fix last cypress test

x-pack/plugins/security_solution/cypress/e2e/detection_alerts/alerts_details.cy.ts

@@ -14,19 +14,17 @@ import {
   TABLE_CONTAINER,
   TABLE_ROWS,
 } from '../../screens/alerts_details';
-
 import { closeAlertFlyout, expandFirstAlert } from '../../tasks/alerts';
-import { openJsonView, openTable } from '../../tasks/alerts_details';
+import { filterBy, openJsonView, openTable } from '../../tasks/alerts_details';
 import { createRule } from '../../tasks/api_calls/rules';
 import { cleanKibana } from '../../tasks/common';
 import { waitForAlertsToPopulate } from '../../tasks/create_new_rule';
 import { esArchiverLoad, esArchiverUnload } from '../../tasks/es_archiver';
 import { login, visit, visitWithoutDateRange } from '../../tasks/login';
-
 import { getUnmappedRule, getNewRule } from '../../objects/rule';
-
 import { ALERTS_URL } from '../../urls/navigation';
 import { tablePageSelector } from '../../screens/table_pagination';
+import { ALERTS_COUNT } from '../../screens/alerts';
 
 describe('Alert details flyout', () => {
   describe('With unmapped fields', { testIsolation: false }, () => {
@@ -90,6 +88,7 @@ describe('Alert details flyout', () => {
         });
     });
   });
+
   describe('Url state management', { testIsolation: false }, () => {
     const testRule = getNewRule();
     before(() => {
@@ -130,7 +129,16 @@ describe('Alert details flyout', () => {
 
     it('should open the flyout given the custom url', () => {
       expandFirstAlert();
-      cy.get(COPY_ALERT_FLYOUT_LINK).should('be.visible');
+      openTable();
+      filterBy('_id');
+      cy.get('[data-test-subj="formatted-field-_id"]')
+        .invoke('text')
+        .then((alertId) => {
+          cy.visit(`http://localhost:5620/app/security/alerts/${alertId}`);
+          cy.get('[data-test-subj="unifiedQueryInput"]').should('have.text', `_id: ${alertId}`);
+          cy.get(ALERTS_COUNT).should('have.text', '1 alert');
+          cy.get(OVERVIEW_RULE).should('be.visible');
+        });
     });
   });
 });

x-pack/plugins/security_solution/public/detections/pages/alerts/alert_details_redirect.tsx

@@ -11,7 +11,7 @@ import { Redirect, useLocation, useParams } from 'react-router-dom';
 
 import moment from 'moment';
 import { encode } from '@kbn/rison';
-import { ALERTS_PATH } from '../../../../common/constants';
+import { ALERTS_PATH, DEFAULT_ALERTS_INDEX } from '../../../../common/constants';
 import { URL_PARAM_KEY } from '../../../common/hooks/use_url_state';
 import { inputsSelectors } from '../../../common/store';
 
@@ -20,15 +20,18 @@ export const AlertDetailsRedirect = () => {
   const { search } = useLocation();
   const searchParams = new URLSearchParams(search);
   const timestamp = searchParams.get('timestamp');
-  const index = searchParams.get('index');
+  // Although we use the 'default' space here when an index isn't provided or accidentally deleted
+  // It's a safe catch all as we reset the '.internal.alerts-*` indices with the correct space in the flyout
+  // Here: x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/helpers.tsx
+  const index = searchParams.get('index') ?? `.internal${DEFAULT_ALERTS_INDEX}-default`;
 
   const getInputSelector = useMemo(() => inputsSelectors.inputsSelector(), []);
   const inputState = useSelector(getInputSelector);
   const { linkTo: globalLinkTo, timerange: globalTimerange } = inputState.global;
   const { linkTo: timelineLinkTo, timerange: timelineTimerange } = inputState.timeline;
 
+  // Default to the existing global timerange if we don't get this query param for whatever reason
   const fromTime = timestamp ?? globalTimerange.from;
-
   // Add 1 millisecond to the alert timestamp as the alert table is non-inclusive of the end time
   // So we have to extend slightly beyond the range of the timestamp of the given alert
   const toTime = moment(timestamp ?? globalTimerange.to).add('1', 'millisecond');