Skip to content

[Security Solution][Alert flyout] Edit highlighted fields in overview tab#216740

Merged
PhilippeOberti merged 3 commits intoelastic:mainfrom
christineweng:edit-hf
Apr 15, 2025
Merged

[Security Solution][Alert flyout] Edit highlighted fields in overview tab#216740
PhilippeOberti merged 3 commits intoelastic:mainfrom
christineweng:edit-hf

Conversation

@christineweng
Copy link
Contributor

@christineweng christineweng commented Apr 2, 2025 •
edited by kibanamachine
Loading

Summary

This PR allows user to edit highlighted fields in alert flyout, under Investigations. The modal shows default highlighted fields that are defined by Elastic, and allow user to edit custom highlighted fields.

Currently this feature is behind feature flag editHighlightedFieldsEnabled (not enabled by default).

Screen.Recording.2025-04-02.at.3.09.48.PM.mov

Disabled when:

User does not have security privilege

image

Prebuilt rule w/o enterprise license (showing upsell)

image

Do not show the button when:

Not an alert

image

rule preview

image

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

@christineweng christineweng self-assigned this Apr 2, 2025
@christineweng christineweng added release_note:feature Makes this part of the condensed release notes Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team backport:version Backport to applied version labels v9.1.0 v8.19.0 labels Apr 2, 2025
@christineweng christineweng force-pushed the edit-hf branch 2 times, most recently from edad531 to c3cff3f Compare April 2, 2025 21:14
@christineweng christineweng marked this pull request as ready for review April 2, 2025 21:15
@christineweng christineweng requested review from a team as code owners April 2, 2025 21:15
@elasticmachine
Copy link
Contributor

elasticmachine commented Apr 2, 2025

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

PhilippeOberti
PhilippeOberti requested changes Apr 3, 2025
View reviewed changes
Copy link
Contributor

@PhilippeOberti PhilippeOberti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Desk tested and it look amazing! I left a few comments in the code, happy to discuss if some don't make sense!

@christineweng christineweng added the ci:cloud-deploy Create or update a Cloud deployment label Apr 4, 2025
PhilippeOberti
PhilippeOberti reviewed Apr 4, 2025
View reviewed changes
Copy link
Contributor

@PhilippeOberti PhilippeOberti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left one more comment/question I had missed in my first review, sorry!

...gins/security_solution/public/flyout/document_details/shared/hooks/use_highlighted_fields.ts Outdated
export const useHighlightedFields = ({
dataFormattedForFieldBrowser,
investigationFields,
type = 'all',
Copy link
Contributor

@PhilippeOberti PhilippeOberti Apr 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes sorry! I think it should be safe to remove the most level one, which is useHighlightedFields (and not getHighlightedFieldsToDisplay). Makes sense?

@christineweng christineweng mentioned this pull request Apr 4, 2025
Open
PhilippeOberti
PhilippeOberti approved these changes Apr 4, 2025
View reviewed changes
Copy link
Contributor

@PhilippeOberti PhilippeOberti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for making all the changes, the functionality is awesome, users are going to love it! Great work on the UI, the code is super clean and thanks for adding plenty of unit tests as well!

@christineweng christineweng removed the ci:cloud-deploy Create or update a Cloud deployment label Apr 14, 2025
@elasticmachine
Copy link
Contributor

elasticmachine commented Apr 14, 2025 •
edited
Loading

💔 Build Failed

Failed CI Steps

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 7221 7224 +3

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 9.0MB 9.0MB +9.0KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
securitySolution 88.8KB 88.8KB +32.0B

History

cc @christineweng

@PhilippeOberti PhilippeOberti merged commit a4a11bb into elastic:main Apr 15, 2025
10 checks passed
@kibanamachine
Copy link
Contributor

kibanamachine commented Apr 15, 2025

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/14475472732

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Apr 15, 2025
@christineweng
[Security Solution][Alert flyout] Edit highlighted fields in overview…
79c192a 
… tab (elastic#216740)

## Summary

This PR allows user to edit highlighted fields in alert flyout, under
`Investigations`. The modal shows default highlighted fields that are
defined by Elastic, and allow user to edit custom highlighted fields.

Currently this feature is behind feature flag
`editHighlightedFieldsEnabled` (not enabled by default).

https://github.com/user-attachments/assets/35b3d09e-5e21-42ea-80e9-e8c0753985c9

#### Disabled when:

<details>
<summary>User does not have security privilege</summary>

![image](https://github.com/user-attachments/assets/69ba7bc7-2d9b-4a2c-ae8e-e9c14f396a31)

</details>

<details>
<summary>Prebuilt rule w/o enterprise license (showing upsell)</summary>

![image](https://github.com/user-attachments/assets/a9c38e20-85b2-4082-af5e-a8707b2098cb)

</details>

#### Do not show the button when:
<details>
<summary>Not an alert </summary>

![image](https://github.com/user-attachments/assets/b5e9afde-f0d0-4a88-aaed-7481ba586850)

</details>

<details>
<summary>rule preview</summary>

![image](https://github.com/user-attachments/assets/283d7a83-50b2-48ab-af2d-11692501c205)

