Skip to content

[Security Solution] EUI Refresh Followup Pt. 1#205990

Merged
rylnd merged 28 commits intoelastic:mainfrom
rylnd:rylnd/eui_refresh_qa
Jan 23, 2025
Merged

[Security Solution] EUI Refresh Followup Pt. 1#205990
rylnd merged 28 commits intoelastic:mainfrom
rylnd:rylnd/eui_refresh_qa

Conversation

@rylnd
Copy link
Contributor

@rylnd rylnd commented Jan 9, 2025

Summary

This is the first batch of work involving #202052. It includes the following tasks:

  • (Important) Review usage of "success" colors for positive, semantic intent.(details).
  • (Important) Review and update color palette usage. (details)
  • (Important) Replace vis colors used outside of visualizations with color tokens . (details)
  • (Important) Replace custom colors with semantic tokens (details)
  • (Important) Replace color calculation functions with semantic tokens. (details)
  • Update tokens to use the new naming scheme. (details)

What changed?

Broadly, these changes involve two main areas: Exception Lists and the Rule Creation form (specifically: the EQL query bar and the "time" inputs (Suppression Duration, Interval, Lookback)).

I also found an unused component, and fixed a minor UI bug with Exception Comments.

Screenshots (before and after, and with both themes) are included below.

Also: as a majority of these components' usage of theme variables is done with @styled-components, and we are transitioning away from that toward @emotion, I also opted to remove usages of @styled-components wherever possible, as that change was negligible in comparison with the theming changes. If a file being changed included references to static eui theme variables, e.g. euiThemeVars, those were removed as well (but many are still outstanding).

Screenshots

NOTE: Most of the "Before" screenshots were taken from a cluster using the Borealis theme.

Rule Exceptions Tab

Before

Rule Exceptions - Before

After (Amsterdam)

Rule Exceptions - After (Amsterdam)

After (Borealis)

Rule Exceptions - After (Borealis)

Shared Exception Lists

Before

Shared Exception Lists - Before

After (Amsterdam)

Shared Exception Lists - After (Amsterdam)

After (Borealis)

Shared Exception Lists - After (Borealis)

Shared List Details

Before

Shared List Details - Before

After (Amsterdam)

Shared List Details - After (Amsterdam)

After (Borealis)

Shared List Details - After (Borealis)

EQL Query Input

Before

EQL Bar - Before

After (Amsterdam)

EQL Bar - After (Amsterdam)

After (Borealis)

EQL Bar - After (Borealis)

Suppression Fields

Before

Suppression Fields - Before

After (Amsterdam)

Suppression Fields - After (Amsterdam)

After (Borealis)

Suppression Fields - After (Borealis)

Suppression Fields (Disabled)

Before

Suppression Fields (Disabled) - Before

After (Amsterdam)

Suppression Fields (Disabled) - After (Amsterdam)

After (Borealis)

Suppression Fields (Disabled) - After (Borealis)

Exception Comments UI Bug

Before

Comments UI Bug - Before

After

Comments UI Bug - After

Checklist

@rylnd rylnd force-pushed the rylnd/eui_refresh_qa branch from 1f64cc9 to 5f89ce8 Compare January 9, 2025 23:10
rylnd added 18 commits January 16, 2025 20:45
`warningText -> textWarning`. This also replaces some uses of the
now-deprecated `euiThemeVars` with use of the `useEuiTheme` hook.
* This uses the theme to set a min-height on the textarea, since it is a
  best practice with a resizable element. The dropped styles were no
  longer necessary with the EUI component.
Both box-shadow and border were being applied here, which combined with
the border-radius lead to a weird-looking input. This removes the
box-shadow.
* Removes uses of deprecated tokens
* Aligns EqlQueryBar closer to a normal form component (no custom label)
These were "solved" by using the `useEuiTheme` hook and placing the
generation of styles within the component itself, as opposed to
statically outside them.
In the case of `generateLinkedRulesMenuItems`, the function was a react
component in everything but name. I renamed it so that the react-hooks
linter rules wouldn't complain, but I left the manual invocations of the
element since they're fine.
This reverts commit 0489ee1f806517f80c08ef622ec9b81ac82fba9d.

