diff --git a/packages/kbn-ftr-common-functional-services/services/saml_auth/default_request_headers.ts b/packages/kbn-ftr-common-functional-services/services/saml_auth/default_request_headers.ts
index e81f3383c9e9..b07ac58c5685 100644
--- a/packages/kbn-ftr-common-functional-services/services/saml_auth/default_request_headers.ts
+++ b/packages/kbn-ftr-common-functional-services/services/saml_auth/default_request_headers.ts
@@ -14,6 +14,7 @@ export const COMMON_REQUEST_HEADERS = {
 // possible change in 9.0 to match serverless
 const STATEFUL_INTERNAL_REQUEST_HEADERS = {
   ...COMMON_REQUEST_HEADERS,
+  'x-elastic-internal-origin': 'kibana',
 };
 
 const SERVERLESS_INTERNAL_REQUEST_HEADERS = {
diff --git a/packages/kbn-router-to-openapispec/src/extract_authz_description.test.ts b/packages/kbn-router-to-openapispec/src/extract_authz_description.test.ts
new file mode 100644
index 000000000000..8da2324e68f0
--- /dev/null
+++ b/packages/kbn-router-to-openapispec/src/extract_authz_description.test.ts
@@ -0,0 +1,81 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { schema } from '@kbn/config-schema';
+import { extractAuthzDescription } from './extract_authz_description';
+import { InternalRouterRoute } from './type';
+import { RouteSecurity } from '@kbn/core-http-server';
+
+describe('extractAuthzDescription', () => {
+  it('should return empty if route does not require privileges', () => {
+    const route: InternalRouterRoute = {
+      path: '/foo',
+      options: { access: 'internal' },
+      handler: jest.fn(),
+      validationSchemas: { request: { body: schema.object({}) } },
+      method: 'get',
+      isVersioned: false,
+    };
+    const description = extractAuthzDescription(route.security);
+    expect(description).toBe('');
+  });
+
+  it('should return route authz description for simple privileges', () => {
+    const routeSecurity: RouteSecurity = {
+      authz: {
+        requiredPrivileges: ['manage_spaces'],
+      },
+    };
+    const description = extractAuthzDescription(routeSecurity);
+    expect(description).toBe('[Authz] Route required privileges: ALL of [manage_spaces].');
+  });
+
+  it('should return route authz description for privilege groups', () => {
+    {
+      const routeSecurity: RouteSecurity = {
+        authz: {
+          requiredPrivileges: [{ allRequired: ['console'] }],
+        },
+      };
+      const description = extractAuthzDescription(routeSecurity);
+      expect(description).toBe('[Authz] Route required privileges: ALL of [console].');
+    }
+    {
+      const routeSecurity: RouteSecurity = {
+        authz: {
+          requiredPrivileges: [
+            {
+              anyRequired: ['manage_spaces', 'taskmanager'],
+            },
+          ],
+        },
+      };
+      const description = extractAuthzDescription(routeSecurity);
+      expect(description).toBe(
+        '[Authz] Route required privileges: ANY of [manage_spaces OR taskmanager].'
+      );
+    }
+    {
+      const routeSecurity: RouteSecurity = {
+        authz: {
+          requiredPrivileges: [
+            {
+              allRequired: ['console', 'filesManagement'],
+              anyRequired: ['manage_spaces', 'taskmanager'],
+            },
+          ],
+        },
+      };
+      const description = extractAuthzDescription(routeSecurity);
+      expect(description).toBe(
+        '[Authz] Route required privileges: ALL of [console, filesManagement] AND ANY of [manage_spaces OR taskmanager].'
+      );
+    }
+  });
+});
diff --git a/packages/kbn-router-to-openapispec/src/extract_authz_description.ts b/packages/kbn-router-to-openapispec/src/extract_authz_description.ts
new file mode 100644
index 000000000000..4cd687591378
--- /dev/null
+++ b/packages/kbn-router-to-openapispec/src/extract_authz_description.ts
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import type { AuthzEnabled, AuthzDisabled, InternalRouteSecurity } from '@kbn/core-http-server';
+
+interface PrivilegeGroupValue {
+  allRequired: string[];
+  anyRequired: string[];
+}
+
+export const extractAuthzDescription = (routeSecurity: InternalRouteSecurity | undefined) => {
+  if (!routeSecurity) {
+    return '';
+  }
+  if (!('authz' in routeSecurity) || (routeSecurity.authz as AuthzDisabled).enabled === false) {
+    return '';
+  }
+
+  const privileges = (routeSecurity.authz as AuthzEnabled).requiredPrivileges;
+
+  const groupedPrivileges = privileges.reduce<PrivilegeGroupValue>(
+    (groups, privilege) => {
+      if (typeof privilege === 'string') {
+        groups.allRequired.push(privilege);
+
+        return groups;
+      }
+      groups.allRequired.push(...(privilege.allRequired ?? []));
+      groups.anyRequired.push(...(privilege.anyRequired ?? []));
+
+      return groups;
+    },
+    {
+      anyRequired: [],
+      allRequired: [],
+    }
+  );
+
+  const getPrivilegesDescription = (allRequired: string[], anyRequired: string[]) => {
+    const allDescription = allRequired.length ? `ALL of [${allRequired.join(', ')}]` : '';
+    const anyDescription = anyRequired.length ? `ANY of [${anyRequired.join(' OR ')}]` : '';
+
+    return `${allDescription}${allDescription && anyDescription ? ' AND ' : ''}${anyDescription}`;
+  };
+
+  const getDescriptionForRoute = () => {
+    const allRequired = [...groupedPrivileges.allRequired];
+    const anyRequired = [...groupedPrivileges.anyRequired];
+
+    return `Route required privileges: ${getPrivilegesDescription(allRequired, anyRequired)}.`;
+  };
+
+  return `[Authz] ${getDescriptionForRoute()}`;
+};
diff --git a/packages/kbn-router-to-openapispec/src/process_router.test.ts b/packages/kbn-router-to-openapispec/src/process_router.test.ts
index 22e03efdf08f..96a10b25d648 100644
--- a/packages/kbn-router-to-openapispec/src/process_router.test.ts
+++ b/packages/kbn-router-to-openapispec/src/process_router.test.ts
@@ -11,7 +11,8 @@ import { schema } from '@kbn/config-schema';
 import { Router } from '@kbn/core-http-router-server-internal';
 import { OasConverter } from './oas_converter';
 import { createOperationIdCounter } from './operation_id_counter';
-import { extractResponses, processRouter, type InternalRouterRoute } from './process_router';
+import { extractResponses, processRouter } from './process_router';
+import { type InternalRouterRoute } from './type';
 
 describe('extractResponses', () => {
   let oasConverter: OasConverter;
@@ -102,6 +103,24 @@ describe('processRouter', () => {
         handler: jest.fn(),
         validationSchemas: { request: { body: schema.object({}) } },
       },
+      {
+        path: '/qux',
+        method: 'post',
+        options: {},
+        handler: jest.fn(),
+        validationSchemas: { request: { body: schema.object({}) } },
+        security: {
+          authz: {
+            requiredPrivileges: [
+              'manage_spaces',
+              {
+                allRequired: ['taskmanager'],
+                anyRequired: ['console'],
+              },
+            ],
+          },
+        },
+      },
     ],
   } as unknown as Router;
 
@@ -110,11 +129,23 @@ describe('processRouter', () => {
       version: '2023-10-31',
     });
 
