diff --git a/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_automated_action_results.cy.ts b/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_automated_action_results.cy.ts
index 6afbecdaba689..a11e9e49f8e77 100644
--- a/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_automated_action_results.cy.ts
+++ b/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_automated_action_results.cy.ts
@@ -7,115 +7,123 @@
 
 import { initializeDataViews } from '../../tasks/login';
 import { cleanupRule, loadRule } from '../../tasks/api_fixtures';
-import { checkActionItemsInResults, loadRuleAlerts } from '../../tasks/live_query';
+import { checkActionItemsInResults, loadRuleAlerts, navigateToRule } from '../../tasks/live_query';
 
 const UUID_REGEX = '[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}';
 
-// Failing: See https://github.com/elastic/kibana/issues/197335
-// Failing: See https://github.com/elastic/kibana/issues/197328
-// Failing: See https://github.com/elastic/kibana/issues/178404
-describe.skip('Alert Flyout Automated Action Results', () => {
-  let ruleId: string;
+describe(
+  'Alert Flyout Automated Action Results',
+  { tags: ['@ess', '@serverless', '@skipInServerlessMKI'] },
+  () => {
+    let ruleId: string;
+    let ruleName: string;
 
-  before(() => {
-    initializeDataViews();
-  });
-
-  beforeEach(() => {
-    loadRule(true).then((data) => {
-      ruleId = data.id;
-      loadRuleAlerts(data.name);
+    before(() => {
+      initializeDataViews();
+      loadRule(true).then((data) => {
+        ruleId = data.id;
+        ruleName = data.name;
+        loadRuleAlerts(ruleName);
+      });
     });
-  });
 
-  afterEach(() => {
-    cleanupRule(ruleId);
-  });
+    beforeEach(() => {
+      navigateToRule(ruleName);
+    });
 
-  it('can visit discover from response action results', { tags: ['@ess'] }, () => {
-    const discoverRegex = new RegExp(`action_id: ${UUID_REGEX}`);
-    cy.getBySel('expand-event').first().click();
-    cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
-    cy.getBySel('securitySolutionFlyoutResponseButton').click();
-    cy.getBySel('responseActionsViewWrapper').should('exist');
-    checkActionItemsInResults({
-      lens: true,
-      discover: true,
-      cases: true,
-      timeline: true,
+    after(() => {
+      cleanupRule(ruleId);
     });
-    cy.contains('View in Discover')
-      .should('exist')
-      .should('have.attr', 'href')
-      .then(($href) => {
-        // @ts-expect-error-next-line href string - check types
-        cy.visit($href);
-        cy.getBySel('discoverDocTable', { timeout: 60000 }).within(() => {
-          cy.contains('action_data{ "query":');
-        });
-        cy.contains(discoverRegex);
-      });
-  });
 
