: { errors: ShardError[] }): string[] => {
  return errors.map((error) => {
    const {
+      index,
      reason: {
        reason,
        type,
@ -541,6 +542,7 @@ export const createErrorsFromShard = ({ errors }: { errors: ShardError[] }): str
    } = error;

    return [
+      ...(index != null ? [`index: "${index}"`] : []),
      ...(reason != null ? [`reason: "${reason}"`] : []),
      ...(type != null ? [`type: "${type}"`] : []),
      ...(causedByReason != null ? [`caused by reason: "${causedByReason}"`] : []),
@ -629,6 +631,25 @@ export const createSearchAfterReturnType = ({
  };
 };

+export const createSearchResultReturnType = (): SignalSearchResponse => {
+  return {
+    took: 0,
+    timed_out: false,
+    _shards: {
+      total: 0,
+      successful: 0,
+      failed: 0,
+      skipped: 0,
+      failures: [],
+    },
+    hits: {
+      total: 0,
+      max_score: 0,
+      hits: [],
+    },
+  };
+};
+
 export const mergeReturns = (
  searchAfters: SearchAfterAndBulkCreateReturnType[]
 ): SearchAfterAndBulkCreateReturnType => {
@ -665,6 +686,52 @@ export const mergeReturns = (
  });
 };

+export const mergeSearchResults = (searchResults: SignalSearchResponse[]) => {
+  return searchResults.reduce((prev, next) => {
+    const {
+      took: existingTook,
+      timed_out: existingTimedOut,
+      // _scroll_id: existingScrollId,
+      _shards: existingShards,
+      // aggregations: existingAggregations,
+      hits: existingHits,
+    } = prev;
+
+    const {
+      took: newTook,
+      timed_out: newTimedOut,
+      _scroll_id: newScrollId,
+      _shards: newShards,
+      aggregations: newAggregations,
+      hits: newHits,
+    } = next;
+
+    return {
+      took: Math.max(newTook, existingTook),
+      timed_out: newTimedOut && existingTimedOut,
+      _scroll_id: newScrollId,
+      _shards: {
+        total: newShards.total + existingShards.total,
+        successful: newShards.successful + existingShards.successful,
+        failed: newShards.failed + existingShards.failed,
+        skipped: newShards.skipped + existingShards.skipped,
+        failures: [
+          ...(existingShards.failures != null ? existingShards.failures : []),
+          ...(newShards.failures != null ? newShards.failures : []),
+        ],
+      },
+      aggregations: newAggregations,
+      hits: {
+        total:
+          createTotalHitsFromSearchResult({ searchResult: prev }) +
+          createTotalHitsFromSearchResult({ searchResult: next }),
+        max_score: Math.max(newHits.max_score, existingHits.max_score),
+        hits: [...existingHits.hits, ...newHits.hits],
+      },
+    };
+  });
+};
+
 export const createTotalHitsFromSearchResult = ({
  searchResult,
 }: {
--- a/x-pack/test/detection_engine_api_integration/basic/tests/find_statuses.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/find_statuses.ts
@ -15,7 +15,7 @@ import {
  deleteAllRulesStatuses,
  getSimpleRule,
  createRule,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
 } from '../../utils';

 // eslint-disable-next-line import/no-default-export
@ -47,7 +47,7 @@ export default ({ getService }: FtrProviderContext): void => {
    it('should return a single rule status when a single rule is loaded from a find status with defaults added', async () => {
      const resBody = await createRule(supertest, getSimpleRule('rule-1', true));

-      await waitForRuleSuccess(supertest, resBody.id);
+      await waitForRuleSuccessOrStatus(supertest, resBody.id);

      // query the single rule from _find
      const { body } = await supertest
--- a/x-pack/test/detection_engine_api_integration/basic/tests/open_close_signals.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/open_close_signals.ts
@ -23,7 +23,7 @@ import {
  createRule,
  waitForSignalsToBePresent,
  getSignalsByIds,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  getRuleForSignalTesting,
 } from '../../utils';

@ -79,7 +79,7 @@ export default ({ getService }: FtrProviderContext) => {
      it('should be able to execute and get 10 signals', async () => {
        const rule = getRuleForSignalTesting(['auditbeat-*']);
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 10, [id]);
        const signalsOpen = await getSignalsByIds(supertest, [id]);
        expect(signalsOpen.hits.hits.length).equal(10);
@ -88,7 +88,7 @@ export default ({ getService }: FtrProviderContext) => {
      it('should be have set the signals in an open state initially', async () => {
        const rule = getRuleForSignalTesting(['auditbeat-*']);
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 10, [id]);
        const signalsOpen = await getSignalsByIds(supertest, [id]);
        const everySignalOpen = signalsOpen.hits.hits.every(
@ -104,7 +104,7 @@ export default ({ getService }: FtrProviderContext) => {
      it('should be able to get a count of 10 closed signals when closing 10', async () => {
        const rule = getRuleForSignalTesting(['auditbeat-*']);
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 10, [id]);
        const signalsOpen = await getSignalsByIds(supertest, [id]);
        const signalIds = signalsOpen.hits.hits.map((signal) => signal._id);
@ -131,7 +131,7 @@ export default ({ getService }: FtrProviderContext) => {
      it('should be able close 10 signals immediately and they all should be closed', async () => {
        const rule = getRuleForSignalTesting(['auditbeat-*']);
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 10, [id]);
        const signalsOpen = await getSignalsByIds(supertest, [id]);
        const signalIds = signalsOpen.hits.hits.map((signal) => signal._id);
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_actions.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_actions.ts
@ -17,7 +17,7 @@ import {
  getWebHookAction,
  getRuleWithWebHookAction,
  getSimpleRuleOutputWithWebHookAction,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  createRule,
 } from '../../utils';

