[Osquery][EDR Workflows] Unskip Osquery e2e serverless tier tests (#1…

…77585)

closes #174567
closes #170536
closes #170469
closes #170820

Wait for page to be fully loaded and recursively try to click Osquery
Response button.

Flaky test runner on all 4 unskipped tests:
100x -
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5287
100x -
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5288

x-pack/plugins/osquery/cypress/e2e/tiers/endpoint_complete.cy.ts

@@ -7,8 +7,7 @@
 
 import { checkOsqueryResponseActionsPermissions } from '../../tasks/response_actions';
 
-// FLAKY: https://github.com/elastic/kibana/issues/170469
-describe.skip(
+describe(
   'App Features for Enpoint Complete PLI',
   {
     tags: ['@serverless'],

x-pack/plugins/osquery/cypress/e2e/tiers/endpoint_essentials.cy.ts

@@ -7,8 +7,7 @@
 
 import { checkOsqueryResponseActionsPermissions } from '../../tasks/response_actions';
 
-// FLAKY: https://github.com/elastic/kibana/issues/174567
-describe.skip(
+describe(
   'App Features for Endpoint Essentials PLI',
   {
     tags: ['@serverless'],

x-pack/plugins/osquery/cypress/e2e/tiers/security_complete.cy.ts

@@ -7,8 +7,7 @@
 
 import { checkOsqueryResponseActionsPermissions } from '../../tasks/response_actions';
 
-// FLAKY: https://github.com/elastic/kibana/issues/170820
-describe.skip(
+describe(
   'App Features for Security Complete PLI',
   {
     tags: ['@serverless'],

x-pack/plugins/osquery/cypress/e2e/tiers/security_essentials.cy.ts

@@ -7,8 +7,7 @@
 
 import { checkOsqueryResponseActionsPermissions } from '../../tasks/response_actions';
 
-// FLAKY: https://github.com/elastic/kibana/issues/170536
-describe.skip(
+describe(
   'App Features for Security Essentials PLI',
   {
     tags: ['@serverless'],

x-pack/plugins/osquery/cypress/tasks/response_actions.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { clickRuleName } from './live_query';
+import { recurse } from 'cypress-recurse';
 import { ServerlessRoleName } from '../support/roles';
 import { cleanupRule, loadRule } from './api_fixtures';
 import { closeDateTabIfVisible } from './integrations';
@@ -14,41 +14,53 @@ export const RESPONSE_ACTIONS_ERRORS = 'response-actions-error';
 export const RESPONSE_ACTIONS_ITEM_0 = 'response-actions-list-item-0';
 export const RESPONSE_ACTIONS_ITEM_1 = 'response-actions-list-item-1';
 export const RESPONSE_ACTIONS_ITEM_2 = 'response-actions-list-item-2';
-export const RESPONSE_ACTIONS_ITEM_3 = 'response-actions-list-item-3';
 
 export const OSQUERY_RESPONSE_ACTION_ADD_BUTTON = 'Osquery-response-action-type-selection-option';
 export const ENDPOINT_RESPONSE_ACTION_ADD_BUTTON =
-  'Endpoint Security-response-action-type-selection-option';
+  'Elastic Defend-response-action-type-selection-option';
 
 export const checkOsqueryResponseActionsPermissions = (enabled: boolean) => {
   let ruleId: string;
-  let ruleName: string;
 
-  before(() => {
-    loadRule().then((data) => {
-      ruleId = data.id;
-      ruleName = data.name;
-    });
-  });
-  after(() => {
+  afterEach(() => {
     cleanupRule(ruleId);
   });
 
   beforeEach(() => {
+    loadRule().then((data) => {
+      ruleId = data.id;
+    });
     cy.login(ServerlessRoleName.SOC_MANAGER);
   });
 
   it(`response actions should ${enabled ? 'be available ' : 'not be available'}`, () => {
-    cy.visit('/app/security/rules');
-    clickRuleName(ruleName);
-    cy.getBySel('globalLoadingIndicator').should('not.exist');
-    cy.getBySel('editRuleSettingsLink').click();
+    cy.intercept('GET', `/api/detection_engine/rules?id=${ruleId}`).as('getRule');
+    cy.visit(`/app/security/rules/id/${ruleId}/edit`);
     cy.getBySel('globalLoadingIndicator').should('not.exist');
+
+    // 2 calls are made to get the rule, so we need to wait for both since only on the second one's success the UI is updated
+    cy.wait('@getRule', { timeout: 2 * 60 * 1000 })
+      .its('response.statusCode')
+      .should('eq', 200);
+    cy.wait('@getRule', { timeout: 2 * 60 * 1000 })
+      .its('response.statusCode')
+      .should('eq', 200);
+
     closeDateTabIfVisible();
     cy.getBySel('edit-rule-actions-tab').click();
-    cy.getBySel('globalLoadingIndicator').should('not.exist');
-    cy.contains('Response actions are run on each rule execution.');
-    cy.getBySel(OSQUERY_RESPONSE_ACTION_ADD_BUTTON).click();
+
+    // In rare cases, the button is not clickable due to the page not being fully loaded
+    recurse(
+      () => {
+        cy.getBySel(OSQUERY_RESPONSE_ACTION_ADD_BUTTON).click();
+
+        return cy.getBySel('alertActionAccordion').should(Cypress._.noop);
+      },
+      ($el) => $el.length === 1,
+      { limit: 5, delay: 2000 }
+    );
+
+    // At this point we should have the response actions available or not
     if (enabled) {
       cy.getBySel(ENDPOINT_RESPONSE_ACTION_ADD_BUTTON).click();
       cy.contains('Query is a required field');