[AI4DSOC] Alert summary KQL bar by PhilippeOberti · Pull Request #215586 · elastic/kibana

PhilippeOberti · 2025-03-21T22:41:09Z

Summary

This PR adds the SiemSearchBar to the alert summary page. The search bar is pretty basic: it hides the query menu and the filter buttons to the left of the query input. Instead, the PR builds a new filter button.

That button lists all the sources available. Sources are basically equivalent to integrations, or their corresponding rules. It is a friendly UI name to abstract the concept or a rule.
In the AI for SOC effort, each integration is bundled with a single rule. This means that deselecting a source from the Source filter button is equivalent to adding a filter to the search bar to exclude all alerts with the kibana.alert.rule.name property having the value of that integration.

Example:

There are following 2 integrations installed:

[
  {
    id: 'splunk',
    name: 'splunk',
    status: installationStatuses.Installed,
    title: 'Splunk',
    version: '',
  },
  {
    id: 'google_secops',
    name: 'google_secops',
    status: installationStatuses.Installed,
    title: 'Google SecOps',
    version: '',
  },
]

This means that - in theory - there are the following 2 rules installed and running:

[
  {
    related_integrations: [{ package: 'splunk' }],
    name: 'Splunk Rule',
  },
  {
    related_integrations: [{ package: 'google_secops' }],
    name: 'Google SecOps Rule',
  },
]

In this case, the Sources button would show 2 entries, as follow:

[
  {
    checked: 'on',
    key: 'Splunk Rule',
    label: 'Splunk',
  },
  {
    checked: 'on',
    key: 'Google SecOps Rule',
    label: 'Splunk',
  },
]

By default, the checked property should be set to on. It would be off if a filter for the corresponding label existed.

Screen.Recording.2025-03-24.at.10.00.14.PM.mov

Screen.Recording.2025-03-24.at.10.01.04.PM.mov

How to test

This needs to be ran in Serverless:

yarn es serverless --projectType security
yarn serverless-security --no-base-path

You also need to enable the AI for SOC tier, by adding the following to your serverless.security.dev.yaml file:

xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]

And this to generate data: yarn test:generate:serverless-dev

Use one of these Serverless users:

platform_engineer
endpoint_operations_analyst
endpoint_policy_manager
admin
system_indices_superuser

Notes

You'll need to either have some AI for SOC integrations installed, or more easily you can:

change the alert_summary.tsx line 38 from if (installedPackages.length === 0) { to if (installedPackages.length > 0) { to force the wrapper component to render
update 42 of the same alert_summary.tsx file from return <Wrapper packages={installedPackages} />; to return <Wrapper packages={availablePackages} />; to be able to see some packages
comment out line the if condition line 66 of use_integrations.ts file to make sure that values are added even if there is no matchingRule
replace const ruleName = changedOption.key; with const ruleName = changedOption.label; on line 78 of the integrations_filter_button.tsx file

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios

Links

Ticket https://github.com/elastic/security-team/issues/11956
Mocks https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=3284-70999&m=dev

elasticmachine · 2025-03-25T03:19:01Z

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

lgestc

added a few comments here and there, given that good test coverage that you have I would try to optimize that filter thing - looks like a hot path to me?

...curity_solution/public/detections/components/alert_summary/search_bar/search_bar_section.tsx

lgestc · 2025-03-25T09:55:05Z

...ity_solution/public/detections/components/alert_summary/search_bar/sources_filter_button.tsx

+  const [isPopoverOpen, setIsPopoverOpen] = useState(false);
+  const togglePopover = useCallback(() => setIsPopoverOpen((value) => !value), []);


just sharing a little something i am trying to do now with local state: check out useReducer :)

lgestc · 2025-03-25T09:59:54Z

.../security/plugins/security_solution/public/detections/hooks/alert_summary/use_get_sources.ts