-    expect(Object.keys(result1.paths!)).toHaveLength(3);
+    expect(Object.keys(result1.paths!)).toHaveLength(4);
 
     const result2 = processRouter(testRouter, new OasConverter(), createOperationIdCounter(), {
       version: '2024-10-31',
     });
     expect(Object.keys(result2.paths!)).toHaveLength(0);
   });
+
+  it('updates description with privileges required', () => {
+    const result = processRouter(testRouter, new OasConverter(), createOperationIdCounter(), {
+      version: '2023-10-31',
+    });
+
+    expect(result.paths['/qux']?.post).toBeDefined();
+
+    expect(result.paths['/qux']?.post?.description).toEqual(
+      '[Authz] Route required privileges: ALL of [manage_spaces, taskmanager] AND ANY of [console].'
+    );
+  });
 });
diff --git a/packages/kbn-router-to-openapispec/src/process_router.ts b/packages/kbn-router-to-openapispec/src/process_router.ts
index f0d37fd208b7..cb55af3735b3 100644
--- a/packages/kbn-router-to-openapispec/src/process_router.ts
+++ b/packages/kbn-router-to-openapispec/src/process_router.ts
@@ -27,7 +27,8 @@ import {
 } from './util';
 import type { OperationIdCounter } from './operation_id_counter';
 import type { GenerateOpenApiDocumentOptionsFilters } from './generate_oas';
-import type { CustomOperationObject } from './type';
+import type { CustomOperationObject, InternalRouterRoute } from './type';
+import { extractAuthzDescription } from './extract_authz_description';
 
 export const processRouter = (
   appRouter: Router,
@@ -63,10 +64,19 @@ export const processRouter = (
         parameters.push(...pathObjects, ...queryObjects);
       }
 
+      let description = '';
+      if (route.security) {
+        const authzDescription = extractAuthzDescription(route.security);
+
+        description = `${route.options.description ?? ''}${authzDescription ?? ''}`;
+      }
+
       const hasDeprecations = !!route.options.deprecated;
+
       const operation: CustomOperationObject = {
         summary: route.options.summary ?? '',
         tags: route.options.tags ? extractTags(route.options.tags) : [],
+        ...(description ? { description } : {}),
         ...(route.options.description ? { description: route.options.description } : {}),
         ...(hasDeprecations ? { deprecated: true } : {}),
         ...(route.options.discontinued ? { 'x-discontinued': route.options.discontinued } : {}),
@@ -99,7 +109,6 @@ export const processRouter = (
   return { paths };
 };
 
-export type InternalRouterRoute = ReturnType<Router['getRoutes']>[0];
 export const extractResponses = (route: InternalRouterRoute, converter: OasConverter) => {
   const responses: OpenAPIV3.ResponsesObject = {};
   if (!route.validationSchemas) return responses;
diff --git a/packages/kbn-router-to-openapispec/src/process_versioned_router.test.ts b/packages/kbn-router-to-openapispec/src/process_versioned_router.test.ts
index f9f4f4898c1d..3738c207f1f7 100644
--- a/packages/kbn-router-to-openapispec/src/process_versioned_router.test.ts
+++ b/packages/kbn-router-to-openapispec/src/process_versioned_router.test.ts
@@ -144,6 +144,22 @@ describe('processVersionedRouter', () => {
       'application/test+json; Elastic-Api-Version=2023-10-31',
     ]);
   });
+
+  it('correctly updates the authz description for routes that require privileges', () => {
+    const results = processVersionedRouter(
+      { getRoutes: () => [createTestRoute()] } as unknown as CoreVersionedRouter,
+      new OasConverter(),
+      createOperationIdCounter(),
+      {}
+    );
+    expect(results.paths['/foo']).toBeDefined();
+
+    expect(results.paths['/foo']!.get).toBeDefined();
+
+    expect(results.paths['/foo']!.get!.description).toBe(
+      '[Authz] Route required privileges: ALL of [manage_spaces].'
+    );
+  });
 });
 
 const createTestRoute: () => VersionedRouterRoute = () => ({
@@ -155,6 +171,11 @@ const createTestRoute: () => VersionedRouterRoute = () => ({
     deprecated: true,
     discontinued: 'discontinued versioned router',
     options: { body: { access: ['application/test+json'] } as any },
+    security: {
+      authz: {
+        requiredPrivileges: ['manage_spaces'],
+      },
+    },
   },
   handlers: [
     {
diff --git a/packages/kbn-router-to-openapispec/src/process_versioned_router.ts b/packages/kbn-router-to-openapispec/src/process_versioned_router.ts
index 7eee0d20c11d..5dad5677c94a 100644
--- a/packages/kbn-router-to-openapispec/src/process_versioned_router.ts
+++ b/packages/kbn-router-to-openapispec/src/process_versioned_router.ts
@@ -14,6 +14,7 @@ import {
 } from '@kbn/core-http-router-server-internal';
 import type { RouteMethod, VersionedRouterRoute } from '@kbn/core-http-server';
 import type { OpenAPIV3 } from 'openapi-types';
+import { extractAuthzDescription } from './extract_authz_description';
 import type { GenerateOpenApiDocumentOptionsFilters } from './generate_oas';
 import type { OasConverter } from './oas_converter';
 import { isReferenceObject } from './oas_converter/common';
@@ -90,6 +91,13 @@ export const processVersionedRouter = (
         ];
       }
 
+      let description = '';
+      if (route.options.security) {
+        const authzDescription = extractAuthzDescription(route.options.security);
+
+        description = `${route.options.description ?? ''}${authzDescription ?? ''}`;
+      }
+
       const hasBody = Boolean(extractValidationSchemaFromVersionedHandler(handler)?.request?.body);
       const contentType = extractContentType(route.options.options?.body);
       const hasVersionFilter = Boolean(filters?.version);
@@ -98,6 +106,7 @@ export const processVersionedRouter = (
       const operation: OpenAPIV3.OperationObject = {
         summary: route.options.summary ?? '',
         tags: route.options.options?.tags ? extractTags(route.options.options.tags) : [],
+        ...(description ? { description } : {}),
         ...(route.options.description ? { description: route.options.description } : {}),
         ...(hasDeprecations ? { deprecated: true } : {}),
         ...(route.options.discontinued ? { 'x-discontinued': route.options.discontinued } : {}),
diff --git a/packages/kbn-router-to-openapispec/src/type.ts b/packages/kbn-router-to-openapispec/src/type.ts
index 5c5f992a0de0..f57e4d00ad7d 100644
--- a/packages/kbn-router-to-openapispec/src/type.ts
+++ b/packages/kbn-router-to-openapispec/src/type.ts
@@ -7,6 +7,7 @@
  * License v3.0 only", or the "Server Side Public License, v 1".
  */
 
