Skipped test: x-pack/test/security_solution_cypress/cypress/e2e/explore/users/users_tabs.cy.ts - it renders users risk tab

[MadameSheema]

The test x-pack/test/security_solution_cypress/cypress/e2e/explore/users/users_tabs.cy.ts - it renders users risk tab has been skipped from serverless executions.

We are moving on serverless from the admin user as a default role, to the platform_engineer user, which has access just to the security solution default indexes.

This test relies on the risk_users archive, which is using the ml_user_risk_score_latest_default index, as the new user does not have access to it the test is failing.

These are the things that might be discussed:

1. Should this test be moved to Entity Analytics?
2. Do we really need to test this behaviour on Serverless when the mentioned index is not available in serverless environments for security projects?

[elasticmachine]

Pinging @elastic/security-threat-hunting-explore (Team:Threat Hunting:Explore)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[jaredburgettelastic]

Should this test be moved to Entity Analytics?

Great question. The test itself is very simple, it just looks to see if the tab loads, without asserting any of the contents of the tab.

   it(`renders users risk tab`, () => {
      waitForTabToBeLoaded(RISK_SCORE_TAB);

      cy.get(RISK_SCORE_TAB_CONTENT).should('exist');
    });

Ownership gets fuzzy because:

• The first line could fail if the link to the tab changed (Explore would regard that as important)
• The second line could fail if the contents can't be rendered (Entity Analytics would regard that as important)
• The other tests in that same file should definitely remain under Explore ownership

Co-ownership sounds like the right approach to me. I don't think we should move that one test to another file solely owned by EA because of the reasons mentioned above. @asnehalb any thoughts?

Do we really need to test this behaviour on Serverless when the mentioned index is not available in serverless environments for security projects?

I agree that we don't need this test as-is in Serverless, and I believe we should instead test for the "new" risk scores instead of the legacy. Right now, I think @MadameSheema can skip that test for Serverless, and in the short-term we can look into whether there is a different esArchiverLoad we can use that loads new scores instead of legacy.