+    packages.forEach((p: PackageListItem) => {
+      const matchingRule = (ruleResponse?.rules || []).find((r: RuleResponse) =>
+        r.related_integrations.map((ri) => ri.package).includes(p.name)
+      );
+
+      if (matchingRule) {
+        // Retrieves the filter from the key/value pair
+        const currentFilterExists = filterExistsInFiltersArray(currentFilters, FILTER_KEY, p.title);
+
+        // A EuiSelectableOption is checked only if there is no matching filter for that rule
+        const source = {
+          'data-test-subj': `${SOURCE_OPTION_TEST_ID}${p.title}`,
+          ...(!currentFilterExists && { checked: 'on' as EuiSelectableOptionCheckedType }),
+          key: matchingRule?.name,
+          label: p.title,
+        };
+        result.push(source);
+      }
+    });


that is a lot of cycles, could this be optimized? while packages and ruleResponses would probably stay the same, this will run every time filters change

I agree that this code is a bit complex, but I'm not sure I see a way to simplify it. I need 3 different sources (no pun intended) of information in order to correctly build the sources object that will be fed to the SourceFilterButton component.

As for the time changing impacting filterManager.getFilters(), are you sure about that? I just tested and changing the time in the KQL bar has no impact on filters. Time is saved in Redux (see this)
For this AI for SOC effort - and especially as filters are disabled within the KQL bar - the only thing at this time that can update filterManager is the SourceFilterButton (and this useSources hook).

So at this time, this useSources hook should be ran only once after the dataView is created.

Also to note that there will be at most 5-6 integrations (packages), which means also 5-6 rules (there will be a single rule per integration). So this will never be a gigantic loop, not even a big one...

christineweng

LGTM! Left a few nit comments.

You may want to update some of the testing instructions 🙂

update 42 of the same alert_summary.tsx file from return <Wrapper packages={installedPackages} />; to return <Wrapper packages={availablePackage} />; to be able to see some packages

s missing in return <Wrapper packages={availablePackage} />;

comment out line the if condition line 56 of use_get_sources.ts file to make sure that values are added even if there is no matchingRule

i think you mean use_spources.ts? the line is now 66

christineweng · 2025-03-27T22:12:54Z

x-pack/solutions/security/plugins/security_solution/public/detections/utils/filter.ts

+ */
+export const filterExistsInFiltersArray = (
+  filters: Filter[],
+  key: string,


what do you think about putting props in an object instead

I could, but what would be the advantage?

Just FYI, I did steal this code from threat intelligence but tweaked it a little bit as the logic is slightly different (simpler) here. (see https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/threat_intelligence/public/modules/query_bar/utils/filter.ts)

For some reason I prefer inputs this way for util functions... I'm not sure I can explain why... Especially here where there are no optional inputs...

I'll keep thinking about it a bit to see if I change my mind 😆

christineweng · 2025-03-27T22:13:58Z

x-pack/solutions/security/plugins/security_solution/public/detections/utils/filter.ts

+ */
+export const updateFiltersArray = (
+  existingFilters: Filter[],
+  key: string,


christineweng · 2025-03-27T22:22:44Z

x-pack/solutions/security/plugins/security_solution/public/detections/utils/filter.ts

+    value as string
+  );
+
+  return filter != null


[filter](filter: Filter | undefined) never be null?

Sorry I don't understand the comment. I'm using != and not !== here so the logic should be fine?
I can change it to just filter if that's easier to read

...ions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_sources.ts

...curity_solution/public/detections/components/alert_summary/search_bar/search_bar_section.tsx

PhilippeOberti · 2025-03-28T01:08:31Z

LGTM! Left a few nit comments.

You may want to update some of the testing instructions 🙂

update 42 of the same alert_summary.tsx file from return <Wrapper packages={installedPackages} />; to return <Wrapper packages={availablePackage} />; to be able to see some packages

s missing in return <Wrapper packages={availablePackage} />;

comment out line the if condition line 56 of use_get_sources.ts file to make sure that values are added even if there is no matchingRule

i think you mean use_spources.ts? the line is now 66

Thanks for the correction, I had indeed made improvements to previous PR while this one was already opened. The description is corrected!