+import type { Router } from '@kbn/core-http-router-server-internal';
 import type { OpenAPIV3 } from '../openapi-types';
 export type { OpenAPIV3 } from '../openapi-types';
 export interface KnownParameters {
@@ -39,3 +40,5 @@ export type CustomOperationObject = OpenAPIV3.OperationObject<{
   // Custom OpenAPI from ES API spec based on @availability
   'x-state'?: 'Technical Preview' | 'Beta';
 }>;
+
+export type InternalRouterRoute = ReturnType<Router['getRoutes']>[0];
diff --git a/packages/kbn-router-to-openapispec/tsconfig.json b/packages/kbn-router-to-openapispec/tsconfig.json
index d82ca0bf4891..3536a90a8256 100644
--- a/packages/kbn-router-to-openapispec/tsconfig.json
+++ b/packages/kbn-router-to-openapispec/tsconfig.json
@@ -17,6 +17,6 @@
     "@kbn/core-http-router-server-internal",
     "@kbn/core-http-server",
     "@kbn/config-schema",
-    "@kbn/zod"
+    "@kbn/zod",
   ]
 }
diff --git a/packages/kbn-search-connectors/components/configuration/connector_configuration_field.tsx b/packages/kbn-search-connectors/components/configuration/connector_configuration_field.tsx
index a43163caa609..08b91ffc1842 100644
--- a/packages/kbn-search-connectors/components/configuration/connector_configuration_field.tsx
+++ b/packages/kbn-search-connectors/components/configuration/connector_configuration_field.tsx
@@ -52,7 +52,7 @@ export const ConfigInputField: React.FC<ConfigInputFieldProps> = ({
   isLoading,
   validateAndSetConfigValue,
 }) => {
-  const { isValid, required, placeholder, value } = configEntry;
+  const { isValid, required, placeholder, value, label } = configEntry;
   const [innerValue, setInnerValue] = useState(value);
   return (
     <EuiFieldText
@@ -65,6 +65,7 @@ export const ConfigInputField: React.FC<ConfigInputFieldProps> = ({
         validateAndSetConfigValue(event.target.value);
       }}
       placeholder={placeholder}
+      aria-label={label}
     />
   );
 };
@@ -74,7 +75,7 @@ export const ConfigInputTextArea: React.FC<ConfigInputFieldProps> = ({
   configEntry,
   validateAndSetConfigValue,
 }) => {
-  const { isValid, required, placeholder, value } = configEntry;
+  const { isValid, required, placeholder, value, label } = configEntry;
   const [innerValue, setInnerValue] = useState(value);
   return (
     <EuiTextArea
@@ -88,6 +89,7 @@ export const ConfigInputTextArea: React.FC<ConfigInputFieldProps> = ({
         validateAndSetConfigValue(event.target.value);
       }}
       placeholder={placeholder}
+      aria-label={label}
     />
   );
 };
@@ -129,7 +131,7 @@ export const ConfigInputPassword: React.FC<ConfigInputFieldProps> = ({
   configEntry,
   validateAndSetConfigValue,
 }) => {
-  const { required, value } = configEntry;
+  const { required, value, label } = configEntry;
   const [innerValue, setInnerValue] = useState(value);
   return (
     <EuiFieldPassword
@@ -141,6 +143,7 @@ export const ConfigInputPassword: React.FC<ConfigInputFieldProps> = ({
         setInnerValue(event.target.value);
         validateAndSetConfigValue(event.target.value);
       }}
+      aria-label={label}
     />
   );
 };
@@ -170,6 +173,7 @@ export const ConnectorConfigurationField: React.FC<ConnectorConfigurationFieldPr
           onChange={(event) => {
             validateAndSetConfigValue(event.target.value);
           }}
+          aria-label={label}
         />
       ) : (
         <EuiRadioGroup
@@ -180,6 +184,7 @@ export const ConnectorConfigurationField: React.FC<ConnectorConfigurationFieldPr
           onChange={(id) => {
             validateAndSetConfigValue(id);
           }}
+          aria-label={label}
         />
       );
 
@@ -227,6 +232,7 @@ export const ConnectorConfigurationField: React.FC<ConnectorConfigurationFieldPr
                     onChange={(event) => {
                       validateAndSetConfigValue(event.target.checked);
                     }}
+                    aria-label={label}
                   />
                 </EuiFlexItem>
                 {!hasPlatinumLicense && (
diff --git a/x-pack/packages/kbn-cloud-security-posture/public/src/constants/component_constants.ts b/x-pack/packages/kbn-cloud-security-posture/public/src/constants/component_constants.ts
index 04a47f0fc12a..d4d436e981cc 100644
--- a/x-pack/packages/kbn-cloud-security-posture/public/src/constants/component_constants.ts
+++ b/x-pack/packages/kbn-cloud-security-posture/public/src/constants/component_constants.ts
@@ -9,4 +9,5 @@ import { euiThemeVars } from '@kbn/ui-theme';
 export const statusColors = {
   passed: euiThemeVars.euiColorSuccess,
   failed: euiThemeVars.euiColorVis9,
+  unknown: euiThemeVars.euiColorLightShade,
 };
diff --git a/x-pack/plugins/actions/server/lib/task_runner_factory.test.ts b/x-pack/plugins/actions/server/lib/task_runner_factory.test.ts
index 6c4cdd31ccf6..9733b56638d7 100644
--- a/x-pack/plugins/actions/server/lib/task_runner_factory.test.ts
+++ b/x-pack/plugins/actions/server/lib/task_runner_factory.test.ts
@@ -885,7 +885,8 @@ describe('Task Runner Factory', () => {
     expect(err).toBeDefined();
     expect(isRetryableError(err)).toEqual(false);
     expect(taskRunnerFactoryInitializerParams.logger.error as jest.Mock).toHaveBeenCalledWith(
-      `Action '2' failed: Error message`
+      `Action '2' failed: Error message`,
+      { tags: ['connector-run-failed', 'framework-error'] }
     );
     expect(getErrorSource(err)).toBe(TaskErrorSource.FRAMEWORK);
   });
@@ -934,7 +935,8 @@ describe('Task Runner Factory', () => {
 
     expect(err).toBeDefined();
     expect(taskRunnerFactoryInitializerParams.logger.error as jest.Mock).toHaveBeenCalledWith(
-      `Action '2' failed: Error message: Service message`
+      `Action '2' failed: Error message: Service message`,
+      { tags: ['connector-run-failed', 'framework-error'] }
     );
   });
 
@@ -1033,7 +1035,8 @@ describe('Task Runner Factory', () => {
     }
     expect(err).toBeDefined();
     expect(taskRunnerFactoryInitializerParams.logger.error as jest.Mock).toHaveBeenCalledWith(
-      `Action '2' failed: Fail`
+      `Action '2' failed: Fail`,
+      { tags: ['connector-run-failed', 'framework-error'] }
     );
     expect(thrownError).toEqual(err);
     expect(getErrorSource(err)).toBe(TaskErrorSource.FRAMEWORK);
@@ -1140,10 +1143,16 @@ describe('Task Runner Factory', () => {
 
     try {
       await taskRunner.run();
+      throw new Error('Should have thrown');
     } catch (e) {
       expect(mockedEncryptedSavedObjectsClient.getDecryptedAsInternalUser).toHaveBeenCalledTimes(1);
       expect(getErrorSource(e)).toBe(TaskErrorSource.FRAMEWORK);
       expect(e).toEqual(error);
+
+      expect(taskRunnerFactoryInitializerParams.logger.error).toHaveBeenCalledWith(
+        `Failed to load action task params ${mockedTaskInstance.params.actionTaskParamsId}: test`,
+        { tags: ['connector-run-failed', 'framework-error'] }
+      );
     }
   });
 });
diff --git a/x-pack/plugins/actions/server/lib/task_runner_factory.ts b/x-pack/plugins/actions/server/lib/task_runner_factory.ts
index d6b418c481ea..d067ddaaae7a 100644
--- a/x-pack/plugins/actions/server/lib/task_runner_factory.ts
+++ b/x-pack/plugins/actions/server/lib/task_runner_factory.ts
@@ -115,7 +115,8 @@ export class TaskRunnerFactory {
         } = await getActionTaskParams(
           actionTaskExecutorParams,
           encryptedSavedObjectsClient,
-          spaceIdToNamespace
+          spaceIdToNamespace,
+          logger
         );
 
         const { spaceId } = actionTaskExecutorParams;
@@ -139,12 +140,18 @@ export class TaskRunnerFactory {
             ...getSource(references, source),
           });
         } catch (e) {
-          logger.error(`Action '${actionId}' failed: ${e.message}`);
+          const errorSource =
+            e instanceof ActionTypeDisabledError
+              ? TaskErrorSource.USER
+              : getErrorSource(e) || TaskErrorSource.FRAMEWORK;
+          logger.error(`Action '${actionId}' failed: ${e.message}`, {
+            tags: ['connector-run-failed', `${errorSource}-error`],
+          });
           if (e instanceof ActionTypeDisabledError) {
             // We'll stop re-trying due to action being forbidden
-            throwUnrecoverableError(createTaskRunError(e, TaskErrorSource.USER));
+            throwUnrecoverableError(createTaskRunError(e, errorSource));
           }
-          throw createTaskRunError(e, getErrorSource(e) || TaskErrorSource.FRAMEWORK);
+          throw createTaskRunError(e, errorSource);
         }
 
         inMemoryMetrics.increment(IN_MEMORY_METRICS.ACTION_EXECUTIONS);
@@ -155,7 +162,9 @@ export class TaskRunnerFactory {
           if (executorResult.serviceMessage) {
             message = `${message}: ${executorResult.serviceMessage}`;
           }
-          logger.error(`Action '${actionId}' failed: ${message}`);
+          logger.error(`Action '${actionId}' failed: ${message}`, {
+            tags: ['connector-run-failed', `${executorResult.errorSource}-error`],
+          });
 
