From f8ed329821c36205994acc8783a1123d75a7ab60 Mon Sep 17 00:00:00 2001
From: animehart <rickyangwyn@gmail.com>
Date: Tue, 17 Sep 2024 02:15:12 -0700
Subject: [PATCH 01/16] initial push: added cypress test for Misconfiguration
 preview

---
 .../hosts/misconfiguration_preview.cy.ts      | 99 +++++++++++++++++++
 1 file changed, 99 insertions(+)
 create mode 100644 x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_preview.cy.ts

diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_preview.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_preview.cy.ts
new file mode 100644
index 0000000000000..b23faa0d42bb5
--- /dev/null
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_preview.cy.ts
@@ -0,0 +1,99 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { CDR_LATEST_NATIVE_MISCONFIGURATIONS_INDEX_PATTERN } from '@kbn/cloud-security-posture-common';
+import { createRule } from '../../../tasks/api_calls/rules';
+import { getNewRule } from '../../../objects/rule';
+import { getDataTestSubjectSelector } from '../../../helpers/common';
+
+import { rootRequest, deleteAlertsAndRules } from '../../../tasks/api_calls/common';
+import { expandFirstAlertHostFlyout } from '../../../tasks/asset_criticality/common';
+import { waitForAlertsToPopulate } from '../../../tasks/create_new_rule';
+import { login } from '../../../tasks/login';
+import { ALERTS_URL } from '../../../urls/navigation';
+import { visit } from '../../../tasks/navigation';
+
+const HOST_INSIGHT_MISCONFIGURATION_TITLE = getDataTestSubjectSelector(
+  'securitySolutionFlyoutInsightsMisconfigurationsTitleText'
+);
+const timestamp = Date.now();
+
+// Create a Date object using the timestamp
+const date = new Date(timestamp);
+
+// Convert the Date object to ISO 8601 format
+const iso8601String = date.toISOString();
+const mockFinding = {
+  '@timestamp': iso8601String,
+  host: { name: 'siem-kibana' },
+  resource: { id: '1234ABCD', name: `kubelet`, sub_type: 'lower case sub type' },
+  result: { evaluation: 'passed' },
+  rule: {
+    name: 'Upper case rule name',
+    section: 'Upper case section',
+    benchmark: {
+      id: 'cis_k8s',
+      posture_type: 'kspm',
+      name: 'CIS Kubernetes V1.23',
+      version: 'v1.0.0',
+    },
+    type: 'process',
+  },
+  cluster_id: 'Upper case cluster id',
+  data_stream: {
+    dataset: 'cloud_security_posture.findings',
+  },
+};
+
+const createMockFinding = () => {
+  return rootRequest({
+    method: 'POST',
+    url: `${Cypress.env(
+      'ELASTICSEARCH_URL'
+    )}/${CDR_LATEST_NATIVE_MISCONFIGURATIONS_INDEX_PATTERN}/_doc`,
+    body: mockFinding,
+  });
+};
+
+const deleteDataStream = () => {
+  return rootRequest({
+    method: 'DELETE',
+    url: `${Cypress.env(
+      'ELASTICSEARCH_URL'
+    )}/_data_stream/${CDR_LATEST_NATIVE_MISCONFIGURATIONS_INDEX_PATTERN}`,
+  });
+};
+
+describe('Alert Host details expandable flyout', { tags: ['@ess', '@serverless'] }, () => {
+  beforeEach(() => {
+    deleteAlertsAndRules();
+    login();
+    createRule(getNewRule());
+    visit(ALERTS_URL);
+    waitForAlertsToPopulate();
+  });
+
+  after(() => {
+    deleteDataStream();
+  });
+
+  it('should not display Misconfiguration preview under Insights Entities when it does not have Misconfiguration Findings', () => {
+    expandFirstAlertHostFlyout();
+
+    cy.log('check if Misconfiguration preview title is not shown');
+    cy.get(HOST_INSIGHT_MISCONFIGURATION_TITLE).should('not.exist');
+  });
+
+  it('should display Misconfiguration preview under Insights Entities when it has Misconfiguration Findings', () => {
+    createMockFinding();
+    cy.reload();
+    expandFirstAlertHostFlyout();
+
+    cy.log('check if Misconfiguration preview title shown');
+    cy.get(HOST_INSIGHT_MISCONFIGURATION_TITLE).should('be.visible');
+  });
+});

From 80d3a01a2cb8e819f5ba29dc1ed95196c4dfa916 Mon Sep 17 00:00:00 2001
From: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 17 Sep 2024 09:29:34 +0000
Subject: [PATCH 02/16] [CI] Auto-commit changed files from 'node
 scripts/lint_ts_projects --fix'

---
 x-pack/test/security_solution_cypress/cypress/tsconfig.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/x-pack/test/security_solution_cypress/cypress/tsconfig.json b/x-pack/test/security_solution_cypress/cypress/tsconfig.json
index 36ef2376ec1ad..b117f42efceae 100644
--- a/x-pack/test/security_solution_cypress/cypress/tsconfig.json
+++ b/x-pack/test/security_solution_cypress/cypress/tsconfig.json
@@ -44,5 +44,6 @@
     "@kbn/securitysolution-endpoint-exceptions-common",
     "@kbn/repo-info",
     "@kbn/elastic-assistant-common",
+    "@kbn/cloud-security-posture-common",
   ]
 }

From 011fb8f5422956c356d3d4104c3cec597dba5882 Mon Sep 17 00:00:00 2001
From: animehart <rickyangwyn@gmail.com>
Date: Wed, 18 Sep 2024 08:00:07 -0700
Subject: [PATCH 03/16] update cypress

---
 .../misconfiguration_findings_details_table.tsx  |  1 +
 .../misconfiguration_preview.tsx                 |  1 +
 .../explore/hosts/misconfiguration_preview.cy.ts | 16 ++++++++++++++++
 3 files changed, 18 insertions(+)

diff --git a/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx b/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx
index 1362e0e42e6ba..3af79822b89d8 100644
--- a/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx
+++ b/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx
@@ -174,6 +174,7 @@ export const MisconfigurationFindingsDetailsTable = memo(
             columns={columns}
             pagination={pagination}
             onChange={onTableChange}
+            data-test-subj={'securitySolutionFlyoutMisconfigurationFindingsTable'}
           />
         </EuiPanel>
       </>
diff --git a/x-pack/plugins/security_solution/public/cloud_security_posture/components/misconfiguration/misconfiguration_preview.tsx b/x-pack/plugins/security_solution/public/cloud_security_posture/components/misconfiguration/misconfiguration_preview.tsx
index f6ba0389f752a..534c9c6724e5a 100644
--- a/x-pack/plugins/security_solution/public/cloud_security_posture/components/misconfiguration/misconfiguration_preview.tsx
+++ b/x-pack/plugins/security_solution/public/cloud_security_posture/components/misconfiguration/misconfiguration_preview.tsx
@@ -182,6 +182,7 @@ export const MisconfigurationsPreview = ({ hostName }: { hostName: string }) =>
         title: (
           <EuiText
             size="xs"
+            data-test-subj={'securitySolutionFlyoutInsightsMisconfigurationsTitleText'}
             css={css`
               font-weight: ${euiTheme.font.weight.semiBold};
             `}
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_preview.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_preview.cy.ts
index b23faa0d42bb5..108eb93585c08 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_preview.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_preview.cy.ts
@@ -20,6 +20,12 @@ import { visit } from '../../../tasks/navigation';
 const HOST_INSIGHT_MISCONFIGURATION_TITLE = getDataTestSubjectSelector(
   'securitySolutionFlyoutInsightsMisconfigurationsTitleText'
 );
+
+const HOST_INSIGHT_TAB_TITLE = getDataTestSubjectSelector('securitySolutionFlyoutInsightInputsTab');
+const HOST_INSIGHT_TABLE = getDataTestSubjectSelector(
+  'securitySolutionFlyoutMisconfigurationFindingsTable'
+);
+
 const timestamp = Date.now();
 
 // Create a Date object using the timestamp
@@ -96,4 +102,14 @@ describe('Alert Host details expandable flyout', { tags: ['@ess', '@serverless']
     cy.log('check if Misconfiguration preview title shown');
     cy.get(HOST_INSIGHT_MISCONFIGURATION_TITLE).should('be.visible');
   });
+
+  it('should display insight tabs and findings table upon clicking on misconfiguration accordion', () => {
+    createMockFinding();
+    cy.reload();
+    expandFirstAlertHostFlyout();
+    cy.contains('Failed findings', { timeout: 3000 });
+    cy.contains('Misconfigurations').click();
+    cy.get(HOST_INSIGHT_TAB_TITLE).should('be.visible');
+    cy.get(HOST_INSIGHT_TABLE).should('be.visible');
+  });
 });

From 6e0ae67e12f2cf3c2ff917bac97201643d2c3395 Mon Sep 17 00:00:00 2001
From: animehart <rickyangwyn@gmail.com>
Date: Wed, 18 Sep 2024 13:30:49 -0700
Subject: [PATCH 04/16] added user name contextual flyout cypress