…-fix'

elasticmachine · 2025-03-28T03:29:42Z

💚 Build Succeeded

Buildkite Build
Commit: b6a4ae5

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	7104	7108	+4

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	8.9MB	8.9MB	+2.8KB

History

💛 Build #287102 was flaky 4569889
💚 Build #286818 succeeded 7458c58
💚 Build #286810 succeeded 57bd362

## Summary This PR adds the SiemSearchBar to the alert summary page. The search bar is pretty basic: it hides the query menu and the filter buttons to the left of the query input. Instead, the PR builds a new filter button. That button lists all the sources available. Sources are basically equivalent to integrations, or their corresponding rules. It is a friendly UI name to abstract the concept or a rule. In the AI for SOC effort, each integration is bundled with a single rule. This means that deselecting a source from the Source filter button is equivalent to adding a filter to the search bar to exclude all alerts with the `kibana.alert.rule.name` property having the value of that integration. ### Example: There are following 2 integrations installed: ```typescript [ { id: 'splunk', name: 'splunk', status: installationStatuses.Installed, title: 'Splunk', version: '', }, { id: 'google_secops', name: 'google_secops', status: installationStatuses.Installed, title: 'Google SecOps', version: '', }, ] ``` This means that - in theory - there are the following 2 rules installed and running: ```typescript [ { related_integrations: [{ package: 'splunk' }], name: 'Splunk Rule', }, { related_integrations: [{ package: 'google_secops' }], name: 'Google SecOps Rule', }, ] ``` In this case, the `Sources` button would show 2 entries, as follow: ```typescript [ { checked: 'on', key: 'Splunk Rule', label: 'Splunk', }, { checked: 'on', key: 'Google SecOps Rule', label: 'Splunk', }, ] ``` By default, the `checked` property should be set to `on`. It would be `off` if a filter for the corresponding `label` existed. https://github.com/user-attachments/assets/059815d2-9181-4bf1-bd78-e0e5bfa7439d https://github.com/user-attachments/assets/126606c7-b4e0-4d0b-82c1-b531c6490de3 ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` And this to generate data: `yarn test:generate:serverless-dev` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes You'll need to either have some AI for SOC integrations installed, or more easily you can: - change the `alert_summary.tsx` line `38` from `if (installedPackages.length === 0) {` to `if (installedPackages.length > 0) {` to force the wrapper component to render - update `42` of the same `alert_summary.tsx` file from `return <Wrapper packages={installedPackages} />;` to `return <Wrapper packages={availablePackages} />;` to be able to see some packages - comment out line the if condition line `66` of `use_integrations.ts` file to make sure that values are added even if there is no `matchingRule` - replace `const ruleName = changedOption.key;` with `const ruleName = changedOption.label;` on line `78` of the `integrations_filter_button.tsx` file ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### Links Ticket elastic/security-team#11956 Mocks https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=3284-70999&m=dev --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

## Summary This PR fixes an issue with the logic implemented in [this previous PR](#215586): _In the AI for SOC effort, each integration is bundled with a single rule. This means that deselecting a source from the Source filter button is equivalent to adding a filter to the search bar to exclude all alerts with the kibana.alert.rule.name property having the value of that integration._ The problem with the previous logic above is the value in the `kibana.alert.rule.name` field can be overridden (see `Rule name override [here](https://www.elastic.co/guide/en/security/current/rules-ui-create.html)). Therefore filtering alerts by this value does not guarantee that all the alerts generated by the rule will be correctly filtered out. The new logic uses the `rule.id` instead of the `rule.name`, which we then use to filter using the `signal.rule.id` field instead of `kibana.alert.rule.name` ### Example: There are following 2 integrations installed: ```typescript [ { id: 'splunk', name: 'splunk', status: installationStatuses.Installed, title: 'Splunk', version: '', }, { id: 'google_secops', name: 'google_secops', status: installationStatuses.Installed, title: 'Google SecOps', version: '', }, ] ``` This means that - in theory - there are the following 2 rules installed and running: ```typescript [ { related_integrations: [{ package: 'splunk' }], id: 'splunk_rule_id', }, { related_integrations: [{ package: 'google_secops' }], id: 'google_secops_rule_id', }, ] ``` In this case, the `Sources` button would show 2 entries, as follow: ```typescript [ { checked: 'on', key: 'splunk_rule_id', label: 'Splunk', }, { checked: 'on', key: 'google_secops_rule_id', label: 'Splunk', }, ] ``` This PR also fixes a small miss in [the prior PR](#215585) that implemented the KPI section, where I had forgotten to pass the KQL filters to the charts. #### Before https://github.com/user-attachments/assets/77e583c6-718f-46d9-96b4-42ee9976161b #### After https://github.com/user-attachments/assets/50e8e541-5798-4906-b7cc-4f9756dbdefc ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes - generate data: `yarn test:generate:serverless-dev` - create 4 catch all rules, each with a name of a AI for SOC integration (`google_secops`, `microsoft_sentinel`,, `sentinel_one` and `crowdstrike`) - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73) to `installedPackages: availablePackages` to force having some packages installed - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63) to `r.name === p.name` to make sure there will be matches between integrations and rules ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios elastic/security-team#11956