           // Task manager error handler only kicks in when an error thrown (at this time)
           // So what we have to do is throw when the return status is `error`.
@@ -175,7 +184,8 @@ export class TaskRunnerFactory {
         } = await getActionTaskParams(
           actionTaskExecutorParams,
           encryptedSavedObjectsClient,
-          spaceIdToNamespace
+          spaceIdToNamespace,
+          logger
         );
 
         const request = getFakeRequest(apiKey);
@@ -239,7 +249,8 @@ function getFakeRequest(apiKey?: string) {
 async function getActionTaskParams(
   executorParams: ActionTaskExecutorParams,
   encryptedSavedObjectsClient: EncryptedSavedObjectsClient,
-  spaceIdToNamespace: SpaceIdToNamespaceFunction
+  spaceIdToNamespace: SpaceIdToNamespaceFunction,
+  logger: Logger
 ): Promise<TaskParams> {
   const { spaceId } = executorParams;
   const namespace = spaceIdToNamespace(spaceId);
@@ -268,10 +279,17 @@ async function getActionTaskParams(
         },
       };
     } catch (e) {
+      const errorSource = SavedObjectsErrorHelpers.isNotFoundError(e)
+        ? TaskErrorSource.USER
+        : TaskErrorSource.FRAMEWORK;
+      logger.error(
+        `Failed to load action task params ${executorParams.actionTaskParamsId}: ${e.message}`,
+        { tags: ['connector-run-failed', `${errorSource}-error`] }
+      );
       if (SavedObjectsErrorHelpers.isNotFoundError(e)) {
-        throw createRetryableError(createTaskRunError(e, TaskErrorSource.USER), true);
+        throw createRetryableError(createTaskRunError(e, errorSource), true);
       }
-      throw createRetryableError(createTaskRunError(e, TaskErrorSource.FRAMEWORK), true);
+      throw createRetryableError(createTaskRunError(e, errorSource), true);
     }
   } else {
     return { attributes: executorParams.taskParams, references: executorParams.references ?? [] };
diff --git a/x-pack/plugins/cloud_security_posture/public/components/compliance_score_bar.test.tsx b/x-pack/plugins/cloud_security_posture/public/components/compliance_score_bar.test.tsx
new file mode 100644
index 000000000000..166fb1184e0b
--- /dev/null
+++ b/x-pack/plugins/cloud_security_posture/public/components/compliance_score_bar.test.tsx
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { render, screen } from '@testing-library/react';
+import { ComplianceScoreBar } from './compliance_score_bar';
+import {
+  COMPLIANCE_SCORE_BAR_UNKNOWN,
+  COMPLIANCE_SCORE_BAR_PASSED,
+  COMPLIANCE_SCORE_BAR_FAILED,
+} from './test_subjects';
+
+describe('<ComplianceScoreBar />', () => {
+  it('should display 0% compliance score with status unknown when both passed and failed are 0', () => {
+    render(<ComplianceScoreBar totalPassed={0} totalFailed={0} />);
+    expect(screen.getByText('0%')).toBeInTheDocument();
+    expect(screen.queryByTestId(COMPLIANCE_SCORE_BAR_UNKNOWN)).not.toBeNull();
+    expect(screen.queryByTestId(COMPLIANCE_SCORE_BAR_FAILED)).toBeNull();
+    expect(screen.queryByTestId(COMPLIANCE_SCORE_BAR_PASSED)).toBeNull();
+  });
+
+  it('should display 100% compliance score when passed is greater than 0 and failed is 0', () => {
+    render(<ComplianceScoreBar totalPassed={10} totalFailed={0} />);
+    expect(screen.getByText('100%')).toBeInTheDocument();
+    expect(screen.queryByTestId(COMPLIANCE_SCORE_BAR_PASSED)).not.toBeNull();
+    expect(screen.queryByTestId(COMPLIANCE_SCORE_BAR_FAILED)).toBeNull();
+    expect(screen.queryByTestId(COMPLIANCE_SCORE_BAR_UNKNOWN)).toBeNull();
+  });
+
+  it('should display 0% compliance score when passed is 0 and failed is greater than 0', () => {
+    render(<ComplianceScoreBar totalPassed={0} totalFailed={10} />);
+    expect(screen.getByText('0%')).toBeInTheDocument();
+    expect(screen.queryByTestId(COMPLIANCE_SCORE_BAR_FAILED)).not.toBeNull();
+    expect(screen.queryByTestId(COMPLIANCE_SCORE_BAR_PASSED)).toBeNull();
+    expect(screen.queryByTestId(COMPLIANCE_SCORE_BAR_UNKNOWN)).toBeNull();
+  });
+
+  it('should display 50% compliance score when passed is equal to failed', () => {
+    render(<ComplianceScoreBar totalPassed={5} totalFailed={5} />);
+    expect(screen.getByText('50%')).toBeInTheDocument();
+    expect(screen.queryByTestId(COMPLIANCE_SCORE_BAR_FAILED)).not.toBeNull();
+    expect(screen.queryByTestId(COMPLIANCE_SCORE_BAR_PASSED)).not.toBeNull();
+    expect(screen.queryByTestId(COMPLIANCE_SCORE_BAR_UNKNOWN)).toBeNull();
+  });
+});
diff --git a/x-pack/plugins/cloud_security_posture/public/components/compliance_score_bar.tsx b/x-pack/plugins/cloud_security_posture/public/components/compliance_score_bar.tsx
index d4acbc97ab10..382954282990 100644
--- a/x-pack/plugins/cloud_security_posture/public/components/compliance_score_bar.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/components/compliance_score_bar.tsx
@@ -11,7 +11,12 @@ import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { statusColors } from '@kbn/cloud-security-posture';
 import { calculatePostureScore } from '../../common/utils/helpers';
-import { CSP_FINDINGS_COMPLIANCE_SCORE } from './test_subjects';
+import {
+  CSP_FINDINGS_COMPLIANCE_SCORE,
+  COMPLIANCE_SCORE_BAR_UNKNOWN,
+  COMPLIANCE_SCORE_BAR_FAILED,
+  COMPLIANCE_SCORE_BAR_PASSED,
+} from './test_subjects';
 
 /**
  * This component will take 100% of the width set by the parent
@@ -59,12 +64,22 @@ export const ComplianceScoreBar = ({
               gap: 1px;
             `}
           >
+            {!totalPassed && !totalFailed && (
+              <EuiFlexItem
+                css={css`
+                  flex: 1;
+                  background: ${statusColors.unknown};
+                `}
+                data-test-subj={COMPLIANCE_SCORE_BAR_UNKNOWN}
+              />
+            )}
             {!!totalPassed && (
               <EuiFlexItem
                 css={css`
                   flex: ${totalPassed};
                   background: ${statusColors.passed};
                 `}
+                data-test-subj={COMPLIANCE_SCORE_BAR_PASSED}
               />
             )}
             {!!totalFailed && (
@@ -73,6 +88,7 @@ export const ComplianceScoreBar = ({
                   flex: ${totalFailed};
                   background: ${statusColors.failed};
                 `}
+                data-test-subj={COMPLIANCE_SCORE_BAR_FAILED}
               />
             )}
           </EuiFlexGroup>
diff --git a/x-pack/plugins/cloud_security_posture/public/components/test_subjects.ts b/x-pack/plugins/cloud_security_posture/public/components/test_subjects.ts
index d29971d3352e..b609950720ec 100644
--- a/x-pack/plugins/cloud_security_posture/public/components/test_subjects.ts
+++ b/x-pack/plugins/cloud_security_posture/public/components/test_subjects.ts
@@ -92,3 +92,7 @@ export const CIS_GCP_INPUT_FIELDS_TEST_SUBJECTS = {
 };
 