---
 .../misconfiguration_contextual_flyout.cy.ts  | 157 ++++++++++++++++++
 .../hosts/misconfiguration_preview.cy.ts      | 115 -------------
 2 files changed, 157 insertions(+), 115 deletions(-)
 create mode 100644 x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_contextual_flyout.cy.ts
 delete mode 100644 x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_preview.cy.ts

diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_contextual_flyout.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_contextual_flyout.cy.ts
new file mode 100644
index 0000000000000..fc8f26c620307
--- /dev/null
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_contextual_flyout.cy.ts
@@ -0,0 +1,157 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { CDR_LATEST_NATIVE_MISCONFIGURATIONS_INDEX_PATTERN } from '@kbn/cloud-security-posture-common';
+import { createRule } from '../../../tasks/api_calls/rules';
+import { getNewRule } from '../../../objects/rule';
+import { getDataTestSubjectSelector } from '../../../helpers/common';
+
+import { rootRequest, deleteAlertsAndRules } from '../../../tasks/api_calls/common';
+import {
+  expandFirstAlertHostFlyout,
+  expandFirstAlertUserFlyout,
+} from '../../../tasks/asset_criticality/common';
+import { waitForAlertsToPopulate } from '../../../tasks/create_new_rule';
+import { login } from '../../../tasks/login';
+import { ALERTS_URL } from '../../../urls/navigation';
+import { visit } from '../../../tasks/navigation';
+
+const CSP_INSIGHT_MISCONFIGURATION_TITLE = getDataTestSubjectSelector(
+  'securitySolutionFlyoutInsightsMisconfigurationsTitleText'
+);
+
+const CSP_INSIGHT_TAB_TITLE = getDataTestSubjectSelector('securitySolutionFlyoutInsightInputsTab');
+const CSP_INSIGHT_TABLE = getDataTestSubjectSelector(
+  'securitySolutionFlyoutMisconfigurationFindingsTable'
+);
+
+const timestamp = Date.now();
+
+// Create a Date object using the timestamp
+const date = new Date(timestamp);
+
+// Convert the Date object to ISO 8601 format
+const iso8601String = date.toISOString();
+const mockFinding = {
+  '@timestamp': iso8601String,
+  host: { name: 'siem-kibana' },
+  user: { name: 'test' },
+  resource: { id: '1234ABCD', name: `kubelet`, sub_type: 'lower case sub type' },
+  result: { evaluation: 'passed' },
+  rule: {
+    name: 'Upper case rule name',
+    section: 'Upper case section',
+    benchmark: {
+      id: 'cis_k8s',
+      posture_type: 'kspm',
+      name: 'CIS Kubernetes V1.23',
+      version: 'v1.0.0',
+    },
+    type: 'process',
+  },
+  cluster_id: 'Upper case cluster id',
+  data_stream: {
+    dataset: 'cloud_security_posture.findings',
+  },
+};
+
+const createMockFinding = () => {
+  return rootRequest({
+    method: 'POST',
+    url: `${Cypress.env(
+      'ELASTICSEARCH_URL'
+    )}/${CDR_LATEST_NATIVE_MISCONFIGURATIONS_INDEX_PATTERN}/_doc`,
+    body: mockFinding,
+  });
+};
+
+const deleteDataStream = () => {
+  return rootRequest({
+    method: 'DELETE',
+    url: `${Cypress.env(
+      'ELASTICSEARCH_URL'
+    )}/_data_stream/${CDR_LATEST_NATIVE_MISCONFIGURATIONS_INDEX_PATTERN}`,
+  });
+};
+
+describe('Alert Host details expandable flyout', { tags: ['@ess', '@serverless'] }, () => {
+  beforeEach(() => {
+    deleteAlertsAndRules();
+    login();
+    createRule(getNewRule());
+    visit(ALERTS_URL);
+    waitForAlertsToPopulate();
+  });
+
+  // after(() => {
+  //   deleteDataStream();
+  // });
+
+  context('Host name', () => {
+    after(() => {
+      deleteDataStream();
+    });
+
+    it('should not display Misconfiguration preview under Insights Entities when it does not have Misconfiguration Findings', () => {
+      expandFirstAlertHostFlyout();
+
+      cy.log('check if Misconfiguration preview title is not shown');
+      cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('not.exist');
+    });
+
+    it('should display Misconfiguration preview under Insights Entities when it has Misconfiguration Findings', () => {
+      createMockFinding();
+      cy.reload();
+      expandFirstAlertHostFlyout();
+
+      cy.log('check if Misconfiguration preview title shown');
+      cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('be.visible');
+    });
+
+    it('should display insight tabs and findings table upon clicking on misconfiguration accordion', () => {
+      createMockFinding();
+      cy.reload();
+      expandFirstAlertHostFlyout();
+      cy.contains('Failed findings', { timeout: 3000 });
+      cy.contains('Misconfigurations').click();
+      cy.get(CSP_INSIGHT_TAB_TITLE).should('be.visible');
+      cy.get(CSP_INSIGHT_TABLE).should('be.visible');
+    });
+  });
+
+  context('User name', () => {
+    after(() => {
+      deleteDataStream();
+    });
+
+    it('should not display Misconfiguration preview under Insights Entities when it does not have Misconfiguration Findings', () => {
+      expandFirstAlertUserFlyout();
+
+      cy.log('check if Misconfiguration preview title is not shown');
+      cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('not.exist');
+    });
+
+    it('should display Misconfiguration preview under Insights Entities when it has Misconfiguration Findings', () => {
+      createMockFinding();
+      cy.reload();
+      expandFirstAlertUserFlyout();
+
+      cy.log('check if Misconfiguration preview title shown');
+      cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('be.visible');
+    });
+
+    it('should display insight tabs and findings table upon clicking on misconfiguration accordion', () => {
+      createMockFinding();
+      cy.reload();
+      expandFirstAlertUserFlyout();
+      cy.contains('Failed findings', { timeout: 3000 });
+      cy.contains('Misconfigurations').click();
+      cy.get(CSP_INSIGHT_TAB_TITLE).should('be.visible');
+      cy.get(CSP_INSIGHT_TABLE).should('be.visible');
+    });
+  });
+});
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_preview.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_preview.cy.ts
deleted file mode 100644
index 108eb93585c08..0000000000000
--- a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_preview.cy.ts
+++ /dev/null
@@ -1,115 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { CDR_LATEST_NATIVE_MISCONFIGURATIONS_INDEX_PATTERN } from '@kbn/cloud-security-posture-common';
-import { createRule } from '../../../tasks/api_calls/rules';
-import { getNewRule } from '../../../objects/rule';
-import { getDataTestSubjectSelector } from '../../../helpers/common';
-
-import { rootRequest, deleteAlertsAndRules } from '../../../tasks/api_calls/common';
-import { expandFirstAlertHostFlyout } from '../../../tasks/asset_criticality/common';
-import { waitForAlertsToPopulate } from '../../../tasks/create_new_rule';
-import { login } from '../../../tasks/login';
-import { ALERTS_URL } from '../../../urls/navigation';
-import { visit } from '../../../tasks/navigation';
-
-const HOST_INSIGHT_MISCONFIGURATION_TITLE = getDataTestSubjectSelector(
-  'securitySolutionFlyoutInsightsMisconfigurationsTitleText'
-);
-
-const HOST_INSIGHT_TAB_TITLE = getDataTestSubjectSelector('securitySolutionFlyoutInsightInputsTab');
-const HOST_INSIGHT_TABLE = getDataTestSubjectSelector(
-  'securitySolutionFlyoutMisconfigurationFindingsTable'
-);
-
-const timestamp = Date.now();
-
-// Create a Date object using the timestamp
-const date = new Date(timestamp);
-
-// Convert the Date object to ISO 8601 format
-const iso8601String = date.toISOString();
-const mockFinding = {
-  '@timestamp': iso8601String,
-  host: { name: 'siem-kibana' },
-  resource: { id: '1234ABCD', name: `kubelet`, sub_type: 'lower case sub type' },
-  result: { evaluation: 'passed' },
-  rule: {
-    name: 'Upper case rule name',
-    section: 'Upper case section',
-    benchmark: {
-      id: 'cis_k8s',
-      posture_type: 'kspm',
-      name: 'CIS Kubernetes V1.23',
-      version: 'v1.0.0',
-    },
-    type: 'process',
-  },
-  cluster_id: 'Upper case cluster id',
-  data_stream: {
-    dataset: 'cloud_security_posture.findings',
-  },
-};
-
-const createMockFinding = () => {
-  return rootRequest({
-    method: 'POST',
-    url: `${Cypress.env(
-      'ELASTICSEARCH_URL'
-    )}/${CDR_LATEST_NATIVE_MISCONFIGURATIONS_INDEX_PATTERN}/_doc`,
-    body: mockFinding,
-  });
-};
-
-const deleteDataStream = () => {
-  return rootRequest({
-    method: 'DELETE',
-    url: `${Cypress.env(
-      'ELASTICSEARCH_URL'
-    )}/_data_stream/${CDR_LATEST_NATIVE_MISCONFIGURATIONS_INDEX_PATTERN}`,
-  });
-};
-
-describe('Alert Host details expandable flyout', { tags: ['@ess', '@serverless'] }, () => {
-  beforeEach(() => {
-    deleteAlertsAndRules();
-    login();
-    createRule(getNewRule());
-    visit(ALERTS_URL);
-    waitForAlertsToPopulate();
-  });
-
-  after(() => {
-    deleteDataStream();
-  });
-
-  it('should not display Misconfiguration preview under Insights Entities when it does not have Misconfiguration Findings', () => {
-    expandFirstAlertHostFlyout();
-
-    cy.log('check if Misconfiguration preview title is not shown');
-    cy.get(HOST_INSIGHT_MISCONFIGURATION_TITLE).should('not.exist');
-  });
-
-  it('should display Misconfiguration preview under Insights Entities when it has Misconfiguration Findings', () => {
-    createMockFinding();
-    cy.reload();
-    expandFirstAlertHostFlyout();
-
-    cy.log('check if Misconfiguration preview title shown');
-    cy.get(HOST_INSIGHT_MISCONFIGURATION_TITLE).should('be.visible');
-  });
-
-  it('should display insight tabs and findings table upon clicking on misconfiguration accordion', () => {
-    createMockFinding();
-    cy.reload();
-    expandFirstAlertHostFlyout();
-    cy.contains('Failed findings', { timeout: 3000 });
-    cy.contains('Misconfigurations').click();
-    cy.get(HOST_INSIGHT_TAB_TITLE).should('be.visible');
-    cy.get(HOST_INSIGHT_TABLE).should('be.visible');
-  });
-});