-  it('can visit lens from response action results', { tags: ['@ess'] }, () => {
-    const lensRegex = new RegExp(`Action ${UUID_REGEX} results`);
-    cy.getBySel('expand-event').first().click();
-    cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
-    cy.getBySel('securitySolutionFlyoutResponseButton').click();
-    cy.getBySel('responseActionsViewWrapper').should('exist');
-    checkActionItemsInResults({
-      lens: true,
-      discover: true,
-      cases: true,
-      timeline: true,
+    it('can visit discover from response action results', { tags: ['@ess'] }, () => {
+      const discoverRegex = new RegExp(`action_id: ${UUID_REGEX}`);
+      cy.getBySel('expand-event').first().click();
+      cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
+      cy.getBySel('securitySolutionFlyoutResponseButton').click();
+      cy.getBySel('responseActionsViewWrapper').should('exist');
+      checkActionItemsInResults({
+        lens: true,
+        discover: true,
+        cases: true,
+        timeline: true,
+      });
+      cy.contains('View in Discover')
+        .should('exist')
+        .should('have.attr', 'href')
+        .then(($href) => {
+          // @ts-expect-error-next-line href string - check types
+          cy.visit($href);
+          cy.getBySel('discoverDocTable', { timeout: 60000 }).within(() => {
+            cy.contains(/action_data\{[^}]*"query":[^}]*\}/);
+          });
+          cy.contains(discoverRegex);
+        });
     });
-    cy.getBySel('osquery-results-comment')
-      .first()
-      .within(() => {
-        let lensUrl = '';
-        cy.window().then((win) => {
-          cy.stub(win, 'open')
-            .as('windowOpen')
-            .callsFake((url) => {
-              lensUrl = url;
+
+    it('can visit lens from response action results', { tags: ['@ess'] }, () => {
+      const lensRegex = new RegExp(`Action ${UUID_REGEX} results`);
+      cy.getBySel('expand-event').first().click();
+      cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
+      cy.getBySel('securitySolutionFlyoutResponseButton').click();
+      cy.getBySel('responseActionsViewWrapper').should('exist');
+      checkActionItemsInResults({
+        lens: true,
+        discover: true,
+        cases: true,
+        timeline: true,
+      });
+      cy.getBySel('osquery-results-comment')
+        .first()
+        .within(() => {
+          let lensUrl = '';
+          cy.window().then((win) => {
+            cy.stub(win, 'open')
+              .as('windowOpen')
+              .callsFake((url) => {
+                lensUrl = url;
+              });
+          });
+          cy.get(`[aria-label="View in Lens"]`).click();
+          cy.window()
+            .its('open')
+            .then(() => {
+              cy.visit(lensUrl);
             });
         });
-        cy.get(`[aria-label="View in Lens"]`).click();
-        cy.window()
-          .its('open')
-          .then(() => {
-            cy.visit(lensUrl);
-          });
-      });
-    cy.getBySel('lnsWorkspace').should('exist');
-    cy.getBySel('breadcrumbs').contains(lensRegex);
-  });
-
-  it('can add to timeline from response action results', { tags: ['@ess', '@serverless'] }, () => {
-    const timelineRegex = new RegExp(`Added ${UUID_REGEX} to timeline`);
-    const filterRegex = new RegExp(`action_id: "${UUID_REGEX}"`);
-    cy.getBySel('expand-event').first().click();
-    cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
-    cy.getBySel('securitySolutionFlyoutResponseButton').click();
-    cy.getBySel('responseActionsViewWrapper').should('exist');
-    checkActionItemsInResults({
-      lens: true,
-      discover: true,
-      cases: true,
-      timeline: true,
+      cy.getBySel('lnsWorkspace').should('exist');
+      cy.getBySel('breadcrumbs').contains(lensRegex);
     });
-    cy.getBySel('osquery-results-comment')
-      .first()
-      .within(() => {
-        cy.get('.euiTableRow')
+
+    it(
+      'can add to timeline from response action results',
+      { tags: ['@ess', '@serverless'] },
+      () => {
+        const timelineRegex = new RegExp(`Added ${UUID_REGEX} to timeline`);
+        const filterRegex = new RegExp(`action_id: "${UUID_REGEX}"`);
+        cy.getBySel('expand-event').first().click();
+        cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
+        cy.getBySel('securitySolutionFlyoutResponseButton').click();
+        cy.getBySel('responseActionsViewWrapper').should('exist');
+        checkActionItemsInResults({
+          lens: true,
+          discover: true,
+          cases: true,
+          timeline: true,
+        });
+        cy.getBySel('osquery-results-comment')
           .first()
           .within(() => {
-            cy.getBySel('add-to-timeline').click();
+            cy.get('.euiTableRow')
+              .first()
+              .within(() => {
+                cy.getBySel('add-to-timeline').click();
+              });
           });
-      });
-    cy.contains(timelineRegex);
-    cy.getBySel('securitySolutionFlyoutNavigationCollapseDetailButton').click();
-    cy.getBySel('timeline-bottom-bar').contains('Untitled timeline').click();
-    cy.contains(filterRegex);
-  });
-});
+        cy.contains(timelineRegex);
+        cy.getBySel('securitySolutionFlyoutNavigationCollapseDetailButton').click();
+        cy.getBySel('timeline-bottom-bar').contains('Untitled timeline').click();
+        cy.contains(filterRegex);
+      }
+    );
+  }
+);
diff --git a/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_cases.cy.ts b/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_cases.cy.ts
index 550e68b40b1de..1b3cd0541580b 100644
--- a/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_cases.cy.ts
+++ b/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_cases.cy.ts
@@ -25,111 +25,118 @@ import {
 } from '../../tasks/live_query';
 import { generateRandomStringName, interceptCaseId } from '../../tasks/integrations';
 