@ -60,7 +60,7 @@ export default ({ getService }: FtrProviderContext) => {
          .expect(200);

        const rule = await createRule(supertest, getRuleWithWebHookAction(hookAction.id, true));
-        await waitForRuleSuccess(supertest, rule.id);
+        await waitForRuleSuccessOrStatus(supertest, rule.id);

        // expected result for status should be 'succeeded'
        const { body } = await supertest
@ -86,7 +86,7 @@ export default ({ getService }: FtrProviderContext) => {
        };

        const rule = await createRule(supertest, ruleWithAction);
-        await waitForRuleSuccess(supertest, rule.id);
+        await waitForRuleSuccessOrStatus(supertest, rule.id);

        // expected result for status should be 'succeeded'
        const { body } = await supertest
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_exceptions.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_exceptions.ts
@ -26,7 +26,7 @@ import {
  removeServerGeneratedProperties,
  downgradeImmutableRule,
  createRule,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  installPrePackagedRules,
  getRule,
  createExceptionList,
@ -113,7 +113,7 @@ export default ({ getService }: FtrProviderContext) => {
        };

        const rule = await createRule(supertest, ruleWithException);
-        await waitForRuleSuccess(supertest, rule.id);
+        await waitForRuleSuccessOrStatus(supertest, rule.id);
        const bodyToCompare = removeServerGeneratedProperties(rule);

        const expected: Partial<RulesSchema> = {
@ -444,7 +444,7 @@ export default ({ getService }: FtrProviderContext) => {
            ],
          };
          const { id: createdId } = await createRule(supertest, ruleWithException);
-          await waitForRuleSuccess(supertest, createdId);
+          await waitForRuleSuccessOrStatus(supertest, createdId);
          await waitForSignalsToBePresent(supertest, 10, [createdId]);
          const signalsOpen = await getSignalsByIds(supertest, [createdId]);
          expect(signalsOpen.hits.hits.length).equal(10);
@ -490,7 +490,7 @@ export default ({ getService }: FtrProviderContext) => {
            ],
          };
          const rule = await createRule(supertest, ruleWithException);
-          await waitForRuleSuccess(supertest, rule.id);
+          await waitForRuleSuccessOrStatus(supertest, rule.id);
          const signalsOpen = await getSignalsByIds(supertest, [rule.id]);
          expect(signalsOpen.hits.hits.length).equal(0);
        });
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts
@ -24,13 +24,16 @@ import {
  removeServerGeneratedPropertiesIncludingRuleId,
  getSimpleMlRule,
  getSimpleMlRuleOutput,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
+  waitForSignalsToBePresent,
  getRuleForSignalTesting,
+  getRuleForSignalTestingWithTimestampOverride,
 } from '../../utils';

 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
  const supertest = getService('supertest');
+  const esArchiver = getService('esArchiver');

  describe('create_rules', () => {
    describe('validation errors', () => {
@ -97,7 +100,7 @@ export default ({ getService }: FtrProviderContext) => {
          .send(simpleRule)
          .expect(200);

-        await waitForRuleSuccess(supertest, body.id);
+        await waitForRuleSuccessOrStatus(supertest, body.id);

        const { body: statusBody } = await supertest
          .post(DETECTION_ENGINE_RULES_STATUS_URL)
@ -201,5 +204,46 @@ export default ({ getService }: FtrProviderContext) => {
        });
      });
    });
+    describe.skip('missing timestamps', () => {
+      beforeEach(async () => {
+        await createSignalsIndex(supertest);
+        // to edit these files run the following script
+        // cd $HOME/kibana/x-pack && nvm use && node ../scripts/es_archiver edit security_solution/timestamp_override
+        await esArchiver.load('security_solution/timestamp_override');
+      });
+      afterEach(async () => {
+        await deleteSignalsIndex(supertest);
+        await deleteAllAlerts(supertest);
+        await esArchiver.unload('security_solution/timestamp_override');
+      });
+      it.skip('should create a single rule which has a timestamp override and generates two signals with a failing status', async () => {
+        // should be a failing status because one of the indices in the index pattern is missing
+        // the timestamp override field.
+
+        // defaults to event.ingested timestamp override.
+        // event.ingested is one of the timestamp fields set on the es archive data
+        // inside of x-pack/test/functional/es_archives/security_solution/timestamp_override/data.json.gz
+        const simpleRule = getRuleForSignalTestingWithTimestampOverride(['myfa*']);
+        const { body } = await supertest
+          .post(DETECTION_ENGINE_RULES_URL)
+          .set('kbn-xsrf', 'true')
+          .send(simpleRule)
+          .expect(200);
+        const bodyId = body.id;
+
+        await waitForRuleSuccessOrStatus(supertest, bodyId, 'failed');
+        await waitForSignalsToBePresent(supertest, 2, [bodyId]);
+
+        const { body: statusBody } = await supertest
+          .post(DETECTION_ENGINE_RULES_STATUS_URL)
+          .set('kbn-xsrf', 'true')
+          .send({ ids: [bodyId] })
+          .expect(200);
+
+        // set to "failed" for now. Will update this with a partial failure
+        // once I figure out the logic
+        expect(statusBody[bodyId].current_status.status).to.eql('failed');
+      });
+    });
  });
 };
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules_bulk.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules_bulk.ts
@ -22,7 +22,7 @@ import {
  getSimpleRuleWithoutRuleId,
  removeServerGeneratedProperties,
  removeServerGeneratedPropertiesIncludingRuleId,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
 } from '../../utils';