This ends up not working since that component now calls a hook, and you
can't call a hook from e.g. the `useMemo` that wraps the
link-generating, in at least one instance. I'll have to come back to
this one.
This replaces the use hex colors (to style a border), swapping instead
for the now-preferred euiTheme context, as well as using `@emotion` when possible.

These changes are applied here to both the in-plugin and packaged
versions of this component, which are used in two different sections. It
also attempts to bring them more inline with one another by applying a
missing `eui-xScroll` class that did not exist on the plugin variant of
this component.
These styles (particularly the box-shadow) were being incorrectly
applied to all child elements, which caused the inner Comments accordion
to be styled incorrectly. I failed to catch this when it was introduced
in elastic#178023.
This fixes the styling of comments, namely on the accordion, by:

1. Ensuring consistency between the two implementations
2. Removing unnecessary styles
…ents

The MetaInfo component was easy to find, but it took a while to track
down where the MenuItems component is used: on the exception DETAILS
page, which is only accessed through the shared exception list page by
clicking on an individual list.
This component is used on the shared exceptions page, where exceptions
lists are listed.
We only use this in our Duration components, as they are custom. It's
worth noting that we've re-implemented this in three different places,
as you can see here, but we can deduplicate later. These are EuiSelects
where Seconds/Minutes/Hours are chosen for either rule scheduling or
suppression duration.

Instead of using this custom color, it's been replaced with
`backgroundBasePrimary`, making it more in light with other similar form
controls.

I also replaced some usages of styled-components, here.
In testing this CSS (to determine a replacement), I discovered that it's
adding a fixed margin-left to labelAppend, which may extend outside the
bounds of the form row. The margin size itself seemed arbitrary. The
container for both labels is also a fixed size.

Instead, I opted to change the containing flexbox to justify as
`spaceBetween`, maximizing the distance between the items. If the
incoming `labelAppend` prop needs to add additional styling, the caller
can add that (although in testing I did not see usage of this prop).
This was replaced by `ScheduleRuleField` in elastic#200304. I discovered
this while looking for usages of EUI color helpers, but upon further
inspection it can just be pruned.
I was reusing style names from the similar Suppression Duration
components, but that's not correct, here. These apply to the Scheduling
fields during rule creation, so "duration" isn't accurate.
This contained now-outdated references to EuiThemeVars that needed to be
inlined to the consuming component (in order to take advantage of the
euiTheme context/hook).

On the ListHeader component, I was able to remove a negative margin by
using `bottomBorder="extended"` as per the documentation. However, due
to the way the content is currently constructed, we still need a
negative margin-top in order to offset a hardcoded EuiSpacer in the
EuiPageHeader component (for which a comment was included on the style).

I was not able to use the full `useEuiFontSize` helper as the
line-heights have changed significantly from the original layout, hence
the `font-size: ().fontSize` pattern.
@rylnd rylnd force-pushed the rylnd/eui_refresh_qa branch from 5f89ce8 to f25db7a Compare January 17, 2025 04:26
rylnd added 2 commits January 17, 2025 14:33
For reasons I'm not yet clear on, the template literal syntax does not
work in this file, but the object notation does.
This was a minor UI bug that only shows when you're editing an exception
item in order to add another comment.
@rylnd rylnd self-assigned this Jan 17, 2025
@rylnd rylnd marked this pull request as ready for review January 17, 2025 21:22
@rylnd rylnd requested a review from a team as a code owner January 17, 2025 21:22
@rylnd rylnd requested a review from vitaliidm January 17, 2025 21:22
@rylnd rylnd added release_note:skip Skip the PR/issue when compiling release notes Team:Detection Engine Security Solution Detection Engine Area labels Jan 17, 2025
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-engine (Team:Detection Engine)