-describe('Alert Event Details - Cases', { tags: ['@ess', '@serverless'] }, () => {
-  let ruleId: string;
-  let packId: string;
-  let packName: string;
-  const packData = packFixture();
+// Failing: See https://github.com/elastic/kibana/issues/197151
+describe.skip(
+  'Alert Event Details - Cases',
+  { tags: ['@ess', '@serverless', '@skipInServerlessMKI'] },
+  () => {
+    let ruleId: string;
+    let packId: string;
+    let packName: string;
+    const packData = packFixture();
 
-  beforeEach(() => {
-    initializeDataViews();
-    loadPack(packData).then((data) => {
-      packId = data.saved_object_id;
-      packName = data.name;
-    });
-    loadRule(true).then((data) => {
-      ruleId = data.id;
-      loadRuleAlerts(data.name);
+    beforeEach(() => {
+      initializeDataViews();
+      loadPack(packData).then((data) => {
+        packId = data.saved_object_id;
+        packName = data.name;
+      });
+      loadRule(true).then((data) => {
+        ruleId = data.id;
+        loadRuleAlerts(data.name);
+      });
     });
-  });
 
-  afterEach(() => {
-    cleanupPack(packId);
-    cleanupRule(ruleId);
-  });
+    afterEach(() => {
+      cleanupPack(packId);
+      cleanupRule(ruleId);
+    });
 
-  describe('Case creation', () => {
-    let caseId: string;
+    describe('Case creation', () => {
+      let caseId: string;
 
-    before(() => {
-      interceptCaseId((id) => {
-        caseId = id;
+      before(() => {
+        interceptCaseId((id) => {
+          caseId = id;
+        });
       });
-    });
 
-    after(() => {
-      cleanupCase(caseId);
-    });
+      after(() => {
+        cleanupCase(caseId);
+      });
 
-    it('runs osquery against alert and creates a new case', () => {
-      const [caseName, caseDescription] = generateRandomStringName(2);
-      cy.getBySel('expand-event').first().click();
-      cy.getBySel('securitySolutionFlyoutFooterDropdownButton').click();
-      cy.getBySel('osquery-action-item').click();
-      cy.contains(/^\d+ agen(t|ts) selected/);
-      cy.getBySel('globalLoadingIndicator').should('not.exist');
-      cy.wait(1000);
-      cy.contains('Run a set of queries in a pack').click();
-      cy.get(OSQUERY_FLYOUT_BODY_EDITOR).should('not.exist');
-      cy.getBySel('globalLoadingIndicator').should('not.exist');
-      cy.getBySel('select-live-pack').click().type(`${packName}{downArrow}{enter}`);
-      submitQuery();
-      cy.get('[aria-label="Add to Case"]').first().click();
-      cy.getBySel('cases-table-add-case-filter-bar').click();
-      cy.getBySel('create-case-flyout').should('be.visible');
-      cy.get('input[aria-describedby="caseTitle"]').type(caseName);
-      cy.get('textarea[aria-label="caseDescription"]').type(caseDescription);
-      cy.getBySel('create-case-submit').click();
-      cy.contains(`An alert was added to "${caseName}"`);
+      it('runs osquery against alert and creates a new case', () => {
+        const [caseName, caseDescription] = generateRandomStringName(2);
+        cy.getBySel('expand-event').first().click();
+        cy.getBySel('securitySolutionFlyoutFooterDropdownButton').click();
+        cy.getBySel('osquery-action-item').click();
+        cy.contains(/^\d+ agen(t|ts) selected/);
+        cy.getBySel('globalLoadingIndicator').should('not.exist');
+        cy.wait(1000);
+        cy.contains('Run a set of queries in a pack').click();
+        cy.get(OSQUERY_FLYOUT_BODY_EDITOR).should('not.exist');
+        cy.getBySel('globalLoadingIndicator').should('not.exist');
+        cy.getBySel('select-live-pack').click().type(`${packName}{downArrow}{enter}`);
+        submitQuery();
+        cy.get('[aria-label="Add to Case"]').first().click();
+        cy.getBySel('cases-table-add-case-filter-bar').click();
+        cy.getBySel('create-case-flyout').should('be.visible');
+        cy.get('input[aria-describedby="caseTitle"]').type(caseName);
+        cy.get('textarea[aria-label="caseDescription"]').type(caseDescription);
+        cy.getBySel('create-case-submit').click();
+        cy.contains(`An alert was added to "${caseName}"`);
+      });
     });
-  });
 