From 1888ccdaa9c4c34f15cb85237fb6c1fdb536222a Mon Sep 17 00:00:00 2001
From: animehart <rickyangwyn@gmail.com>
Date: Mon, 23 Sep 2024 10:15:54 -0700
Subject: [PATCH 05/16] pr comments

---
 .github/CODEOWNERS                            |   1 +
 .../misconfiguration_contextual_flyout.cy.ts  | 175 +++++++++++++-----
 2 files changed, 126 insertions(+), 50 deletions(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 9284e5ba821f9..171e3554dd331 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1747,6 +1747,7 @@ x-pack/plugins/osquery @elastic/security-defend-workflows
 /x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/components/cloud_security_posture @elastic/fleet @elastic/kibana-cloud-security-posture
 /x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/hooks/setup_technology.* @elastic/fleet @elastic/kibana-cloud-security-posture
 /x-pack/plugins/security_solution/public/cloud_security_posture @elastic/kibana-cloud-security-posture
+/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_contextual_flyout.cy.ts @elastic/kibana-cloud-security-posture
 
 # Security Solution onboarding tour
 /x-pack/plugins/security_solution/public/common/components/guided_onboarding @elastic/security-threat-hunting-explore
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_contextual_flyout.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_contextual_flyout.cy.ts
index fc8f26c620307..39be9dfaeb3b1 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_contextual_flyout.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_contextual_flyout.cy.ts
@@ -28,7 +28,7 @@ const CSP_INSIGHT_TAB_TITLE = getDataTestSubjectSelector('securitySolutionFlyout
 const CSP_INSIGHT_TABLE = getDataTestSubjectSelector(
   'securitySolutionFlyoutMisconfigurationFindingsTable'
 );
-
+const NO_FINDINGS_TEXT = getDataTestSubjectSelector('noFindingsDataTestSubj');
 const timestamp = Date.now();
 
 // Create a Date object using the timestamp
@@ -36,36 +36,73 @@ const date = new Date(timestamp);
 
 // Convert the Date object to ISO 8601 format
 const iso8601String = date.toISOString();
-const mockFinding = {
-  '@timestamp': iso8601String,
-  host: { name: 'siem-kibana' },
-  user: { name: 'test' },
-  resource: { id: '1234ABCD', name: `kubelet`, sub_type: 'lower case sub type' },
-  result: { evaluation: 'passed' },
-  rule: {
-    name: 'Upper case rule name',
-    section: 'Upper case section',
-    benchmark: {
-      id: 'cis_k8s',
-      posture_type: 'kspm',
-      name: 'CIS Kubernetes V1.23',
-      version: 'v1.0.0',
+
+const mockFindingHostName = (matches: boolean) => {
+  return {
+    '@timestamp': iso8601String,
+    host: { name: matches ? 'siem-kibana' : 'not-siem-kibana' },
+    resource: {
+      id: '1234ABCD',
+      name: 'kubelet',
+      sub_type: 'lower case sub type',
+    },
+    result: { evaluation: matches ? 'passed' : 'failed' }, // Adjusting result based on matches
+    rule: {
+      name: 'Upper case rule name',
+      section: 'Upper case section',
+      benchmark: {
+        id: 'cis_k8s',
+        posture_type: 'kspm',
+        name: 'CIS Kubernetes V1.23',
+        version: 'v1.0.0',
+      },
+      type: 'process',
+    },
+    cluster_id: 'Upper case cluster id',
+    data_stream: {
+      dataset: 'cloud_security_posture.findings',
+    },
+  };
+};
+
+const mockFindingUserName = (matches: boolean) => {
+  return {
+    '@timestamp': iso8601String,
+    user: { name: matches ? 'test' : 'not-test' },
+    resource: {
+      id: '1234ABCD',
+      name: 'kubelet',
+      sub_type: 'lower case sub type',
+    },
+    result: { evaluation: matches ? 'passed' : 'failed' }, // Adjusting result based on matches
+    rule: {
+      name: 'Upper case rule name',
+      section: 'Upper case section',
+      benchmark: {
+        id: 'cis_k8s',
+        posture_type: 'kspm',
+        name: 'CIS Kubernetes V1.23',
+        version: 'v1.0.0',
+      },
+      type: 'process',
     },
-    type: 'process',
-  },
-  cluster_id: 'Upper case cluster id',
-  data_stream: {
-    dataset: 'cloud_security_posture.findings',
-  },
+    cluster_id: 'Upper case cluster id',
+    data_stream: {
+      dataset: 'cloud_security_posture.findings',
+    },
+  };
 };
 
-const createMockFinding = () => {
+const createMockFinding = (isNameMatches: boolean, findingType: 'host.name' | 'user.name') => {
   return rootRequest({
     method: 'POST',
     url: `${Cypress.env(
       'ELASTICSEARCH_URL'
     )}/${CDR_LATEST_NATIVE_MISCONFIGURATIONS_INDEX_PATTERN}/_doc`,
-    body: mockFinding,
+    body:
+      findingType === 'host.name'
+        ? mockFindingHostName(isNameMatches)
+        : mockFindingUserName(isNameMatches),
   });
 };
 
@@ -87,35 +124,39 @@ describe('Alert Host details expandable flyout', { tags: ['@ess', '@serverless']
     waitForAlertsToPopulate();
   });
 
-  // after(() => {
-  //   deleteDataStream();
-  // });
+  context('No Misconfiguration Findings', () => {
+    it('should not display Misconfiguration preview under Insights Entities when it does not have Misconfiguration Findings', () => {
+      expandFirstAlertHostFlyout();
 
-  context('Host name', () => {
-    after(() => {
-      deleteDataStream();
+      cy.log('check if Misconfiguration preview title is not shown');
+      cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('not.exist');
     });
 
     it('should not display Misconfiguration preview under Insights Entities when it does not have Misconfiguration Findings', () => {
-      expandFirstAlertHostFlyout();
+      expandFirstAlertUserFlyout();
 
       cy.log('check if Misconfiguration preview title is not shown');
       cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('not.exist');
     });
+  });
 
-    it('should display Misconfiguration preview under Insights Entities when it has Misconfiguration Findings', () => {
-      createMockFinding();
+  context('Host name - Has misconfiguration findings', () => {
+    beforeEach(() => {
+      createMockFinding(true, 'host.name');
       cy.reload();
       expandFirstAlertHostFlyout();
+    });
+
+    afterEach(() => {
+      deleteDataStream();
+    });
 
+    it('should display Misconfiguration preview under Insights Entities when it has Misconfiguration Findings', () => {
       cy.log('check if Misconfiguration preview title shown');
       cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('be.visible');
     });
 
     it('should display insight tabs and findings table upon clicking on misconfiguration accordion', () => {
-      createMockFinding();
-      cy.reload();
-      expandFirstAlertHostFlyout();
       cy.contains('Failed findings', { timeout: 3000 });
       cy.contains('Misconfigurations').click();
       cy.get(CSP_INSIGHT_TAB_TITLE).should('be.visible');
@@ -123,35 +164,69 @@ describe('Alert Host details expandable flyout', { tags: ['@ess', '@serverless']
     });
   });
 
-  context('User name', () => {
-    after(() => {
-      deleteDataStream();
-    });
-
-    it('should not display Misconfiguration preview under Insights Entities when it does not have Misconfiguration Findings', () => {
+  context(
+    'Host name - Has misconfiguration findings but host name is not the same as alert host name',
+    () => {
+      beforeEach(() => {
+        createMockFinding(false, 'host.name');
+        cy.reload();
+        expandFirstAlertHostFlyout();
+      });
+
+      afterEach(() => {
+        deleteDataStream();
+      });
+
+      it('should display Misconfiguration preview under Insights Entities when it has Misconfiguration Findings', () => {
+        cy.log('check if Misconfiguration preview title shown');
+        cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('be.visible');
+        cy.get(NO_FINDINGS_TEXT).should('be.visible');
+      });
+    }
+  );
+
+  context('User name - Has misconfiguration findings', () => {
+    beforeEach(() => {
+      createMockFinding(true, 'user.name');
+      cy.reload();
       expandFirstAlertUserFlyout();
+    });
 
-      cy.log('check if Misconfiguration preview title is not shown');
-      cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('not.exist');
+    afterEach(() => {
+      deleteDataStream();
     });
 
     it('should display Misconfiguration preview under Insights Entities when it has Misconfiguration Findings', () => {
-      createMockFinding();
-      cy.reload();
-      expandFirstAlertUserFlyout();
-
       cy.log('check if Misconfiguration preview title shown');
       cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('be.visible');
     });
 
     it('should display insight tabs and findings table upon clicking on misconfiguration accordion', () => {
-      createMockFinding();
-      cy.reload();
-      expandFirstAlertUserFlyout();
       cy.contains('Failed findings', { timeout: 3000 });
       cy.contains('Misconfigurations').click();
       cy.get(CSP_INSIGHT_TAB_TITLE).should('be.visible');
       cy.get(CSP_INSIGHT_TABLE).should('be.visible');
     });
   });
+
+  context(
+    'User name - Has misconfiguration findings but host name is not the same as alert host name',
+    () => {
+      beforeEach(() => {
+        createMockFinding(false, 'user.name');
+        cy.reload();
+        expandFirstAlertHostFlyout();
+      });
+
+      afterEach(() => {
+        deleteDataStream();
+      });
+
+      it('should display Misconfiguration preview under Insights Entities when it has Misconfiguration Findings', () => {
+        cy.log('check if Misconfiguration preview title shown');
+        cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('be.visible');
+        cy.get(NO_FINDINGS_TEXT).should('be.visible');
+      });
+    }
+  );
 });