 // eslint-disable-next-line import/no-default-export
@ -99,7 +99,7 @@ export default ({ getService }: FtrProviderContext): void => {
          .send([simpleRule])
          .expect(200);

-        await waitForRuleSuccess(supertest, body[0].id);
+        await waitForRuleSuccessOrStatus(supertest, body[0].id);

        const { body: statusBody } = await supertest
          .post(DETECTION_ENGINE_RULES_STATUS_URL)
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts
@ -19,7 +19,7 @@ import {
  deleteSignalsIndex,
  getSignalsByIds,
  removeServerGeneratedProperties,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  waitForSignalsToBePresent,
 } from '../../utils';

@ -72,7 +72,7 @@ export default ({ getService }: FtrProviderContext) => {
          supertest,
          getCreateThreatMatchRulesSchemaMock('rule-1', true)
        );
-        await waitForRuleSuccess(supertest, ruleResponse.id);
+        await waitForRuleSuccessOrStatus(supertest, ruleResponse.id);

        const { body: statusBody } = await supertest
          .post(DETECTION_ENGINE_RULES_STATUS_URL)
@ -128,7 +128,7 @@ export default ({ getService }: FtrProviderContext) => {
        };

        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 10, [id]);
        const signalsOpen = await getSignalsByIds(supertest, [id]);
        expect(signalsOpen.hits.hits.length).equal(10);
@ -163,7 +163,7 @@ export default ({ getService }: FtrProviderContext) => {
        };

        const ruleResponse = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, ruleResponse.id);
+        await waitForRuleSuccessOrStatus(supertest, ruleResponse.id);
        const signalsOpen = await getSignalsByIds(supertest, [ruleResponse.id]);
        expect(signalsOpen.hits.hits.length).equal(0);
      });
@ -201,7 +201,7 @@ export default ({ getService }: FtrProviderContext) => {
        };

        const ruleResponse = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, ruleResponse.id);
+        await waitForRuleSuccessOrStatus(supertest, ruleResponse.id);
        const signalsOpen = await getSignalsByIds(supertest, [ruleResponse.id]);
        expect(signalsOpen.hits.hits.length).equal(0);
      });
@ -239,7 +239,7 @@ export default ({ getService }: FtrProviderContext) => {
        };

        const ruleResponse = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, ruleResponse.id);
+        await waitForRuleSuccessOrStatus(supertest, ruleResponse.id);
        const signalsOpen = await getSignalsByIds(supertest, [ruleResponse.id]);
        expect(signalsOpen.hits.hits.length).equal(0);
      });
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/date.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/date.ts
@ -21,7 +21,7 @@ import {
  deleteSignalsIndex,
  getRuleForSignalTesting,
  getSignalsById,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  waitForSignalsToBePresent,
 } from '../../../utils';

@ -50,7 +50,7 @@ export default ({ getService }: FtrProviderContext) => {
      it('should find all the dates from the data set when no exceptions are set on the rule', async () => {
        const rule = getRuleForSignalTesting(['date']);
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
@ -74,7 +74,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
@ -105,7 +105,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
@ -140,7 +140,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
@ -183,7 +183,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
        expect(hits).to.eql([]);
@ -203,7 +203,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
        expect(hits).to.eql([]);
@ -221,7 +221,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
@ -248,7 +248,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
        expect(hits).to.eql([]);
@ -268,7 +268,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
@ -291,7 +291,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
@ -314,7 +314,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
@ -338,7 +338,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
        expect(hits).to.eql([]);
@ -358,7 +358,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
        expect(hits).to.eql([]);
@ -376,7 +376,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
@ -396,7 +396,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
        expect(hits).to.eql([]);
@ -415,7 +415,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
@ -445,7 +445,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
@ -477,7 +477,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
@ -510,7 +510,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
        expect(hits).to.eql([]);
@ -534,7 +534,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
@ -562,7 +562,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
@ -595,7 +595,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/double.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/double.ts
@ -21,7 +21,7 @@ import {
  deleteSignalsIndex,
  getRuleForSignalTesting,
  getSignalsById,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  waitForSignalsToBePresent,
 } from '../../../utils';