## Summary This PR adds the SiemSearchBar to the alert summary page. The search bar is pretty basic: it hides the query menu and the filter buttons to the left of the query input. Instead, the PR builds a new filter button. That button lists all the sources available. Sources are basically equivalent to integrations, or their corresponding rules. It is a friendly UI name to abstract the concept or a rule. In the AI for SOC effort, each integration is bundled with a single rule. This means that deselecting a source from the Source filter button is equivalent to adding a filter to the search bar to exclude all alerts with the `kibana.alert.rule.name` property having the value of that integration. ### Example: There are following 2 integrations installed: ```typescript [ { id: 'splunk', name: 'splunk', status: installationStatuses.Installed, title: 'Splunk', version: '', }, { id: 'google_secops', name: 'google_secops', status: installationStatuses.Installed, title: 'Google SecOps', version: '', }, ] ``` This means that - in theory - there are the following 2 rules installed and running: ```typescript [ { related_integrations: [{ package: 'splunk' }], name: 'Splunk Rule', }, { related_integrations: [{ package: 'google_secops' }], name: 'Google SecOps Rule', }, ] ``` In this case, the `Sources` button would show 2 entries, as follow: ```typescript [ { checked: 'on', key: 'Splunk Rule', label: 'Splunk', }, { checked: 'on', key: 'Google SecOps Rule', label: 'Splunk', }, ] ``` By default, the `checked` property should be set to `on`. It would be `off` if a filter for the corresponding `label` existed. https://github.com/user-attachments/assets/059815d2-9181-4bf1-bd78-e0e5bfa7439d https://github.com/user-attachments/assets/126606c7-b4e0-4d0b-82c1-b531c6490de3 ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` And this to generate data: `yarn test:generate:serverless-dev` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes You'll need to either have some AI for SOC integrations installed, or more easily you can: - change the `alert_summary.tsx` line `38` from `if (installedPackages.length === 0) {` to `if (installedPackages.length > 0) {` to force the wrapper component to render - update `42` of the same `alert_summary.tsx` file from `return <Wrapper packages={installedPackages} />;` to `return <Wrapper packages={availablePackages} />;` to be able to see some packages - comment out line the if condition line `66` of `use_integrations.ts` file to make sure that values are added even if there is no `matchingRule` - replace `const ruleName = changedOption.key;` with `const ruleName = changedOption.label;` on line `78` of the `integrations_filter_button.tsx` file ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### Links Ticket elastic/security-team#11956 Mocks https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=3284-70999&m=dev --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 27bc009)