From 7c2f4684dfc479ab506ab83c4e37a796927382e8 Mon Sep 17 00:00:00 2001
From: animehart <rickyangwyn@gmail.com>
Date: Mon, 23 Sep 2024 10:55:48 -0700
Subject: [PATCH 06/16] update notes about cypress

---
 .../plugins/cloud_security_posture/README.md  | 27 ++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/cloud_security_posture/README.md b/x-pack/plugins/cloud_security_posture/README.md
index bd0b7de6ac661..4fbaf8c46ad4d 100755
--- a/x-pack/plugins/cloud_security_posture/README.md
+++ b/x-pack/plugins/cloud_security_posture/README.md
@@ -20,6 +20,7 @@ For general guidelines, read [Kibana Testing Guide](https://www.elastic.co/guide
 1. [End-to-End Tests](../../test/cloud_security_posture_functional/config.ts)
 1. [Serverless API Integration tests](../../test_serverless/api_integration/test_suites/security/config.ts)
 1. [Serverless End-to-End Tests](../../test_serverless/functional/test_suites/security/config.ts)
+1. [Cypress End-to-End Tests (Temporary location)](../../test/security_solution_cypress/cypress/e2e/explore/hosts)
 
 
 ### Tools
@@ -73,6 +74,15 @@ yarn test:ftr --config x-pack/test_serverless/api_integration/test_suites/securi
 yarn test:ftr --config x-pack/test_serverless/functional/test_suites/security/config.cloud_security_posture.ts
 ```
 
+Run [**End-to-End Cypress Tests**](https://github.com/elastic/kibana/tree/main/x-pack/test/security_solution_cypress/cypress):
+> **Note**
+>
+> Run this from security_solution_cypress folder
+```bash
+yarn cypress:open:serverless
+yarn cypress:open:ess
+```
+
 #### Run **FTR tests (integration or e2e) for development**
 
 Functional test runner (FTR) can be used separately with `ftr:runner` and `ftr:server`. This is convenient while developing tests.
@@ -107,4 +117,19 @@ run serverless e2e tests:
 ```bash
 yarn test:ftr:server --config x-pack/test_serverless/functional/test_suites/security/config.cloud_security_posture.ts
 yarn test:ftr:runner ---config x-pack/test_serverless/functional/test_suites/security/config.cloud_security_posture.ts
-```
\ No newline at end of file
+```
+
+#### Run **Cypress tests (e2e) for development**
+When developing feature outside our plugin folder, instead of using FTRs for e2e test, we may use Cypress. Before running cypress, make sure you have installed it first. Like FTRs, we can run cypress in different environment, for example:
+
+run ess e2e tests:
+```bash
+yarn cypress:open:ess
+```
+
+run serverless e2e tests:
+```bash
+yarn cypress:open:serverless
+```
+
+Unlike FTR where we have to set server and runner separately, Cypress handles everything in 1 go, so just running the above the script is enough to get it running
\ No newline at end of file

From 1b8db5918fc3f2101353f8455b80a7dcee879b75 Mon Sep 17 00:00:00 2001
From: animehart <rickyangwyn@gmail.com>
Date: Wed, 9 Oct 2024 09:50:28 -0700
Subject: [PATCH 07/16] edit cypress test

---
 .github/CODEOWNERS                            |  5 +-
 .../misconfiguration_contextual_flyout.cy.ts  | 58 +++++++------------
 2 files changed, 23 insertions(+), 40 deletions(-)
 rename x-pack/test/security_solution_cypress/cypress/e2e/{explore/hosts => investigations/alerts/expandable_flyout}/misconfiguration_contextual_flyout.cy.ts (74%)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 6fe105eed7077..7ce0d49241be5 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1828,9 +1828,8 @@ x-pack/plugins/osquery @elastic/security-defend-workflows
 /x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/components/cloud_security_posture @elastic/fleet @elastic/kibana-cloud-security-posture
 /x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/hooks/setup_technology.* @elastic/fleet @elastic/kibana-cloud-security-posture
 /x-pack/plugins/security_solution/public/cloud_security_posture @elastic/kibana-cloud-security-posture
-/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_contextual_flyout.cy.ts @elastic/kibana-cloud-security-posture
-/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/vulnerabilities_contextual_flyout.cy.ts @elastic/kibana-cloud-security-posture
-
+/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/misconfiguration_contextual_flyout.cy.ts @elastic/kibana-cloud-security-posture
+/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/vulnerabilities_contextual_flyout.cy.ts @elastic/kibana-cloud-security-posture
 # Security Solution onboarding tour
 /x-pack/plugins/security_solution/public/common/components/guided_onboarding @elastic/security-threat-hunting-explore
 
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_contextual_flyout.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/misconfiguration_contextual_flyout.cy.ts
similarity index 74%
rename from x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_contextual_flyout.cy.ts
rename to x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/misconfiguration_contextual_flyout.cy.ts
index 39be9dfaeb3b1..2f4caec99b578 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/misconfiguration_contextual_flyout.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/misconfiguration_contextual_flyout.cy.ts
@@ -6,29 +6,29 @@
  */
 
 import { CDR_LATEST_NATIVE_MISCONFIGURATIONS_INDEX_PATTERN } from '@kbn/cloud-security-posture-common';
-import { createRule } from '../../../tasks/api_calls/rules';
-import { getNewRule } from '../../../objects/rule';
-import { getDataTestSubjectSelector } from '../../../helpers/common';
+import { createRule } from '../../../../tasks/api_calls/rules';
+import { getNewRule } from '../../../../objects/rule';
+import { getDataTestSubjectSelector } from '../../../../helpers/common';
 
-import { rootRequest, deleteAlertsAndRules } from '../../../tasks/api_calls/common';
+import { rootRequest, deleteAlertsAndRules } from '../../../../tasks/api_calls/common';
 import {
   expandFirstAlertHostFlyout,
   expandFirstAlertUserFlyout,
-} from '../../../tasks/asset_criticality/common';
-import { waitForAlertsToPopulate } from '../../../tasks/create_new_rule';
-import { login } from '../../../tasks/login';
-import { ALERTS_URL } from '../../../urls/navigation';
-import { visit } from '../../../tasks/navigation';
+} from '../../../../tasks/asset_criticality/common';
+import { waitForAlertsToPopulate } from '../../../../tasks/create_new_rule';
+import { login } from '../../../../tasks/login';
+import { ALERTS_URL } from '../../../../urls/navigation';
+import { visit } from '../../../../tasks/navigation';
 
 const CSP_INSIGHT_MISCONFIGURATION_TITLE = getDataTestSubjectSelector(
-  'securitySolutionFlyoutInsightsMisconfigurationsTitleText'
+  'securitySolutionFlyoutInsightsMisconfigurationsTitleLink'
 );
 
 const CSP_INSIGHT_TAB_TITLE = getDataTestSubjectSelector('securitySolutionFlyoutInsightInputsTab');
 const CSP_INSIGHT_TABLE = getDataTestSubjectSelector(
   'securitySolutionFlyoutMisconfigurationFindingsTable'
 );
-const NO_FINDINGS_TEXT = getDataTestSubjectSelector('noFindingsDataTestSubj');
+
 const timestamp = Date.now();
 
 // Create a Date object using the timestamp
@@ -124,22 +124,6 @@ describe('Alert Host details expandable flyout', { tags: ['@ess', '@serverless']
     waitForAlertsToPopulate();
   });
 
-  context('No Misconfiguration Findings', () => {
-    it('should not display Misconfiguration preview under Insights Entities when it does not have Misconfiguration Findings', () => {
-      expandFirstAlertHostFlyout();
-
-      cy.log('check if Misconfiguration preview title is not shown');
-      cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('not.exist');
-    });
-
-    it('should not display Misconfiguration preview under Insights Entities when it does not have Misconfiguration Findings', () => {
-      expandFirstAlertUserFlyout();
-
-      cy.log('check if Misconfiguration preview title is not shown');
-      cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('not.exist');
-    });
-  });
-
   context('Host name - Has misconfiguration findings', () => {
     beforeEach(() => {
       createMockFinding(true, 'host.name');
@@ -157,8 +141,7 @@ describe('Alert Host details expandable flyout', { tags: ['@ess', '@serverless']
     });
 
     it('should display insight tabs and findings table upon clicking on misconfiguration accordion', () => {
-      cy.contains('Failed findings', { timeout: 3000 });
-      cy.contains('Misconfigurations').click();
+      cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).click();
       cy.get(CSP_INSIGHT_TAB_TITLE).should('be.visible');
       cy.get(CSP_INSIGHT_TABLE).should('be.visible');
     });
@@ -178,9 +161,10 @@ describe('Alert Host details expandable flyout', { tags: ['@ess', '@serverless']
       });
 
       it('should display Misconfiguration preview under Insights Entities when it has Misconfiguration Findings', () => {
-        cy.log('check if Misconfiguration preview title shown');
-        cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('be.visible');
-        cy.get(NO_FINDINGS_TEXT).should('be.visible');
+        expandFirstAlertHostFlyout();
+
+        cy.log('check if Misconfiguration preview title is not shown');
+        cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('not.exist');
       });
     }
   );
@@ -202,8 +186,7 @@ describe('Alert Host details expandable flyout', { tags: ['@ess', '@serverless']
     });
 
     it('should display insight tabs and findings table upon clicking on misconfiguration accordion', () => {
-      cy.contains('Failed findings', { timeout: 3000 });
-      cy.contains('Misconfigurations').click();
+      cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).click();
       cy.get(CSP_INSIGHT_TAB_TITLE).should('be.visible');
       cy.get(CSP_INSIGHT_TABLE).should('be.visible');
     });
@@ -223,9 +206,10 @@ describe('Alert Host details expandable flyout', { tags: ['@ess', '@serverless']
       });
 
       it('should display Misconfiguration preview under Insights Entities when it has Misconfiguration Findings', () => {
-        cy.log('check if Misconfiguration preview title shown');
-        cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('be.visible');
-        cy.get(NO_FINDINGS_TEXT).should('be.visible');
+        expandFirstAlertUserFlyout();
+
+        cy.log('check if Misconfiguration preview title is not shown');
+        cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).should('not.exist');
       });
     }
   );