@ -52,7 +52,7 @@ export default ({ getService }: FtrProviderContext) => {
      it('should find all the double from the data set when no exceptions are set on the rule', async () => {
        const rule = getRuleForSignalTesting(['double']);
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -71,7 +71,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -98,7 +98,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -133,7 +133,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -176,7 +176,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
        expect(hits).to.eql([]);
@ -196,7 +196,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
        expect(hits).to.eql([]);
@ -214,7 +214,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -241,7 +241,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
        expect(hits).to.eql([]);
@ -261,7 +261,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -280,7 +280,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -299,7 +299,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -318,7 +318,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
        expect(hits).to.eql([]);
@ -338,7 +338,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
        expect(hits).to.eql([]);
@ -356,7 +356,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -376,7 +376,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
        expect(hits).to.eql([]);
@ -395,7 +395,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -421,7 +421,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 3, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -444,7 +444,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -467,7 +467,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
          expect(hits).to.eql([]);
@ -491,7 +491,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -514,7 +514,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -537,7 +537,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
          expect(hits).to.eql([]);
@ -562,7 +562,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -589,7 +589,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -612,7 +612,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -635,7 +635,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 4, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -660,7 +660,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -683,7 +683,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -706,7 +706,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 4, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
@ -732,7 +732,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 3, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/float.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/float.ts
@ -21,7 +21,7 @@ import {
  deleteSignalsIndex,
  getRuleForSignalTesting,
  getSignalsById,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  waitForSignalsToBePresent,
 } from '../../../utils';

@ -52,7 +52,7 @@ export default ({ getService }: FtrProviderContext) => {
      it('should find all the float from the data set when no exceptions are set on the rule', async () => {
        const rule = getRuleForSignalTesting(['float']);
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -71,7 +71,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -98,7 +98,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -133,7 +133,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -176,7 +176,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
        expect(hits).to.eql([]);
@ -196,7 +196,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
        expect(hits).to.eql([]);
@ -214,7 +214,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -241,7 +241,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
        expect(hits).to.eql([]);
@ -261,7 +261,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -280,7 +280,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -299,7 +299,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -318,7 +318,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
        expect(hits).to.eql([]);
@ -338,7 +338,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
        expect(hits).to.eql([]);
@ -356,7 +356,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -376,7 +376,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
        expect(hits).to.eql([]);
@ -395,7 +395,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -421,7 +421,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 3, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -444,7 +444,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -467,7 +467,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
          expect(hits).to.eql([]);
@ -491,7 +491,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -514,7 +514,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -537,7 +537,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
          expect(hits).to.eql([]);
@ -559,7 +559,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -586,7 +586,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -609,7 +609,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -632,7 +632,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 4, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -657,7 +657,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -680,7 +680,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -703,7 +703,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 4, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
@ -726,7 +726,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 3, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/integer.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/integer.ts
@ -21,7 +21,7 @@ import {
  deleteSignalsIndex,
  getRuleForSignalTesting,
  getSignalsById,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  waitForSignalsToBePresent,
 } from '../../../utils';

@ -52,7 +52,7 @@ export default ({ getService }: FtrProviderContext) => {
      it('should find all the integer from the data set when no exceptions are set on the rule', async () => {
        const rule = getRuleForSignalTesting(['integer']);
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -71,7 +71,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -98,7 +98,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -133,7 +133,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -176,7 +176,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
        expect(hits).to.eql([]);
@ -196,7 +196,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
        expect(hits).to.eql([]);
@ -214,7 +214,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -241,7 +241,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
        expect(hits).to.eql([]);
@ -261,7 +261,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -280,7 +280,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -299,7 +299,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -318,7 +318,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
        expect(hits).to.eql([]);
@ -338,7 +338,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
        expect(hits).to.eql([]);
@ -356,7 +356,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -376,7 +376,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
        expect(hits).to.eql([]);
@ -395,7 +395,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -421,7 +421,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 3, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -444,7 +444,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -467,7 +467,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
          expect(hits).to.eql([]);
@ -491,7 +491,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -514,7 +514,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -537,7 +537,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
          expect(hits).to.eql([]);
@ -559,7 +559,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -586,7 +586,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -609,7 +609,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -632,7 +632,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 4, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -657,7 +657,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -680,7 +680,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -703,7 +703,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 4, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
@ -726,7 +726,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 3, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip.ts
@ -21,7 +21,7 @@ import {
  deleteSignalsIndex,
  getRuleForSignalTesting,
  getSignalsById,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  waitForSignalsToBePresent,
 } from '../../../utils';