## Summary This PR fixes an issue with the logic implemented in [this previous PR](elastic#215586): _In the AI for SOC effort, each integration is bundled with a single rule. This means that deselecting a source from the Source filter button is equivalent to adding a filter to the search bar to exclude all alerts with the kibana.alert.rule.name property having the value of that integration._ The problem with the previous logic above is the value in the `kibana.alert.rule.name` field can be overridden (see `Rule name override [here](https://www.elastic.co/guide/en/security/current/rules-ui-create.html)). Therefore filtering alerts by this value does not guarantee that all the alerts generated by the rule will be correctly filtered out. The new logic uses the `rule.id` instead of the `rule.name`, which we then use to filter using the `signal.rule.id` field instead of `kibana.alert.rule.name` ### Example: There are following 2 integrations installed: ```typescript [ { id: 'splunk', name: 'splunk', status: installationStatuses.Installed, title: 'Splunk', version: '', }, { id: 'google_secops', name: 'google_secops', status: installationStatuses.Installed, title: 'Google SecOps', version: '', }, ] ``` This means that - in theory - there are the following 2 rules installed and running: ```typescript [ { related_integrations: [{ package: 'splunk' }], id: 'splunk_rule_id', }, { related_integrations: [{ package: 'google_secops' }], id: 'google_secops_rule_id', }, ] ``` In this case, the `Sources` button would show 2 entries, as follow: ```typescript [ { checked: 'on', key: 'splunk_rule_id', label: 'Splunk', }, { checked: 'on', key: 'google_secops_rule_id', label: 'Splunk', }, ] ``` This PR also fixes a small miss in [the prior PR](elastic#215585) that implemented the KPI section, where I had forgotten to pass the KQL filters to the charts. #### Before https://github.com/user-attachments/assets/77e583c6-718f-46d9-96b4-42ee9976161b #### After https://github.com/user-attachments/assets/50e8e541-5798-4906-b7cc-4f9756dbdefc ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes - generate data: `yarn test:generate:serverless-dev` - create 4 catch all rules, each with a name of a AI for SOC integration (`google_secops`, `microsoft_sentinel`,, `sentinel_one` and `crowdstrike`) - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73) to `installedPackages: availablePackages` to force having some packages installed - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63) to `r.name === p.name` to make sure there will be matches between integrations and rules ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios elastic/security-team#11956 (cherry picked from commit 2ed4266)

## Summary This PR adds the SiemSearchBar to the alert summary page. The search bar is pretty basic: it hides the query menu and the filter buttons to the left of the query input. Instead, the PR builds a new filter button. That button lists all the sources available. Sources are basically equivalent to integrations, or their corresponding rules. It is a friendly UI name to abstract the concept or a rule. In the AI for SOC effort, each integration is bundled with a single rule. This means that deselecting a source from the Source filter button is equivalent to adding a filter to the search bar to exclude all alerts with the `kibana.alert.rule.name` property having the value of that integration. ### Example: There are following 2 integrations installed: ```typescript [ { id: 'splunk', name: 'splunk', status: installationStatuses.Installed, title: 'Splunk', version: '', }, { id: 'google_secops', name: 'google_secops', status: installationStatuses.Installed, title: 'Google SecOps', version: '', }, ] ``` This means that - in theory - there are the following 2 rules installed and running: ```typescript [ { related_integrations: [{ package: 'splunk' }], name: 'Splunk Rule', }, { related_integrations: [{ package: 'google_secops' }], name: 'Google SecOps Rule', }, ] ``` In this case, the `Sources` button would show 2 entries, as follow: ```typescript [ { checked: 'on', key: 'Splunk Rule', label: 'Splunk', }, { checked: 'on', key: 'Google SecOps Rule', label: 'Splunk', }, ] ``` By default, the `checked` property should be set to `on`. It would be `off` if a filter for the corresponding `label` existed. https://github.com/user-attachments/assets/059815d2-9181-4bf1-bd78-e0e5bfa7439d https://github.com/user-attachments/assets/126606c7-b4e0-4d0b-82c1-b531c6490de3 ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` And this to generate data: `yarn test:generate:serverless-dev` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes You'll need to either have some AI for SOC integrations installed, or more easily you can: - change the `alert_summary.tsx` line `38` from `if (installedPackages.length === 0) {` to `if (installedPackages.length > 0) {` to force the wrapper component to render - update `42` of the same `alert_summary.tsx` file from `return <Wrapper packages={installedPackages} />;` to `return <Wrapper packages={availablePackages} />;` to be able to see some packages - comment out line the if condition line `66` of `use_integrations.ts` file to make sure that values are added even if there is no `matchingRule` - replace `const ruleName = changedOption.key;` with `const ruleName = changedOption.label;` on line `78` of the `integrations_filter_button.tsx` file ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### Links Ticket elastic/security-team#11956 Mocks https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=3284-70999&m=dev --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 27bc009)

## Summary This PR fixes an issue with the logic implemented in [this previous PR](elastic#215586): _In the AI for SOC effort, each integration is bundled with a single rule. This means that deselecting a source from the Source filter button is equivalent to adding a filter to the search bar to exclude all alerts with the kibana.alert.rule.name property having the value of that integration._ The problem with the previous logic above is the value in the `kibana.alert.rule.name` field can be overridden (see `Rule name override [here](https://www.elastic.co/guide/en/security/current/rules-ui-create.html)). Therefore filtering alerts by this value does not guarantee that all the alerts generated by the rule will be correctly filtered out. The new logic uses the `rule.id` instead of the `rule.name`, which we then use to filter using the `signal.rule.id` field instead of `kibana.alert.rule.name` ### Example: There are following 2 integrations installed: ```typescript [ { id: 'splunk', name: 'splunk', status: installationStatuses.Installed, title: 'Splunk', version: '', }, { id: 'google_secops', name: 'google_secops', status: installationStatuses.Installed, title: 'Google SecOps', version: '', }, ] ``` This means that - in theory - there are the following 2 rules installed and running: ```typescript [ { related_integrations: [{ package: 'splunk' }], id: 'splunk_rule_id', }, { related_integrations: [{ package: 'google_secops' }], id: 'google_secops_rule_id', }, ] ``` In this case, the `Sources` button would show 2 entries, as follow: ```typescript [ { checked: 'on', key: 'splunk_rule_id', label: 'Splunk', }, { checked: 'on', key: 'google_secops_rule_id', label: 'Splunk', }, ] ``` This PR also fixes a small miss in [the prior PR](elastic#215585) that implemented the KPI section, where I had forgotten to pass the KQL filters to the charts. #### Before https://github.com/user-attachments/assets/77e583c6-718f-46d9-96b4-42ee9976161b #### After https://github.com/user-attachments/assets/50e8e541-5798-4906-b7cc-4f9756dbdefc ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes - generate data: `yarn test:generate:serverless-dev` - create 4 catch all rules, each with a name of a AI for SOC integration (`google_secops`, `microsoft_sentinel`,, `sentinel_one` and `crowdstrike`) - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73) to `installedPackages: availablePackages` to force having some packages installed - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63) to `r.name === p.name` to make sure there will be matches between integrations and rules ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios elastic/security-team#11956 (cherry picked from commit 2ed4266)

## Summary This PR adds the SiemSearchBar to the alert summary page. The search bar is pretty basic: it hides the query menu and the filter buttons to the left of the query input. Instead, the PR builds a new filter button. That button lists all the sources available. Sources are basically equivalent to integrations, or their corresponding rules. It is a friendly UI name to abstract the concept or a rule. In the AI for SOC effort, each integration is bundled with a single rule. This means that deselecting a source from the Source filter button is equivalent to adding a filter to the search bar to exclude all alerts with the `kibana.alert.rule.name` property having the value of that integration. ### Example: There are following 2 integrations installed: ```typescript [ { id: 'splunk', name: 'splunk', status: installationStatuses.Installed, title: 'Splunk', version: '', }, { id: 'google_secops', name: 'google_secops', status: installationStatuses.Installed, title: 'Google SecOps', version: '', }, ] ``` This means that - in theory - there are the following 2 rules installed and running: ```typescript [ { related_integrations: [{ package: 'splunk' }], name: 'Splunk Rule', }, { related_integrations: [{ package: 'google_secops' }], name: 'Google SecOps Rule', }, ] ``` In this case, the `Sources` button would show 2 entries, as follow: ```typescript [ { checked: 'on', key: 'Splunk Rule', label: 'Splunk', }, { checked: 'on', key: 'Google SecOps Rule', label: 'Splunk', }, ] ``` By default, the `checked` property should be set to `on`. It would be `off` if a filter for the corresponding `label` existed. https://github.com/user-attachments/assets/059815d2-9181-4bf1-bd78-e0e5bfa7439d https://github.com/user-attachments/assets/126606c7-b4e0-4d0b-82c1-b531c6490de3 ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` And this to generate data: `yarn test:generate:serverless-dev` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes You'll need to either have some AI for SOC integrations installed, or more easily you can: - change the `alert_summary.tsx` line `38` from `if (installedPackages.length === 0) {` to `if (installedPackages.length > 0) {` to force the wrapper component to render - update `42` of the same `alert_summary.tsx` file from `return <Wrapper packages={installedPackages} />;` to `return <Wrapper packages={availablePackages} />;` to be able to see some packages - comment out line the if condition line `66` of `use_integrations.ts` file to make sure that values are added even if there is no `matchingRule` - replace `const ruleName = changedOption.key;` with `const ruleName = changedOption.label;` on line `78` of the `integrations_filter_button.tsx` file ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### Links Ticket elastic/security-team#11956 Mocks https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=3284-70999&m=dev --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 27bc009)

## Summary This PR fixes an issue with the logic implemented in [this previous PR](elastic#215586): _In the AI for SOC effort, each integration is bundled with a single rule. This means that deselecting a source from the Source filter button is equivalent to adding a filter to the search bar to exclude all alerts with the kibana.alert.rule.name property having the value of that integration._ The problem with the previous logic above is the value in the `kibana.alert.rule.name` field can be overridden (see `Rule name override [here](https://www.elastic.co/guide/en/security/current/rules-ui-create.html)). Therefore filtering alerts by this value does not guarantee that all the alerts generated by the rule will be correctly filtered out. The new logic uses the `rule.id` instead of the `rule.name`, which we then use to filter using the `signal.rule.id` field instead of `kibana.alert.rule.name` ### Example: There are following 2 integrations installed: ```typescript [ { id: 'splunk', name: 'splunk', status: installationStatuses.Installed, title: 'Splunk', version: '', }, { id: 'google_secops', name: 'google_secops', status: installationStatuses.Installed, title: 'Google SecOps', version: '', }, ] ``` This means that - in theory - there are the following 2 rules installed and running: ```typescript [ { related_integrations: [{ package: 'splunk' }], id: 'splunk_rule_id', }, { related_integrations: [{ package: 'google_secops' }], id: 'google_secops_rule_id', }, ] ``` In this case, the `Sources` button would show 2 entries, as follow: ```typescript [ { checked: 'on', key: 'splunk_rule_id', label: 'Splunk', }, { checked: 'on', key: 'google_secops_rule_id', label: 'Splunk', }, ] ``` This PR also fixes a small miss in [the prior PR](elastic#215585) that implemented the KPI section, where I had forgotten to pass the KQL filters to the charts. #### Before https://github.com/user-attachments/assets/77e583c6-718f-46d9-96b4-42ee9976161b #### After https://github.com/user-attachments/assets/50e8e541-5798-4906-b7cc-4f9756dbdefc ## How to test This needs to be ran in Serverless: - `yarn es serverless --projectType security` - `yarn serverless-security --no-base-path` You also need to enable the AI for SOC tier, by adding the following to your `serverless.security.dev.yaml` file: ``` xpack.securitySolutionServerless.productTypes: [ { product_line: 'ai_soc', product_tier: 'search_ai_lake' }, ] ``` Use one of these Serverless users: - `platform_engineer` - `endpoint_operations_analyst` - `endpoint_policy_manager` - `admin` - `system_indices_superuser` ### Notes - generate data: `yarn test:generate:serverless-dev` - create 4 catch all rules, each with a name of a AI for SOC integration (`google_secops`, `microsoft_sentinel`,, `sentinel_one` and `crowdstrike`) - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73) to `installedPackages: availablePackages` to force having some packages installed - change [this line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63) to `r.name === p.name` to make sure there will be matches between integrations and rules ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios elastic/security-team#11956 (cherry picked from commit 2ed4266)

