[Security Solution] Adds serverlessQA tag to the API tests (elastic#1…

…80773)

Continues elastic#179737 effort we are
aligning the tags on Cypress and API to have a unified experience.

## Summary

We want to start integrating our Cypress tests with the serverless
Kibana quality gate. However, not all the teams feel comfortable
enabling all the tests, to facilitate the effort of enabling tests in
the quality gate we are adding the `@serverlessQA` tag, now on API tests
as well.

We use tags to select which tests we want to execute on each environment
and pipeline.

`ess` - runs in ESS env
`serverless` - runs in serverless env and periodic pipeline (failures
don't block release)
`serverlessQA` - runs in kibana release process (failures block release)
`skipInEss` - skipped for ESS env
`skipInServerless` - skipped for all serverless related environments
`skipInServerlessMKI` - skipped for MKI environments

### Description

**Tests tagged as `@serverless`**

All the tests tagged as `@serverless` will be executed as part of the PR
validation process using the serverless FTR environment (not a real
one). That tests will be executed as well as part of the periodic
pipeline using a real serverless project. QA environment is used to do
so using the latest available commit in main at the time of the
execution.

**Tests tagged as `@serverlessQA`**

All the tests tagged as `@serverlessQA` will be executed as part of the
kibana release process using a real serverless project with the latest
image available in the QA environment

**Tests tagged as `@ess`**

All the tests tagged as `@ess` will be executed as part of the PR
validation process using an on-prem ESS environment.

**Tests tagged as `@skipInServerless`**

All the tests tagged as `@skipInServerless` will be excluded from the PR
validation process using the serverless FTR environment, the periodic
pipeline and kibana release process for Serverless.

**Tests tagged as `@skipInEss`**

All the tests tagged as `skipInEss` will be excluded from the PR
validation process using an on-prem ESS environment.

---------

Co-authored-by: Ryland Herrick <ryalnd@gmail.com>

x-pack/test/security_solution_api_integration/README.md

@@ -15,16 +15,28 @@ we have introduced the `detection_response` directory to consolidate all the int
 
 - In this directory, Mocha tagging is utilized to assign tags to specific test suites and individual test cases. This tagging system enables the ability to selectively apply tags to test suites and test cases, facilitating the exclusion of specific test cases within a test suite as needed.
 
-- There are three primary tags that have been defined: @ess, @serverless, and @brokenInServerless
-
 - Test suites and cases are prefixed with specific tags to determine their execution in particular environments or to exclude them from specific environments. 
 
+- We are using the following tags:
+   * `@ess`: Runs in an ESS environment (on-prem installation) as part of the CI validation on PRs.
+
+   * `@serverless`: Runs in the first quality gate and in the periodic pipeline.
+
+   * `@serverlessQA`: Runs in the second quality gate.
+
+   * `@skipInEss`: Skipped for ESS environment.
+
+   * `@skipInServerless`: Skipped for all quality gates, CI and periodic pipeline.
+
+   * `@skipInServerlessMKI`: Skipped for all the MKI environments. 
+
 ex:
 ```
  describe('@serverless @ess create_rules', () => { ==> tests in this suite will run in both Ess and Serverless
    describe('creating rules', () => {}); 
 
-   describe('@brokenInServerless missing timestamps', () => {}); ==> tests in this suite will be excluded in Serverless
+  // This test is skipped due to flakiness in serverless environments: https://github.com/elastic/kibana/issues/497777
+   describe('@skipInServerless missing timestamps', () => {}); ==> tests in this suite will be excluded in Serverless
 
  ```
 