@rylnd rylnd added the v8.18.0 label Jan 17, 2025
@rylnd rylnd added backport:skip This PR does not require backporting EUI Visual Refresh labels Jan 17, 2025
@elastic-vault-github-plugin-prod elastic-vault-github-plugin-prod bot requested a review from a team as a code owner January 17, 2025 21:31
Copy link
Contributor

@jbudz jbudz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

packages/kbn-babel-preset/styled_components_files.js LGTM

rylnd added 2 commits January 17, 2025 17:43
We changed some props being passed to EUI components, which changed the
resultant HTML, here.
import React, { useCallback, useEffect, useRef, useMemo } from 'react';
import { Subscription } from 'rxjs';
import styled from 'styled-components';
import { css } from '@emotion/css';
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is @emotion/css needed here? We generally advice to use @emotion/react with the css prop. (info on the distinction)

(same for other usages done with these changes)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mgadewoll that general advice seemed, to me, to be overruled by this comment:

If your Kibana plugin is set up with styled-components, it will not support @emotion/react and you must use @emotion/css instead

which, revisiting this based on your feedback, is perhaps too broad of a statement? Is this functionality actually at the level of an individual file, and we can have both packages working in the same plugin? That is currently unclear, so I was erring on the side of the "known working" @emotion/css.

Additionally, the proceeding comment about subtle bugs when mixing the two implementations does not inspire confidence that the solution is straightforward.

Please advise.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the insights! That's why I asked what's the reasoning here, since I'm not having the overview across plugins. Then your update is fine. 🙂

If you're still mixing styled-components and emotion, then there are limitations indeed. If you run into those and need a middle ground until all is migrated to emotion, there are two ways to do that:

  • use @emotion/css as stated in the FAQ
  • use emotion/styled as direct replacement for styled from styled-components (FAQ)

rylnd added 2 commits January 21, 2025 12:58
 Conflicts:
	x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation/components/schedule_item_field/schedule_item_field.tsx
Copy link
Contributor

@vitaliidm vitaliidm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rylnd

Thank you for working on this.
I left one comment that would be great to address before merging

color="danger"
style={{ marginLeft: '8px' }}
data-test-subj="alertSuppressionInsufficientLicensingIcon"
/>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Screenshot 2025-01-22 at 11 02 22

supression duration component in Borealis has doubled right border.
Would be great if it can be fixed

Copy link
Contributor

@vitaliidm vitaliidm Jan 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

affects only disabled state

Screen.Recording.2025-01-22.at.11.06.11.mov

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@vitaliidm good catch, I think I'd seen this but forgotten to follow up.

Should be fixed in cfa6cde; here are some screenshots:

Duration Input - Amsterdam

Enabled

Duration Input - Amsterdam

Disabled

Duration Input (Disabled) - Amsterdam

Duration Input - Borealis

Enabled

Duration Input - Borealis

Disabled

Duration Input (Disabled) - Borealis

rylnd added 3 commits January 22, 2025 12:53
This incorrectly had a 2px right border when disabled, due to a) the
box-shadow style being overridden by inner EUI disabled styling. This
fixes that issue, and also adds a border for contrast when the input is
disabled (the light gray of the disabled numerical input was too
low-contrast sitting next to the light blue of the duration input).
We only need @emotion/css in files that _also_ use styled-components,
which none of these do. I previously did not understand this limitation,
and so was overly conservative with my usage of @emotion/react.
@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 6609 6608 -1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 21.3MB 21.3MB -3.5KB

History

cc @rylnd

@rylnd rylnd merged commit c430a6c into elastic:main Jan 23, 2025
8 checks passed
@rylnd rylnd deleted the rylnd/eui_refresh_qa branch January 23, 2025 21:06
JoseLuisGJ pushed a commit to JoseLuisGJ/kibana that referenced this pull request Jan 27, 2025
## Summary

This is the first batch of work involving
elastic#202052. It includes the
following tasks:

- [x] (Important) Review usage of "success" colors for positive,
semantic
intent.([details](elastic#202052 (comment))).
- [x] (Important) Review and update color palette usage.
([details](#color-palettes))
- [x] (Important) Replace vis colors used outside of visualizations with
color tokens .
([details](elastic#202052 (comment)))
- [x] (Important) Replace custom colors with semantic tokens
([details](elastic#202052 (comment)))
- [x] (Important) Replace color calculation functions with semantic
tokens.
([details](elastic#202052 (comment)))
- [x] Update tokens to use the new naming scheme.
([details](elastic#202052 (comment)))

### What changed?
Broadly, these changes involve two main areas: Exception Lists and the
Rule Creation form (specifically: the EQL query bar and the "time"
inputs (Suppression Duration, Interval, Lookback)).