@ -50,7 +50,7 @@ export default ({ getService }: FtrProviderContext) => {
      it('should find all the ips from the data set when no exceptions are set on the rule', async () => {
        const rule = getRuleForSignalTesting(['ip']);
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -69,7 +69,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -96,7 +96,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -131,7 +131,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -174,7 +174,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
        expect(ips).to.eql([]);
@ -192,7 +192,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -213,7 +213,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
        expect(ips).to.eql([]);
@ -231,7 +231,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -258,7 +258,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
        expect(ips).to.eql([]);
@ -278,7 +278,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -297,7 +297,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -316,7 +316,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -335,7 +335,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
        expect(ips).to.eql([]);
@ -355,7 +355,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
        expect(ips).to.eql([]);
@ -373,7 +373,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -393,7 +393,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
        expect(ips).to.eql([]);
@ -412,7 +412,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -437,7 +437,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -460,7 +460,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -488,7 +488,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
        expect(ips).to.eql([]);
@ -514,7 +514,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -541,7 +541,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -570,7 +570,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -595,7 +595,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -618,7 +618,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -646,7 +646,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -673,7 +673,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -700,7 +700,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip_array.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip_array.ts
@ -21,7 +21,7 @@ import {
  deleteSignalsIndex,
  getRuleForSignalTesting,
  getSignalsById,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  waitForSignalsToBePresent,
 } from '../../../utils';

@ -50,7 +50,7 @@ export default ({ getService }: FtrProviderContext) => {
      it('should find all the ips from the data set when no exceptions are set on the rule', async () => {
        const rule = getRuleForSignalTesting(['ip_as_array']);
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -74,7 +74,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -105,7 +105,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -140,7 +140,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -159,7 +159,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -182,7 +182,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -203,7 +203,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
        expect(ips).to.eql([]);
@ -221,7 +221,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -246,7 +246,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -273,7 +273,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
        expect(ips).to.eql([]);
@ -293,7 +293,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -316,7 +316,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -335,7 +335,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -356,7 +356,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
        expect(ips).to.eql([]);
@ -374,7 +374,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -397,7 +397,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
        expect(ips).to.eql([[]]);
@ -416,7 +416,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -445,7 +445,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -472,7 +472,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -500,7 +500,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
        expect(ips).to.eql([[]]);
@ -536,7 +536,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -567,7 +567,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -592,7 +592,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -615,7 +615,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -646,7 +646,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -687,7 +687,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
@ -721,7 +721,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword.ts
@ -21,7 +21,7 @@ import {
  deleteSignalsIndex,
  getRuleForSignalTesting,
  getSignalsById,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  waitForSignalsToBePresent,
 } from '../../../utils';

@ -50,7 +50,7 @@ export default ({ getService }: FtrProviderContext) => {
      it('should find all the keyword from the data set when no exceptions are set on the rule', async () => {
        const rule = getRuleForSignalTesting(['keyword']);
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -69,7 +69,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -96,7 +96,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -131,7 +131,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -174,7 +174,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
        expect(hits).to.eql([]);
@ -194,7 +194,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
        expect(hits).to.eql([]);
@ -212,7 +212,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -239,7 +239,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
        expect(hits).to.eql([]);
@ -259,7 +259,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -278,7 +278,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -297,7 +297,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -316,7 +316,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
        expect(hits).to.eql([]);
@ -336,7 +336,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
        expect(hits).to.eql([]);
@ -354,7 +354,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -374,7 +374,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
        expect(hits).to.eql([]);
@ -393,7 +393,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -428,7 +428,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -451,7 +451,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -474,7 +474,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -502,7 +502,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
        expect(hits).to.eql([]);
@ -526,7 +526,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -549,7 +549,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -577,7 +577,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword_array.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword_array.ts
@ -21,7 +21,7 @@ import {
  deleteSignalsIndex,
  getRuleForSignalTesting,
  getSignalsById,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  waitForSignalsToBePresent,
 } from '../../../utils';

@ -50,7 +50,7 @@ export default ({ getService }: FtrProviderContext) => {
      it('should find all the keyword from the data set when no exceptions are set on the rule', async () => {
        const rule = getRuleForSignalTesting(['keyword_as_array']);
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -74,7 +74,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -105,7 +105,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -140,7 +140,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -161,7 +161,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
        expect(hits).to.eql([]);
@ -179,7 +179,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -206,7 +206,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
        expect(hits).to.eql([]);
@ -226,7 +226,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -249,7 +249,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -268,7 +268,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -289,7 +289,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
        expect(hits).to.eql([]);
@ -307,7 +307,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -330,7 +330,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
        expect(hits).to.eql([[]]);
@ -349,7 +349,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -388,7 +388,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -426,7 +426,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -453,7 +453,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -480,7 +480,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -508,7 +508,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
        expect(hits).to.eql([[]]);
@ -532,7 +532,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -555,7 +555,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -578,7 +578,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
@ -609,7 +609,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/long.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/long.ts
@ -21,7 +21,7 @@ import {
  deleteSignalsIndex,
  getRuleForSignalTesting,
  getSignalsById,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  waitForSignalsToBePresent,
 } from '../../../utils';