 export const SUBSCRIPTION_NOT_ALLOWED_TEST_SUBJECT = 'cloud_posture_page_subscription_not_allowed';
+
+export const COMPLIANCE_SCORE_BAR_UNKNOWN = 'complianceScoreBarUnknown';
+export const COMPLIANCE_SCORE_BAR_FAILED = 'complianceScoreBarFailed';
+export const COMPLIANCE_SCORE_BAR_PASSED = 'complianceScoreBarPassed';
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/configurations/latest_findings/latest_findings_group_renderer.test.tsx b/x-pack/plugins/cloud_security_posture/public/pages/configurations/latest_findings/latest_findings_group_renderer.test.tsx
new file mode 100644
index 000000000000..60aa64aa8814
--- /dev/null
+++ b/x-pack/plugins/cloud_security_posture/public/pages/configurations/latest_findings/latest_findings_group_renderer.test.tsx
@@ -0,0 +1,101 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { render } from '@testing-library/react';
+import { useEuiTheme } from '@elastic/eui';
+import { ComplianceBarComponent } from './latest_findings_group_renderer';
+import { RawBucket } from '@kbn/grouping/src';
+import { FindingsGroupingAggregation } from './use_grouped_findings';
+import { ComplianceScoreBar } from '../../../components/compliance_score_bar';
+
+jest.mock('@elastic/eui', () => {
+  const actual = jest.requireActual('@elastic/eui');
+  return {
+    ...actual,
+    useEuiTheme: jest.fn(),
+  };
+});
+
+jest.mock('../../../components/compliance_score_bar', () => ({
+  ComplianceScoreBar: jest.fn(() => null),
+}));
+
+jest.mock('../../../components/cloud_security_grouping');
+
+describe('<ComplianceBarComponent />', () => {
+  beforeEach(() => {
+    (useEuiTheme as jest.Mock).mockReturnValue({ euiTheme: { size: { s: 's' } } });
+    (ComplianceScoreBar as jest.Mock).mockClear();
+  });
+
+  it('renders ComplianceScoreBar with correct totalFailed and totalPassed, when total = failed+passed', () => {
+    const bucket = {
+      doc_count: 10,
+      failedFindings: {
+        doc_count: 4,
+      },
+      passedFindings: {
+        doc_count: 6,
+      },
+    } as RawBucket<FindingsGroupingAggregation>;
+
+    render(<ComplianceBarComponent bucket={bucket} />);
+
+    expect(ComplianceScoreBar).toHaveBeenCalledWith(
+      expect.objectContaining({
+        totalFailed: 4,
+        totalPassed: 6,
+      }),
+      {}
+    );
+  });
+
+  it('renders ComplianceScoreBar with correct totalFailed and totalPassed, when there are unknown findings', () => {
+    const bucket = {
+      doc_count: 10,
+      failedFindings: {
+        doc_count: 3,
+      },
+      passedFindings: {
+        doc_count: 6,
+      },
+    } as RawBucket<FindingsGroupingAggregation>;
+
+    render(<ComplianceBarComponent bucket={bucket} />);
+
+    expect(ComplianceScoreBar).toHaveBeenCalledWith(
+      expect.objectContaining({
+        totalFailed: 3,
+        totalPassed: 6,
+      }),
+      {}
+    );
+  });
+
+  it('renders ComplianceScoreBar with correct totalFailed and totalPassed, when there are no findings', () => {
+    const bucket = {
+      doc_count: 10,
+      failedFindings: {
+        doc_count: 0,
+      },
+      passedFindings: {
+        doc_count: 0,
+      },
+    } as RawBucket<FindingsGroupingAggregation>;
+
+    render(<ComplianceBarComponent bucket={bucket} />);
+
+    expect(ComplianceScoreBar).toHaveBeenCalledWith(
+      expect.objectContaining({
+        totalFailed: 0,
+        totalPassed: 0,
+      }),
+      {}
+    );
+  });
+});
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/configurations/latest_findings/latest_findings_group_renderer.tsx b/x-pack/plugins/cloud_security_posture/public/pages/configurations/latest_findings/latest_findings_group_renderer.tsx
index b4ad5d15ec8e..b41c5e4996db 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/configurations/latest_findings/latest_findings_group_renderer.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/pages/configurations/latest_findings/latest_findings_group_renderer.tsx
@@ -198,11 +198,15 @@ const FindingsCountComponent = ({ bucket }: { bucket: RawBucket<FindingsGrouping
 
 const FindingsCount = React.memo(FindingsCountComponent);
 
-const ComplianceBarComponent = ({ bucket }: { bucket: RawBucket<FindingsGroupingAggregation> }) => {
+export const ComplianceBarComponent = ({
+  bucket,
+}: {
+  bucket: RawBucket<FindingsGroupingAggregation>;
+}) => {
   const { euiTheme } = useEuiTheme();
 
   const totalFailed = bucket.failedFindings?.doc_count || 0;
-  const totalPassed = bucket.doc_count - totalFailed;
+  const totalPassed = bucket.passedFindings?.doc_count || 0;
   return (
     <ComplianceScoreBar
       size="l"
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agents_selection_status.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agents_selection_status.tsx
index 682aaa91af6b..618a7a6b8e11 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agents_selection_status.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agents_selection_status.tsx
@@ -7,7 +7,7 @@
 
 import React from 'react';
 import styled from 'styled-components';
-import { EuiFlexGroup, EuiFlexItem, EuiText, EuiButtonEmpty } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiText, EuiButtonEmpty, EuiIconTip } from '@elastic/eui';
 import { FormattedMessage, FormattedNumber } from '@kbn/i18n-react';
 
 import { SO_SEARCH_LIMIT } from '../../../../constants';
@@ -33,6 +33,7 @@ const Button = styled(EuiButtonEmpty)`
 
 export const AgentsSelectionStatus: React.FunctionComponent<{
   totalAgents: number;
+  totalManagedAgents: number;
   selectableAgents: number;
   managedAgentsOnCurrentPage: number;
   selectionMode: SelectionMode;
@@ -41,6 +42,7 @@ export const AgentsSelectionStatus: React.FunctionComponent<{
   setSelectedAgents: (agents: Agent[]) => void;
 }> = ({
   totalAgents,
+  totalManagedAgents,
   selectableAgents,
   managedAgentsOnCurrentPage,
   selectionMode,
@@ -71,11 +73,28 @@ export const AgentsSelectionStatus: React.FunctionComponent<{
                 }}
               />
             ) : (
-              <FormattedMessage
-                id="xpack.fleet.agentBulkActions.totalAgents"
-                defaultMessage="Showing {count, plural, one {# agent} other {# agents}}"
-                values={{ count: totalAgents }}
-              />
+              <>
+                <FormattedMessage
+                  id="xpack.fleet.agentBulkActions.totalAgents"
+                  defaultMessage="Showing {count, plural, one {# agent} other {# agents}}"
+                  values={{ count: totalAgents }}
+                />{' '}
+                <EuiIconTip
+                  type="iInCircle"
+                  content={
+                    <FormattedMessage
+                      data-test-subj="selectedAgentCountTooltip"
+                      id="xpack.fleet.agentBulkActions.agentsBreakDownTooltip"
+                      defaultMessage=" {totalAgents} total agents: {totalSelected} user-managed agents, {totalManagedAgents} on hosted policies"
+                      values={{
+                        totalAgents,
+                        totalManagedAgents,
+                        totalSelected: totalAgents - totalManagedAgents,
+                      }}
+                    />
+                  }
+                />
+              </>
             )}
           </EuiText>
         </EuiFlexItem>
@@ -96,7 +115,24 @@ export const AgentsSelectionStatus: React.FunctionComponent<{
                     selectionMode,
                     count: selectedAgents.length,
                   }}
-                />
+                />{' '}
+                {selectionMode === 'query' && (
+                  <EuiIconTip
+                    type="iInCircle"
+                    content={
+                      <FormattedMessage
+                        data-test-subj="selectedAgentCountTooltip"
+                        id="xpack.fleet.agentBulkActions.agentsSelectedTooltip"
+                        defaultMessage="{totalSelected} user-managed agents selected: {totalAgents} total agents, {totalManagedAgents} on hosted policies. Most actions are only available to user-managed agents."
+                        values={{
+                          totalAgents,
+                          totalManagedAgents,
+                          totalSelected: totalAgents - totalManagedAgents,
+                        }}
+                      />
+                    }
+                  />
+                )}
               </EuiText>
             </EuiFlexItem>
             {showSelectEverything ? (
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/bulk_actions.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/bulk_actions.tsx
index e0235fab0144..c5fd1c2caec8 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/bulk_actions.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/bulk_actions.tsx
@@ -77,7 +77,7 @@ export const AgentBulkActions: React.FunctionComponent<Props> = ({
   const [isRequestDiagnosticsModalOpen, setIsRequestDiagnosticsModalOpen] =
     useState<boolean>(false);
 