-  // FLAKY: https://github.com/elastic/kibana/issues/176783
-  describe.skip('Case', () => {
-    let caseId: string;
+    describe('Case', () => {
+      let caseId: string;
 
-    beforeEach(() => {
-      loadCase('securitySolution').then((data) => {
-        caseId = data.id;
+      beforeEach(() => {
+        loadCase('securitySolution').then((data) => {
+          caseId = data.id;
+        });
       });
-    });
 
-    afterEach(() => {
-      cleanupCase(caseId);
-    });
+      afterEach(() => {
+        cleanupCase(caseId);
+      });
 
-    it('sees osquery results from last action and add to a case', () => {
-      cy.getBySel('expand-event').first().click();
-      cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
-      cy.getBySel('securitySolutionFlyoutResponseButton').click();
-      cy.getBySel('responseActionsViewWrapper').should('exist');
-      cy.contains('select * from users;');
-      cy.contains("SELECT * FROM os_version where name='Ubuntu';");
-      cy.getBySel('osquery-results-comment').each(($comment) => {
-        cy.wrap($comment).within(() => {
-          // On initial load result table might not render due to displayed error
-          if ($comment.find('div .euiDataGridRow').length <= 0) {
-            // If tabs are present try clicking between status and results to get rid of the error message
-            if ($comment.find('div .euiTabs').length > 0) {
-              cy.getBySel('osquery-status-tab').click();
-              cy.getBySel('osquery-results-tab').click();
+      it('sees osquery results from last action and add to a case', () => {
+        cy.getBySel('expand-event').first().click();
+        cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
+        cy.getBySel('securitySolutionFlyoutResponseButton').click();
+        cy.getBySel('responseActionsViewWrapper').should('exist');
+        cy.contains('select * from users;');
+        cy.contains("SELECT * FROM os_version where name='Ubuntu';");
+        cy.getBySel('osquery-results-comment').each(($comment) => {
+          cy.wrap($comment).within(() => {
+            // On initial load result table might not render due to displayed error
+            if ($comment.find('div .euiDataGridRow').length <= 0) {
+              // If tabs are present try clicking between status and results to get rid of the error message
+              if ($comment.find('div .euiTabs').length > 0) {
+                cy.getBySel('osquery-status-tab').click();
+                cy.getBySel('osquery-results-tab').click();
+                cy.getBySel('dataGridRowCell', { timeout: 120000 }).should(
+                  'have.lengthOf.above',
+                  0
+                );
+              }
+            } else {
+              // Result tab was rendered successfully
               cy.getBySel('dataGridRowCell', { timeout: 120000 }).should('have.lengthOf.above', 0);
             }
-          } else {
-            // Result tab was rendered successfully
-            cy.getBySel('dataGridRowCell', { timeout: 120000 }).should('have.lengthOf.above', 0);
-          }
+          });
+        });
+        checkActionItemsInResults({
+          lens: true,
+          discover: true,
+          cases: true,
+          timeline: true,
         });
-      });
-      checkActionItemsInResults({
-        lens: true,
-        discover: true,
-        cases: true,
-        timeline: true,
-      });
 
-      addToCase(caseId);
-      viewRecentCaseAndCheckResults();
+        addToCase(caseId);
+        viewRecentCaseAndCheckResults();
+      });
     });
-  });
-});
+  }
+);
diff --git a/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_linked_apps.cy.ts b/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_linked_apps.cy.ts
index 6ea1acfebabce..326ec97ef754c 100644
--- a/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_linked_apps.cy.ts
+++ b/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_linked_apps.cy.ts
@@ -16,10 +16,8 @@ import {
   submitQuery,
 } from '../../tasks/live_query';
 import { closeModalIfVisible, closeToastIfVisible } from '../../tasks/integrations';
-import { RESULTS_TABLE, RESULTS_TABLE_BUTTON } from '../../screens/live_query';
 
