diff --git a/x-pack/test/api_integration/apis/security_solution/users.ts b/x-pack/test/api_integration/apis/security_solution/users.ts
index 77b2dc4092b0..5afb2bba745a 100644
--- a/x-pack/test/api_integration/apis/security_solution/users.ts
+++ b/x-pack/test/api_integration/apis/security_solution/users.ts
@@ -20,6 +20,7 @@ const TO = '3000-01-01T00:00:00.000Z';
 const IP = '0.0.0.0';
 
 export default function ({ getService }: FtrProviderContext) {
+  const retry = getService('retry');
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
   describe('Users', () => {
@@ -28,42 +29,44 @@ export default function ({ getService }: FtrProviderContext) {
       after(() => esArchiver.unload('auditbeat/users'));
 
       it('Ensure data is returned from auditbeat', async () => {
-        const { body: users } = await supertest
-          .post('/internal/search/securitySolutionSearchStrategy/')
-          .set('kbn-xsrf', 'true')
-          .send({
-            factoryQueryType: NetworkQueries.users,
-            sourceId: 'default',
-            timerange: {
-              interval: '12h',
-              to: TO,
-              from: FROM,
-            },
-            defaultIndex: ['auditbeat-users'],
-            docValueFields: [],
-            ip: IP,
-            flowTarget: FlowTarget.destination,
-            sort: { field: NetworkUsersFields.name, direction: Direction.asc },
-            pagination: {
-              activePage: 0,
-              cursorStart: 0,
-              fakePossibleCount: 30,
-              querySize: 10,
-            },
-            inspect: false,
-            /* We need a very long timeout to avoid returning just partial data.
-             ** https://github.com/elastic/kibana/blob/master/x-pack/test/api_integration/apis/search/search.ts#L18
-             */
-            wait_for_completion_timeout: '10s',
-          })
-          .expect(200);
-        expect(users.edges.length).to.be(1);
-        expect(users.totalCount).to.be(1);
-        expect(users.edges[0].node.user!.id).to.eql(['0']);
-        expect(users.edges[0].node.user!.name).to.be('root');
-        expect(users.edges[0].node.user!.groupId).to.eql(['0']);
-        expect(users.edges[0].node.user!.groupName).to.eql(['root']);
-        expect(users.edges[0].node.user!.count).to.be(1);
+        await retry.try(async () => {
+          const { body: users } = await supertest
+            .post('/internal/search/securitySolutionSearchStrategy/')
+            .set('kbn-xsrf', 'true')
+            .send({
+              factoryQueryType: NetworkQueries.users,
+              sourceId: 'default',
+              timerange: {
+                interval: '12h',
+                to: TO,
+                from: FROM,
+              },
+              defaultIndex: ['auditbeat-users'],
+              docValueFields: [],
+              ip: IP,
+              flowTarget: FlowTarget.destination,
+              sort: { field: NetworkUsersFields.name, direction: Direction.asc },
+              pagination: {
+                activePage: 0,
+                cursorStart: 0,
+                fakePossibleCount: 30,
+                querySize: 10,
+              },
+              inspect: false,
+              /* We need a very long timeout to avoid returning just partial data.
+               ** https://github.com/elastic/kibana/blob/master/x-pack/test/api_integration/apis/search/search.ts#L18
+               */
+              wait_for_completion_timeout: '10s',
+            })
+            .expect(200);
+          expect(users.edges.length).to.be(1);
+          expect(users.totalCount).to.be(1);
+          expect(users.edges[0].node.user!.id).to.eql(['0']);
+          expect(users.edges[0].node.user!.name).to.be('root');
+          expect(users.edges[0].node.user!.groupId).to.eql(['0']);
+          expect(users.edges[0].node.user!.groupName).to.eql(['root']);
+          expect(users.edges[0].node.user!.count).to.be(1);
+        });
       });
     });
   });