@ -52,7 +52,7 @@ export default ({ getService }: FtrProviderContext) => {
      it('should find all the long from the data set when no exceptions are set on the rule', async () => {
        const rule = getRuleForSignalTesting(['long']);
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -71,7 +71,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -98,7 +98,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -133,7 +133,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -176,7 +176,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
        expect(hits).to.eql([]);
@ -196,7 +196,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
        expect(hits).to.eql([]);
@ -214,7 +214,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -241,7 +241,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
        expect(hits).to.eql([]);
@ -261,7 +261,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -280,7 +280,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -299,7 +299,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -318,7 +318,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
        expect(hits).to.eql([]);
@ -338,7 +338,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
        expect(hits).to.eql([]);
@ -356,7 +356,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -376,7 +376,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
        expect(hits).to.eql([]);
@ -395,7 +395,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -421,7 +421,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 3, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -444,7 +444,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -467,7 +467,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
          expect(hits).to.eql([]);
@ -491,7 +491,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -514,7 +514,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -537,7 +537,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
          expect(hits).to.eql([]);
@ -559,7 +559,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -586,7 +586,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -609,7 +609,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -632,7 +632,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 4, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -657,7 +657,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -680,7 +680,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -703,7 +703,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 4, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
@ -726,7 +726,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 3, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text.ts
@ -22,7 +22,7 @@ import {
  deleteSignalsIndex,
  getRuleForSignalTesting,
  getSignalsById,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  waitForSignalsToBePresent,
 } from '../../../utils';

@ -53,7 +53,7 @@ export default ({ getService }: FtrProviderContext) => {
      it('should find all the text from the data set when no exceptions are set on the rule', async () => {
        const rule = getRuleForSignalTesting(['text']);
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -72,7 +72,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -99,7 +99,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -134,7 +134,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -177,7 +177,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
        expect(hits).to.eql([]);
@ -195,7 +195,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -214,7 +214,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
        expect(hits).to.eql([]);
@ -232,7 +232,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -253,7 +253,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
        expect(hits).to.eql([]);
@ -271,7 +271,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -298,7 +298,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
        expect(hits).to.eql([]);
@ -316,7 +316,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -335,7 +335,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
        expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
@ -353,7 +353,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -374,7 +374,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -393,7 +393,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -412,7 +412,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -431,7 +431,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
        expect(hits).to.eql([]);
@ -451,7 +451,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
        expect(hits).to.eql([]);
@ -469,7 +469,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -489,7 +489,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
        expect(hits).to.eql([]);
@ -508,7 +508,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -534,7 +534,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 3, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -557,7 +557,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -585,7 +585,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
          expect(hits).to.eql([]);
@ -609,7 +609,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -637,7 +637,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -660,7 +660,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -688,7 +688,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
          expect(hits).to.eql([]);
@ -714,7 +714,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -737,7 +737,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 2, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -765,7 +765,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 4, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -790,7 +790,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -818,7 +818,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -841,7 +841,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -869,7 +869,7 @@ export default ({ getService }: FtrProviderContext) => {
              },
            ],
          ]);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsById(supertest, id);
          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text_array.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text_array.ts
@ -21,7 +21,7 @@ import {
  deleteSignalsIndex,
  getRuleForSignalTesting,
  getSignalsById,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  waitForSignalsToBePresent,
 } from '../../../utils';

@ -50,7 +50,7 @@ export default ({ getService }: FtrProviderContext) => {
      it('should find all the text from the data set when no exceptions are set on the rule', async () => {
        const rule = getRuleForSignalTesting(['text_as_array']);
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -74,7 +74,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -105,7 +105,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -140,7 +140,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -161,7 +161,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
        expect(hits).to.eql([]);
@ -179,7 +179,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -206,7 +206,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
        expect(hits).to.eql([]);
@ -226,7 +226,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -249,7 +249,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -268,7 +268,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -289,7 +289,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
        expect(hits).to.eql([]);
@ -307,7 +307,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -330,7 +330,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
        expect(hits).to.eql([[]]);
@ -349,7 +349,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -388,7 +388,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -426,7 +426,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -453,7 +453,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -480,7 +480,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -508,7 +508,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
        expect(hits).to.eql([[]]);
@ -532,7 +532,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -555,7 +555,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -578,7 +578,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 2, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
@ -604,7 +604,7 @@ export default ({ getService }: FtrProviderContext) => {
            },
          ],
        ]);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 3, [id]);
        const signalsOpen = await getSignalsById(supertest, id);
        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/find_statuses.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/find_statuses.ts
@ -14,7 +14,7 @@ import {
  deleteSignalsIndex,
  deleteAllRulesStatuses,
  getSimpleRule,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  createRule,
 } from '../../utils';

@ -66,7 +66,7 @@ export default ({ getService }: FtrProviderContext): void => {
    it('should return a single rule status when a single rule is loaded from a find status with defaults added', async () => {
      const resBody = await createRule(supertest, getSimpleRule('rule-1', true));

-      await waitForRuleSuccess(supertest, resBody.id);
+      await waitForRuleSuccessOrStatus(supertest, resBody.id);

