Closes #161758 ## Summary In this PR, I am saving the groupings information for the new threshold in AAD in a similar format as the security team does, you can check the format in the following screenshots. (Please check this [RFC](https://docs.google.com/document/d/1DlykydM8Hk7-VAPOcuoUXp0L_qSi2jCZabJkPdO44tQ/edit#heading=h.2b1v1tr0ep8m) for more information) ### Alert as data document 
This requires separate test servers and test runners.
Basic
# Start server
node scripts/functional_tests_server --config x-pack/test/observability_api_integration/basic/config.ts
# Run tests
node scripts/functional_test_runner --config x-pack/test/observability_api_integration/basic/config.ts
The API tests for "basic" are located in x-pack/test/observability_api_integration/basic/tests
.
Trial
# Start server
node scripts/functional_tests_server --config x-pack/test/observability_api_integration/trial/config.ts
# Run tests
node scripts/functional_test_runner --config x-pack/test/observability_api_integration/trial/config.ts
The API tests for "trial" are located in x-pack/test/observability_api_integration/trial/tests
.
API test tips
- For debugging access Elasticsearch on http://localhost:9220` (elastic/changeme)
- To update snapshots append
--updateSnapshots
to the functional_test_runner command