@@ -86,7 +98,7 @@ In this project, you can run various commands to execute tests and workflows, ea
          ```
       3. **Run tests for "exception_workflows" using the serverless runner in the "qaEnv" environment:**
          ```shell
-         npm run run-tests:dr:default exceptions/workflows serverless qaEnv
+         npm run run-tests:dr:default exceptions/workflows serverless qaPeriodicEnv
          ```
       4. **Run the server for "exception_workflows" in the "essEnv" environment:**
          ```shell

x-pack/test/security_solution_api_integration/config/ess/config.base.ts

@@ -96,7 +96,7 @@ export function createTestConfig(options: CreateTestConfigOptions, testFiles?: s
         ],
       },
       mochaOpts: {
-        grep: '/^(?!.*@brokenInEss).*@ess.*/',
+        grep: '/^(?!.*@skipInEss).*@ess.*/',
       },
     };
   };

x-pack/test/security_solution_api_integration/config/serverless/config.base.essentials.ts

@@ -44,7 +44,7 @@ export function createTestConfig(options: CreateTestConfigOptions) {
 
       mochaOpts: {
         ...svlSharedConfig.get('mochaOpts'),
-        grep: '/^(?!.*@brokenInServerless).*@serverless.*/',
+        grep: '/^(?!.*@skipInServerless).*@serverless.*/',
       },
     };
   };

x-pack/test/security_solution_api_integration/config/serverless/config.base.ts

@@ -42,7 +42,7 @@ export function createTestConfig(options: CreateTestConfigOptions) {
 
       mochaOpts: {
         ...svlSharedConfig.get('mochaOpts'),
-        grep: '/^(?!.*@brokenInServerless).*@serverless.*/',
+        grep: '/^(?!.*@skipInServerless).*@serverless.*/',
       },
     };
   };

x-pack/test/security_solution_api_integration/scripts/index.js

@@ -21,15 +21,19 @@ let grepArgs = [];
 if (type !== 'server') {
   switch (environment) {
     case 'serverlessEnv':
-      grepArgs = ['--grep', '/^(?!.*@brokenInServerless).*@serverless.*/'];
+      grepArgs = ['--grep', '/^(?!.*@skipInServerless).*@serverless.*/'];
       break;
 
     case 'essEnv':
-      grepArgs = ['--grep', '/^(?!.*@brokenInEss).*@ess.*/'];
+      grepArgs = ['--grep', '/^(?!.*@skipInEss).*@ess.*/'];
+      break;
+
+    case 'qaPeriodicEnv':
+      grepArgs = ['--grep', '/^(?!.*@skipInServerless|.*@skipInServerlessMKI).*@serverless.*/'];
       break;
 
     case 'qaEnv':
-      grepArgs = ['--grep', '/^(?!.*@brokenInServerless|.*@skipInQA).*@serverless.*/'];
+      grepArgs = ['--grep', '/^(?!.*@skipInServerless|.*@skipInServerlessMKI).*@serverlessQA.*/'];
       break;
 
     default:

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/actions/trial_license_complete_tier/add_actions.ts

@@ -21,7 +21,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@serverless @ess add_actions', () => {
+  describe('@serverless @serverlessQA @ess add_actions', () => {
     describe('adding actions', () => {
       beforeEach(async () => {
         await es.indices.delete({ index: 'logs-test', ignore_unavailable: true });

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/actions/trial_license_complete_tier/check_privileges.ts

@@ -31,7 +31,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@ess @serverless @brokenInServerless check_privileges', () => {
+  describe('@ess @serverless @skipInServerless check_privileges', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
       await esArchiver.load('x-pack/test/functional/es_archives/security_solution/alias');

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/actions/trial_license_complete_tier/update_actions.ts

@@ -147,7 +147,8 @@ export default ({ getService }: FtrProviderContext) => {
         expect(body?.execution_summary?.last_execution?.status).toBe('succeeded');
       });
 
-      it('@skipInQA expects an updated rule with a webhook action and meta field runs successfully', async () => {
+      // Broken in MKI environment, needs triage
+      it('@skipInServerlessMKI expects an updated rule with a webhook action and meta field runs successfully', async () => {
         const webhookAction = await createWebHookRuleAction(supertest);
 
         await supertest
@@ -187,7 +188,8 @@ export default ({ getService }: FtrProviderContext) => {
         expect(body?.execution_summary?.last_execution?.status).toBe('succeeded');
       });
 