From ef20875459bffdcf81a5fff46cf271fc9e82a95a Mon Sep 17 00:00:00 2001
From: animehart <rickyangwyn@gmail.com>
Date: Mon, 14 Oct 2024 04:47:07 -0700
Subject: [PATCH 08/16] start making csp cypress test to run on CI the proper
 way

---
 .../cloud_security_posture.yml                | 34 +++++++++++++++++++
 .../pipelines/pull_request/pipeline.ts        | 17 ++++++++++
 .../functional/cloud_security_posture.sh      | 16 +++++++++
 .../cloud_security_posture_serverless.sh      | 16 +++++++++
 ...isconfiguration_findings_details_table.tsx |  1 +
 .../misconfiguration_contextual_flyout.cy.ts  | 18 +++++-----
 .../vulnerabilities_contextual_flyout.cy.ts   | 20 +++++------
 .../security_solution_cypress/package.json    |  5 ++-
 8 files changed, 107 insertions(+), 20 deletions(-)
 create mode 100644 .buildkite/pipelines/pull_request/security_solution/cloud_security_posture.yml
 create mode 100644 .buildkite/scripts/steps/functional/cloud_security_posture.sh
 create mode 100644 .buildkite/scripts/steps/functional/cloud_security_posture_serverless.sh
 rename x-pack/test/security_solution_cypress/cypress/e2e/{investigations/alerts/expandable_flyout => cloud_security_posture}/misconfiguration_contextual_flyout.cy.ts (91%)
 rename x-pack/test/security_solution_cypress/cypress/e2e/{investigations/alerts/expandable_flyout => cloud_security_posture}/vulnerabilities_contextual_flyout.cy.ts (91%)

diff --git a/.buildkite/pipelines/pull_request/security_solution/cloud_security_posture.yml b/.buildkite/pipelines/pull_request/security_solution/cloud_security_posture.yml
new file mode 100644
index 0000000000000..f4ce327293b31
--- /dev/null
+++ b/.buildkite/pipelines/pull_request/security_solution/cloud_security_posture.yml
@@ -0,0 +1,34 @@
+steps:
+  - command: .buildkite/scripts/steps/functional/cloud_security_posture.sh
+    label: 'Cloud Security Posture Cypress Tests'
+    agents:
+      enableNestedVirtualization: true
+      localSsds: 1
+      localSsdInterface: nvme
+      machineType: n2-standard-4
+    depends_on:
+      - build
+      - quick_checks
+    timeout_in_minutes: 60
+    parallelism: 20
+    retry:
+      automatic:
+        - exit_status: '-1'
+          limit: 1
+
+  - command: .buildkite/scripts/steps/functional/cloud_security_posture_serverless.sh
+    label: 'Cloud Security Posture Cypress Tests on Serverless'
+    agents:
+      enableNestedVirtualization: true
+      localSsds: 1
+      localSsdInterface: nvme
+      machineType: n2-standard-4
+    depends_on:
+      - build
+      - quick_checks
+    timeout_in_minutes: 60
+    parallelism: 14
+    retry:
+      automatic:
+        - exit_status: '-1'
+          limit: 1
\ No newline at end of file
diff --git a/.buildkite/scripts/pipelines/pull_request/pipeline.ts b/.buildkite/scripts/pipelines/pull_request/pipeline.ts
index 08d459ac5e7fd..31d1d39137d36 100644
--- a/.buildkite/scripts/pipelines/pull_request/pipeline.ts
+++ b/.buildkite/scripts/pipelines/pull_request/pipeline.ts
@@ -298,6 +298,23 @@ const getPipeline = (filename: string, removeSteps = true) => {
       );
     }
 
+    if (
+      (await doAnyChangesMatch([
+        /^x-pack\/packages\/kbn-cloud-security-posture/,
+        /^x-pack\/packages\/kbn-cloud-security-posture-common/,
+        /^x-pack\/plugins\/cloud_security_posture/,
+        /^x-pack\/plugins\/security_solution/,
+        /^x-pack\/test\/security_solution_cypress/,
+      ])) ||
+      GITHUB_PR_LABELS.includes('ci:all-cypress-suites')
+    ) {
+      pipeline.push(
+        getPipeline(
+          '.buildkite/pipelines/pull_request/security_solution/cloud_security_posture.yml'
+        )
+      );
+    }
+
     pipeline.push(getPipeline('.buildkite/pipelines/pull_request/post_build.yml'));
 
     // remove duplicated steps
diff --git a/.buildkite/scripts/steps/functional/cloud_security_posture.sh b/.buildkite/scripts/steps/functional/cloud_security_posture.sh
new file mode 100644
index 0000000000000..990d19e1ecdb0
--- /dev/null
+++ b/.buildkite/scripts/steps/functional/cloud_security_posture.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/scripts/steps/functional/common.sh
+
+export JOB=kibana-cloud-security-posture-cypress
+export KIBANA_INSTALL_DIR=${KIBANA_BUILD_LOCATION}
+
+echo "--- Cloud Security Posture Workflows Cypress tests"
+
+cd x-pack/plugins/security_solution
+
+set +e
+
+yarn cypress:cloud_security_posture:run:ess; status=$?; yarn junit:merge || :; exit $status
\ No newline at end of file
diff --git a/.buildkite/scripts/steps/functional/cloud_security_posture_serverless.sh b/.buildkite/scripts/steps/functional/cloud_security_posture_serverless.sh
new file mode 100644
index 0000000000000..daac91af34d32
--- /dev/null
+++ b/.buildkite/scripts/steps/functional/cloud_security_posture_serverless.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/scripts/steps/functional/common.sh
+
+export JOB=kibana-cloud-security-posture-serverless-cypress
+export KIBANA_INSTALL_DIR=${KIBANA_BUILD_LOCATION}
+
+echo "--- Cloud Security Posture Workflows Cypress tests on Serverless"
+
+cd x-pack/plugins/security_solution
+
+set +e
+
+yarn cypress:run:qa:serverless:cloud_security_posture; status=$?; yarn junit:merge || :; exit $status
diff --git a/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx b/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx
index 851513ec2b211..ef75ef4c52d13 100644
--- a/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx
+++ b/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx
@@ -119,6 +119,7 @@ export const MisconfigurationFindingsDetailsTable = memo(
         METRIC_TYPE.CLICK,
         NAV_TO_FINDINGS_BY_RULE_NAME_FRPOM_ENTITY_FLYOUT
       );
+      console.log(navToFindings({ [queryField]: name }, ['rule.name']))
       navToFindings({ [queryField]: name }, ['rule.name']);
     };
 
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/misconfiguration_contextual_flyout.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/misconfiguration_contextual_flyout.cy.ts
similarity index 91%
rename from x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/misconfiguration_contextual_flyout.cy.ts
rename to x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/misconfiguration_contextual_flyout.cy.ts
index 2f4caec99b578..b69f01b06c305 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/misconfiguration_contextual_flyout.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/misconfiguration_contextual_flyout.cy.ts
@@ -6,19 +6,19 @@
  */
 
 import { CDR_LATEST_NATIVE_MISCONFIGURATIONS_INDEX_PATTERN } from '@kbn/cloud-security-posture-common';
-import { createRule } from '../../../../tasks/api_calls/rules';
-import { getNewRule } from '../../../../objects/rule';
-import { getDataTestSubjectSelector } from '../../../../helpers/common';
+import { createRule } from '../../tasks/api_calls/rules';
+import { getNewRule } from '../../objects/rule';
+import { getDataTestSubjectSelector } from '../../helpers/common';
 