I also found an unused component, and fixed a minor UI bug with
Exception Comments.

Screenshots (before and after, and with both themes) are included below.

Also: as a majority of these components' usage of theme variables is
done with `@styled-components`, and we are transitioning away from that
toward `@emotion`, I also opted to remove usages of `@styled-components`
wherever possible, as that change was negligible in comparison with the
theming changes. If a file being changed included references to static
eui theme variables, e.g. `euiThemeVars`, those were removed as well
(but many are still outstanding).


### Screenshots

__NOTE__: Most of the "Before" screenshots were taken from a cluster
using the Borealis theme.

<details>
  <summary>
    <h3>Rule Exceptions Tab</h3>
  </summary>
  <kbd>
    <h3>Before</h3>
<img width="1594" alt="Rule Exceptions - Before"
src="https://github.com/user-attachments/assets/56feb5e8-b5ec-4bdc-9372-968056e6bca3"
/>

  </kbd>
  <kbd>
    <h3>After (Amsterdam)</h3>
<img width="805" alt="Rule Exceptions - After (Amsterdam)"
src="https://github.com/user-attachments/assets/a6ab3d47-acc7-4eb6-8a0c-bd9ccafc2021"
/>

  </kbd>
  <kbd>
    <h3>After (Borealis)</h3>
<img width="805" alt="Rule Exceptions - After (Borealis)"
src="https://github.com/user-attachments/assets/9fbd8a17-0afb-4ccc-95ea-5bab4da5b254"
/>

  </kbd>
</details>

<details>
  <summary>
    <h3>Shared Exception Lists</h3>
  </summary>
  <kbd>
    <h3>Before</h3>
<img width="1594" alt="Shared Exception Lists - Before"
src="https://github.com/user-attachments/assets/b2a69f9c-4892-4732-a2e1-e167461680d1"
/>

  </kbd>
  <kbd>
    <h3>After (Amsterdam)</h3>
<img width="805" alt="Shared Exception Lists - After (Amsterdam)"
src="https://github.com/user-attachments/assets/1aea0dff-97ee-4482-9a66-38c4be2baea8"
/>

  </kbd>
  <kbd>
    <h3>After (Borealis)</h3>
<img width="805" alt="Shared Exception Lists - After (Borealis)"
src="https://github.com/user-attachments/assets/76be9446-17fb-451d-b15a-99166cb1f588"
/>
  </kbd>
</details>

<details>


  <summary>
    <h3>Shared List Details</h3>
  </summary>
  <kbd>
    <h3>Before</h3>
<img width="1594" alt="Shared List Details - Before"
src="https://github.com/user-attachments/assets/5eeec91d-ea96-4e3c-8c7d-b5e6bb8bf35a"
/>

  </kbd>
  <kbd>
    <h3>After (Amsterdam)</h3>
<img width="805" alt="Shared List Details - After (Amsterdam)"
src="https://github.com/user-attachments/assets/5229b850-356c-40e7-80f1-d32156f97a56"
/>

  </kbd>
  <kbd>
    <h3>After (Borealis)</h3>
<img width="805" alt="Shared List Details - After (Borealis)"
src="https://github.com/user-attachments/assets/81219613-c329-48f8-8fd3-857207d0ada0"
/>

  </kbd>
</details>

<details>
  <summary>
    <h3>EQL Query Input</h3>
  </summary>
  <kbd>
    <h3>Before</h3>
<img width="1085" alt="EQL Bar - Before"
src="https://github.com/user-attachments/assets/b19cf18b-a5d2-4001-bebc-9154af8e9b43"
/>