-      it('@skipInQA adds a webhook to an immutable rule', async () => {
+      // Broken in MKI environment, needs triage
+      it('@skipInServerlessMKI adds a webhook to an immutable rule', async () => {
         const immutableRule = await getImmutableRule();
         const webhookAction = await createWebHookRuleAction(supertest);
         const ruleAction = {
@@ -210,7 +212,8 @@ export default ({ getService }: FtrProviderContext) => {
         expect(updatedRule.throttle).toEqual(immutableRule.throttle);
       });
 
-      it('@skipInQA should be able to create a new webhook action, attach it to an immutable rule and the count of prepackaged rules should not increase. If this fails, suspect the immutable tags are not staying on the rule correctly.', async () => {
+      // Broken in MKI environment, needs triage
+      it('@skipInServerlessMKI should be able to create a new webhook action, attach it to an immutable rule and the count of prepackaged rules should not increase. If this fails, suspect the immutable tags are not staying on the rule correctly.', async () => {
         const immutableRule = await getImmutableRule();
         const hookAction = await createWebHookRuleAction(supertest);
         const ruleToUpdate = getRuleWithWebHookAction(
@@ -224,7 +227,8 @@ export default ({ getService }: FtrProviderContext) => {
         expect(status.rules_not_installed).toBe(0);
       });
 
-      it('@skipInQA should be able to create a new webhook action, attach it to an immutable rule and the rule should stay immutable when searching against immutable tags', async () => {
+      // Broken in MKI environment, needs triage
+      it('@skipInServerlessMKI should be able to create a new webhook action, attach it to an immutable rule and the rule should stay immutable when searching against immutable tags', async () => {
         const immutableRule = await getImmutableRule();
         const webhookAction = await createWebHookRuleAction(supertest);
         const ruleAction = {

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/basic_license_essentials_tier/field_aliases.ts

@@ -29,7 +29,7 @@ export default ({ getService }: FtrProviderContext) => {
     name: string;
   }
 
-  describe('@ess @serverless Tests involving aliases of source indexes and the alerts index', () => {
+  describe('@ess @serverless @serverlessQA Tests involving aliases of source indexes and the alerts index', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/security_solution/alias');
     });

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/basic_license_essentials_tier/query_alerts.ts

@@ -34,7 +34,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@ess @serverless query_signals_route and find_alerts_route', () => {
+  describe('@ess @serverless @serverlessQA query_signals_route and find_alerts_route', () => {
     describe('validation checks', () => {
       it('should not give errors when querying and the alerts index does exist and is empty', async () => {
         await createAlertsIndex(supertest, log);

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/basic_license_essentials_tier/set_alert_tags.ts

@@ -40,8 +40,7 @@ export default ({ getService }: FtrProviderContext) => {
   const dataPathBuilder = new EsArchivePathBuilder(isServerless);
   const path = dataPathBuilder.getPath('auditbeat/hosts');
 
-  // Intentionally setting as @skipInQA, keeping tests running in MKI that should block release
-  describe('@ess @serverless @skipInQA set_alert_tags', () => {
+  describe('@ess @serverless set_alert_tags', () => {
     describe('validation checks', () => {
       it('should give errors when no alert ids are provided', async () => {
         const { body } = await supertest

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/trial_license_complete_tier/assignments/assignments.ts

@@ -39,8 +39,7 @@ export default ({ getService }: FtrProviderContext) => {
   const dataPathBuilder = new EsArchivePathBuilder(isServerless);
   const path = dataPathBuilder.getPath('auditbeat/hosts');
 
-  // Intentionally setting as @skipInQA, keeping tests running in MKI that should block release
-  describe('@ess @serverless @skipInQA Alert User Assignment - ESS & Serverless', () => {
+  describe('@ess @serverless Alert User Assignment - ESS & Serverless', () => {
     describe('validation checks', () => {
       it('should give errors when no alert ids are provided', async () => {
         const { body } = await supertest

