[Failing Test] Fixes intermittent failures in audit log integration tests

[jeramysoucy]

resolves #119267

Summary

As discussed in the issue, we believed the issue to be timing between file write and read, however this is not the case. I found that two 'saved_object_find' events were being logged - the expected user one (for a 'dashboard'), and one by the fleet app (for 'epm-packages'). Should the 'epm-packages' event get logged before the 'dashboard' event, the test fails because the first 'saved_object_find' event it finds does not contain the expected user data in the audit. This appears to happen much less frequently in CI than locally for whatever reason.

Fix

I have added additional criteria when looking for the 'saved_object_find' event so it will only find an event for a 'dashboard' object.

Testing

Flaky Test Runner: https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/2150

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[thomheymann]

LGTM!

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: a2a6df4

Metrics [docs]

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
securitySolution	394	397	+3

Total ESLint disabled count

id	before	after	diff
securitySolution	474	477	+3

History

• 💚 Build #121254 succeeded 080f6f6
• 💚 Build #119896 succeeded 9bbb5c7

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream