[CTI] bring back skipped cypress tests (#108978)

x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts

@@ -37,8 +37,7 @@ import {
 import { ALERTS_URL } from '../../urls/navigation';
 import { addsFieldsToTimeline } from '../../tasks/rule_details';
 
-// TODO: Doesn't look like the roll over is happening for these tests. 'indicator' is still referenced in the fields browser
-describe.skip('CTI Enrichment', () => {
+describe('CTI Enrichment', () => {
   before(() => {
     cleanKibana();
     esArchiverLoad('threat_indicator');

x-pack/plugins/security_solution/cypress/integration/detection_rules/indicator_match_rule.spec.ts

@@ -116,7 +116,7 @@ describe('indicator match', () => {
     const expectedTags = getNewThreatIndicatorRule().tags.join('');
     const expectedMitre = formatMitreAttackDescription(getNewThreatIndicatorRule().mitre);
     const expectedNumberOfRules = 1;
-    const expectedNumberOfAlerts = 1;
+    const expectedNumberOfAlerts = '1 alert';
 
     before(() => {
       cleanKibana();
@@ -139,8 +139,7 @@ describe('indicator match', () => {
           getIndicatorIndex().should('have.text', getIndexPatterns().join(''));
         });
 
-        // TODO: Need to fix
-        it.skip('Does NOT show invalidation text on initial page load if indicator index pattern is filled out', () => {
+        it('Does NOT show invalidation text on initial page load if indicator index pattern is filled out', () => {
           getDefineContinueButton().click();
           getIndexPatternInvalidationText().should('not.exist');
         });
@@ -154,8 +153,7 @@ describe('indicator match', () => {
       });
 
       describe('Indicator index patterns', () => {
-        // TODO: Need to fix
-        it.skip('Contains a predefined index pattern', () => {
+        it('Contains a predefined index pattern', () => {
           getIndicatorIndicatorIndex().should('have.text', getThreatIndexPatterns().join(''));
         });
 
@@ -392,8 +390,7 @@ describe('indicator match', () => {
         loginAndWaitForPageWithoutDateRange(ALERTS_URL);
       });
 
-      // TODO: Need to fix
-      it.skip('Creates and activates a new Indicator Match rule', () => {
+      it('Creates and activates a new Indicator Match rule', () => {
         waitForAlertsPanelToBeLoaded();
         waitForAlertsIndexToBeCreated();
         goToManageAlertsDetectionRules();
@@ -491,8 +488,7 @@ describe('indicator match', () => {
           .should('have.text', getNewThreatIndicatorRule().riskScore);
       });
 
-      // TODO: Need to fix
-      it.skip('Investigate alert in timeline', () => {
+      it('Investigate alert in timeline', () => {
         const accessibilityText = `Press enter for options, or press space to begin dragging.`;
 
         loadPrepackagedTimelineTemplates();

x-pack/plugins/security_solution/cypress/screens/alerts.ts

@@ -21,15 +21,11 @@ export const ALERT_ID = '[data-test-subj="draggable-content-_id"]';
 export const ALERT_RISK_SCORE_HEADER =
   '[data-test-subj="dataGridHeaderCell-signal.rule.risk_score"]';
 
-export const ALERT_RULE_METHOD = '[data-test-subj="draggable-content-signal.rule.type"]';
+export const ALERT_RULE_NAME = '[data-test-subj="formatted-field-signal.rule.name"]';
 
-export const ALERT_RULE_NAME = '[data-test-subj="draggable-content-signal.rule.name"]';
+export const ALERT_RULE_RISK_SCORE = '[data-test-subj="formatted-field-signal.rule.risk_score"]';
 
-export const ALERT_RULE_RISK_SCORE = '[data-test-subj="draggable-content-signal.rule.risk_score"]';
-
-export const ALERT_RULE_SEVERITY = '[data-test-subj="draggable-content-signal.rule.severity"]';
-
-export const ALERT_RULE_VERSION = '[data-test-subj="draggable-content-signal.rule.version"]';
+export const ALERT_RULE_SEVERITY = '[data-test-subj="formatted-field-signal.rule.severity"]';
 
 export const CLOSE_ALERT_BTN = '[data-test-subj="close-alert-status"]';
 

x-pack/plugins/security_solution/cypress/screens/rule_details.ts

@@ -96,7 +96,7 @@ export const TIMELINE_TEMPLATE_DETAILS = 'Timeline template';
 export const TIMESTAMP_OVERRIDE_DETAILS = 'Timestamp override';
 
 export const TIMELINE_FIELD = (field: string) => {
-  return `[data-test-subj="draggable-content-${field}"]`;
+  return `[data-test-subj="formatted-field-${field}"]`;
 };
 
 export const getDetails = (title: string) =>

x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts

@@ -394,7 +394,7 @@ export const fillIndexAndIndicatorIndexPattern = (
 ) => {
   getIndexPatternClearButton().click();
   getIndicatorIndex().type(`${indexPattern}{enter}`);
-  getIndicatorIndicatorIndex().type(`${indicatorIndex}{enter}`);
+  getIndicatorIndicatorIndex().type(`{backspace}{enter}${indicatorIndex}{enter}`);
 };
 
 export const fillEmailConnectorForm = (connector: EmailConnector = getEmailConnector()) => {
@@ -437,7 +437,7 @@ export const getIndexPatternInvalidationText = () => cy.contains(AT_LEAST_ONE_IN
 export const getAboutContinueButton = () => cy.get(ABOUT_CONTINUE_BTN);
 
 /** Returns the continue button on the step of define */
-export const getDefineContinueButton = () => cy.get(DEFINE_CONTINUE_BUTTON);
+export const getDefineContinueButton = () => cy.get(DEFINE_CONTINUE_BUTTON).should('exist');
 
 /** Returns the indicator index pattern */
 export const getIndicatorIndex = () => cy.get(THREAT_MATCH_INDICATOR_INDEX).eq(0);
@@ -447,7 +447,7 @@ export const getIndicatorIndicatorIndex = () =>
   cy.get(THREAT_MATCH_INDICATOR_INDICATOR_INDEX).eq(0);
 
 /** Returns the index pattern's clear button  */
-export const getIndexPatternClearButton = () => cy.get(COMBO_BOX_CLEAR_BTN).first();
+export const getIndexPatternClearButton = () => cy.get(COMBO_BOX_CLEAR_BTN).should('exist').first();
 
 /** Returns the custom query input */
 export const getCustomQueryInput = () => cy.get(THREAT_MATCH_CUSTOM_QUERY_INPUT).eq(0);

x-pack/plugins/security_solution/public/common/components/truncatable_text/truncatable_text.tsx

@@ -32,14 +32,22 @@ EllipsisText.displayName = 'EllipsisText';
 interface Props {
   tooltipContent?: React.ReactNode;
   children: React.ReactNode;
+  dataTestSubj?: string;
 }
 
-export function TruncatableText({ tooltipContent, children, ...props }: Props) {
-  if (!tooltipContent) return <EllipsisText {...props}>{children}</EllipsisText>;
+export function TruncatableText({ tooltipContent, children, dataTestSubj, ...props }: Props) {
+  if (!tooltipContent)
+    return (
+      <EllipsisText data-test-subj={dataTestSubj} {...props}>
+        {children}
+      </EllipsisText>
+    );
 
   return (
     <EuiToolTip display="block" content={tooltipContent}>
-      <EllipsisText {...props}>{children}</EllipsisText>
+      <EllipsisText data-test-subj={dataTestSubj} {...props}>
+        {children}
+      </EllipsisText>
     </EuiToolTip>
   );
 }

x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx

@@ -202,11 +202,11 @@ const FormattedFieldValueComponent: React.FC<{
             </EuiFlexGroup>
           }
         >
-          <>{value}</>
+          <span data-test-subj={`formatted-field-${fieldName}`}>{value}</span>
         </EuiToolTip>
       </TruncatableText>
     ) : (
-      <>{value}</>
+      <span data-test-subj={`formatted-field-${fieldName}`}>{value}</span>
     );
   } else {
     const contentValue = getOrEmptyTagFromValue(value);

x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field_helpers.tsx

@@ -52,7 +52,11 @@ export const RenderRuleName: React.FC<RenderRuleNameProps> = ({
   const ruleId = linkValue;
   const { search } = useFormatUrl(SecurityPageName.rules);
   const { navigateToApp, getUrlForApp } = useKibana().services.application;
-  const content = truncate ? <TruncatableText>{value}</TruncatableText> : value;
+  const content = truncate ? (
+    <TruncatableText dataTestSubj={`formatted-field-${fieldName}`}>{value}</TruncatableText>
+  ) : (
+    value
+  );
 
   const goToRuleDetails = useCallback(
     (ev) => {