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/trial_license_complete_tier/assignments/assignments_serverless.ts

@@ -33,8 +33,7 @@ export default ({ getService }: FtrProviderContext) => {
   const dataPathBuilder = new EsArchivePathBuilder(isServerless);
   const path = dataPathBuilder.getPath('auditbeat/hosts');
 
-  // Intentionally setting as @skipInQA, keeping tests running in MKI that should block release
-  describe('@serverless @skipInQA Alert User Assignment - Serverless', () => {
+  describe('@serverless Alert User Assignment - Serverless', () => {
     before(async () => {
       await esArchiver.load(path);
     });

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/alerts/trial_license_complete_tier/document_level_security.ts

@@ -74,7 +74,7 @@ export default ({ getService }: FtrProviderContext) => {
   const esArchiver = getService('esArchiver');
   const security = getService('security');
 
-  describe('@ess @serverless @brokenInServerless find alert with/without doc level security', () => {
+  describe('@ess @serverless @skipInServerless find alert with/without doc level security', () => {
     before(async () => {
       await security.role.create(
         roleToAccessSecuritySolution.name,

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/operators_data_types/date_numeric_types/basic_license_essentials_tier/date.ts

@@ -32,7 +32,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@serverless @ess Rule exception operators for data type date', () => {
+  describe('@serverless @serverlessQA @ess Rule exception operators for data type date', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/date');
     });

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/operators_data_types/date_numeric_types/basic_license_essentials_tier/double.ts

@@ -32,7 +32,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@serverless @ess Rule exception operators for data type double', () => {
+  describe('@serverless @serverlessQA @ess Rule exception operators for data type double', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/double');
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/double_as_string');

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/operators_data_types/date_numeric_types/basic_license_essentials_tier/float.ts

@@ -32,7 +32,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@serverless @ess Rule exception operators for data type float', () => {
+  describe('@serverless @serverlessQA @ess Rule exception operators for data type float', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/float');
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/float_as_string');

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/operators_data_types/date_numeric_types/basic_license_essentials_tier/integer.ts

@@ -32,7 +32,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@serverless @ess Rule exception operators for data type integer', () => {
+  describe('@serverless @serverlessQA @ess Rule exception operators for data type integer', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/integer');
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/integer_as_string');

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/operators_data_types/ips/basic_license_essentials_tier/ip.ts

@@ -32,7 +32,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@serverless @ess Rule exception operators for data type ip', () => {
+  describe('@serverless @serverlessQA @ess Rule exception operators for data type ip', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/ip');
     });

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/operators_data_types/ips/basic_license_essentials_tier/ip_array.ts

@@ -32,7 +32,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@serverless @ess Rule exception operators for data type ip', () => {
+  describe('@serverless @serverlessQA @ess Rule exception operators for data type ip', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/ip_as_array');
     });

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/operators_data_types/keyword/basic_license_essentials_tier/keyword.ts

@@ -32,7 +32,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@serverless @ess Rule exception operators for data type keyword', () => {
+  describe('@serverless @serverlessQA  @ess Rule exception operators for data type keyword', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/keyword');
     });

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/operators_data_types/keyword/basic_license_essentials_tier/keyword_array.ts

@@ -33,7 +33,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@serverless @ess Rule exception operators for data type keyword', () => {
+  describe('@serverles @serverlessQA @ess Rule exception operators for data type keyword', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/keyword_as_array');
     });

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/operators_data_types/long/basic_license_essentials_tier/long.ts

@@ -32,7 +32,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@serverless @ess Rule exception operators for data type long', () => {
+  describe('@serverless @serverlessQA  @ess Rule exception operators for data type long', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/long');
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/long_as_string');

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/operators_data_types/text/basic_license_essentials_tier/text.ts

@@ -33,7 +33,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@serverless @ess Rule exception operators for data type text', () => {
+  describe('@serverless @serverlessQA @ess Rule exception operators for data type text', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/text');
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/text_no_spaces');