-// Failing: See https://github.com/elastic/kibana/issues/181889
-describe.skip(
+describe(
   'Alert Event Details',
   {
     tags: ['@ess', '@serverless', '@skipInServerlessMKI'],
@@ -76,17 +74,17 @@ describe.skip(
       submitQuery();
       checkResults();
       cy.contains('Add to timeline investigation');
-      cy.contains('Save for later').click();
-      cy.contains('Save query');
-      cy.get('[data-test-subj="osquery-save-query-flyout"]').within(() => {
-        cy.get('.euiButtonEmpty').contains('Cancel').click();
-      });
+      // cy.contains('Save for later').click();
+      // cy.contains('Save query');
+      // cy.get('[data-test-subj="osquery-save-query-flyout"]').within(() => {
+      //   cy.get('.euiButtonEmpty').contains('Cancel').click();
+      // });
       cy.getBySel('add-to-timeline').first().click();
       cy.getBySel('globalToastList').contains('Added');
       closeToastIfVisible();
-      cy.getBySel(RESULTS_TABLE).within(() => {
-        cy.getBySel(RESULTS_TABLE_BUTTON).should('not.exist');
-      });
+      // cy.getBySel(RESULTS_TABLE).within(() => {
+      //   cy.getBySel(RESULTS_TABLE_BUTTON).should('not.exist');
+      // });
       cy.contains('Cancel').click();
       cy.getBySel('timeline-bottom-bar').within(() => {
         cy.contains(TIMELINE_NAME).click();
diff --git a/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_response_actions_form.cy.ts b/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_response_actions_form.cy.ts
index 4d8a83d8d6b5f..a23151b0d78d3 100644
--- a/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_response_actions_form.cy.ts
+++ b/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_response_actions_form.cy.ts
@@ -24,10 +24,9 @@ import {
 import { clickRuleName, inputQuery, typeInECSFieldInput } from '../../tasks/live_query';
 import { closeDateTabIfVisible, closeToastIfVisible } from '../../tasks/integrations';
 
-// FLAKY: https://github.com/elastic/kibana/issues/169785
-describe.skip(
+describe(
   'Alert Event Details - Response Actions Form',
-  { tags: ['@ess', '@serverless'] },
+  { tags: ['@ess', '@serverless', '@skipInServerlessMKI'] },
   () => {
     let multiQueryPackId: string;
     let multiQueryPackName: string;
diff --git a/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/ecs_mappings.cy.ts b/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/ecs_mappings.cy.ts
index d6f9f1a9fe4fd..4bafc3d173156 100644
--- a/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/ecs_mappings.cy.ts
+++ b/x-pack/platform/plugins/shared/osquery/cypress/e2e/all/ecs_mappings.cy.ts
@@ -18,8 +18,7 @@ import {
   typeInOsqueryFieldInput,
 } from '../../tasks/live_query';
 