  </kbd>
  <kbd>
    <h3>After (Amsterdam)</h3>
<img width="1085" alt="EQL Bar - After (Amsterdam)"
src="https://github.com/user-attachments/assets/70911ad2-9e52-4b65-b305-cd90a6be1fd2"
/>

  </kbd>
  <kbd>
    <h3>After (Borealis)</h3>
<img width="1085" alt="EQL Bar - After (Borealis)"
src="https://github.com/user-attachments/assets/92a789d0-fffa-483c-bcb2-fc02b5e8ce10"
/>

  </kbd>
</details>


<details>
  <summary>
    <h3>Suppression Fields</h3>
  </summary>
  <kbd>
    <h3>Before</h3>
<img width="1085" alt="Suppression Fields - Before"
src="https://github.com/user-attachments/assets/458c3464-0eba-47d4-abbe-8de0b333b8ec"
/>

  </kbd>
  <kbd>
    <h3>After (Amsterdam)</h3>
<img width="1085" alt="Suppression Fields - After (Amsterdam)"
src="https://github.com/user-attachments/assets/b6fb67b0-7908-4fe8-9e02-d9e14c8f97c5"
/>

  </kbd>
  <kbd>
    <h3>After (Borealis)</h3>
<img width="1085" alt="Suppression Fields - After (Borealis)"
src="https://github.com/user-attachments/assets/f48c24a5-50ea-41fd-af45-b3d32f20921b"
/>

  </kbd>

</details>

<details>
  <summary>
    <h3>Suppression Fields (Disabled)</h3>
  </summary>
  <kbd>
    <h3>Before</h3>
<img width="1085" alt="Suppression Fields (Disabled) - Before"
src="https://github.com/user-attachments/assets/e60aa561-d8ce-4b23-8694-e6443ad37c16"
/>

  </kbd>
  <kbd>
    <h3>After (Amsterdam)</h3>
<img width="1085" alt="Suppression Fields (Disabled) - After
(Amsterdam)"
src="https://github.com/user-attachments/assets/45277962-482d-484c-b8bd-3a587b7c16d1"
/>

  </kbd>
  <kbd>
    <h3>After (Borealis)</h3>
<img width="1085" alt="Suppression Fields (Disabled) - After (Borealis)"
src="https://github.com/user-attachments/assets/69f6217b-a2c2-4c6a-be9e-80dfd0a4e5f1"
/>

  </kbd>
</details>

<details>
  <summary>
    <h3>Exception Comments UI Bug</h3>
  </summary>
  <kbd>
    <h3>Before</h3>
<img width="805" alt="Comments UI Bug - Before"
src="https://github.com/user-attachments/assets/652d35fa-8ff2-4850-a9a4-79cec3b4b698"
/>

  </kbd>
  <kbd>
    <h3>After</h3>
<img width="805" alt="Comments UI Bug - After"
src="https://github.com/user-attachments/assets/a8cc1cd6-b25f-4694-a479-c35f45eae6aa"
/>

  </kbd>
</details>

### Checklist

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
rylnd added a commit that referenced this pull request Feb 5, 2025
…ces to static EuiTheme variables (#208820)

## Summary

This PR is a followup to #205990, which removed references to all of the
deprecated/renamed EUI vars in preparation for 9.0. Here, we address
some of the non-critical tech debt related to the EUI refresh, namely
the [removal of static EUI
tokens](#199715 (comment))
from our codebase.

I made every attempt not to change any styles in this PR, except to
simplify CSS to produce an equivalent design. A common example of this
was removing a static `margin` or `padding` declaration referencing
`euiThemeVars.size*`, and swapping it with an equivalent `gutterSize`
prop on the `EuiFlexGroup` container, or with an `align-self` or other
equivalent flexbox directive.