…) (#222074) # Backport This will backport the following commits from `main` to `8.19`: - [[AI4DSOC] Alert summary page routing and initialization (#214889)](#214889) - [[AI4DSOC] Alert summary landing page (#215246)](#215246) - [[AI4DSOC] Alert summary dataview (#215265)](#215265) - [[AI4DSOC] Alert summary KQL bar [#215586]](#215586) - [[AI4DSOC] Alert summary KPI charts [#215585]](#215585) - [[AI4DSOR] Alert summary integrations section [#215266]](#215266) - [[AI4DSOC] Fix issue with filtering by integrations [#216574]](#216574) - [[AI4DSOC] Alert summary table setup [#216744]](#216744) - [Alerty summary table flyout setup [#217421]](#217421) - [[AI4DSOC] Alert summary alert actions in table and flyout [#217696]](#217696) - [[AI4DSOC] Alert summary table custom cell renderers [#217124]](#217124) - [[AI4DSOC] Alert summary table and flyout ai assistant [#217744]](#217744) - [[AI4DSOC] Alert summary page performance improvements [#218632]](#218632) - [[AI4DSOC] Change the Attack Discovery page to use the AI for SOC alerts table [#218736]](#218736) - [[AI4DSOC] Change the Cases page to use the AI for SOC alerts table [#218742]](#218742) - [[AI4DSOC] Fix spacing issue on alert summary landing page integration card [#218868]](#218868) - [[AI4DSOC][ResponseOps] Fix alerts table not handling undefined maintenanceWindow capability [#218999]](#218999) - [[AI4DSOC] Fix link to the new integrations page [#219030]](#219030) - [[AI4DSOC] Disable CellActions and PreviewLinks on the Attack discovery page [#219033]](#219033) - [[AI4DSOC] Add cell renderer for datetime fields to the alert summary table [#219126]](#219126) - [[AI4DSOC] Remove Assistant icon from row action in alert summary table [#219141]](#219141) - [[AI4DSOC] Add checkboxes to the alert summary table [#219169]](#219169) - [[Security Solution][AI4DSOC] Fix table not applying alert tags for Attack discovery and Cases pages in AI4DSOC [#219410]](#219410) - [[AI4DSOC] Fix logic that renders the group title when grouping by integrations [#219430]](#219430) - [[AI4DSOC] Alert summary table truncates long values and display the field/value pair in tooltip [#219438]](#219438) - [[Security Solution] Fix alerts table potentially not applying alert assignees [#219460]](#219460) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

PhilippeOberti mentioned this pull request Mar 21, 2025

[AI4DSOC] Alert summary KPI charts #215585

Merged

2 tasks

PhilippeOberti force-pushed the alerty-summary-kql-bar branch 3 times, most recently from 6c8026c to 7458c58 Compare March 25, 2025 03:18

PhilippeOberti marked this pull request as ready for review March 25, 2025 03:18

PhilippeOberti requested review from a team as code owners March 25, 2025 03:18

lgestc reviewed Mar 25, 2025

View reviewed changes

PhilippeOberti force-pushed the alerty-summary-kql-bar branch from 7458c58 to 4569889 Compare March 25, 2025 19:16

christineweng approved these changes Mar 28, 2025

View reviewed changes

PhilippeOberti added 2 commits March 27, 2025 19:28

[AI4DSOC] Alert summary KQL bar

845cb0e

move fetching rules within sources hook

d339e01

rename source to integration for clarity + PR comments

4d55975

PhilippeOberti force-pushed the alerty-summary-kql-bar branch from 4569889 to 4d55975 Compare March 28, 2025 01:10

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

b6a4ae5

…-fix'

PhilippeOberti merged commit 27bc009 into elastic:main Mar 28, 2025
9 checks passed

PhilippeOberti deleted the alerty-summary-kql-bar branch March 28, 2025 03:31

PhilippeOberti mentioned this pull request Apr 1, 2025

[AI4DSOC] Fix issue with filtering by integrations #216574

Merged

1 task

PhilippeOberti mentioned this pull request May 30, 2025

[8.19] [AI4DSOC] Backport of AI4DSOC alert summary related PRs (#214889) #222074

Merged

PhilippeOberti added the v8.19.0 label Jun 4, 2025

		const [isPopoverOpen, setIsPopoverOpen] = useState(false);
		const togglePopover = useCallback(() => setIsPopoverOpen((value) => !value), []);

Conversation

PhilippeOberti commented Mar 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Example:

How to test

Notes

Checklist

Links

Uh oh!

elasticmachine commented Mar 25, 2025

Uh oh!

lgestc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

PhilippeOberti Mar 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

christineweng left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

PhilippeOberti Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

PhilippeOberti Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

PhilippeOberti commented Mar 28, 2025

Uh oh!

elasticmachine commented Mar 28, 2025

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

PhilippeOberti commented Mar 21, 2025 •

edited

Loading

PhilippeOberti Mar 25, 2025 •

edited

Loading

PhilippeOberti Mar 28, 2025 •

edited

Loading

PhilippeOberti Mar 28, 2025 •

edited

Loading