-import { rootRequest, deleteAlertsAndRules } from '../../../../tasks/api_calls/common';
+import { rootRequest, deleteAlertsAndRules } from '../../tasks/api_calls/common';
 import {
   expandFirstAlertHostFlyout,
   expandFirstAlertUserFlyout,
-} from '../../../../tasks/asset_criticality/common';
-import { waitForAlertsToPopulate } from '../../../../tasks/create_new_rule';
-import { login } from '../../../../tasks/login';
-import { ALERTS_URL } from '../../../../urls/navigation';
-import { visit } from '../../../../tasks/navigation';
+} from '../../tasks/asset_criticality/common';
+import { waitForAlertsToPopulate } from '../../tasks/create_new_rule';
+import { login } from '../../tasks/login';
+import { ALERTS_URL } from '../../urls/navigation';
+import { visit } from '../../tasks/navigation';
 
 const CSP_INSIGHT_MISCONFIGURATION_TITLE = getDataTestSubjectSelector(
   'securitySolutionFlyoutInsightsMisconfigurationsTitleLink'
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/vulnerabilities_contextual_flyout.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/vulnerabilities_contextual_flyout.cy.ts
similarity index 91%
rename from x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/vulnerabilities_contextual_flyout.cy.ts
rename to x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/vulnerabilities_contextual_flyout.cy.ts
index 591d458af56c1..cd85ab71c7db8 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/vulnerabilities_contextual_flyout.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/vulnerabilities_contextual_flyout.cy.ts
@@ -6,16 +6,16 @@
  */
 
 import { CDR_LATEST_NATIVE_VULNERABILITIES_INDEX_PATTERN } from '@kbn/cloud-security-posture-common';
-import { createRule } from '../../../../tasks/api_calls/rules';
-import { getNewRule } from '../../../../objects/rule';
-import { getDataTestSubjectSelector } from '../../../../helpers/common';
-
-import { rootRequest, deleteAlertsAndRules } from '../../../../tasks/api_calls/common';
-import { expandFirstAlertHostFlyout } from '../../../../tasks/asset_criticality/common';
-import { waitForAlertsToPopulate } from '../../../../tasks/create_new_rule';
-import { login } from '../../../../tasks/login';
-import { ALERTS_URL } from '../../../../urls/navigation';
-import { visit } from '../../../../tasks/navigation';
+import { createRule } from '../../tasks/api_calls/rules';
+import { getNewRule } from '../../objects/rule';
+import { getDataTestSubjectSelector } from '../../helpers/common';
+
+import { rootRequest, deleteAlertsAndRules } from '../../tasks/api_calls/common';
+import { expandFirstAlertHostFlyout } from '../../tasks/asset_criticality/common';
+import { waitForAlertsToPopulate } from '../../tasks/create_new_rule';
+import { login } from '../../tasks/login';
+import { ALERTS_URL } from '../../urls/navigation';
+import { visit } from '../../tasks/navigation';
 
 const CSP_INSIGHT_VULNERABILITIES_TITLE = getDataTestSubjectSelector(
   'securitySolutionFlyoutInsightsVulnerabilitiesTitleLink'
diff --git a/x-pack/test/security_solution_cypress/package.json b/x-pack/test/security_solution_cypress/package.json
index 5f7fc4fadf2bf..b4a0f4951f045 100644
--- a/x-pack/test/security_solution_cypress/package.json
+++ b/x-pack/test/security_solution_cypress/package.json
@@ -19,6 +19,7 @@
     "cypress:investigations:run:ess": "yarn cypress:ess --spec './cypress/e2e/investigations/**/*.cy.ts'",
     "cypress:explore:run:ess": "yarn cypress:ess --spec './cypress/e2e/explore/**/*.cy.ts'",
     "cypress:changed-specs-only:ess": "yarn cypress:ess --changed-specs-only --env burn=5",
+    "cypress:cloud_security_posture:run:ess": "yarn cypress:ess --spec './cypress/e2e/cloud_security_posture/**/*.cy.ts'",
     "cypress:burn:ess": "yarn cypress:ess --env burn=5",
     "junit:merge": "../../../node_modules/.bin/mochawesome-merge ../../../target/kibana-security-solution/cypress/results/mochawesome*.json > ../../../target/kibana-security-solution/cypress/results/output.json && ../../../node_modules/.bin/marge ../../../target/kibana-security-solution/cypress/results/output.json --reportDir ../../../target/kibana-security-solution/cypress/results && yarn junit:transform && mkdir -p ../../../target/junit && cp ../../../target/kibana-security-solution/cypress/results/*.xml ../../../target/junit/",
     "junit:transform": "node ../../plugins/security_solution/scripts/junit_transformer --pathPattern '../../../target/kibana-security-solution/cypress/results/*.xml' --rootDirectory ../../../ --reportName 'Security Solution Cypress' --writeInPlace",
@@ -35,6 +36,7 @@
     "cypress:investigations:run:serverless": "yarn cypress:serverless --spec './cypress/e2e/investigations/**/*.cy.ts'",
     "cypress:explore:run:serverless": "yarn cypress:serverless --spec './cypress/e2e/explore/**/*.cy.ts'",
     "cypress:changed-specs-only:serverless": "yarn cypress:serverless --changed-specs-only --env burn=5",
+    "cypress:cloud_security_posture:run:serverless": "yarn cypress:serverless --spec'./cypress/e2e/cloud_security_posture/**/*.cy.ts'",
     "cypress:burn:serverless": "yarn cypress:serverless --env burn=2",
     "cypress:qa:serverless": "TZ=UTC NODE_OPTIONS=--openssl-legacy-provider node ../../plugins/security_solution/scripts/start_cypress_parallel_serverless --config-file ../../test/security_solution_cypress/cypress/cypress_ci_serverless_qa.config.ts",
     "cypress:open:qa:serverless": "yarn cypress:qa:serverless open",
@@ -45,6 +47,7 @@
     "cypress:run:qa:serverless:rule_management:prebuilt_rules": "yarn cypress:qa:serverless --spec './cypress/e2e/detection_response/rule_management/prebuilt_rules/**/*.cy.ts'",
     "cypress:run:qa:serverless:detection_engine": "yarn cypress:qa:serverless --spec './cypress/e2e/detection_response/detection_engine/!(exceptions)/**/*.cy.ts'",
     "cypress:run:qa:serverless:detection_engine:exceptions": "yarn cypress:qa:serverless --spec './cypress/e2e/detection_response/detection_engine/exceptions/**/*.cy.ts'",
-    "cypress:run:qa:serverless:ai_assistant": "yarn cypress:qa:serverless --spec './cypress/e2e/ai_assistant/**/*.cy.ts'"
+    "cypress:run:qa:serverless:ai_assistant": "yarn cypress:qa:serverless --spec './cypress/e2e/ai_assistant/**/*.cy.ts'",
+    "cypress:run:qa:serverless:cloud_security_posture": "yarn cypress:qa:serverless --spec './cypress/e2e/cloud_security_posture/**/*.cy.ts"
   }
 }
\ No newline at end of file

From 519dec95f399766448df94b339cdffb79c767e77 Mon Sep 17 00:00:00 2001
From: animehart <rickyangwyn@gmail.com>
Date: Wed, 16 Oct 2024 01:35:34 -0700
Subject: [PATCH 09/16] more cypress settings

---
 .../security_solution/cloud_security_posture.yml     | 12 ++++--------
 .../functional/cloud_security_posture_serverless.sh  |  2 +-
 x-pack/plugins/cloud_security_posture/README.md      |  2 +-
 3 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/.buildkite/pipelines/pull_request/security_solution/cloud_security_posture.yml b/.buildkite/pipelines/pull_request/security_solution/cloud_security_posture.yml
index f4ce327293b31..7f5131b77f204 100644
--- a/.buildkite/pipelines/pull_request/security_solution/cloud_security_posture.yml
+++ b/.buildkite/pipelines/pull_request/security_solution/cloud_security_posture.yml
@@ -2,15 +2,13 @@ steps:
   - command: .buildkite/scripts/steps/functional/cloud_security_posture.sh
     label: 'Cloud Security Posture Cypress Tests'
     agents:
-      enableNestedVirtualization: true
-      localSsds: 1
-      localSsdInterface: nvme
       machineType: n2-standard-4
+      preemptible: true
     depends_on:
       - build
       - quick_checks
     timeout_in_minutes: 60
-    parallelism: 20
+    parallelism: 1
     retry:
       automatic:
         - exit_status: '-1'
@@ -19,15 +17,13 @@ steps:
   - command: .buildkite/scripts/steps/functional/cloud_security_posture_serverless.sh
     label: 'Cloud Security Posture Cypress Tests on Serverless'
     agents:
-      enableNestedVirtualization: true
-      localSsds: 1
-      localSsdInterface: nvme
       machineType: n2-standard-4
+      preemptible: true
     depends_on:
       - build
       - quick_checks
     timeout_in_minutes: 60
-    parallelism: 14
+    parallelism: 1
     retry:
       automatic:
         - exit_status: '-1'
diff --git a/.buildkite/scripts/steps/functional/cloud_security_posture_serverless.sh b/.buildkite/scripts/steps/functional/cloud_security_posture_serverless.sh
index daac91af34d32..873ebce5afaa0 100644
--- a/.buildkite/scripts/steps/functional/cloud_security_posture_serverless.sh
+++ b/.buildkite/scripts/steps/functional/cloud_security_posture_serverless.sh
@@ -13,4 +13,4 @@ cd x-pack/plugins/security_solution
 
 set +e
 
-yarn cypress:run:qa:serverless:cloud_security_posture; status=$?; yarn junit:merge || :; exit $status
+yarn cypress:cloud_security_posture:run:serverless; status=$?; yarn junit:merge || :; exit $status
diff --git a/x-pack/plugins/cloud_security_posture/README.md b/x-pack/plugins/cloud_security_posture/README.md
index 4fbaf8c46ad4d..53bbed7848b03 100755
--- a/x-pack/plugins/cloud_security_posture/README.md
+++ b/x-pack/plugins/cloud_security_posture/README.md
@@ -20,7 +20,7 @@ For general guidelines, read [Kibana Testing Guide](https://www.elastic.co/guide
 1. [End-to-End Tests](../../test/cloud_security_posture_functional/config.ts)
 1. [Serverless API Integration tests](../../test_serverless/api_integration/test_suites/security/config.ts)
 1. [Serverless End-to-End Tests](../../test_serverless/functional/test_suites/security/config.ts)
-1. [Cypress End-to-End Tests (Temporary location)](../../test/security_solution_cypress/cypress/e2e/explore/hosts)
+1. [Cypress End-to-End Tests (Temporary location)](../../test/security_solution_cypress/cypress/e2e/cloud_security_posture)
 
