From 5d0f5867d1b378a5511390b48a197b41d9c9cbd7 Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Tue, 8 Oct 2024 16:36:18 +0200
Subject: [PATCH 01/16] incremental fix

---
 .../query_tab_unified_components.test.tsx     |  7 +++
 .../timelines/data_providers.cy.ts            | 27 ++++------
 .../timelines/esql/search_filter.cy.ts        |  5 +-
 .../e2e/investigations/timelines/export.cy.ts |  2 +-
 .../cypress/screens/timeline.ts               | 18 ++++---
 .../cypress/tasks/timeline.ts                 | 52 +++++++++----------
 6 files changed, 57 insertions(+), 54 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/query_tab_unified_components.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/query_tab_unified_components.test.tsx
index 107c166183647..a6a2bd0b397a3 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/query_tab_unified_components.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/query_tab_unified_components.test.tsx
@@ -1207,4 +1207,11 @@ describe('query tab with unified timeline', () => {
       );
     });
   });
+
+
+  describe('Hover Actions',()=>{
+    describe('Add to Timeline', ()=>{
+
+    })
+  })
 });
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/data_providers.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/data_providers.cy.ts
index 609dd0081f87e..691a0457d8cb7 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/data_providers.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/data_providers.cy.ts
@@ -9,8 +9,8 @@ import {
   TIMELINE_DROPPED_DATA_PROVIDERS,
   TIMELINE_DATA_PROVIDERS_ACTION_MENU,
   TIMELINE_FLYOUT_HEADER,
-  GET_TIMELINE_GRID_CELL,
   TIMELINE_DATA_PROVIDERS_CONTAINER,
+  GET_TIMELINE_GRID_CELL_VALUE,
 } from '../../../screens/timeline';
 
 import { waitForAllHostsToBeLoaded } from '../../../tasks/hosts/all_hosts';
@@ -19,7 +19,6 @@ import { login } from '../../../tasks/login';
 import { visitWithTimeRange } from '../../../tasks/navigation';
 import {
   addDataProvider,
-  updateDataProviderbyDraggingField,
   addNameAndDescriptionToTimeline,
   populateTimeline,
   createTimelineFromBottomBar,
@@ -28,12 +27,14 @@ import {
 } from '../../../tasks/timeline';
 import { getTimeline } from '../../../objects/timeline';
 import { hostsUrl } from '../../../urls/navigation';
+import { LOADING_INDICATOR } from '../../../screens/security_header';
 
 // FLAKY: https://github.com/elastic/kibana/issues/176945
 const mockTimeline = getTimeline();
-describe.skip('Timeline data providers', { tags: ['@ess', '@serverless'] }, () => {
+describe('Timeline data providers', { tags: ['@ess', '@serverless'] }, () => {
   beforeEach(() => {
     login();
+    cy.intercept('PATCH', '/api/timeline').as('updateTimeline');
     visitWithTimeRange(hostsUrl('allHosts'));
     waitForAllHostsToBeLoaded();
     createTimelineFromBottomBar();
@@ -53,28 +54,20 @@ describe.skip('Timeline data providers', { tags: ['@ess', '@serverless'] }, () =
     cy.get(TIMELINE_DATA_PROVIDERS_ACTION_MENU).should('exist');
   });
 
-  it('should persist timeline when data provider is updated by dragging a field from data grid', () => {
-    updateDataProviderbyDraggingField('host.name', 0);
-    saveTimeline();
-    cy.reload();
-    cy.get(`${GET_TIMELINE_GRID_CELL('host.name')}`)
-      .first()
-      .then((hostname) => {
-        cy.get(TIMELINE_DATA_PROVIDERS_CONTAINER).contains(`host.name: "${hostname.text()}"`);
-      });
-  });
-
-  it('should persist timeline when a field is added by hover action "Add To Timeline" in data provider ', () => {
+  it.only('should persist timeline when a field is added by hover action "Add To Timeline" in data provider ', () => {
     addDataProvider({ field: 'host.name', operator: 'exists' });
     saveTimeline();
+    cy.wait('@updateTimeline');
+    cy.get(LOADING_INDICATOR).should('not.exist');
     updateDataProviderByFieldHoverAction('host.name', 0);
     saveTimeline();
+    cy.wait('@updateTimeline');
     cy.reload();
-    cy.get(`${GET_TIMELINE_GRID_CELL('host.name')}`)
+    cy.get(`${GET_TIMELINE_GRID_CELL_VALUE('host.name')}`)
       .first()
       .then((hostname) => {
         cy.get(TIMELINE_DATA_PROVIDERS_CONTAINER).should((dataProviderContainer) => {
-          expect(dataProviderContainer).to.contain(`host.name: "${hostname.text()}"`);
+          expect(dataProviderContainer).to.contain(`host.name: "${hostname.text().trim()}"`);
         });
       });
   });
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts
index 0009351852176..cb0dcbb635c3e 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts
@@ -38,8 +38,7 @@ const INITIAL_END_DATE = 'Jan 19, 2024 @ 20:33:29.186';
 const NEW_START_DATE = 'Jan 18, 2023 @ 20:33:29.186';
 const esqlQuery = 'from auditbeat-* | where ecs.version == "8.0.0"';
 
-// FLAKY: https://github.com/elastic/kibana/issues/175180
-describe.skip(
+describe(
   'Basic esql search and filter operations',
   {
     tags: ['@ess'],
@@ -72,7 +71,7 @@ describe.skip(
       cy.get(GET_DISCOVER_DATA_GRID_CELL_HEADER('user.name')).should('be.visible');
     });
 
-    it('should remove the query when the back button is pressed after adding a query', () => {
+    it.only('should remove the query when the back button is pressed after adding a query', () => {
       addDiscoverEsqlQuery(esqlQuery);
       cy.get(DISCOVER_ESQL_INPUT_TEXT_CONTAINER).then((subj) => {
         const currentQuery = subj.text();
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/export.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/export.cy.ts
index c28f0ed90d8c5..ca25f7f4ccc5c 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/export.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/export.cy.ts
@@ -42,7 +42,7 @@ describe.skip('Export timelines', { tags: ['@ess', '@serverless'] }, () => {
     visit(TIMELINES_URL);
   });
 
-  it('should export custom timeline(s)', function () {
+  it.only('should export custom timeline(s)', function () {
     cy.log('Export a custom timeline via timeline actions');
 
     exportTimeline(this.timelineId1);
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/timeline.ts b/x-pack/test/security_solution_cypress/cypress/screens/timeline.ts
index 96bd20dbd29dc..a02362a9d2cf7 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/timeline.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/timeline.ts
@@ -277,8 +277,13 @@ export const ALERT_TABLE_FILE_NAME_VALUES = `${ALERT_TABLE_FILE_NAME_HEADER}[dat
 
 export const ACTIVE_TIMELINE_BOTTOM_BAR = '[data-test-subj="timeline-bottom-bar-title-button"]';
 
+// timeline table grid cell
 export const GET_TIMELINE_GRID_CELL = (fieldName: string) =>
-  `[data-test-subj="draggable-content-${fieldName}"]`;
+  `[data-test-subj="dataGridRowCell"][data-gridcell-column-id="${fieldName}"]`;
+
+// actual content within timeline table grid cell without screenreader text
+export const GET_TIMELINE_GRID_CELL_VALUE = (fieldName: string) =>
+  `[data-test-subj="dataGridRowCell"][data-gridcell-column-id="${fieldName}"] .unifiedDataTable__cellValue`;
 
 export const EMPTY_DROPPABLE_DATA_PROVIDER_GROUP = `.empty-providers-group`;
 
