[Cypress][Flake][Detection Engine] Fix flakey add/edit exception test (…

…elastic#171697)

## Summary

Addresses elastic#169382,
elastic#169274

Wasn't liking the 10s default rule interval in the test. Updated it to
`1m` that requires enabling/disabling to kick off a run.

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_management/related_integrations/related_integrations.cy.ts

@@ -40,7 +40,7 @@ import {
 } from '../../../../tasks/alerts_detection_rules';
 import { fetchRuleAlerts } from '../../../../tasks/api_calls/alerts';
 import {
-  enablesRule,
+  clickEnableRuleSwitch,
   visitRuleDetailsPage,
   waitForPageToBeLoaded,
 } from '../../../../tasks/rule_details';
@@ -213,7 +213,7 @@ describe('Related integrations', { tags: ['@ess', '@serverless', '@brokenInServe
         deleteDataStream(DATA_STREAM_NAME);
         createDocument(DATA_STREAM_NAME, generateEvent());
 
-        enablesRule();
+        clickEnableRuleSwitch();
         waitForAlertsToPopulate();
 
         fetchRuleAlerts({

x-pack/test/security_solution_cypress/cypress/e2e/exceptions/entry/match_any.cy.ts

@@ -14,7 +14,7 @@ import { login } from '../../../tasks/login';
 import {
   openExceptionFlyoutFromEmptyViewerPrompt,
   visitRuleDetailsPage,
-  enablesRule,
+  clickEnableRuleSwitch,
   waitForTheRuleToBeExecuted,
   goToAlertsTab,
 } from '../../../tasks/rule_details';
@@ -73,7 +73,7 @@ describe('Exceptions match_any', { tags: ['@ess', '@serverless'] }, () => {
     cy.get(CONFIRM_BTN).should('be.enabled');
     submitNewExceptionItem();
 
-    enablesRule();
+    clickEnableRuleSwitch();
 
     goToAlertsTab();
 

x-pack/test/security_solution_cypress/cypress/e2e/exceptions/rule_details_flow/add_edit_exception_data_view.cy.ts

@@ -20,6 +20,8 @@ import {
 import { login } from '../../../tasks/login';
 import {
   addFirstExceptionFromRuleDetails,
+  clickEnableRuleSwitch,
+  clickDisableRuleSwitch,
   goToAlertsTab,
   goToExceptionsTab,
   openEditException,
@@ -40,10 +42,9 @@ import {
 } from '../../../screens/exceptions';
 import { waitForAlertsToPopulate } from '../../../tasks/create_new_rule';
 
-// TODO: https://github.com/elastic/kibana/issues/161539
 describe(
   'Add exception using data views from rule details',
-  { tags: ['@ess', '@serverless', '@brokenInServerless'] },
+  { tags: ['@ess', '@serverless'] },
   () => {
     const NUMBER_OF_AUDITBEAT_EXCEPTIONS_ALERTS = '3 alerts';
     const ITEM_NAME = 'Sample Exception List Item';
@@ -65,8 +66,8 @@ describe(
         getNewRule({
           query: 'agent.name:*',
           data_view_id: 'exceptions-*',
-          interval: '10s',
           rule_id: 'rule_testing',
+          enabled: true,
         })
       ).then((rule) => visitRuleDetailsPage(rule.body.id));
       waitForAlertsToPopulate();
@@ -77,6 +78,9 @@ describe(
     });
 
     it('Creates an exception item and close all matching alerts', () => {
+      // Disables enabled rule
+      clickDisableRuleSwitch();
+
       goToExceptionsTab();
       // when no exceptions exist, empty component shows with action to add exception
       cy.get(NO_EXCEPTIONS_EXIST_PROMPT).should('exist');
@@ -115,6 +119,8 @@ describe(
 
       // load more docs
       cy.task('esArchiverLoad', { archiveName: 'exceptions_2' });
+      // Enables disabled rule
+      clickEnableRuleSwitch();
 
       // now that there are no more exceptions, the docs should match and populate alerts
       goToAlertsTab();

x-pack/test/security_solution_cypress/cypress/tasks/rule_details.ts

@@ -54,13 +54,25 @@ export function visitRuleDetailsPage(ruleId: string, options?: VisitRuleDetailsP
   visit(ruleDetailsUrl(ruleId, options?.tab));
 }
 
-export const enablesRule = () => {
+export const clickEnableRuleSwitch = () => {
   // Rules get enabled via _bulk_action endpoint
   cy.intercept('POST', '/api/detection_engine/rules/_bulk_action?dry_run=false').as('bulk_action');
   cy.get(RULE_SWITCH).should('be.visible');
   cy.get(RULE_SWITCH).click();
   cy.wait('@bulk_action').then(({ response }) => {
     cy.wrap(response?.statusCode).should('eql', 200);
+    cy.wrap(response?.body.attributes.results.updated[0].enabled).should('eql', true);
+  });
+};
+
+export const clickDisableRuleSwitch = () => {
+  // Rules get enabled via _bulk_action endpoint
+  cy.intercept('POST', '/api/detection_engine/rules/_bulk_action?dry_run=false').as('bulk_action');
+  cy.get(RULE_SWITCH).should('be.visible');
+  cy.get(RULE_SWITCH).click();
+  cy.wait('@bulk_action').then(({ response }) => {
+    cy.wrap(response?.statusCode).should('eql', 200);
+    cy.wrap(response?.body.attributes.results.updated[0].enabled).should('eql', false);
   });
 };