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/operators_data_types/text/basic_license_essentials_tier/text_array.ts

@@ -32,7 +32,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@serverless @ess Rule exception operators for data type text', () => {
+  describe('@serverless @serverlessQA @ess Rule exception operators for data type text', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/text_as_array');
     });

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/create_endpoint_exceptions.ts

@@ -74,7 +74,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@serverless @ess create_endpoint_exceptions', () => {
+  describe('@serverless @serverlessQA @ess create_endpoint_exceptions', () => {
     before(async () => {
       await esArchiver.load(
         'x-pack/test/functional/es_archives/rule_exceptions/endpoint_without_host_type'

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/create_rule_exceptions.ts

@@ -48,7 +48,7 @@ export default ({ getService }: FtrProviderContext) => {
   const config = getService('config');
   const ELASTICSEARCH_USERNAME = config.get('servers.kibana.username');
 
-  describe('@serverless @ess create "rule_default" exceptions', () => {
+  describe('@serverless @serverlessQA @ess create "rule_default" exceptions', () => {
     before(async () => {
       await createAlertsIndex(supertest, log);
     });

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/exception_comments_serverless.ts

@@ -26,8 +26,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
 
-  // @skipInQA purposefully - only running tests in MKI whose failure should block release
-  describe('@serverless @skipInQA exception item comments - serverless specific behavior', () => {
+  describe('@serverless exception item comments - serverless specific behavior', () => {
     describe('Rule Exceptions', () => {
       afterEach(async () => {
         await deleteAllExceptions(supertest, log);

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/exceptions_data_integrity.ts

@@ -37,8 +37,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  // @skipInQA purposefully - only running tests in MKI whose failure should block release
-  describe('@serverless @ess @skipInQA exceptions data integrity', () => {
+  describe('@serverless @ess exceptions data integrity', () => {
     afterEach(async () => {
       await deleteAllAlerts(supertest, log, es);
       await deleteAllRules(supertest, log);

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/find_rule_exception_references.ts

@@ -36,7 +36,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  describe('@serverless @ess find_rule_exception_references', () => {
+  describe('@serverless @serverlessQA @ess find_rule_exception_references', () => {
     before(async () => {
       await createAlertsIndex(supertest, log);
     });

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/prebuilt_rules.ts

@@ -37,8 +37,7 @@ export default ({ getService }: FtrProviderContext) => {
   const log = getService('log');
   const es = getService('es');
 
-  // @skipInQA purposefully - only running tests in MKI whose failure should block release
-  describe('@serverless @ess @skipInQA exceptions workflows for prebuilt rules', () => {
+  describe('@serverless @ess exceptions workflows for prebuilt rules', () => {
     describe('creating rules with exceptions', () => {
       beforeEach(async () => {
         await createAlertsIndex(supertest, log);

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/rule_exceptions_execution.ts

@@ -58,7 +58,7 @@ export default ({ getService }: FtrProviderContext) => {
   const dataPathBuilder = new EsArchivePathBuilder(isServerless);
   const path = dataPathBuilder.getPath('auditbeat/hosts');
 
-  describe('@serverless @ess rule exceptions execution', () => {
+  describe('@serverless @serverlessQA @ess rule exceptions execution', () => {
     before(async () => {
       await esArchiver.load(path);
     });

x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/trial_license_complete_tier/execution_logic/eql.ts

@@ -77,7 +77,7 @@ export default ({ getService }: FtrProviderContext) => {
   const auditPath = dataPathBuilder.getPath('auditbeat/hosts');
 
   // FLAKY: https://github.com/elastic/kibana/issues/180641
-  describe.skip('@ess @serverless EQL type rules', () => {
+  describe.skip('@ess @serverless @serverlessQA EQL type rules', () => {
     const { indexListOfDocuments } = dataGeneratorFactory({
       es,
       index: 'ecs_compliant',