@@ -289,11 +294,12 @@ export const TIMELINE_VIEW_IN_ANALYZER = '[data-test-subj="view-in-analyzer"]';
 export const EMPTY_DATA_PROVIDER_AREA = `.timeline-drop-area-empty`;
 
 export const HOVER_ACTIONS = {
-  ADD_TO_TIMELINE: '[data-test-subj="actionItem-security-default-cellActions-addToTimeline"]',
-  FILTER_FOR: '[data-test-subj="actionItem-security-default-cellActions-filterIn"]',
-  FILTER_OUT: '[data-test-subj="actionItem-security-default-cellActions-filterOut"]',
-  COPY: '[data-test-subj="actionItem-security-default-cellActions-copyToClipboard"]',
-  SHOW_TOP: '[data-test-subj="actionItem-security-default-cellActions-showTopN"]',
+  ADD_TO_TIMELINE:
+    '[data-test-subj="dataGridColumnCellAction-security-default-cellActions-addToTimeline"]',
+  FILTER_FOR: '[data-test-subj="dataGridColumnCellAction-security-default-cellActions-filterIn"]',
+  FILTER_OUT: '[data-test-subj="dataGridColumnCellAction-security-default-cellActions-filterOut"]',
+  COPY: '[data-test-subj="dataGridColumnCellAction-security-default-cellActions-copyToClipboard"]',
+  SHOW_TOP: '[data-test-subj="dataGridColumnCellAction-security-default-cellActions-showTopN"]',
 };
 
 export const TIMELINE_FILTER_BADGE_ENABLED = '[data-test-subj~="filter-enabled"]';
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/timeline.ts b/x-pack/test/security_solution_cypress/cypress/tasks/timeline.ts
index 9f37436d69bf6..511ca3df0d8a6 100644
--- a/x-pack/test/security_solution_cypress/cypress/tasks/timeline.ts
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/timeline.ts
@@ -98,6 +98,8 @@ import { drag, drop, waitForTabToBeLoaded } from './common';
 
 import { closeFieldsBrowser, filterFieldsBrowser } from './fields_browser';
 import { TIMELINE_CONTEXT_MENU_BTN } from '../screens/alerts';
+import { LOADING_INDICATOR } from '../screens/security_header';
+import { TOASTER } from '../screens/alerts_detection_rules';
 
 const hostExistsQuery = 'host.name: *';
 
@@ -121,6 +123,16 @@ export const addNameToTimelineAndSaveAsNew = (name: string) => {
   cy.get(TIMELINE_TITLE_INPUT).should('not.exist');
 };
 
+export const openSaveTimelineModal = () =>{
+  recurse(()=>{
+  cy.get(SAVE_TIMELINE_ACTION)
+
+    return cy.get(TIMELINE_TITLE_INPUT)
+  },
+    (sub) => sub.is(':visible')
+  )
+}
+
 export const addNameAndDescriptionToTimeline = (
   timeline: Timeline,
   modalAlreadyOpen: boolean = false
@@ -239,38 +251,18 @@ export const addDataProvider = (filter: TimelineFilter): Cypress.Chainable<JQuer
   return cy.get(SAVE_DATA_PROVIDER_BTN).click();
 };
 
-export const updateDataProviderbyDraggingField = (fieldName: string, rowNumber: number) => {
-  const dragTargetSelector = GET_TIMELINE_GRID_CELL(fieldName);
-  cy.get(dragTargetSelector)
-    .eq(rowNumber)
-    .then((currentSubject) => {
-      drag(currentSubject);
-    });
-  let dropTarget: Cypress.Chainable<JQuery<HTMLElement>>;
-
-  cy.get('body').then((body) => {
-    if (body.find(EMPTY_DATA_PROVIDER_AREA).length > 0) {
-      dropTarget = cy.get(EMPTY_DATA_PROVIDER_AREA);
-    } else {
-      dropTarget = cy.get(EMPTY_DROPPABLE_DATA_PROVIDER_GROUP);
-    }
-
-    dropTarget.then((currentEl) => {
-      drop(currentEl);
-    });
-  });
-};
-
 export const updateDataProviderByFieldHoverAction = (fieldName: string, rowNumber: number) => {
   const fieldSelector = GET_TIMELINE_GRID_CELL(fieldName);
-  cy.get(fieldSelector).eq(rowNumber).trigger('mouseover');
-  cy.get(HOVER_ACTIONS.ADD_TO_TIMELINE).should('be.visible');
+  cy.get(fieldSelector).eq(rowNumber).should('be.visible').realHover();
+cy.get(HOVER_ACTIONS.ADD_TO_TIMELINE).should('be.visible')
+
   recurse(
     () => {
-      cy.get(HOVER_ACTIONS.ADD_TO_TIMELINE).click();
-      return cy.root();
+
+       cy.get(HOVER_ACTIONS.ADD_TO_TIMELINE).click();
+      return cy.root()
     },
-    ($el) => $el.find(HOVER_ACTIONS.ADD_TO_TIMELINE).length === 0
+    ($el) => $el.find(TOASTER).text().startsWith('Added ')
   );
 };
 
@@ -312,7 +304,11 @@ export const createNewTimeline = () => {
 };
 
 export const openCreateTimelineOptionsPopover = () => {
+  recurse(()=> {
   cy.get(NEW_TIMELINE_ACTION).filter(':visible').click();
+  return cy.get(CREATE_NEW_TIMELINE);
+  },
+    (sub) => sub.is(':visible'))
 };
 
 export const createTimelineFromBottomBar = () => {
@@ -368,6 +364,8 @@ export const saveTimeline = () => {
 
     cy.get(TIMELINE_PROGRESS_BAR).should('exist');
     cy.get(TIMELINE_PROGRESS_BAR).should('not.exist');
+
+  cy.get(LOADING_INDICATOR).should('not.exist');
   });
 };
 

From 9be79ffd7f8d60c49ea4d322551590b31885066b Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Wed, 9 Oct 2024 17:13:44 +0200
Subject: [PATCH 02/16] Enables timeline export cypress tests

It looks like previous test was disabled or erring out because of some
kind of 403 error from the server. Not sure what was the reason at the
time.

I think test should work as it is now.
---
 .../cypress/e2e/investigations/timelines/export.cy.ts    | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/export.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/export.cy.ts
index ca25f7f4ccc5c..89545c1cf0834 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/export.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/export.cy.ts
@@ -23,7 +23,7 @@ import { expectedExportedTimeline } from '../../../objects/timeline';
 import { closeToast } from '../../../tasks/common/toast';
 
 // FLAKY: https://github.com/elastic/kibana/issues/187550
-describe.skip('Export timelines', { tags: ['@ess', '@serverless'] }, () => {
+describe('Export timelines', { tags: ['@ess', '@serverless'] }, () => {
   beforeEach(() => {
     login();
     deleteTimelines();
@@ -42,7 +42,11 @@ describe.skip('Export timelines', { tags: ['@ess', '@serverless'] }, () => {
     visit(TIMELINES_URL);
   });
 
-  it.only('should export custom timeline(s)', function () {
+  /**
+   *  TODO: Good candidate for converting to a jest Test
+   *  https://github.com/elastic/kibana/issues/195612
+   */
+  it('should export custom timeline(s)', function () {
     cy.log('Export a custom timeline via timeline actions');
 
     exportTimeline(this.timelineId1);
@@ -60,6 +64,7 @@ describe.skip('Export timelines', { tags: ['@ess', '@serverless'] }, () => {
       cy.wrap(response?.statusCode).should('eql', 200);
       cy.wrap(response?.body).should('eql', expectedExportedTimeline(this.timelineResponse1));
     });
+
     closeToast();
 
     cy.log('Export all custom timelines via bulk actions');