 
 ### Tools

From a04efbd4e12b6adf58ecc7701d65bd5da5e22354 Mon Sep 17 00:00:00 2001
From: animehart <rickyangwyn@gmail.com>
Date: Wed, 16 Oct 2024 02:08:01 -0700
Subject: [PATCH 10/16] fix typo

---
 x-pack/test/security_solution_cypress/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/test/security_solution_cypress/package.json b/x-pack/test/security_solution_cypress/package.json
index b4a0f4951f045..c7bc7fe1d94a0 100644
--- a/x-pack/test/security_solution_cypress/package.json
+++ b/x-pack/test/security_solution_cypress/package.json
@@ -36,7 +36,7 @@
     "cypress:investigations:run:serverless": "yarn cypress:serverless --spec './cypress/e2e/investigations/**/*.cy.ts'",
     "cypress:explore:run:serverless": "yarn cypress:serverless --spec './cypress/e2e/explore/**/*.cy.ts'",
     "cypress:changed-specs-only:serverless": "yarn cypress:serverless --changed-specs-only --env burn=5",
-    "cypress:cloud_security_posture:run:serverless": "yarn cypress:serverless --spec'./cypress/e2e/cloud_security_posture/**/*.cy.ts'",
+    "cypress:cloud_security_posture:run:serverless": "yarn cypress:serverless --spec './cypress/e2e/cloud_security_posture/**/*.cy.ts'",
     "cypress:burn:serverless": "yarn cypress:serverless --env burn=2",
     "cypress:qa:serverless": "TZ=UTC NODE_OPTIONS=--openssl-legacy-provider node ../../plugins/security_solution/scripts/start_cypress_parallel_serverless --config-file ../../test/security_solution_cypress/cypress/cypress_ci_serverless_qa.config.ts",
     "cypress:open:qa:serverless": "yarn cypress:qa:serverless open",

From f21365a6bf4e3fddf69cbce4daa4e4cd800b3fe2 Mon Sep 17 00:00:00 2001
From: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Date: Wed, 16 Oct 2024 09:51:43 +0000
Subject: [PATCH 11/16] [CI] Auto-commit changed files from 'node
 scripts/eslint --no-cache --fix'

---
 .../csp_details/misconfiguration_findings_details_table.tsx     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx b/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx
index ef75ef4c52d13..d8dc5dd70acca 100644
--- a/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx
+++ b/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx
@@ -119,7 +119,7 @@ export const MisconfigurationFindingsDetailsTable = memo(
         METRIC_TYPE.CLICK,
         NAV_TO_FINDINGS_BY_RULE_NAME_FRPOM_ENTITY_FLYOUT
       );
-      console.log(navToFindings({ [queryField]: name }, ['rule.name']))
+      console.log(navToFindings({ [queryField]: name }, ['rule.name']));
       navToFindings({ [queryField]: name }, ['rule.name']);
     };
 

From 675f1c027783a936b4825c37bcb1d187cc23ecf3 Mon Sep 17 00:00:00 2001
From: animehart <rickyangwyn@gmail.com>
Date: Thu, 17 Oct 2024 02:03:33 -0700
Subject: [PATCH 12/16] remove console log

---
 .../csp_details/misconfiguration_findings_details_table.tsx     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx b/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx
index ef75ef4c52d13..a01b559d5588f 100644
--- a/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx
+++ b/x-pack/plugins/security_solution/public/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx
@@ -119,7 +119,7 @@ export const MisconfigurationFindingsDetailsTable = memo(
         METRIC_TYPE.CLICK,
         NAV_TO_FINDINGS_BY_RULE_NAME_FRPOM_ENTITY_FLYOUT
       );
-      console.log(navToFindings({ [queryField]: name }, ['rule.name']))
+
       navToFindings({ [queryField]: name }, ['rule.name']);
     };
 

From 5672e82e5f8b900cba43c1008a6c826c37f081c4 Mon Sep 17 00:00:00 2001
From: animehart <rickyangwyn@gmail.com>
Date: Thu, 17 Oct 2024 02:33:32 -0700
Subject: [PATCH 13/16] update readme

---
 x-pack/plugins/cloud_security_posture/README.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/x-pack/plugins/cloud_security_posture/README.md b/x-pack/plugins/cloud_security_posture/README.md
index 53bbed7848b03..15c0e16afa552 100755
--- a/x-pack/plugins/cloud_security_posture/README.md
+++ b/x-pack/plugins/cloud_security_posture/README.md
@@ -81,6 +81,8 @@ Run [**End-to-End Cypress Tests**](https://github.com/elastic/kibana/tree/main/x
 ```bash
 yarn cypress:open:serverless
 yarn cypress:open:ess
+yarn cypress:cloud_security_posture:run:serverless
+yarn cypress:cloud_security_posture:run:ess
 ```
 