      // query the single rule from _find
      const { body } = await supertest
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
@ -22,7 +22,7 @@ import {
  getSignalsByIds,
  getSignalsByRuleIds,
  getSimpleRule,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  waitForSignalsToBePresent,
 } from '../../utils';
 import { SIGNALS_TEMPLATE_VERSION } from '../../../../plugins/security_solution/server/lib/detection_engine/routes/index/get_signals_template';
@ -63,7 +63,7 @@ export default ({ getService }: FtrProviderContext) => {
          query: `_id:${ID}`,
        };
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsByIds(supertest, [id]);
        expect(signalsOpen.hits.hits.length).greaterThan(0);
@ -75,7 +75,7 @@ export default ({ getService }: FtrProviderContext) => {
          query: `_id:${ID}`,
        };
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsByIds(supertest, [id]);
        expect(signalsOpen.hits.hits[0]._source.signal.rule.rule_id).eql(getSimpleRule().rule_id);
@ -87,7 +87,7 @@ export default ({ getService }: FtrProviderContext) => {
          query: `_id:${ID}`,
        };
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsByIds(supertest, [id]);
        // remove rule to cut down on touch points for test changes when the rule format changes
@ -136,7 +136,7 @@ export default ({ getService }: FtrProviderContext) => {
          query: `_id:${ID}`,
        };
        const { id: createdId } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, createdId);
+        await waitForRuleSuccessOrStatus(supertest, createdId);
        await waitForSignalsToBePresent(supertest, 1, [createdId]);

        // Run signals on top of that 1 signal which should create a single signal (on top of) a signal
@ -146,7 +146,7 @@ export default ({ getService }: FtrProviderContext) => {
        };

        const { id } = await createRule(supertest, ruleForSignals);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);

        // Get our single signal on top of a signal
@ -212,7 +212,7 @@ export default ({ getService }: FtrProviderContext) => {
            query: 'sequence by host.name [any where true] [any where true]',
          };
          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signals = await getSignalsByRuleIds(supertest, ['eql-rule']);
          const signal = signals.hits.hits[0]._source.signal;
@ -267,7 +267,7 @@ export default ({ getService }: FtrProviderContext) => {
            query: 'sequence by host.name [any where true] [any where true]',
          };
          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsByRuleIds(supertest, ['eql-rule']);
          const sequenceSignal = signalsOpen.hits.hits.find(
@ -355,7 +355,7 @@ export default ({ getService }: FtrProviderContext) => {
        };

        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsByIds(supertest, [id]);
        expect(signalsOpen.hits.hits.length).greaterThan(0);
@ -368,7 +368,7 @@ export default ({ getService }: FtrProviderContext) => {
        };

        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsByIds(supertest, [id]);
        expect(signalsOpen.hits.hits[0]._source.signal.rule.rule_id).eql(getSimpleRule().rule_id);
@ -380,7 +380,7 @@ export default ({ getService }: FtrProviderContext) => {
          query: '_id:1',
        };
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsByIds(supertest, [id]);
        // remove rule to cut down on touch points for test changes when the rule format changes
@ -424,7 +424,7 @@ export default ({ getService }: FtrProviderContext) => {
          query: '_id:1',
        };
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);

        // Run signals on top of that 1 signal which should create a single signal (on top of) a signal
@ -433,7 +433,7 @@ export default ({ getService }: FtrProviderContext) => {
          rule_id: 'signal-on-signal',
        };
        const { id: createdId } = await createRule(supertest, ruleForSignals);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [createdId]);

        // Get our single signal on top of a signal
@ -508,7 +508,7 @@ export default ({ getService }: FtrProviderContext) => {
          query: '_id:1',
        };
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsByIds(supertest, [id]);
        expect(signalsOpen.hits.hits.length).greaterThan(0);
@ -520,7 +520,7 @@ export default ({ getService }: FtrProviderContext) => {
          query: '_id:1',
        };
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsByIds(supertest, [id]);
        expect(signalsOpen.hits.hits[0]._source.signal.rule.rule_id).eql(getSimpleRule().rule_id);
@ -532,7 +532,7 @@ export default ({ getService }: FtrProviderContext) => {
          query: '_id:1',
        };
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);
        const signalsOpen = await getSignalsByIds(supertest, [id]);
        // remove rule to cut down on touch points for test changes when the rule format changes
@ -582,7 +582,7 @@ export default ({ getService }: FtrProviderContext) => {
          query: '_id:1',
        };
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 1, [id]);

        // Run signals on top of that 1 signal which should create a single signal (on top of) a signal
@ -591,7 +591,7 @@ export default ({ getService }: FtrProviderContext) => {
          rule_id: 'signal-on-signal',
        };
        const { id: createdId } = await createRule(supertest, ruleForSignals);
-        await waitForRuleSuccess(supertest, createdId);
+        await waitForRuleSuccessOrStatus(supertest, createdId);
        await waitForSignalsToBePresent(supertest, 1, [createdId]);

        // Get our single signal on top of a signal
@ -661,7 +661,7 @@ export default ({ getService }: FtrProviderContext) => {