From 4f04a2eb9ce0fd1db38f925a28a1d288047fcbc3 Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Wed, 9 Oct 2024 17:14:46 +0200
Subject: [PATCH 03/16] fix: discover integration test

---
 .../esql/discover_timeline_state_integration.cy.ts   | 12 ++++++------
 .../cypress/tasks/discover.ts                        |  4 ++++
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/discover_timeline_state_integration.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/discover_timeline_state_integration.cy.ts
index 8e45d23d35433..4e1e706e5a807 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/discover_timeline_state_integration.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/discover_timeline_state_integration.cy.ts
@@ -18,6 +18,7 @@ import {
 import {
   addDiscoverEsqlQuery,
   addFieldToTable,
+  assertFieldsAreLoaded,
   verifyDiscoverEsqlQuery,
 } from '../../../../tasks/discover';
 import {
@@ -70,7 +71,7 @@ const handleIntercepts = () => {
 };
 
 // Failing: See https://github.com/elastic/kibana/issues/180755
-describe.skip(
+describe(
   'Discover Timeline State Integration',
   {
     tags: ['@ess', '@skipInServerless'],
@@ -81,6 +82,7 @@ describe.skip(
       visitWithTimeRange(ALERTS_URL);
       createTimelineFromBottomBar();
       goToEsqlTab();
+      addDiscoverEsqlQuery(esqlQuery);
       updateDateRangeInLocalDatePickers(DISCOVER_CONTAINER, INITIAL_START_DATE, INITIAL_END_DATE);
       handleIntercepts();
     });
@@ -90,17 +92,14 @@ describe.skip(
         addNameToTimelineAndSave('Timerange timeline');
         createNewTimeline();
         goToEsqlTab();
-        cy.get(GET_LOCAL_SHOW_DATES_BUTTON(DISCOVER_CONTAINER)).should(
-          'contain.text',
-          `Last 15 minutes`
-        );
+        cy.get(GET_LOCAL_SHOW_DATES_BUTTON(DISCOVER_CONTAINER)).should('be.disabled'); // default state
       });
       it('should save/restore esql tab dataview/timerange/filter/query/columns when saving/resoring timeline', () => {
         const timelineSuffix = Date.now();
         const timelineName = `DataView timeline-${timelineSuffix}`;
         const column1 = 'event.category';
         const column2 = 'ecs.version';
-        addDiscoverEsqlQuery(esqlQuery);
+        assertFieldsAreLoaded();
         addFieldToTable(column1);
         addFieldToTable(column2);
 
@@ -132,6 +131,7 @@ describe.skip(
         const column1 = 'event.category';
         const column2 = 'ecs.version';
         addDiscoverEsqlQuery(esqlQuery);
+        assertFieldsAreLoaded();
         addFieldToTable(column1);
         addFieldToTable(column2);
 
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts b/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts
index 1034922383a40..39a24083e0aa9 100644
--- a/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts
@@ -43,6 +43,10 @@ export const waitForDiscoverGridToLoad = () => {
   cy.get(DISCOVER_FIELD_LIST_LOADING).should('not.exist');
 };
 
+export const assertFieldsAreLoaded = () => {
+  cy.get(DISCOVER_FIELD_LIST_LOADING).should('not.exist');
+};
+
 export const fillEsqlQueryBar = (query: string) => {
   // eslint-disable-next-line cypress/no-force
   cy.get(DISCOVER_ESQL_EDITABLE_INPUT).type(query, { force: true });

From ed8c68ee5a4199559dde2bc08ee476bab40c1de9 Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Wed, 9 Oct 2024 17:45:05 +0200
Subject: [PATCH 04/16] ESQL state part 1

---
 .../timelines/esql/esql_state.cy.ts           | 41 +++++++++++++------
 1 file changed, 28 insertions(+), 13 deletions(-)

diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/esql_state.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/esql_state.cy.ts
index b8db1dacd03e1..e263a87cd1020 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/esql_state.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/esql_state.cy.ts
@@ -25,7 +25,7 @@ import {
   goToEsqlTab,
   openActiveTimeline,
   addNameAndDescriptionToTimeline,
-  saveTimeline,
+  addNameToTimelineAndSave,
 } from '../../../../tasks/timeline';
 import { ALERTS_URL } from '../../../../urls/navigation';
 import { getTimeline } from '../../../../objects/timeline';
@@ -35,8 +35,27 @@ const INITIAL_START_DATE = 'Jan 18, 2021 @ 20:33:29.186';
 const INITIAL_END_DATE = 'Jan 19, 2024 @ 20:33:29.186';
 
 const mockTimeline = getTimeline();
-// FAILURE introduced by the fix for 8.11.4 related to the default empty string and fix for the infinite loop on the esql tab
-describe.skip(
+const esqlQuery = 'from auditbeat-* | limit 5';
+
+const TIMELINE_REQ_WITH_SAVED_SEARCH = 'TIMELINE_REQ_WITH_SAVED_SEARCH';
+const TIMELINE_PATCH_REQ = 'TIMELINE_PATCH_REQ';
+const TIMELINE_RESPONSE_SAVED_OBJECT_ID_PATH =
+  'response.body.data.persistTimeline.timeline.savedObjectId';
+
+const handleIntercepts = () => {
+  cy.intercept('PATCH', '/api/timeline', (req) => {
+    if (Object.hasOwn(req.body, 'timeline') && req.body.timeline.savedSearchId === null) {
+      req.alias = TIMELINE_PATCH_REQ;
+    }
+  });
+  cy.intercept('PATCH', '/api/timeline', (req) => {
+    if (Object.hasOwn(req.body, 'timeline') && req.body.timeline.savedSearchId !== null) {
+      req.alias = TIMELINE_REQ_WITH_SAVED_SEARCH;
+    }
+  });
+};
+
+describe(
   'Timeline Discover ESQL State',
   {
     tags: ['@ess'],
@@ -50,33 +69,29 @@ describe.skip(
         win.onbeforeunload = null;
       });
       goToEsqlTab();
+      addDiscoverEsqlQuery(esqlQuery);
       updateDateRangeInLocalDatePickers(DISCOVER_CONTAINER, INITIAL_START_DATE, INITIAL_END_DATE);
+      handleIntercepts();
     });
     it('should not allow the dataview to be changed', () => {
       cy.get(DISCOVER_DATA_VIEW_SWITCHER.BTN).should('not.exist');
     });
-    it('should remember esql query when navigating away and back to discover ', () => {
-      const esqlQuery = 'from auditbeat-* | limit 5';
-      addDiscoverEsqlQuery(esqlQuery);
+    it.skip('should remember esql query when navigating away and back to discover ', () => {
       submitDiscoverSearchBar();
-      addNameAndDescriptionToTimeline(mockTimeline);
-      saveTimeline();
+      addNameToTimelineAndSave(mockTimeline.title);
+      cy.wait(`@${TIMELINE_REQ_WITH_SAVED_SEARCH}`);
       closeTimeline();
       navigateFromHeaderTo(CSP_FINDINGS);
       navigateFromHeaderTo(ALERTS);
       openActiveTimeline();
       goToEsqlTab();
-
       verifyDiscoverEsqlQuery(esqlQuery);
     });
     it('should remember columns when navigating away and back to discover ', () => {
-      const esqlQuery = 'from auditbeat-* | limit 5';
-      addDiscoverEsqlQuery(esqlQuery);
       submitDiscoverSearchBar();
-      addNameAndDescriptionToTimeline(mockTimeline);
       addFieldToTable('host.name');
       addFieldToTable('user.name');
-      saveTimeline();
+      addNameAndDescriptionToTimeline(mockTimeline);
       closeTimeline();
       navigateFromHeaderTo(CSP_FINDINGS);
       navigateFromHeaderTo(ALERTS);

From f211dbfff1ab998206eae4f8fe2f9a21757ba565 Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Thu, 10 Oct 2024 10:37:12 +0200
Subject: [PATCH 05/16] fix: row renderer

---
 .../timelines/row_renderers.cy.ts             | 24 ++++++---
 .../cypress/screens/timeline.ts               |  3 ++
 .../cypress/tasks/timeline.ts                 | 51 +++++++++++--------
 3 files changed, 51 insertions(+), 27 deletions(-)

diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/row_renderers.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/row_renderers.cy.ts
index b27ea9fcc6a81..ebc3591adfe15 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/row_renderers.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/row_renderers.cy.ts
@@ -23,12 +23,16 @@ import { waitForAllHostsToBeLoaded } from '../../../tasks/hosts/all_hosts';
 import { login } from '../../../tasks/login';
 import { visitWithTimeRange } from '../../../tasks/navigation';
 import { openTimelineUsingToggle } from '../../../tasks/security_main';
-import { addNameToTimelineAndSave, populateTimeline, saveTimeline } from '../../../tasks/timeline';
+import {
+  addNameToTimelineAndSave,
+  enableAllRowRenderersWithSwitch,
+  populateTimeline,
+  saveTimeline,
+} from '../../../tasks/timeline';
 
 import { hostsUrl } from '../../../urls/navigation';
 
-// FLAKY: https://github.com/elastic/kibana/issues/182021
-describe.skip('Row renderers', { tags: ['@ess', '@serverless'] }, () => {
+describe('Row renderers', { tags: ['@ess', '@serverless'] }, () => {
   beforeEach(() => {
     deleteTimelines();
     login();
@@ -42,16 +46,19 @@ describe.skip('Row renderers', { tags: ['@ess', '@serverless'] }, () => {
     });
     openTimelineUsingToggle();
     populateTimeline();
-    cy.get(TIMELINE_SHOW_ROW_RENDERERS_GEAR).should('exist');
-    cy.get(TIMELINE_SHOW_ROW_RENDERERS_GEAR).first().click({ force: true });
   });
 
-  it('Row renderers should be enabled by default', () => {
+  it('Row renderers should be disabled by default', () => {
+    cy.get(TIMELINE_SHOW_ROW_RENDERERS_GEAR).should('exist');
+    cy.get(TIMELINE_SHOW_ROW_RENDERERS_GEAR).first().click();
     cy.get(TIMELINE_ROW_RENDERERS_MODAL_ITEMS_CHECKBOX).should('exist');
-    cy.get(TIMELINE_ROW_RENDERERS_MODAL_ITEMS_CHECKBOX).should('be.checked');
+    cy.get(TIMELINE_ROW_RENDERERS_MODAL_ITEMS_CHECKBOX).should('not.be.checked');
   });
 
   it('Selected renderer can be disabled and enabled', () => {
+    enableAllRowRenderersWithSwitch();
+    cy.get(TIMELINE_SHOW_ROW_RENDERERS_GEAR).should('exist');
+    cy.get(TIMELINE_SHOW_ROW_RENDERERS_GEAR).first().click();
     cy.get(TIMELINE_ROW_RENDERERS_SEARCHBOX).should('exist');
     cy.get(TIMELINE_ROW_RENDERERS_SEARCHBOX).type('flow');
 
@@ -95,6 +102,9 @@ describe.skip('Row renderers', { tags: ['@ess', '@serverless'] }, () => {
   it('Selected renderer can be disabled with one click', () => {
     // Ensure these elements are visible before continuing since sometimes it takes a second for the modal to show up
     // and it gives the click handlers a bit of time to be initialized as well to reduce chances of flake
+    enableAllRowRenderersWithSwitch();
+    cy.get(TIMELINE_SHOW_ROW_RENDERERS_GEAR).should('exist');
+    cy.get(TIMELINE_SHOW_ROW_RENDERERS_GEAR).first().click();
     cy.get(TIMELINE_ROW_RENDERERS_DISABLE_ALL_BTN).should('exist');
     cy.get(TIMELINE_ROW_RENDERERS_MODAL_ITEMS_CHECKBOX).should('be.checked');
 
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/timeline.ts b/x-pack/test/security_solution_cypress/cypress/screens/timeline.ts
index a02362a9d2cf7..66fe11bb2dfd3 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/timeline.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/timeline.ts
@@ -257,6 +257,9 @@ export const TIMELINE_ROW_RENDERERS_SURICATA_SIGNATURE_TOOLTIP = `[data-test-sub
 
 export const TIMELINE_SHOW_ROW_RENDERERS_GEAR = '[data-test-subj="show-row-renderers-gear"]';
 
+export const TIMELINE_ENABLE_DISABLE_ALL_ROW_RENDERER =
+  getDataTestSubjectSelector('row-renderer-switch');
+
 export const TIMELINE_TABS = '[data-test-subj="timeline"] .euiTabs';
 
 export const TIMELINE_TAB_CONTENT_EQL = '[data-test-subj="timeline-tab-content-eql"]';
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/timeline.ts b/x-pack/test/security_solution_cypress/cypress/tasks/timeline.ts
index 511ca3df0d8a6..6c9f7f50d259c 100644
--- a/x-pack/test/security_solution_cypress/cypress/tasks/timeline.ts
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/timeline.ts
@@ -65,8 +65,6 @@ import {
   TIMELINE_TAB_CONTENT_EQL,
   TIMESTAMP_HOVER_ACTION_OVERFLOW_BTN,
   ACTIVE_TIMELINE_BOTTOM_BAR,
-  EMPTY_DATA_PROVIDER_AREA,
-  EMPTY_DROPPABLE_DATA_PROVIDER_GROUP,
   GET_TIMELINE_GRID_CELL,
   HOVER_ACTIONS,
   TIMELINE_SWITCHQUERYLANGUAGE_BUTTON,
@@ -91,10 +89,11 @@ import {
   TIMELINE_FLYOUT,
   TIMELINE_FULL_SCREEN_BUTTON,
   QUERY_EVENT_COUNT,
+  TIMELINE_ENABLE_DISABLE_ALL_ROW_RENDERER,
 } from '../screens/timeline';
 
 import { REFRESH_BUTTON, TIMELINE, TIMELINES_TAB_TEMPLATE } from '../screens/timelines';
-import { drag, drop, waitForTabToBeLoaded } from './common';
+import { waitForTabToBeLoaded } from './common';
 
 import { closeFieldsBrowser, filterFieldsBrowser } from './fields_browser';
 import { TIMELINE_CONTEXT_MENU_BTN } from '../screens/alerts';
@@ -123,15 +122,16 @@ export const addNameToTimelineAndSaveAsNew = (name: string) => {
   cy.get(TIMELINE_TITLE_INPUT).should('not.exist');
 };
 
-export const openSaveTimelineModal = () =>{
-  recurse(()=>{
-  cy.get(SAVE_TIMELINE_ACTION)
+export const openSaveTimelineModal = () => {
+  recurse(
+    () => {
+      cy.get(SAVE_TIMELINE_ACTION);
 
-    return cy.get(TIMELINE_TITLE_INPUT)
-  },
+      return cy.get(TIMELINE_TITLE_INPUT);
+    },
     (sub) => sub.is(':visible')
-  )
-}
+  );
+};
 
 export const addNameAndDescriptionToTimeline = (
   timeline: Timeline,
@@ -254,13 +254,12 @@ export const addDataProvider = (filter: TimelineFilter): Cypress.Chainable<JQuer
 export const updateDataProviderByFieldHoverAction = (fieldName: string, rowNumber: number) => {
   const fieldSelector = GET_TIMELINE_GRID_CELL(fieldName);
   cy.get(fieldSelector).eq(rowNumber).should('be.visible').realHover();
-cy.get(HOVER_ACTIONS.ADD_TO_TIMELINE).should('be.visible')
+  cy.get(HOVER_ACTIONS.ADD_TO_TIMELINE).should('be.visible');
 
   recurse(
     () => {
-
-       cy.get(HOVER_ACTIONS.ADD_TO_TIMELINE).click();
-      return cy.root()
+      cy.get(HOVER_ACTIONS.ADD_TO_TIMELINE).click();
+      return cy.root();
     },
     ($el) => $el.find(TOASTER).text().startsWith('Added ')
   );
@@ -304,11 +303,13 @@ export const createNewTimeline = () => {
 };
 
 export const openCreateTimelineOptionsPopover = () => {
-  recurse(()=> {
-  cy.get(NEW_TIMELINE_ACTION).filter(':visible').click();
-  return cy.get(CREATE_NEW_TIMELINE);
-  },
-    (sub) => sub.is(':visible'))
+  recurse(
+    () => {
+      cy.get(NEW_TIMELINE_ACTION).filter(':visible').click();
+      return cy.get(CREATE_NEW_TIMELINE);
+    },
+    (sub) => sub.is(':visible')
+  );
 };
 
 export const createTimelineFromBottomBar = () => {
@@ -365,7 +366,7 @@ export const saveTimeline = () => {
     cy.get(TIMELINE_PROGRESS_BAR).should('exist');
     cy.get(TIMELINE_PROGRESS_BAR).should('not.exist');
 
-  cy.get(LOADING_INDICATOR).should('not.exist');
+    cy.get(LOADING_INDICATOR).should('not.exist');
   });
 };
 
@@ -530,3 +531,13 @@ export const openTimelineEventContextMenu = (rowIndex: number = 0) => {
 export const toggleFullScreen = () => {
   cy.get(TIMELINE_FULL_SCREEN_BUTTON).first().click();
 };
+
+export const enableAllRowRenderersWithSwitch = () => {
+  cy.get(TIMELINE_ENABLE_DISABLE_ALL_ROW_RENDERER).click();
+  cy.get(TIMELINE_ENABLE_DISABLE_ALL_ROW_RENDERER).should('have.attr', 'aria-checked', 'true');
+};
+
+export const disableAllRowRenderersWithSwitch = () => {
+  cy.get(TIMELINE_ENABLE_DISABLE_ALL_ROW_RENDERER).click();
+  cy.get(TIMELINE_ENABLE_DISABLE_ALL_ROW_RENDERER).should('have.attr', 'aria-checked', 'false');
+};

From 07f79b826060a32799c8ff730dd6003f66a47d7a Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Thu, 10 Oct 2024 10:57:36 +0200
Subject: [PATCH 06/16] fix: timelines table

---
 .../e2e/investigations/timelines/timelines_table.cy.ts       | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/timelines_table.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/timelines_table.cy.ts
index 6c1e7ee3f6cf4..4b8d55065d44e 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/timelines_table.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/timelines_table.cy.ts
@@ -26,11 +26,10 @@ import { clearSearchBar, searchForTimeline, toggleFavoriteFilter } from '../../.
 const mockTimeline = getTimeline();
 const mockFavoritedTimeline = getFavoritedTimeline();
 
-// FLAKY: https://github.com/elastic/kibana/issues/181466
-// Failing: See https://github.com/elastic/kibana/issues/181466
-describe.skip('timeline overview search', { tags: ['@ess', '@serverless'] }, () => {
+describe('timeline overview search', { tags: ['@ess', '@serverless'] }, () => {
   beforeEach(() => {
     deleteTimelines();
+    // create timeline which is not favorited
     createTimeline();
     login();
 

From f04f85d8be24e708139d66d7465dca211a235670 Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Thu, 10 Oct 2024 11:07:23 +0200
Subject: [PATCH 07/16] fix: flyout_button

---
 .../timelines/flyout_button.cy.ts               | 17 +----------------
 1 file changed, 1 insertion(+), 16 deletions(-)

diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/flyout_button.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/flyout_button.cy.ts
index 4ee0f4c58f151..fc2efa8534d47 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/flyout_button.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/flyout_button.cy.ts
@@ -18,8 +18,7 @@ import {
 
 import { hostsUrl } from '../../../urls/navigation';
 
-// FLAKY: https://github.com/elastic/kibana/issues/183085
-describe.skip('timeline flyout button', () => {
+describe('timeline flyout button', () => {
   beforeEach(() => {
     login();
     visitWithTimeRange(hostsUrl('allHosts'));
@@ -64,18 +63,4 @@ describe.skip('timeline flyout button', () => {
       cy.get(TIMELINE_BOTTOM_BAR_TOGGLE_BUTTON).should('have.focus');
     }
   );
-
-  it(
-    'should render the global search dropdown when the input is focused',
-    { tags: ['@ess'] },
-    () => {
-      openTimelineUsingToggle();
-      cy.get('[data-test-subj="nav-search-input"]').focus();
-      cy.get('[data-test-subj="nav-search-input"]').should('be.focused');
-      cy.get('[data-test-subj="nav-search-option"]').should('be.visible');
-      cy.get('[data-test-subj="nav-search-option"]').first().realHover();
-      // check that at least one item is visible in the search bar after mousing over, i.e. it's still usable.
-      cy.get('[data-test-subj="nav-search-option"]').its('length').should('be.gte', 1);
-    }
-  );
 });

From 986ccc1cf512c611fb817bcb3894fdd286691fbb Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Thu, 10 Oct 2024 11:14:52 +0200
Subject: [PATCH 08/16] fix: creation timeline

---
 .../cypress/e2e/investigations/timelines/creation.cy.ts        | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/creation.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/creation.cy.ts
index 05957e885d9ea..c51258406c5d5 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/creation.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/creation.cy.ts
@@ -50,8 +50,7 @@ import { OVERVIEW_URL, TIMELINE_TEMPLATES_URL, TIMELINES_URL } from '../../../ur
 
 const mockTimeline = getTimeline();
 
-// FLAKY: https://github.com/elastic/kibana/issues/180688
-describe.skip('Timelines', { tags: ['@ess', '@serverless'] }, (): void => {
+describe('Timelines', { tags: ['@ess', '@serverless'] }, (): void => {
   beforeEach(() => {
     deleteTimelines();
   });

From 8010bede0ae0c6745693c6c7e0ff8bc1a4612005 Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Thu, 10 Oct 2024 11:32:36 +0200
Subject: [PATCH 09/16] fix: remove focused tests

---
 .../tabs/query/query_tab_unified_components.test.tsx       | 7 -------
 .../e2e/investigations/timelines/data_providers.cy.ts      | 3 +--
 .../esql/discover_timeline_state_integration.cy.ts         | 1 -
 .../e2e/investigations/timelines/esql/search_filter.cy.ts  | 2 +-
 .../cypress/e2e/investigations/timelines/export.cy.ts      | 1 -
 5 files changed, 2 insertions(+), 12 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/query_tab_unified_components.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/query_tab_unified_components.test.tsx
index a6a2bd0b397a3..107c166183647 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/query_tab_unified_components.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/query_tab_unified_components.test.tsx
@@ -1207,11 +1207,4 @@ describe('query tab with unified timeline', () => {
       );
     });
   });
-
-
-  describe('Hover Actions',()=>{
-    describe('Add to Timeline', ()=>{
-
-    })
-  })
 });
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/data_providers.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/data_providers.cy.ts
index 691a0457d8cb7..c6ec496744a52 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/data_providers.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/data_providers.cy.ts
@@ -29,7 +29,6 @@ import { getTimeline } from '../../../objects/timeline';
 import { hostsUrl } from '../../../urls/navigation';
 import { LOADING_INDICATOR } from '../../../screens/security_header';
 
