Use menu-based navigation instead of direct URLs

- Replace direct URL navigation with menu-based navigation for reliability
- Menu structure is stable while URLs can change (e.g., /activity/detections → /activity-v2/detections)
- Remove sensitive test data from comments

Author: mraible

e2e/src/pages/SocketNavigationPage.ts

@@ -4,6 +4,8 @@ import { BasePage } from './BasePage';
 /**
  * Utility page object for navigating to detection pages with socket extensions
  *
+ * Uses menu-based navigation to ensure reliability when URLs change.
+ *
  * Supports testing Foundry extensions that appear in detection sockets:
  * - activity.detections.details (Endpoint Detections)
  * - xdr.detections.panel (XDR Detections)
@@ -15,26 +17,48 @@ export class SocketNavigationPage extends BasePage {
   }
 
   protected getPagePath(): string {
-    throw new Error('Socket navigation does not have a direct path');
+    throw new Error('Socket navigation does not have a direct path - use menu navigation');
   }
 
   protected async verifyPageLoaded(): Promise<void> {
   }
 
-  /** Navigate to Endpoint Detections page (activity.detections.details socket) */
+  /**
+   * Navigate to Endpoint Detections page (activity.detections.details socket)
+   * Uses menu navigation: Menu → Endpoint security → Monitor → Endpoint detections
+   */
   async navigateToEndpointDetections(): Promise<void> {
     return this.withTiming(
       async () => {
         this.logger.info('Navigating to Endpoint Detections page');
 
-        // Navigate to endpoint detections
-        await this.navigateToPath('/activity/detections', 'Endpoint Detections page');
+        // Open the hamburger menu
+        const menuButton = this.page.getByRole('button', { name: 'Menu' });
+        await menuButton.click();
+        await this.page.waitForLoadState('networkidle');
+
+        // Click "Endpoint security"
+        const endpointSecurityButton = this.page.getByRole('button', { name: /Endpoint security/i });
+        await endpointSecurityButton.click();
+        await this.waiter.delay(500);
+
+        // Click "Monitor" to expand submenu (if not already expanded)
+        const monitorButton = this.page.getByRole('button', { name: /^Monitor$/i });
+        const isExpanded = await monitorButton.getAttribute('aria-expanded');
+        if (isExpanded !== 'true') {
+          await monitorButton.click();
+          await this.waiter.delay(500);
+        }
+
+        // Click "Endpoint detections" link
+        const endpointDetectionsLink = this.page.getByRole('link', { name: /Endpoint detections/i });
+        await endpointDetectionsLink.click();
 
         // Wait for page to load
         await this.page.waitForLoadState('networkidle');
 
-        // Verify we're on the detections page
-        const pageTitle = this.page.locator('h1, [role="heading"]').first();
+        // Verify we're on the detections page by looking for the page heading
+        const pageTitle = this.page.locator('h1, h2').filter({ hasText: /Detections/i }).first();
         await expect(pageTitle).toBeVisible({ timeout: 10000 });
 
         this.logger.success('Navigated to Endpoint Detections page');
@@ -43,13 +67,31 @@ export class SocketNavigationPage extends BasePage {
     );
   }
 
-  /** Navigate to XDR Detections page (xdr.detections.panel socket) */
+  /**
+   * Navigate to XDR Detections page (xdr.detections.panel socket)
+   * Uses menu navigation: Menu → Next-Gen SIEM → appropriate submenu → XDR detections
+   * Note: Requires XDR SKU - may not be available in all environments
+   */
   async navigateToXDRDetections(): Promise<void> {
     return this.withTiming(
       async () => {
         this.logger.info('Navigating to XDR Detections page');
 
-        await this.navigateToPath('/ngsiem/detections', 'XDR Detections page');
+        // Open the hamburger menu
+        const menuButton = this.page.getByRole('button', { name: 'Menu' });
+        await menuButton.click();
+        await this.page.waitForLoadState('networkidle');
+
+        // Click "Next-Gen SIEM"
+        const ngsiemButton = this.page.getByRole('button', { name: /Next-Gen SIEM/i });
+        await ngsiemButton.click();
+        await this.waiter.delay(500);
+
+        // Look for XDR-related navigation items
+        // Note: This may vary based on environment configuration
+        const xdrLink = this.page.getByRole('link', { name: /XDR.*[Dd]etections?/i });
+        await xdrLink.click();
+
         await this.page.waitForLoadState('networkidle');
 
         const pageTitle = this.page.locator('h1, [role="heading"]').first();
@@ -61,13 +103,30 @@ export class SocketNavigationPage extends BasePage {
     );
   }
 
-  /** Navigate to NGSIEM Incidents page (ngsiem.workbench.details socket) */
+  /**
+   * Navigate to NGSIEM Incidents page (ngsiem.workbench.details socket)
+   * Uses menu navigation: Menu → Next-Gen SIEM → appropriate submenu → Incidents
+   * Note: Requires NGSIEM SKU - may not be available in all environments
+   */
   async navigateToNGSIEMIncidents(): Promise<void> {
     return this.withTiming(
       async () => {
         this.logger.info('Navigating to NGSIEM Incidents page');
 
-        await this.navigateToPath('/ngsiem/workbench/incidents', 'NGSIEM Incidents page');
+        // Open the hamburger menu
+        const menuButton = this.page.getByRole('button', { name: 'Menu' });
+        await menuButton.click();
+        await this.page.waitForLoadState('networkidle');
+
+        // Click "Next-Gen SIEM"
+        const ngsiemButton = this.page.getByRole('button', { name: /Next-Gen SIEM/i });
+        await ngsiemButton.click();
+        await this.waiter.delay(500);
+
+        // Look for Incidents navigation
+        const incidentsLink = this.page.getByRole('link', { name: /Incidents/i });
+        await incidentsLink.click();
+
         await this.page.waitForLoadState('networkidle');
 
         const pageTitle = this.page.locator('h1, [role="heading"]').first();
@@ -84,8 +143,8 @@ export class SocketNavigationPage extends BasePage {
       async () => {
         await this.page.waitForLoadState('networkidle');
 
-        // Click on the first detection - look for buttons with process/host information
-        // Based on the structure seen: gridcell with buttons like "REVIL.EXE on SE-MRA-WIN10-BL by demo"
+        // In the new Endpoint Detections UI, detections are represented as buttons in the table
+        // Look for process/host information buttons
         const firstDetectionButton = this.page.locator('[role="gridcell"] button').first();
         await firstDetectionButton.waitFor({ state: 'visible', timeout: 10000 });
         await firstDetectionButton.click();