-// Failing: See https://github.com/elastic/kibana/issues/192128
-describe.skip('EcsMapping', { tags: ['@ess', '@serverless', '@skipInServerlessMKI'] }, () => {
+describe('EcsMapping', { tags: ['@ess', '@serverless', '@skipInServerlessMKI'] }, () => {
   beforeEach(() => {
     initializeDataViews();
   });
diff --git a/x-pack/platform/plugins/shared/osquery/cypress/support/project_controller_osquery_roles.yml b/x-pack/platform/plugins/shared/osquery/cypress/support/project_controller_osquery_roles.yml
index 30c7ad430efbc..00a42aa6d7850 100644
--- a/x-pack/platform/plugins/shared/osquery/cypress/support/project_controller_osquery_roles.yml
+++ b/x-pack/platform/plugins/shared/osquery/cypress/support/project_controller_osquery_roles.yml
@@ -1,5 +1,8 @@
 # add more functionalities just for ESS environment
 soc_manager:
+  indices:
+    - names: [ '.items-default*', '.lists-default*' ]
+      privileges: [ 'manage', 'read', 'write' ]
   applications:
     - application: "kibana-.kibana"
       privileges:
diff --git a/x-pack/platform/plugins/shared/osquery/cypress/tasks/live_query.ts b/x-pack/platform/plugins/shared/osquery/cypress/tasks/live_query.ts
index 910427272c5ff..ac5625c0532e0 100644
--- a/x-pack/platform/plugins/shared/osquery/cypress/tasks/live_query.ts
+++ b/x-pack/platform/plugins/shared/osquery/cypress/tasks/live_query.ts
@@ -8,7 +8,11 @@
 import { waitForAlertsToPopulate } from '@kbn/test-suites-xpack/security_solution_cypress/cypress/tasks/create_new_rule';
 import { disableNewFeaturesTours } from './navigation';
 import { getAdvancedButton } from '../screens/integrations';
-import { LIVE_QUERY_EDITOR, OSQUERY_FLYOUT_BODY_EDITOR } from '../screens/live_query';
+import {
+  LIVE_QUERY_EDITOR,
+  OSQUERY_FLYOUT_BODY_EDITOR,
+  RESULTS_TABLE,
+} from '../screens/live_query';
 import { ServerlessRoleName } from '../support/roles';
 
 export const DEFAULT_QUERY = 'select * from processes;';
@@ -58,13 +62,13 @@ export const verifyQueryTimeout = (timeout: string) => {
 
 // sometimes the results get stuck in the tests, this is a workaround
 export const checkResults = () => {
-  cy.getBySel('osqueryResultsTable', { timeout: 120000 }).then(($table) => {
+  cy.getBySel(RESULTS_TABLE, { timeout: 240000 }).then(($table) => {
     if ($table.find('div .euiDataGridRow').length > 0) {
-      cy.getBySel('dataGridRowCell', { timeout: 120000 }).should('have.lengthOf.above', 0);
+      cy.getBySel('dataGridRowCell', { timeout: 240000 }).should('have.lengthOf.above', 0);
     } else {
-      cy.getBySel('osquery-status-tab').click();
-      cy.getBySel('osquery-results-tab').click();
-      cy.getBySel('dataGridRowCell', { timeout: 120000 }).should('have.lengthOf.above', 0);
+      cy.getBySel('osquery-status-tab').click({ multiple: true });
+      cy.getBySel('osquery-results-tab').click({ multiple: true });
+      cy.getBySel('dataGridRowCell', { timeout: 240000 }).should('have.lengthOf.above', 0);
     }
   });
 };
@@ -117,7 +121,7 @@ export const toggleRuleOffAndOn = (ruleName: string) => {
     });
 };
 
-export const loadRuleAlerts = (ruleName: string) => {
+export const navigateToRule = (ruleName: string) => {
   cy.login(ServerlessRoleName.SOC_MANAGER, false);
   cy.visit('/app/security/rules', {
     onBeforeLoad: (win) => disableNewFeaturesTours(win),
@@ -126,6 +130,12 @@ export const loadRuleAlerts = (ruleName: string) => {
   waitForAlertsToPopulate();
 };
 
+export const loadRuleAlerts = (ruleName: string) => {
+  navigateToRule(ruleName);
+  cy.getBySel('ruleSwitch').should('have.attr', 'aria-checked', 'true');
+  cy.getBySel('ruleSwitch').click();
+};
+
 export const addToCase = (caseId: string) => {
   cy.contains('Add to Case').click();
   cy.contains('Select case');
diff --git a/x-pack/platform/plugins/shared/osquery/cypress/tasks/wait_until.ts b/x-pack/platform/plugins/shared/osquery/cypress/tasks/wait_until.ts
index 361a371865dcb..bbc6fb02a5b64 100644
--- a/x-pack/platform/plugins/shared/osquery/cypress/tasks/wait_until.ts
+++ b/x-pack/platform/plugins/shared/osquery/cypress/tasks/wait_until.ts
@@ -6,7 +6,7 @@
  */
 
 export const waitUntil = (fn: () => Cypress.Chainable) => {
-  const timeout = 120000;
+  const timeout = 240000;
   const interval = 5000;
   let attempts = timeout / interval;