-// FLAKY: https://github.com/elastic/kibana/issues/176945
 const mockTimeline = getTimeline();
 describe('Timeline data providers', { tags: ['@ess', '@serverless'] }, () => {
   beforeEach(() => {
@@ -54,7 +53,7 @@ describe('Timeline data providers', { tags: ['@ess', '@serverless'] }, () => {
     cy.get(TIMELINE_DATA_PROVIDERS_ACTION_MENU).should('exist');
   });
 
-  it.only('should persist timeline when a field is added by hover action "Add To Timeline" in data provider ', () => {
+  it('should persist timeline when a field is added by hover action "Add To Timeline" in data provider ', () => {
     addDataProvider({ field: 'host.name', operator: 'exists' });
     saveTimeline();
     cy.wait('@updateTimeline');
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/discover_timeline_state_integration.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/discover_timeline_state_integration.cy.ts
index 4e1e706e5a807..c15f42e0e218e 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/discover_timeline_state_integration.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/discover_timeline_state_integration.cy.ts
@@ -70,7 +70,6 @@ const handleIntercepts = () => {
   });
 };
 
-// Failing: See https://github.com/elastic/kibana/issues/180755
 describe(
   'Discover Timeline State Integration',
   {
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts
index cb0dcbb635c3e..f147f46a69881 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts
@@ -71,7 +71,7 @@ describe(
       cy.get(GET_DISCOVER_DATA_GRID_CELL_HEADER('user.name')).should('be.visible');
     });
 
-    it.only('should remove the query when the back button is pressed after adding a query', () => {
+    it('should remove the query when the back button is pressed after adding a query', () => {
       addDiscoverEsqlQuery(esqlQuery);
       cy.get(DISCOVER_ESQL_INPUT_TEXT_CONTAINER).then((subj) => {
         const currentQuery = subj.text();
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/export.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/export.cy.ts
index 89545c1cf0834..e1e3a5cf2de32 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/export.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/export.cy.ts
@@ -22,7 +22,6 @@ import { createTimeline } from '../../../tasks/api_calls/timelines';
 import { expectedExportedTimeline } from '../../../objects/timeline';
 import { closeToast } from '../../../tasks/common/toast';
 
-// FLAKY: https://github.com/elastic/kibana/issues/187550
 describe('Export timelines', { tags: ['@ess', '@serverless'] }, () => {
   beforeEach(() => {
     login();

From 668b5161851485602acfad088373651108313958 Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Thu, 10 Oct 2024 14:37:54 +0200
Subject: [PATCH 10/16] fix: remove unnecessary timeline creation tests

---
 .../investigations/timelines/creation.cy.ts   | 34 +------------------
 1 file changed, 1 insertion(+), 33 deletions(-)

diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/creation.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/creation.cy.ts
index c51258406c5d5..ffc1fc187142b 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/creation.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/creation.cy.ts
@@ -9,10 +9,8 @@ import { ROLES } from '@kbn/security-solution-plugin/common/test';
 import { getTimeline } from '../../../objects/timeline';
 
 import {
-  LOCKED_ICON,
   // NOTES_TEXT,
-  PIN_EVENT,
-  TIMELINE_FILTER,
+
   TIMELINE_FLYOUT_WRAPPER,
   TIMELINE_QUERY,
   TIMELINE_PANEL,
@@ -30,7 +28,6 @@ import { visit, visitWithTimeRange } from '../../../tasks/navigation';
 import { openTimelineUsingToggle } from '../../../tasks/security_main';
 import { selectCustomTemplates } from '../../../tasks/templates';
 import {
-  addFilter,
   addNameAndDescriptionToTimeline,
   // addNotesToTimeline,
   clickingOnCreateTimelineFormTemplateBtn,
@@ -38,9 +35,6 @@ import {
   createNewTimeline,
   executeTimelineKQL,
   expandEventAction,
-  goToQueryTab,
-  pinFirstEvent,
-  populateTimeline,
   addNameToTimelineAndSave,
   addNameToTimelineAndSaveAsNew,
 } from '../../../tasks/timeline';
@@ -91,32 +85,6 @@ describe('Timelines', { tags: ['@ess', '@serverless'] }, (): void => {
     );
   });
 
-  it('should create a timeline by clicking untitled timeline from bottom bar', () => {
-    login();
-    visitWithTimeRange(OVERVIEW_URL);
-    openTimelineUsingToggle();
-    addNameAndDescriptionToTimeline(mockTimeline);
-    populateTimeline();
-    goToQueryTab();
-
-    addFilter(mockTimeline.filter);
-    cy.get(TIMELINE_FILTER(mockTimeline.filter)).should('exist');
-
-    pinFirstEvent();
-    cy.get(PIN_EVENT)
-      .should('have.attr', 'aria-label')
-      .and('match', /Unpin the event in row 2/);
-
-    cy.get(LOCKED_ICON).should('be.visible');
-
-    // TODO: fix this
-    // While typing the note, cypress encounters this -> Error: ResizeObserver loop completed with undelivered notifications.
-    // addNotesToTimeline(mockTimeline.notes);
-    // cy.get(TIMELINE_TAB_CONTENT_GRAPHS_NOTES)
-    //   .find(NOTES_TEXT)
-    //   .should('have.text', mockTimeline.notes);
-  });
-
   it('should show the different timeline states', () => {
     login();
     visitWithTimeRange(TIMELINES_URL);

From 8407212f74a2dc44e6e12ab896992eb1a3a722e7 Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Fri, 11 Oct 2024 16:05:36 +0200
Subject: [PATCH 11/16] fix: more tests

---
 .../alerts/event_rendered_view.cy.ts          | 12 ++--
 .../timelines/table_row_actions.cy.ts         | 57 -------------------
 .../cypress/screens/alerts.ts                 |  8 +++
 3 files changed, 14 insertions(+), 63 deletions(-)
 delete mode 100644 x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/table_row_actions.cy.ts

diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/event_rendered_view.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/event_rendered_view.cy.ts
index e1e7e07a3df15..e028b751c0bf5 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/event_rendered_view.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/event_rendered_view.cy.ts
@@ -12,12 +12,12 @@ import {
   EVENT_SUMMARY_COLUMN,
   ALERT_RENDERER_HOST_NAME,
   SHOW_TOP_N_HEADER,
+  HOVER_ACTIONS,
 } from '../../../screens/alerts';
 import {
   DATA_GRID_COLUMN_ORDER_BTN,
   DATA_GRID_FIELD_SORT_BTN,
 } from '../../../screens/common/data_grid';
-import { HOVER_ACTIONS } from '../../../screens/timeline';
 import {
   showHoverActionsEventRenderedView,
   switchAlertTableToEventRenderedView,
@@ -43,12 +43,12 @@ describe(`Event Rendered View`, { tags: ['@ess', '@serverless'] }, () => {
     waitForAlerts();
   });
 
-  it('Event Summary Column', () => {
+  it('should show Event Summary column correctly', () => {
     cy.get(EVENT_SUMMARY_COLUMN).should('be.visible');
     cy.get(EVENT_SUMMARY_ALERT_RENDERER_CONTENT).should('be.visible');
   });
 
-  it('Hover Action TopN in event summary column', () => {
+  it('should show TopN in Event Summary column', () => {
     showHoverActionsEventRenderedView(ALERT_RENDERER_HOST_NAME);
     cy.get(HOVER_ACTIONS.SHOW_TOP).trigger('click');
     cy.get(TOP_N_ALERT_HISTOGRAM).should('be.visible');
@@ -64,15 +64,15 @@ describe(`Event Rendered View`, { tags: ['@ess', '@serverless'] }, () => {
    * This test main checks if Alert Table controls are rendered properly.
    *
    * */
-  it('Field Browser is not visible', () => {
+  it('should not show Field Browser', () => {
     cy.get(FIELDS_BROWSER_BTN).should('not.exist');
   });
 
-  it('Sorting control is not visible', () => {
+  it('should now show Sorting Control', () => {
     cy.get(DATA_GRID_FIELD_SORT_BTN).should('not.exist');
   });
 
-  it('Column Order button is not visible', () => {
+  it('should not show column order control', () => {
     cy.get(DATA_GRID_COLUMN_ORDER_BTN).should('not.exist');
   });
 });
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/table_row_actions.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/table_row_actions.cy.ts
deleted file mode 100644
index 400290ef1ed5a..0000000000000
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/table_row_actions.cy.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { getNewRule } from '../../../objects/rule';
-import { deleteAlertsAndRules } from '../../../tasks/api_calls/common';
-import { createRule } from '../../../tasks/api_calls/rules';
-import { login } from '../../../tasks/login';
-import { visitWithTimeRange } from '../../../tasks/navigation';
-import { openTimelineUsingToggle } from '../../../tasks/security_main';
-import { ALERTS_URL } from '../../../urls/navigation';
-import {
-  createNewTimeline,
-  executeTimelineKQL,
-  executeTimelineSearch,
-  openTimelineEventContextMenu,
-} from '../../../tasks/timeline';
-import { MARK_ALERT_ACKNOWLEDGED_BTN } from '../../../screens/alerts';
-import { GET_TIMELINE_GRID_CELL } from '../../../screens/timeline';
-
-describe(
-  'Timeline table Row Actions',
-  {
-    tags: ['@ess', '@serverless', '@skipInServerlessMKI'],
-    env: {
-      ftrConfig: {
-        kbnServerArgs: [
-          `--xpack.securitySolution.enableExperimental=${JSON.stringify([
-            'unifiedComponentsInTimelineDisabled',
-          ])}`,
-        ],
-      },
-    },
-  },
-  () => {
-    beforeEach(() => {
-      deleteAlertsAndRules();
-      createRule(getNewRule());
-      login();
-      visitWithTimeRange(ALERTS_URL);
-      openTimelineUsingToggle();
-      createNewTimeline();
-      executeTimelineSearch('*');
-    });
-
-    it('should refresh the table when alert status is changed', () => {
-      executeTimelineKQL('kibana.alert.workflow_status:open');
-      cy.get(GET_TIMELINE_GRID_CELL('@timestamp')).should('have.length', 1);
-      openTimelineEventContextMenu();
-      cy.get(MARK_ALERT_ACKNOWLEDGED_BTN).click();
-      cy.get(GET_TIMELINE_GRID_CELL('@timestamp')).should('have.length', 0);
-    });
-  }
-);
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/alerts.ts b/x-pack/test/security_solution_cypress/cypress/screens/alerts.ts
index 35c46e9f97557..75ee0d10c53ef 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/alerts.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/alerts.ts
@@ -256,3 +256,11 @@ export const ALERT_DETAILS_TAKE_ACTION_BUTTON =
 
 export const USER_COLUMN = '[data-gridcell-column-id="user.name"]';
 export const TOOLTIP = '[data-test-subj="message-tool-tip"]';
+
+export const HOVER_ACTIONS = {
+  ADD_TO_TIMELINE: '[data-test-subj="actionItem-security-default-cellActions-addToTimeline"]',
+  FILTER_FOR: '[data-test-subj="actionItem-security-default-cellActions-filterIn"]',
+  FILTER_OUT: '[data-test-subj="actionItem-security-default-cellActions-filterOut"]',
+  COPY: '[data-test-subj="actionItem-security-default-cellActions-copyToClipboard"]',
+  SHOW_TOP: '[data-test-subj="actionItem-security-default-cellActions-showTopN"]',
+};

From 96d269ec061da3202ab52cab8121973f1559a0cb Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Tue, 15 Oct 2024 09:58:36 +0200
Subject: [PATCH 12/16] skip esql state test

---
 .../e2e/investigations/timelines/esql/esql_state.cy.ts       | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/esql_state.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/esql_state.cy.ts
index e263a87cd1020..0676d3d5dbfb8 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/esql_state.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/esql_state.cy.ts
@@ -39,8 +39,6 @@ const esqlQuery = 'from auditbeat-* | limit 5';
 
 const TIMELINE_REQ_WITH_SAVED_SEARCH = 'TIMELINE_REQ_WITH_SAVED_SEARCH';
 const TIMELINE_PATCH_REQ = 'TIMELINE_PATCH_REQ';
-const TIMELINE_RESPONSE_SAVED_OBJECT_ID_PATH =
-  'response.body.data.persistTimeline.timeline.savedObjectId';
 
 const handleIntercepts = () => {
   cy.intercept('PATCH', '/api/timeline', (req) => {
@@ -55,7 +53,8 @@ const handleIntercepts = () => {
   });
 };
 
-describe(
+// Flaky: https://github.com/elastic/kibana/issues/180755
+describe.skip(
   'Timeline Discover ESQL State',
   {
     tags: ['@ess'],

From 81be6f46f58a68d3e0e7f7d928f1f56007cf41fd Mon Sep 17 00:00:00 2001
From: Michael Olorunnisola <michael.olorunnisola@elastic.co>
Date: Wed, 23 Oct 2024 22:39:53 -0400
Subject: [PATCH 13/16] fix esql tests

---
 .../e2e/investigations/timelines/esql/search_filter.cy.ts   | 6 ++++--
 .../security_solution_cypress/cypress/tasks/discover.ts     | 4 ++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts
index f147f46a69881..6a4297e3507c7 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts
@@ -57,14 +57,14 @@ describe(
     });
 
     it('should show data according to the esql query', () => {
-      updateDateRangeInLocalDatePickers(DISCOVER_CONTAINER, INITIAL_START_DATE, INITIAL_END_DATE);
       addDiscoverEsqlQuery(`${esqlQuery} | limit 1`);
+      updateDateRangeInLocalDatePickers(DISCOVER_CONTAINER, INITIAL_START_DATE, INITIAL_END_DATE);
       cy.get(DISCOVER_RESULT_HITS).should('have.text', 1);
     });
 
     it('should be able to add fields to the table', () => {
-      updateDateRangeInLocalDatePickers(DISCOVER_CONTAINER, INITIAL_START_DATE, INITIAL_END_DATE);
       addDiscoverEsqlQuery(`${esqlQuery} | limit 1`);
+      updateDateRangeInLocalDatePickers(DISCOVER_CONTAINER, INITIAL_START_DATE, INITIAL_END_DATE);
       addFieldToTable('host.name');
       addFieldToTable('user.name');
       cy.get(GET_DISCOVER_DATA_GRID_CELL_HEADER('host.name')).should('be.visible');
@@ -87,6 +87,8 @@ describe(
     });
 
     it(`should change the timerange to ${DEFAULT_DATE} when back is pressed after modifying timerange to ${NEW_START_DATE} without saving`, () => {
+      // The datepicker is only active when a query exists.
+      addDiscoverEsqlQuery(esqlQuery);
       cy.get(GET_LOCAL_SHOW_DATES_BUTTON(DISCOVER_CONTAINER)).click();
       cy.get(GET_LOCAL_DATE_PICKER_START_DATE_POPOVER_BUTTON(DISCOVER_CONTAINER)).first().click({});
 
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts b/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts
index 39a24083e0aa9..a05f189407441 100644
--- a/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts
@@ -98,11 +98,11 @@ export const openAddDiscoverFilterPopover = () => {
 };
 
 export const searchForField = (fieldId: string) => {
-  cy.get(DISCOVER_FIELD_SEARCH).type(fieldId);
+  cy.get(DISCOVER_FIELD_SEARCH).first().type(fieldId);
 };
 
 export const clearFieldSearch = () => {
-  cy.get(DISCOVER_FIELD_SEARCH).clear();
+  cy.get(DISCOVER_FIELD_SEARCH).first().clear();
 };
 
 export const addFieldToTable = (fieldId: string) => {

From 5a8a54128a7c2e43718e70fe47ed464cad6968aa Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Thu, 24 Oct 2024 12:28:44 +0200
Subject: [PATCH 14/16] more resilient esql tab test

---
 .../e2e/investigations/timelines/esql/search_filter.cy.ts | 2 ++
 .../security_solution_cypress/cypress/screens/discover.ts | 8 +++++++-
 .../security_solution_cypress/cypress/tasks/discover.ts   | 7 ++++++-
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts
index 6a4297e3507c7..d049ba7fe39d9 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts
@@ -25,6 +25,7 @@ import {
   addDiscoverEsqlQuery,
   addFieldToTable,
   convertEditorNonBreakingSpaceToSpace,
+  waitForDiscoverFieldsToLoad,
 } from '../../../../tasks/discover';
 import { login } from '../../../../tasks/login';
 import { visitWithTimeRange } from '../../../../tasks/navigation';
@@ -65,6 +66,7 @@ describe(
     it('should be able to add fields to the table', () => {
       addDiscoverEsqlQuery(`${esqlQuery} | limit 1`);
       updateDateRangeInLocalDatePickers(DISCOVER_CONTAINER, INITIAL_START_DATE, INITIAL_END_DATE);
+      waitForDiscoverFieldsToLoad();
       addFieldToTable('host.name');
       addFieldToTable('user.name');
       cy.get(GET_DISCOVER_DATA_GRID_CELL_HEADER('host.name')).should('be.visible');
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/discover.ts b/x-pack/test/security_solution_cypress/cypress/screens/discover.ts
index 114cb9a4db0c4..e699eb48d5f9d 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/discover.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/discover.ts
@@ -79,6 +79,12 @@ export const GET_DISCOVER_COLUMN = (columnId: string) =>
 export const GET_DISCOVER_COLUMN_TOGGLE_BTN = (columnId: string) =>
   `${getDataTestSubjectSelector(`fieldToggle-${columnId}`)}`;
 
-export const DISCOVER_FIELD_SEARCH = getDataTestSubjectSelector('fieldListFiltersFieldSearch');
+export const DISCOVER_FIELD_SEARCH = `${getDataTestSubjectSelector(
+  'fieldList'
+)} ${getDataTestSubjectSelector('fieldListFiltersFieldSearch')}`;
 
 export const DISCOVER_FIELD_LIST_LOADING = getDataTestSubjectSelector('fieldListLoading');
+
+export const AVAILABLE_FIELD_COUNT = getDataTestSubjectSelector(
+  'fieldListGroupedAvailableFields-count'
+);
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts b/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts
index a05f189407441..583f42aaaf2e3 100644
--- a/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts
@@ -15,6 +15,7 @@ import {
   DISCOVER_DATA_VIEW_EDITOR_FLYOUT,
   DISCOVER_FIELD_LIST_LOADING,
   DISCOVER_ESQL_EDITABLE_INPUT,
+  AVAILABLE_FIELD_COUNT,
 } from '../screens/discover';
 import { GET_LOCAL_SEARCH_BAR_SUBMIT_BUTTON } from '../screens/search_bar';
 import { goToEsqlTab } from './timeline';
@@ -43,6 +44,10 @@ export const waitForDiscoverGridToLoad = () => {
   cy.get(DISCOVER_FIELD_LIST_LOADING).should('not.exist');
 };
 
+export const waitForDiscoverFieldsToLoad = () => {
+  cy.get(AVAILABLE_FIELD_COUNT).should('be.visible');
+};
+
 export const assertFieldsAreLoaded = () => {
   cy.get(DISCOVER_FIELD_LIST_LOADING).should('not.exist');
 };
@@ -98,7 +103,7 @@ export const openAddDiscoverFilterPopover = () => {
 };
 
 export const searchForField = (fieldId: string) => {
-  cy.get(DISCOVER_FIELD_SEARCH).first().type(fieldId);
+  cy.get(DISCOVER_FIELD_SEARCH).should('be.visible').type(fieldId);
 };
 
 export const clearFieldSearch = () => {

From 7972cde3384608c08a596406259894c650c94d9f Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Fri, 25 Oct 2024 05:50:05 +0200
Subject: [PATCH 15/16] better field search

---
 x-pack/test/security_solution_cypress/cypress/tasks/discover.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts b/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts
index 583f42aaaf2e3..b5bb60bcc46df 100644
--- a/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts
@@ -103,7 +103,7 @@ export const openAddDiscoverFilterPopover = () => {
 };
 
 export const searchForField = (fieldId: string) => {
-  cy.get(DISCOVER_FIELD_SEARCH).should('be.visible').type(fieldId);
+  cy.get(`${DISCOVER_CONTAINER} ${DISCOVER_FIELD_SEARCH}`).should('be.visible').type(fieldId);
 };
 
 export const clearFieldSearch = () => {

From 812f9af9b5319525ee7b1fc43798a83e440c89c0 Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Fri, 25 Oct 2024 07:32:42 +0200
Subject: [PATCH 16/16] scoped search for better testing

---
 .../e2e/investigations/timelines/esql/search_filter.cy.ts   | 6 ++++--
 .../security_solution_cypress/cypress/tasks/discover.ts     | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts
index d049ba7fe39d9..889f75130d197 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/search_filter.cy.ts
@@ -67,8 +67,10 @@ describe(
       addDiscoverEsqlQuery(`${esqlQuery} | limit 1`);
       updateDateRangeInLocalDatePickers(DISCOVER_CONTAINER, INITIAL_START_DATE, INITIAL_END_DATE);
       waitForDiscoverFieldsToLoad();
-      addFieldToTable('host.name');
-      addFieldToTable('user.name');
+      cy.get(DISCOVER_CONTAINER).within(() => {
+        addFieldToTable('host.name');
+        addFieldToTable('user.name');
+      });
       cy.get(GET_DISCOVER_DATA_GRID_CELL_HEADER('host.name')).should('be.visible');
       cy.get(GET_DISCOVER_DATA_GRID_CELL_HEADER('user.name')).should('be.visible');
     });
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts b/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts
index b5bb60bcc46df..583f42aaaf2e3 100644
--- a/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/discover.ts
@@ -103,7 +103,7 @@ export const openAddDiscoverFilterPopover = () => {
 };
 
 export const searchForField = (fieldId: string) => {
-  cy.get(`${DISCOVER_CONTAINER} ${DISCOVER_FIELD_SEARCH}`).should('be.visible').type(fieldId);
+  cy.get(DISCOVER_FIELD_SEARCH).should('be.visible').type(fieldId);
 };
 
 export const clearFieldSearch = () => {