## Screenshots of Areas Affected
The majority of changes here involved the Exception List/Item pages.
I've attached screenshots of their current layout for comparison/review:


<details>
  <summary>
    <h3>Rule Exceptions Tab</h3>
  </summary>
  <kbd>
    <h3>Before</h3>
<img width="1395" alt="Rule exceptions tab - before"
src="https://github.com/user-attachments/assets/db7a5487-7df3-4a5f-b88e-90ab34784970"
/>

  </kbd>
  <kbd>
    <h3>After</h3>
<img width="1421" alt="Rule exceptions tab - after"
src="https://github.com/user-attachments/assets/77cbdefc-cbec-4b9e-8436-197f2f2f6677"
/>

  </kbd>
</details>

<details>
  <summary>
    <h3>Shared Exception Lists</h3>
  </summary>
  <kbd>
<img width="1517" alt="Shared Exception Lists"
src="https://github.com/user-attachments/assets/5448dd65-60f7-470c-bf7a-7af75bb914fa"
/>

  </kbd>
</details>

<details>
  <summary>
    <h3>Shared Exception List Details</h3>
  </summary>
  <kbd>
<img width="1517" alt="Shared Exception List Details"
src="https://github.com/user-attachments/assets/6e03fef6-af58-40bb-98c5-188651a584cc"
/>

  </kbd>
</details>

<details>
  <summary>
    <h3>Threshold Input</h3>
  </summary>
  <kbd>
<img width="1046" alt="Threshold Input"
src="https://github.com/user-attachments/assets/28738857-6bdf-404f-a790-a9f4e66ff27a"
/>

  </kbd>
</details>



### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.


- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
drewdaemon pushed a commit to drewdaemon/kibana that referenced this pull request Feb 6, 2025
…ces to static EuiTheme variables (elastic#208820)

## Summary

This PR is a followup to elastic#205990, which removed references to all of the
deprecated/renamed EUI vars in preparation for 9.0. Here, we address
some of the non-critical tech debt related to the EUI refresh, namely
the [removal of static EUI
tokens](elastic#199715 (comment))
from our codebase.

I made every attempt not to change any styles in this PR, except to
simplify CSS to produce an equivalent design. A common example of this
was removing a static `margin` or `padding` declaration referencing
`euiThemeVars.size*`, and swapping it with an equivalent `gutterSize`
prop on the `EuiFlexGroup` container, or with an `align-self` or other
equivalent flexbox directive.

## Screenshots of Areas Affected
The majority of changes here involved the Exception List/Item pages.
I've attached screenshots of their current layout for comparison/review:


<details>
  <summary>
    <h3>Rule Exceptions Tab</h3>
  </summary>
  <kbd>
    <h3>Before</h3>
<img width="1395" alt="Rule exceptions tab - before"
src="https://github.com/user-attachments/assets/db7a5487-7df3-4a5f-b88e-90ab34784970"
/>

  </kbd>
  <kbd>
    <h3>After</h3>
<img width="1421" alt="Rule exceptions tab - after"
src="https://github.com/user-attachments/assets/77cbdefc-cbec-4b9e-8436-197f2f2f6677"
/>

  </kbd>
</details>

<details>
  <summary>
    <h3>Shared Exception Lists</h3>
  </summary>
  <kbd>
<img width="1517" alt="Shared Exception Lists"
src="https://github.com/user-attachments/assets/5448dd65-60f7-470c-bf7a-7af75bb914fa"
/>

  </kbd>
</details>

<details>
  <summary>
    <h3>Shared Exception List Details</h3>
  </summary>
  <kbd>
<img width="1517" alt="Shared Exception List Details"
src="https://github.com/user-attachments/assets/6e03fef6-af58-40bb-98c5-188651a584cc"
/>

  </kbd>
</details>

<details>
  <summary>
    <h3>Threshold Input</h3>
  </summary>
  <kbd>
<img width="1046" alt="Threshold Input"
src="https://github.com/user-attachments/assets/28738857-6bdf-404f-a790-a9f4e66ff27a"
/>

  </kbd>
</details>



### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.


- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:skip This PR does not require backporting EUI Visual Refresh release_note:skip Skip the PR/issue when compiling release notes Team:Detection Engine Security Solution Detection Engine Area v8.18.0 v9.0.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants