[Security Solution][Detection Engine] fix broken serverless ES|QL tes…

…ts (#184581)

## Summary

- #183096 PR disabled bfetch
requests for Serverless, leading to failure of multiple serverless ES|QL
tests that rely on intercepting `bsearch` request
- addresses:
  -  #184558
  -  #184556
  - #184557

x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/esql_rule.cy.ts

@@ -67,8 +67,7 @@ const workaroundForResizeObserver = () =>
     }
   });
 
-// Failing: See https://github.com/elastic/kibana/issues/184558
-describe.skip(
+describe(
   'Detection ES|QL rules, creation',
   {
     // skipped in MKI as it depends on feature flag alertSuppressionForEsqlRuleEnabled

x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_edit/esql_rule.cy.ts

@@ -54,9 +54,7 @@ const expectedValidEsqlQuery =
 
 // skipped in MKI as it depends on feature flag alertSuppressionForEsqlRuleEnabled
 // alertSuppressionForEsqlRuleEnabled feature flag is also enabled in a global config
-// Failing: See https://github.com/elastic/kibana/issues/184556
-// Failing: See https://github.com/elastic/kibana/issues/184557
-describe.skip(
+describe(
   'Detection ES|QL rules, edit',
   {
     tags: ['@ess', '@serverless', '@skipInServerlessMKI'],

x-pack/test/security_solution_cypress/cypress/tasks/create_new_rule.ts

@@ -953,11 +953,21 @@ export const interceptEsqlQueryFieldsRequest = (
   esqlQuery: string,
   alias: string = 'esqlQueryFields'
 ) => {
-  cy.intercept('POST', '/internal/bsearch?*', (req) => {
-    if (req.body?.batch?.[0]?.request?.params?.query?.includes?.(esqlQuery)) {
-      req.alias = alias;
-    }
-  });
+  const isServerless = Cypress.env('IS_SERVERLESS');
+  // bfetch is disabled in serverless, so we need to watch another request
+  if (isServerless) {
+    cy.intercept('POST', '/internal/search/esql_async', (req) => {
+      if (req.body?.params?.query?.includes?.(esqlQuery)) {
+        req.alias = alias;
+      }
+    });
+  } else {
+    cy.intercept('POST', '/internal/bsearch?*', (req) => {
+      if (req.body?.batch?.[0]?.request?.params?.query?.includes?.(esqlQuery)) {
+        req.alias = alias;
+      }
+    });
+  }
 };
 
 export const checkLoadQueryDynamically = () => {