-  // update the query removing the "managed" agents
+  // update the query removing the "managed" agents in any state (unenrolled, offline, etc)
   const selectionQuery = useMemo(() => {
     if (totalManagedAgentIds.length) {
       const excludedKuery = `${AGENTS_PREFIX}.agent.id : (${totalManagedAgentIds
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/table_header.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/table_header.tsx
index bcac45801be0..48757ecebdd8 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/table_header.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/table_header.tsx
@@ -21,6 +21,7 @@ export const AgentTableHeader: React.FunctionComponent<{
   agentStatus?: { [k in SimplifiedAgentStatus]: number };
   totalAgents: number;
   selectableAgents: number;
+  totalManagedAgents: number;
   managedAgentsOnCurrentPage: number;
   selectionMode: SelectionMode;
   setSelectionMode: (mode: SelectionMode) => void;
@@ -31,6 +32,7 @@ export const AgentTableHeader: React.FunctionComponent<{
 }> = ({
   agentStatus,
   totalAgents,
+  totalManagedAgents,
   selectableAgents,
   managedAgentsOnCurrentPage,
   selectionMode,
@@ -47,6 +49,7 @@ export const AgentTableHeader: React.FunctionComponent<{
           <EuiFlexItem grow={false}>
             <AgentsSelectionStatus
               totalAgents={totalAgents}
+              totalManagedAgents={totalManagedAgents}
               selectableAgents={selectableAgents}
               managedAgentsOnCurrentPage={managedAgentsOnCurrentPage}
               selectionMode={selectionMode}
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/hooks/use_fetch_agents_data.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/hooks/use_fetch_agents_data.tsx
index 4ea03518620d..35233a5b79fe 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/hooks/use_fetch_agents_data.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/hooks/use_fetch_agents_data.tsx
@@ -306,14 +306,18 @@ export function useFetchAgentsData() {
             setTotalManagedAgentIds([]);
             setManagedAgentsOnCurrentPage(0);
           } else {
-            // Find all the agents that have managed policies and are not unenrolled
-            const policiesKuery = managedAgentPolicies
-              .map((policy) => `policy_id:"${policy.id}"`)
-              .join(' or ');
+            // Find all the agents that have managed policies
+            // to the correct ids we need to build the kuery applying the same filters as the global ones
+            const managedPoliciesKuery = getKuery({
+              search,
+              selectedAgentPolicies: managedAgentPolicies.map((policy) => policy.id),
+              selectedTags,
+              selectedStatus,
+            });
             const response = await sendGetAgents({
-              kuery: `NOT (status:unenrolled) and ${policiesKuery}`,
+              kuery: `${managedPoliciesKuery}`,
               perPage: SO_SEARCH_LIMIT,
-              showInactive: true,
+              showInactive,
             });
             if (response.error) {
               throw new Error(response.error.message);
@@ -350,7 +354,6 @@ export function useFetchAgentsData() {
       fetchDataAsync();
     },
     [
-      fullAgentPolicyFecher,
       pagination.currentPage,
       pagination.pageSize,
       kuery,
@@ -359,8 +362,12 @@ export function useFetchAgentsData() {
       showInactive,
       showUpgradeable,
       displayAgentMetrics,
+      fullAgentPolicyFecher,
       allTags,
       latestAgentActionErrors,
+      search,
+      selectedTags,
+      selectedStatus,
       notifications.toasts,
     ]
   );
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/index.tsx
index 51f3fe68a9d9..a4171a8d5197 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/index.tsx
@@ -434,6 +434,7 @@ export const AgentListPage: React.FunctionComponent<{}> = () => {
       {/* Agent total, bulk actions and status bar */}
       <AgentTableHeader
         totalAgents={nAgentsInTable}
+        totalManagedAgents={totalManagedAgentIds.length || 0}
         agentStatus={agentsStatus}
         selectableAgents={agentsOnCurrentPage?.filter(isAgentSelectable).length || 0}
         managedAgentsOnCurrentPage={managedAgentsOnCurrentPage}
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/alerts_automated_action_results.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/alerts_automated_action_results.cy.ts
index 1bc058b188fc..4c7c9663b2d4 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/alerts_automated_action_results.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/alerts_automated_action_results.cy.ts
@@ -11,8 +11,7 @@ import { checkActionItemsInResults, loadRuleAlerts } from '../../tasks/live_quer
 
 const UUID_REGEX = '[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}';
 
-// FLAKY: https://github.com/elastic/kibana/issues/169727
-describe.skip('Alert Flyout Automated Action Results', () => {
+describe('Alert Flyout Automated Action Results', () => {
   let ruleId: string;
 
   before(() => {
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/alerts_cases.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/alerts_cases.cy.ts
index 2dbd905b4df9..1817a81e4682 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/alerts_cases.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/alerts_cases.cy.ts
@@ -49,8 +49,7 @@ describe.skip('Alert Event Details - Cases', { tags: ['@ess', '@serverless'] },
     cleanupRule(ruleId);
   });
 
-  // FLAKY: https://github.com/elastic/kibana/issues/197151
-  describe.skip('Case creation', () => {
+  describe('Case creation', () => {
     let caseId: string;
 
     before(() => {
@@ -86,8 +85,7 @@ describe.skip('Alert Event Details - Cases', { tags: ['@ess', '@serverless'] },
     });
   });
 
-  // FLAKY: https://github.com/elastic/kibana/issues/176783
-  describe.skip('Case', () => {
+  describe('Case', () => {
     let caseId: string;
 
     beforeEach(() => {
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/alerts_linked_apps.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/alerts_linked_apps.cy.ts
index f7585d32a2bb..2b04a99bd4f9 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/alerts_linked_apps.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/alerts_linked_apps.cy.ts
@@ -18,9 +18,7 @@ import {
 import { closeModalIfVisible, closeToastIfVisible } from '../../tasks/integrations';
 import { RESULTS_TABLE, RESULTS_TABLE_BUTTON } from '../../screens/live_query';
 
-// Failing: See https://github.com/elastic/kibana/issues/181889
-// Failing: See https://github.com/elastic/kibana/issues/181889
-describe.skip(
+describe(
   'Alert Event Details',
   {
     tags: ['@ess', '@serverless', '@skipInServerlessMKI'],
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/alerts_multiple_agents.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/alerts_multiple_agents.cy.ts
index 4f6d30dd7143..95f0d947b8e8 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/alerts_multiple_agents.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/alerts_multiple_agents.cy.ts
@@ -15,8 +15,7 @@ import {
 } from '../../tasks/live_query';
 import { OSQUERY_FLYOUT_BODY_EDITOR } from '../../screens/live_query';
 
-// FLAKY: https://github.com/elastic/kibana/issues/170157
-describe.skip(
+describe(
   'Alert Event Details - dynamic params',
   {
     tags: ['@ess', '@serverless'],
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/ecs_mappings.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/ecs_mappings.cy.ts
index 89881c47083f..5330b7869e6f 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/ecs_mappings.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/ecs_mappings.cy.ts
@@ -18,8 +18,7 @@ import {
   typeInOsqueryFieldInput,
 } from '../../tasks/live_query';
 
-// Failing: See https://github.com/elastic/kibana/issues/192128
-describe.skip('EcsMapping', { tags: ['@ess', '@serverless'] }, () => {
+describe('EcsMapping', { tags: ['@ess', '@serverless'] }, () => {
   beforeEach(() => {
     initializeDataViews();
   });
diff --git a/x-pack/plugins/osquery/cypress/tasks/api_fixtures.ts b/x-pack/plugins/osquery/cypress/tasks/api_fixtures.ts
index 2b0db52f4569..4aa2879883b3 100644
--- a/x-pack/plugins/osquery/cypress/tasks/api_fixtures.ts
+++ b/x-pack/plugins/osquery/cypress/tasks/api_fixtures.ts
@@ -231,7 +231,7 @@ export const loadRule = (includeResponseActions = false) => {
       tags: [],
       license: '',
       interval: '1m',
-      from: 'now-120s',
+      from: 'now-360s',
       to: 'now',
       meta: { from: '1m', kibana_siem_app_url: 'http://localhost:5620/app/security' },
       actions: [],
diff --git a/x-pack/plugins/osquery/cypress/tasks/live_query.ts b/x-pack/plugins/osquery/cypress/tasks/live_query.ts
index c8ef18801013..910427272c5f 100644
--- a/x-pack/plugins/osquery/cypress/tasks/live_query.ts
+++ b/x-pack/plugins/osquery/cypress/tasks/live_query.ts
@@ -58,7 +58,7 @@ export const verifyQueryTimeout = (timeout: string) => {
 
 // sometimes the results get stuck in the tests, this is a workaround
 export const checkResults = () => {
-  cy.getBySel('osqueryResultsTable').then(($table) => {
+  cy.getBySel('osqueryResultsTable', { timeout: 120000 }).then(($table) => {
     if ($table.find('div .euiDataGridRow').length > 0) {
       cy.getBySel('dataGridRowCell', { timeout: 120000 }).should('have.lengthOf.above', 0);
     } else {
@@ -158,6 +158,7 @@ export const checkActionItemsInResults = ({
   cases: boolean;
   timeline: boolean;
 }) => {
+  checkResults();
   cy.contains('View in Discover').should(discover ? 'exist' : 'not.exist');
   cy.contains('View in Lens').should(lens ? 'exist' : 'not.exist');
   cy.contains('Add to Case').should(cases ? 'exist' : 'not.exist');
diff --git a/x-pack/plugins/security_solution/public/cloud_security_posture/components/misconfiguration/misconfiguration_preview.tsx b/x-pack/plugins/security_solution/public/cloud_security_posture/components/misconfiguration/misconfiguration_preview.tsx
index 433e493493e3..091179b40393 100644
--- a/x-pack/plugins/security_solution/public/cloud_security_posture/components/misconfiguration/misconfiguration_preview.tsx
+++ b/x-pack/plugins/security_solution/public/cloud_security_posture/components/misconfiguration/misconfiguration_preview.tsx
@@ -12,13 +12,12 @@ import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiText, useEuiTheme, EuiTitle }
 import { FormattedMessage } from '@kbn/i18n-react';
 import { DistributionBar } from '@kbn/security-solution-distribution-bar';
 import { useMisconfigurationPreview } from '@kbn/cloud-security-posture/src/hooks/use_misconfiguration_preview';
-import { euiThemeVars } from '@kbn/ui-theme';
 import { i18n } from '@kbn/i18n';
 import { ExpandablePanel } from '@kbn/security-solution-common';
 import { buildEntityFlyoutPreviewQuery } from '@kbn/cloud-security-posture-common';
 import { useExpandableFlyoutApi } from '@kbn/expandable-flyout';
 import { useVulnerabilitiesPreview } from '@kbn/cloud-security-posture/src/hooks/use_vulnerabilities_preview';
-import { hasVulnerabilitiesData } from '@kbn/cloud-security-posture';
+import { hasVulnerabilitiesData, statusColors } from '@kbn/cloud-security-posture';
 import { METRIC_TYPE } from '@kbn/analytics';
 import {
   ENTITY_FLYOUT_WITH_MISCONFIGURATION_VISIT,
@@ -51,7 +50,7 @@ export const getFindingsStats = (passedFindingsStats: number, failedFindingsStat
         }
       ),
       count: passedFindingsStats,
-      color: euiThemeVars.euiColorSuccess,
+      color: statusColors.passed,
     },
     {
       key: i18n.translate(
@@ -61,7 +60,7 @@ export const getFindingsStats = (passedFindingsStats: number, failedFindingsStat
         }
       ),
       count: failedFindingsStats,
-      color: euiThemeVars.euiColorVis9,
+      color: statusColors.failed,
     },
   ];
 };
@@ -70,14 +69,10 @@ const MisconfigurationPreviewScore = ({
   passedFindings,
   failedFindings,
   euiTheme,
-  numberOfPassedFindings,
-  numberOfFailedFindings,
 }: {
   passedFindings: number;
   failedFindings: number;
   euiTheme: EuiThemeComputed<{}>;
-  numberOfPassedFindings?: number;
-  numberOfFailedFindings?: number;
 }) => {
   return (
     <EuiFlexItem>
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/api/entity_store.ts b/x-pack/plugins/security_solution/public/entity_analytics/api/entity_store.ts
index 34789402c89a..54f5415d24a3 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/api/entity_store.ts
+++ b/x-pack/plugins/security_solution/public/entity_analytics/api/entity_store.ts
@@ -43,9 +43,10 @@ export const useEntityStoreRoutes = () => {
       });
     };
 
-    const deleteEntityEngine = async (entityType: EntityType) => {
+    const deleteEntityEngine = async (entityType: EntityType, deleteData: boolean) => {
       return http.fetch<DeleteEntityEngineResponse>(`/api/entity_store/engines/${entityType}`, {
         method: 'DELETE',
+        query: { data: deleteData },
         version: API_VERSIONS.public.v1,
       });
     };
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/hooks/use_entity_store.ts b/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/hooks/use_entity_store.ts
index 29e9e6c5098c..0ac684555fd0 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/hooks/use_entity_store.ts
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/hooks/use_entity_store.ts
@@ -110,7 +110,7 @@ export const useDeleteEntityEngineMutation = (options?: UseMutationOptions<{}>)
   const invalidateEntityEngineStatusQuery = useInvalidateEntityEngineStatusQuery();
   const { deleteEntityEngine } = useEntityStoreRoutes();
   return useMutation<DeleteEntityEngineResponse[]>(
-    () => Promise.all([deleteEntityEngine('user'), deleteEntityEngine('host')]),
+    () => Promise.all([deleteEntityEngine('user', true), deleteEntityEngine('host', true)]),
     {
       ...options,
       mutationKey: DELETE_ENTITY_ENGINE_STATUS_KEY,
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/automated_response_actions.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/automated_response_actions.cy.ts
index 887fa47d0391..86e07e65e83a 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/automated_response_actions.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/automated_response_actions.cy.ts
@@ -5,13 +5,13 @@
  * 2.0.
  */
 
+import { waitForAlertsToPopulate } from '@kbn/test-suites-xpack/security_solution_cypress/cypress/tasks/create_new_rule';
+import { login } from '../../tasks/login';
+import { waitForEndpointListPageToBeLoaded } from '../../tasks/response_console';
 import type { PolicyData } from '../../../../../common/endpoint/types';
-import { APP_ENDPOINTS_PATH } from '../../../../../common/constants';
 import { closeAllToasts } from '../../tasks/toasts';
 import { toggleRuleOffAndOn, visitRuleAlerts } from '../../tasks/isolate';
 import { cleanupRule, loadRule } from '../../tasks/api_fixtures';
-import { login } from '../../tasks/login';
-import { loadPage } from '../../tasks/common';
 import type { IndexedFleetEndpointPolicyResponse } from '../../../../../common/endpoint/data_loaders/index_fleet_endpoint_policy';
 import { createAgentPolicyTask, getEndpointIntegrationVersion } from '../../tasks/fleet';
 import { changeAlertsFilter } from '../../tasks/alerts';
@@ -38,21 +38,33 @@ describe(
     let indexedPolicy: IndexedFleetEndpointPolicyResponse;
     let policy: PolicyData;
     let createdHost: CreateAndEnrollEndpointHostResponse;
+    let ruleId: string;
+    let ruleName: string;
+    beforeEach(() => {
+      login();
+    });
 
     before(() => {
-      getEndpointIntegrationVersion().then((version) =>
-        createAgentPolicyTask(version, 'automated_response_actions').then((data) => {
-          indexedPolicy = data;
-          policy = indexedPolicy.integrationPolicies[0];
-
-          return enableAllPolicyProtections(policy.id).then(() => {
-            // Create and enroll a new Endpoint host
-            return createEndpointHost(policy.policy_ids[0]).then((host) => {
-              createdHost = host as CreateAndEnrollEndpointHostResponse;
+      getEndpointIntegrationVersion()
+        .then((version) =>
+          createAgentPolicyTask(version, 'automated_response_actions').then((data) => {
+            indexedPolicy = data;
+            policy = indexedPolicy.integrationPolicies[0];
+
+            return enableAllPolicyProtections(policy.id).then(() => {
+              // Create and enroll a new Endpoint host
+              return createEndpointHost(policy.policy_ids[0]).then((host) => {
+                createdHost = host as CreateAndEnrollEndpointHostResponse;
+              });
             });
+          })
+        )
+        .then(() => {
+          loadRule().then((data) => {
+            ruleId = data.id;
+            ruleName = data.name;
           });
-        })
-      );
+        });
     });
 
     after(() => {
@@ -67,48 +79,29 @@ describe(
       if (createdHost) {
         deleteAllLoadedEndpointData({ endpointAgentIds: [createdHost.agentId] });
       }
-    });
 
-    beforeEach(() => {
-      login();
+      if (ruleId) {
+        cleanupRule(ruleId);
+      }
     });
 
-    // FLAKY: https://github.com/elastic/kibana/issues/169828
-    describe.skip('From alerts', () => {
-      let ruleId: string;
-      let ruleName: string;
-
-      before(() => {
-        loadRule().then((data) => {
-          ruleId = data.id;
-          ruleName = data.name;
-        });
-      });
-
-      after(() => {
-        if (ruleId) {
-          cleanupRule(ruleId);
-        }
-      });
-
-      it('should have generated endpoint and rule', () => {
-        loadPage(APP_ENDPOINTS_PATH);
-        cy.contains(createdHost.hostname).should('exist');
+    it('should have been called against a created host', () => {
+      waitForEndpointListPageToBeLoaded(createdHost.hostname);
+      toggleRuleOffAndOn(ruleName);
 
-        toggleRuleOffAndOn(ruleName);
+      visitRuleAlerts(ruleName);
+      closeAllToasts();
 
-        visitRuleAlerts(ruleName);
-        closeAllToasts();
+      changeAlertsFilter(`process.name: "agentbeat" and agent.id: "${createdHost.agentId}"`);
+      waitForAlertsToPopulate();
 
-        changeAlertsFilter(`process.name: "agentbeat" and agent.id: "${createdHost.agentId}"`);
-        cy.getByTestSubj('expand-event').first().click();
-        cy.getByTestSubj('securitySolutionFlyoutNavigationExpandDetailButton').click();
-        cy.getByTestSubj('securitySolutionFlyoutResponseTab').click();
+      cy.getByTestSubj('expand-event').first().click();
+      cy.getByTestSubj('securitySolutionFlyoutNavigationExpandDetailButton').click();
+      cy.getByTestSubj('securitySolutionFlyoutResponseTab').click();
 
-        cy.contains(/isolate is pending|isolate completed successfully/g);
-        cy.contains(/kill-process is pending|kill-process completed successfully/g);
-        cy.contains('The action was called with a non-existing event field name: entity_id');
-      });
+      cy.contains(/isolate is pending|isolate completed successfully/g);
+      cy.contains(/kill-process is pending|kill-process completed successfully/g);
+      cy.contains('The action was called with a non-existing event field name: entity_id');
     });
   }
 );
diff --git a/x-pack/plugins/security_solution/public/management/cypress/tasks/api_fixtures.ts b/x-pack/plugins/security_solution/public/management/cypress/tasks/api_fixtures.ts
index 1bd0e5652b44..e6e44e7e5517 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/tasks/api_fixtures.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/tasks/api_fixtures.ts
@@ -55,7 +55,7 @@ export const loadRule = (body = {}, includeResponseActions = true) =>
       tags: [],
       license: '',
       interval: '1m',
-      from: 'now-120s',
+      from: 'now-360s',
       to: 'now',
       meta: { from: '1m', kibana_siem_app_url: 'http://localhost:5620/app/security' },
       actions: [],
diff --git a/x-pack/plugins/security_solution/public/management/cypress/tsconfig.json b/x-pack/plugins/security_solution/public/management/cypress/tsconfig.json
index 5d124d103525..c98336816490 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/tsconfig.json
+++ b/x-pack/plugins/security_solution/public/management/cypress/tsconfig.json
@@ -34,5 +34,6 @@
     "@kbn/security-solution-serverless",
     "@kbn/dev-utils",
     "@kbn/spaces-plugin",
+    "@kbn/test-suites-xpack/security_solution_cypress/cypress",
   ]
 }
diff --git a/x-pack/test_serverless/api_integration/test_suites/common/reporting/datastream.ts b/x-pack/test_serverless/api_integration/test_suites/common/reporting/datastream.ts
index 671b42f5a02a..f2b78426ec64 100644
--- a/x-pack/test_serverless/api_integration/test_suites/common/reporting/datastream.ts
+++ b/x-pack/test_serverless/api_integration/test_suites/common/reporting/datastream.ts
@@ -33,6 +33,9 @@ export default function ({ getService }: FtrProviderContext) {
   };
 
   describe('Data Stream', function () {
+    // see details: https://github.com/elastic/kibana/issues/197955
+    this.tags(['failsOnMKI']);
+
     const generatedReports = new Set<string>();
     before(async () => {
       roleAuthc = await svlUserManager.createM2mApiKeyWithRoleScope('admin');
diff --git a/x-pack/test_serverless/functional/test_suites/common/discover/x_pack/reporting.ts b/x-pack/test_serverless/functional/test_suites/common/discover/x_pack/reporting.ts
index 76c95ebbd890..c944865d0632 100644
--- a/x-pack/test_serverless/functional/test_suites/common/discover/x_pack/reporting.ts
+++ b/x-pack/test_serverless/functional/test_suites/common/discover/x_pack/reporting.ts
@@ -58,7 +58,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     return res;
   };
 
-  describe('Discover CSV Export', () => {
+  describe('Discover CSV Export', function () {
+    // see details: https://github.com/elastic/kibana/issues/197957
+    this.tags(['failsOnMKI']);
     describe('Check Available', () => {
       before(async () => {
         await PageObjects.svlCommonPage.loginAsAdmin();