 #### Run **FTR tests (integration or e2e) for development**
@@ -127,9 +129,19 @@ run ess e2e tests:
 yarn cypress:open:ess
 ```
 
+run ess Cloud Security Posture e2e tests:
+```bash
+yarn cypress:cloud_security_posture:run:ess
+```
+
 run serverless e2e tests:
 ```bash
 yarn cypress:open:serverless
 ```
 
+run serverless Cloud Security Posture e2e tests:
+```bash
+yarn cypress:cloud_security_posture:run:serverless
+```
+
 Unlike FTR where we have to set server and runner separately, Cypress handles everything in 1 go, so just running the above the script is enough to get it running
\ No newline at end of file

From 61b251e0b0329650bb9f60ba92e42e26183ceeec Mon Sep 17 00:00:00 2001
From: animehart <rickyangwyn@gmail.com>
Date: Thu, 17 Oct 2024 08:50:56 -0700
Subject: [PATCH 14/16] fix

---
 .buildkite/scripts/pipelines/pull_request/pipeline.ts           | 1 -
 .buildkite/scripts/steps/functional/cloud_security_posture.sh   | 2 +-
 .../steps/functional/cloud_security_posture_serverless.sh       | 2 +-
 3 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/.buildkite/scripts/pipelines/pull_request/pipeline.ts b/.buildkite/scripts/pipelines/pull_request/pipeline.ts
index 1b785a550b18e..ea7cc29f95da2 100644
--- a/.buildkite/scripts/pipelines/pull_request/pipeline.ts
+++ b/.buildkite/scripts/pipelines/pull_request/pipeline.ts
@@ -301,7 +301,6 @@ const getPipeline = (filename: string, removeSteps = true) => {
     if (
       (await doAnyChangesMatch([
         /^x-pack\/packages\/kbn-cloud-security-posture/,
-        /^x-pack\/packages\/kbn-cloud-security-posture-common/,
         /^x-pack\/plugins\/cloud_security_posture/,
         /^x-pack\/plugins\/security_solution/,
         /^x-pack\/test\/security_solution_cypress/,
diff --git a/.buildkite/scripts/steps/functional/cloud_security_posture.sh b/.buildkite/scripts/steps/functional/cloud_security_posture.sh
index 990d19e1ecdb0..bea407e6a5b1c 100644
--- a/.buildkite/scripts/steps/functional/cloud_security_posture.sh
+++ b/.buildkite/scripts/steps/functional/cloud_security_posture.sh
@@ -9,7 +9,7 @@ export KIBANA_INSTALL_DIR=${KIBANA_BUILD_LOCATION}
 
 echo "--- Cloud Security Posture Workflows Cypress tests"
 
-cd x-pack/plugins/security_solution
+cd x-pack/test/security_solution_cypress
 
 set +e
 
diff --git a/.buildkite/scripts/steps/functional/cloud_security_posture_serverless.sh b/.buildkite/scripts/steps/functional/cloud_security_posture_serverless.sh
index 873ebce5afaa0..57c9be111a151 100644
--- a/.buildkite/scripts/steps/functional/cloud_security_posture_serverless.sh
+++ b/.buildkite/scripts/steps/functional/cloud_security_posture_serverless.sh
@@ -9,7 +9,7 @@ export KIBANA_INSTALL_DIR=${KIBANA_BUILD_LOCATION}
 
 echo "--- Cloud Security Posture Workflows Cypress tests on Serverless"
 
-cd x-pack/plugins/security_solution
+cd x-pack/test/security_solution_cypress
 
 set +e
 

From 4c328bb196b55e423678d2a6da23bded2b20318a Mon Sep 17 00:00:00 2001
From: animehart <rickyangwyn@gmail.com>
Date: Fri, 18 Oct 2024 03:54:13 -0700
Subject: [PATCH 15/16] added groups so we can run Cypres on Flaky Test Runner

---
 .buildkite/pipelines/flaky_tests/groups.json | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.buildkite/pipelines/flaky_tests/groups.json b/.buildkite/pipelines/flaky_tests/groups.json
index 292c5fe33397c..2c85d862f1bd0 100644
--- a/.buildkite/pipelines/flaky_tests/groups.json
+++ b/.buildkite/pipelines/flaky_tests/groups.json
@@ -87,6 +87,14 @@
     {
       "key": "cypress/apm_cypress",
       "name": "APM - Cypress"
+    },
+    {
+      "key": "cypress/cloud_security_posture",
+      "name": "Cloud Security Posture - Cypress"
+    },
+    {
+      "key": "cypress/cloud_security_posture_serverless",
+      "name": "[Serverless] Cloud Security Posture - Cypress"
     }
   ]
 }

From 602865d4c17780fc4a24b771988ad1fac3308fe8 Mon Sep 17 00:00:00 2001
From: animehart <rickyangwyn@gmail.com>
Date: Fri, 18 Oct 2024 12:04:29 -0700
Subject: [PATCH 16/16] pr Comments

---
 .github/CODEOWNERS                                |  5 +++--
 x-pack/plugins/cloud_security_posture/README.md   |  2 +-
 .../security_solution_cypress/cypress/README.md   |  3 +++
 .../misconfiguration_contextual_flyout.cy.ts      | 15 +++++++++------
 .../vulnerabilities_contextual_flyout.cy.ts       |  3 +--
 5 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index c67c02ddcaff2..874211e572a28 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1861,8 +1861,9 @@ x-pack/plugins/osquery @elastic/security-defend-workflows
 /x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/hooks/setup_technology.* @elastic/fleet @elastic/kibana-cloud-security-posture
 /x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/components/cloud_posture_third_party_support_callout.* @elastic/fleet @elastic/kibana-cloud-security-posture
 /x-pack/plugins/security_solution/public/cloud_security_posture @elastic/kibana-cloud-security-posture
-/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/misconfiguration_contextual_flyout.cy.ts @elastic/kibana-cloud-security-posture
-/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/vulnerabilities_contextual_flyout.cy.ts @elastic/kibana-cloud-security-posture
+/x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/misconfiguration_contextual_flyout.cy.ts @elastic/kibana-cloud-security-posture
+/x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/vulnerabilities_contextual_flyout.cy.ts @elastic/kibana-cloud-security-posture
+
 # Security Solution onboarding tour
 /x-pack/plugins/security_solution/public/common/components/guided_onboarding @elastic/security-threat-hunting-explore
 
diff --git a/x-pack/plugins/cloud_security_posture/README.md b/x-pack/plugins/cloud_security_posture/README.md
index 15c0e16afa552..f608a614fca1c 100755
--- a/x-pack/plugins/cloud_security_posture/README.md
+++ b/x-pack/plugins/cloud_security_posture/README.md
@@ -20,7 +20,7 @@ For general guidelines, read [Kibana Testing Guide](https://www.elastic.co/guide
 1. [End-to-End Tests](../../test/cloud_security_posture_functional/config.ts)
 1. [Serverless API Integration tests](../../test_serverless/api_integration/test_suites/security/config.ts)
 1. [Serverless End-to-End Tests](../../test_serverless/functional/test_suites/security/config.ts)
-1. [Cypress End-to-End Tests (Temporary location)](../../test/security_solution_cypress/cypress/e2e/cloud_security_posture)
+1. [Cypress End-to-End Tests](../../test/security_solution_cypress/cypress/e2e/cloud_security_posture)
 
 
 ### Tools
diff --git a/x-pack/test/security_solution_cypress/cypress/README.md b/x-pack/test/security_solution_cypress/cypress/README.md
index bf153cb3be5e0..7ae9017c8f9c8 100644
--- a/x-pack/test/security_solution_cypress/cypress/README.md
+++ b/x-pack/test/security_solution_cypress/cypress/README.md
@@ -79,6 +79,8 @@ Run the tests with the following yarn scripts from `x-pack/test/security_solutio
 | cypress:detection_engine:run:serverless | Runs all tests tagged as SERVERLESS in the `e2e/detection_response/detection_engine` excluding `e2e/detection_response/detection_engine` directory in headless mode |
 | cypress:ai_assistant:run:ess | Runs all tests tagged as ESS in the `e2e/ai_assistant` directory in headless mode |
 | cypress:ai_assistant:run:serverless | Runs all tests tagged as SERVERLESS in the `e2e/ai_assistant` directory in headless mode |
+| cypress:cloud_security_posture:run:ess | Runs all tests tagged as ESS in the `e2e/cloud_security_posture` directory in headless mode |
+| cypress:cloud_security_posture:run:serverless | Runs all tests tagged as SERVERLESS in the `e2e/cloud_security_posture` directory in headless mode |
 | cypress:detection_engine:exceptions:run:serverless | Runs all tests tagged as ESS in the `e2e/detection_response/detection_engine/exceptions` directory in headless mode |
 | cypress:investigations:run:ess | Runs all tests tagged as SERVERLESS in the `e2e/investigations` directory in headless mode |
 | cypress:explore:run:ess | Runs all tests tagged as ESS in the `e2e/explore` directory in headless mode |
@@ -88,6 +90,7 @@ Run the tests with the following yarn scripts from `x-pack/test/security_solutio
 | cypress:run:qa:serverless:entity_analytics | Runs all tests tagged as SERVERLESS placed in the `e2e/entity_analytics` directory in headless mode using the QA environment and real MKI projects.|
 | cypress:run:qa:serverless:explore | Runs all tests tagged as SERVERLESS in the `e2e/explore` directory in headless mode using the QA environment and real MKI prorjects. |
 | cypress:run:qa:serverless:investigations | Runs all tests tagged as SERVERLESS in the `e2e/investigations` directory in headless mode using the QA environment and reak MKI projects. |
+| cypress:run:qa:serverless:cloud_security_posture | Runs all tests tagged as SERVERLESS in the `e2e/cloud_security_posture` directory in headless mode using the QA environment and reak MKI projects. |
 | cypress:run:qa:serverless:rule_management | Runs all tests tagged as SERVERLESS in the `e2e/detection_response/rule_management` directory, excluding `e2e/detection_response/rule_management/prebuilt_rules` in headless mode using the QA environment and reak MKI projects. |
 | cypress:run:qa:serverless:rule_management:prebuilt_rules | Runs all tests tagged as SERVERLESS in the `e2e/detection_response/rule_management/prebuilt_rules` directory in headless mode using the QA environment and reak MKI projects. |
 | cypress:run:qa:serverless:detection_engine | Runs all tests tagged as SERVERLESS in the `e2e/detection_response/detection_engine` directory, excluding `e2e/detection_response/detection_engine/exceptions` in headless mode using the QA environment and reak MKI projects. |
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/misconfiguration_contextual_flyout.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/misconfiguration_contextual_flyout.cy.ts
index b69f01b06c305..f2bce9b1fa00e 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/misconfiguration_contextual_flyout.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/misconfiguration_contextual_flyout.cy.ts
@@ -29,12 +29,14 @@ const CSP_INSIGHT_TABLE = getDataTestSubjectSelector(
   'securitySolutionFlyoutMisconfigurationFindingsTable'
 );
 
+const clickMisconfigurationTitle = () => {
+  cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).click();
+};
+
 const timestamp = Date.now();
 
-// Create a Date object using the timestamp
 const date = new Date(timestamp);
 
-// Convert the Date object to ISO 8601 format
 const iso8601String = date.toISOString();
 
 const mockFindingHostName = (matches: boolean) => {
@@ -46,7 +48,7 @@ const mockFindingHostName = (matches: boolean) => {
       name: 'kubelet',
       sub_type: 'lower case sub type',
     },
-    result: { evaluation: matches ? 'passed' : 'failed' }, // Adjusting result based on matches
+    result: { evaluation: matches ? 'passed' : 'failed' },
     rule: {
       name: 'Upper case rule name',
       section: 'Upper case section',
@@ -74,7 +76,7 @@ const mockFindingUserName = (matches: boolean) => {
       name: 'kubelet',
       sub_type: 'lower case sub type',
     },
-    result: { evaluation: matches ? 'passed' : 'failed' }, // Adjusting result based on matches
+    result: { evaluation: matches ? 'passed' : 'failed' },
     rule: {
       name: 'Upper case rule name',
       section: 'Upper case section',
@@ -132,6 +134,7 @@ describe('Alert Host details expandable flyout', { tags: ['@ess', '@serverless']
     });
 
     afterEach(() => {
+      /* Deleting data stream even though we don't create it because data stream is automatically created when Cloud security API is used  */
       deleteDataStream();
     });
 
@@ -141,7 +144,7 @@ describe('Alert Host details expandable flyout', { tags: ['@ess', '@serverless']
     });
 
     it('should display insight tabs and findings table upon clicking on misconfiguration accordion', () => {
-      cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).click();
+      clickMisconfigurationTitle();
       cy.get(CSP_INSIGHT_TAB_TITLE).should('be.visible');
       cy.get(CSP_INSIGHT_TABLE).should('be.visible');
     });
@@ -186,7 +189,7 @@ describe('Alert Host details expandable flyout', { tags: ['@ess', '@serverless']
     });
 
     it('should display insight tabs and findings table upon clicking on misconfiguration accordion', () => {
-      cy.get(CSP_INSIGHT_MISCONFIGURATION_TITLE).click();
+      clickMisconfigurationTitle();
       cy.get(CSP_INSIGHT_TAB_TITLE).should('be.visible');
       cy.get(CSP_INSIGHT_TABLE).should('be.visible');
     });
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/vulnerabilities_contextual_flyout.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/vulnerabilities_contextual_flyout.cy.ts
index cd85ab71c7db8..046864962318b 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/vulnerabilities_contextual_flyout.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/cloud_security_posture/vulnerabilities_contextual_flyout.cy.ts
@@ -27,10 +27,8 @@ const CSP_INSIGHT_VULNERABILITIES_TABLE = getDataTestSubjectSelector(
 
 const timestamp = Date.now();
 
-// Create a Date object using the timestamp
 const date = new Date(timestamp);
 
-// Convert the Date object to ISO 8601 format
 const iso8601String = date.toISOString();
 
 const getMockVulnerability = (isNameMatchesAlert: boolean) => {
@@ -166,6 +164,7 @@ describe('Alert Host details expandable flyout', { tags: ['@ess', '@serverless']
       });
 
       afterEach(() => {
+        /* Deleting data stream even though we don't create it because data stream is automatically created when Cloud security API is used  */
         deleteDataStream();
       });