From 5dd72ed319043a211fd788b63cd66abd9ba8b024 Mon Sep 17 00:00:00 2001
From: Georgii Gorbachev <georgii.gorbachev@elastic.co>
Date: Mon, 18 Aug 2025 18:57:40 +0200
Subject: [PATCH] [Security Solution] Unskip Cypress tests for rule execution
 log (#232023)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

**Partially addresses: https://github.com/elastic/kibana/issues/229688**
**Resolves: https://github.com/elastic/kibana/issues/184360**

## Summary

This PR fixes and unskips the following tests:

-
`x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/rule_details/execution_log.cy.ts`

## Flaky test runs

- [100x ESS + 100x
Serverless](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/9162)
🟢

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

(cherry picked from commit c09e281c9ff08a96773b9d1fe59697a8fde7cbe7)
---
 .../rule_details/execution_log.cy.ts          | 30 ++++++++++++++-----
 .../cypress/tasks/api_calls/backfill.ts       |  3 +-
 2 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/rule_details/execution_log.cy.ts b/x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/rule_details/execution_log.cy.ts
index 6906ffb901e1b..572237426a75b 100644
--- a/x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/rule_details/execution_log.cy.ts
+++ b/x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/rule_details/execution_log.cy.ts
@@ -12,19 +12,17 @@ import { login } from '../../../../tasks/login';
 import { visit } from '../../../../tasks/navigation';
 import { ruleDetailsUrl } from '../../../../urls/rule_details';
 import { createRule } from '../../../../tasks/api_calls/rules';
-import { waitForAlertsToPopulate } from '../../../../tasks/create_new_rule';
 import {
   goToExecutionLogTab,
   getExecutionLogTableRow,
   refreshRuleExecutionTable,
   filterByRunType,
 } from '../../../../tasks/rule_details';
-import { getNewRule } from '../../../../objects/rule';
+import { getCustomQueryRuleParams } from '../../../../objects/rule';
 import { EXECUTION_SHOWING } from '../../../../screens/rule_details';
 import { manualRuleRun } from '../../../../tasks/api_calls/backfill';
 
-// FLAKY: https://github.com/elastic/kibana/issues/184360
-describe.skip(
+describe(
   'Event log',
   {
     tags: ['@ess', '@serverless'],
@@ -38,7 +36,9 @@ describe.skip(
       login();
       deleteAlertsAndRules();
       createRule({
-        ...getNewRule(),
+        ...getCustomQueryRuleParams({
+          enabled: true,
+        }),
       }).then((rule) => {
         cy.wrap(rule.body.id).as('ruleId');
       });
@@ -46,11 +46,23 @@ describe.skip(
 
     it('should display the execution log', function () {
       visit(ruleDetailsUrl(this.ruleId));
-      waitForAlertsToPopulate();
       goToExecutionLogTab();
 
+      cy.waitUntil(
+        () => {
+          cy.log('Waiting for execution logs to appear in execution log table');
+          refreshRuleExecutionTable();
+          return getExecutionLogTableRow().then((rows) => {
+            return rows.length > 0;
+          });
+        },
+        { interval: 5000, timeout: 20000 }
+      );
+
       cy.get(EXECUTION_SHOWING).contains('Showing 1 rule execution');
       getExecutionLogTableRow().should('have.length', 1);
+
+      cy.log('Scheduling a manual rule run');
       manualRuleRun({
         ruleId: this.ruleId,
         start: moment().subtract(5, 'm').toISOString(),
@@ -62,14 +74,16 @@ describe.skip(
           cy.log('Waiting for execution logs to appear in execution log table');
           refreshRuleExecutionTable();
           return getExecutionLogTableRow().then((rows) => {
-            return rows.length === 2;
+            return rows.length > 1;
           });
         },
         { interval: 5000, timeout: 20000 }
       );
+
       cy.get(EXECUTION_SHOWING).contains('Showing 2 rule executions');
-      filterByRunType('Manual');
+      getExecutionLogTableRow().should('have.length', 2);
 
+      filterByRunType('Manual');
       getExecutionLogTableRow().should('have.length', 1);
     });
   }
diff --git a/x-pack/solutions/security/test/security_solution_cypress/cypress/tasks/api_calls/backfill.ts b/x-pack/solutions/security/test/security_solution_cypress/cypress/tasks/api_calls/backfill.ts
index bfa495d78abd5..7bf7689962f01 100644
--- a/x-pack/solutions/security/test/security_solution_cypress/cypress/tasks/api_calls/backfill.ts
+++ b/x-pack/solutions/security/test/security_solution_cypress/cypress/tasks/api_calls/backfill.ts
@@ -27,8 +27,7 @@ export const manualRuleRun = ({
     body: [
       {
         rule_id: ruleId,
-        start,
-        end,
+        ranges: [{ start, end }],
       },
     ],
   });