      const executeRuleAndGetSignals = async (rule: QueryCreateSchema) => {
        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccess(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, id);
        await waitForSignalsToBePresent(supertest, 4, [id]);
        const signalsResponse = await getSignalsByIds(supertest, [id]);
        const signals = signalsResponse.hits.hits.map((hit) => hit._source);
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/open_close_signals.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/open_close_signals.ts
@ -23,7 +23,7 @@ import {
  createRule,
  waitForSignalsToBePresent,
  getSignalsByIds,
-  waitForRuleSuccess,
+  waitForRuleSuccessOrStatus,
  getRuleForSignalTesting,
 } from '../../utils';
 import { createUserAndRole } from '../roles_users_utils';
@ -82,7 +82,7 @@ export default ({ getService }: FtrProviderContext) => {
        it('should be able to execute and get 10 signals', async () => {
          const rule = getRuleForSignalTesting(['auditbeat-*']);
          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 10, [id]);
          const signalsOpen = await getSignalsByIds(supertest, [id]);
          expect(signalsOpen.hits.hits.length).equal(10);
@ -91,7 +91,7 @@ export default ({ getService }: FtrProviderContext) => {
        it('should be have set the signals in an open state initially', async () => {
          const rule = getRuleForSignalTesting(['auditbeat-*']);
          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 10, [id]);
          const signalsOpen = await getSignalsByIds(supertest, [id]);
          const everySignalOpen = signalsOpen.hits.hits.every(
@ -107,7 +107,7 @@ export default ({ getService }: FtrProviderContext) => {
        it('should be able to get a count of 10 closed signals when closing 10', async () => {
          const rule = getRuleForSignalTesting(['auditbeat-*']);
          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 10, [id]);
          const signalsOpen = await getSignalsByIds(supertest, [id]);
          const signalIds = signalsOpen.hits.hits.map((signal) => signal._id);
@ -134,7 +134,7 @@ export default ({ getService }: FtrProviderContext) => {
        it('should be able close signals immediately and they all should be closed', async () => {
          const rule = getRuleForSignalTesting(['auditbeat-*']);
          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const signalsOpen = await getSignalsByIds(supertest, [id]);
          const signalIds = signalsOpen.hits.hits.map((signal) => signal._id);
@ -169,7 +169,7 @@ export default ({ getService }: FtrProviderContext) => {
        it('should NOT be able to close signals with t1 analyst user', async () => {
          const rule = getRuleForSignalTesting(['auditbeat-*']);
          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          await createUserAndRole(securityService, ROLES.t1_analyst);
          const signalsOpen = await getSignalsByIds(supertest, [id]);
@ -207,7 +207,7 @@ export default ({ getService }: FtrProviderContext) => {
        it('should be able to close signals with soc_manager user', async () => {
          const rule = getRuleForSignalTesting(['auditbeat-*']);
          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccess(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, id);
          await waitForSignalsToBePresent(supertest, 1, [id]);
          const userAndRole = ROLES.soc_manager;
          await createUserAndRole(securityService, userAndRole);
--- a/x-pack/test/detection_engine_api_integration/utils.ts
+++ b/x-pack/test/detection_engine_api_integration/utils.ts
@ -119,6 +119,25 @@ export const getRuleForSignalTesting = (
  from: '1900-01-01T00:00:00.000Z',
 });

+export const getRuleForSignalTestingWithTimestampOverride = (
+  index: string[],
+  ruleId = 'rule-1',
+  enabled = true,
+  timestampOverride = 'event.ingested'
+): QueryCreateSchema => ({
+  name: 'Signal Testing Query',
+  description: 'Tests a simple query',
+  enabled,
+  risk_score: 1,
+  rule_id: ruleId,
+  severity: 'high',
+  index,
+  type: 'query',
+  query: '*:*',
+  timestamp_override: timestampOverride,
+  from: '1900-01-01T00:00:00.000Z',
+});
+
 /**
 * This is a typical simple rule for testing that is easy for most basic testing
 * @param ruleId The rule id
@ -864,21 +883,22 @@ export const getRule = async (
 };

 /**
- * Waits for the rule in find status to be succeeded before continuing
+ * Waits for the rule in find status to be 'succeeded'
+ * or the provided status, before continuing
 * @param supertest Deps
 */
-export const waitForRuleSuccess = async (
+export const waitForRuleSuccessOrStatus = async (
  supertest: SuperTest<supertestAsPromised.Test>,
-  id: string
+  id: string,
+  status: 'succeeded' | 'failed' | 'partial failure' = 'succeeded'
 ): Promise<void> => {
-  // wait for Task Manager to finish executing the rule
  await waitFor(async () => {
    const { body } = await supertest
      .post(`${DETECTION_ENGINE_RULES_URL}/_find_statuses`)
      .set('kbn-xsrf', 'true')
      .send({ ids: [id] })
      .expect(200);
-    return body[id]?.current_status?.status === 'succeeded';
+    return body[id]?.current_status?.status === status;
  }, 'waitForRuleSuccess');
 };

--- a/x-pack/test/functional/es_archives/security_solution/timestamp_override/data.json.gz
+++ b/x-pack/test/functional/es_archives/security_solution/timestamp_override/data.json.gz
--- a/x-pack/test/functional/es_archives/security_solution/timestamp_override/mappings.json
+++ b/x-pack/test/functional/es_archives/security_solution/timestamp_override/mappings.json
@ -0,0 +1,19 @@
+{
+    "type": "index",
+    "value": {
+        "index": "myfakeindex-1",
+        "mappings" : {
+            "properties" : {
+              "message" : {
+                "type" : "text",
+                "fields" : {
+                  "keyword" : {
+                    "type" : "keyword",
+                    "ignore_above" : 256
+                  }
+                }
+              }
+            }
+          }
+    }
+}