[AI4DSOR] Alert summary integrations section

[PhilippeOberti]

Summary

This PR adds the integration section at the top of the alert summary page. This section shows the installed AI for SOC integrations and an Add integration button. Clicking on the button navigates to the fleet's page.
In each integration card, we show the integration name, its logo as well as the last activity time. This last activity value is retrieve as follow:

• fetch all dataStreams (see this api documentation)
• find all the dataStreams that are related to the installed integrations (via the package property)
• from all the matching dataStreams, take the most recently updated (via the last_activity_ms value

Screen.Recording.2025-03-20.at.4.09.04.PM.mov

How to test

This needs to be ran in Serverless:

• yarn es serverless --projectType security
• yarn serverless-security --no-base-path

You also need to enable the AI for SOC tier, by adding the following to your serverless.security.dev.yaml file:

xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]

Use one of these Serverless users:

• platform_engineer
• endpoint_operations_analyst
• endpoint_policy_manager
• admin
• system_indices_superuser

Notes

You'll need to either have some AI for SOC integrations installed, or more easily you can:

• change the alert_summary.tsx line 38 from if (installedPackages.length === 0) { to if (installedPackages.length > 0) { to force the wrapper component to render
• update 42 of the same alert_summary.tsx file from return <Wrapper packages={installedPackages} />; to return <Wrapper packages={availablePackages} />; to be able to see some packages

Also you'll dataStreams if you want to be able to test the last activity value. Easiest would probably be to mock the call return value following the documentation.

Checklist

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Unit or functional tests were updated or added to match the most common scenarios

https://github.com/elastic/security-team/issues/11955

[elasticmachine]

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

[nchaulet]

Fleet changes 🚀

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 1cbe408

Failed CI Steps

• Jest Tests #1
• Jest Integration Tests #5

Test Failures

• [job] [logs] Jest Tests #1 / RedirectWithDefaultEnvironment eventually renders the child element

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	7176	7179	+3

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
fleet	1375	1388	+13

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
fleet	1.7MB	1.7MB	+1.0B
securitySolution	8.9MB	8.9MB	+2.3KB
total			+2.3KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
fleet	162.2KB	162.3KB	+124.0B

Unknown metric groups

API count

id	before	after	diff
fleet	1503	1516	+13

History

• 💚 Build #288675 succeeded 22f1dac
• 💚 Build #287945 succeeded 5709814
• 💚 Build #286304 succeeded a7bab0b