</details>

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

(cherry picked from commit a4a11bb)
@kibanamachine kibanamachine mentioned this pull request Apr 15, 2025
Merged
@kibanamachine
Copy link
Contributor

kibanamachine commented Apr 15, 2025

💚 All backports created successfully

Status Branch Result
✅ 8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

@kibanamachine kibanamachine mentioned this pull request Apr 15, 2025
Merged
1 task
kibanamachine added a commit that referenced this pull request Apr 15, 2025
@kibanamachine @christineweng
[8.x] [Security Solution][Alert flyout] Edit highlighted fields in ov…
3e77aaa 
…erview tab (#216740) (#218323)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution][Alert flyout] Edit highlighted fields in overview
tab (#216740)](#216740)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT
[{"author":{"name":"christineweng","email":"18648970+christineweng@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-04-15T17:18:35Z","message":"[Security
Solution][Alert flyout] Edit highlighted fields in overview tab
(#216740)\n\n## Summary\n\nThis PR allows user to edit highlighted
fields in alert flyout, under\n`Investigations`. The modal shows default
highlighted fields that are\ndefined by Elastic, and allow user to edit
custom highlighted fields.\n\nCurrently this feature is behind feature
flag\n`editHighlightedFieldsEnabled` (not enabled by
default).\n\n\n\nhttps://github.com/user-attachments/assets/35b3d09e-5e21-42ea-80e9-e8c0753985c9\n\n\n\n####
Disabled when:\n\n<details>\n<summary>User does not have security
privilege</summary>\n\n\n![image](https://github.com/user-attachments/assets/69ba7bc7-2d9b-4a2c-ae8e-e9c14f396a31)\n\n</details>\n\n<details>\n<summary>Prebuilt
rule w/o enterprise license (showing
upsell)</summary>\n\n\n![image](https://github.com/user-attachments/assets/a9c38e20-85b2-4082-af5e-a8707b2098cb)\n\n</details>\n\n####
Do not show the button when:\n<details>\n<summary>Not an alert
</summary>\n\n\n![image](https://github.com/user-attachments/assets/b5e9afde-f0d0-4a88-aaed-7481ba586850)\n\n</details>\n\n<details>\n<summary>rule
preview</summary>\n\n\n![image](https://github.com/user-attachments/assets/283d7a83-50b2-48ab-af2d-11692501c205)\n\n</details>\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [x] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"a4a11bb46f63ad78399f152257a883d1a35f4ce9","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:feature","Team:Threat
Hunting:Investigations","backport:version","v9.1.0","v8.19.0"],"title":"[Security
Solution][Alert flyout] Edit highlighted fields in overview
tab","number":216740,"url":"https://github.com/elastic/kibana/pull/216740","mergeCommit":{"message":"[Security
Solution][Alert flyout] Edit highlighted fields in overview tab
(#216740)\n\n## Summary\n\nThis PR allows user to edit highlighted
fields in alert flyout, under\n`Investigations`. The modal shows default
highlighted fields that are\ndefined by Elastic, and allow user to edit
custom highlighted fields.\n\nCurrently this feature is behind feature
flag\n`editHighlightedFieldsEnabled` (not enabled by
default).\n\n\n\nhttps://github.com/user-attachments/assets/35b3d09e-5e21-42ea-80e9-e8c0753985c9\n\n\n\n####
Disabled when:\n\n<details>\n<summary>User does not have security
privilege</summary>\n\n\n![image](https://github.com/user-attachments/assets/69ba7bc7-2d9b-4a2c-ae8e-e9c14f396a31)\n\n</details>\n\n<details>\n<summary>Prebuilt
rule w/o enterprise license (showing
upsell)</summary>\n\n\n![image](https://github.com/user-attachments/assets/a9c38e20-85b2-4082-af5e-a8707b2098cb)\n\n</details>\n\n####
Do not show the button when:\n<details>\n<summary>Not an alert
</summary>\n\n\n![image](https://github.com/user-attachments/assets/b5e9afde-f0d0-4a88-aaed-7481ba586850)\n\n</details>\n\n<details>\n<summary>rule
preview</summary>\n\n\n![image](https://github.com/user-attachments/assets/283d7a83-50b2-48ab-af2d-11692501c205)\n\n</details>\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [x] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"a4a11bb46f63ad78399f152257a883d1a35f4ce9"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/216740","number":216740,"mergeCommit":{"message":"[Security
Solution][Alert flyout] Edit highlighted fields in overview tab
(#216740)\n\n## Summary\n\nThis PR allows user to edit highlighted
fields in alert flyout, under\n`Investigations`. The modal shows default
highlighted fields that are\ndefined by Elastic, and allow user to edit
custom highlighted fields.\n\nCurrently this feature is behind feature
flag\n`editHighlightedFieldsEnabled` (not enabled by
default).\n\n\n\nhttps://github.com/user-attachments/assets/35b3d09e-5e21-42ea-80e9-e8c0753985c9\n\n\n\n####
Disabled when:\n\n<details>\n<summary>User does not have security
privilege</summary>\n\n\n![image](https://github.com/user-attachments/assets/69ba7bc7-2d9b-4a2c-ae8e-e9c14f396a31)\n\n</details>\n\n<details>\n<summary>Prebuilt
rule w/o enterprise license (showing
upsell)</summary>\n\n\n![image](https://github.com/user-attachments/assets/a9c38e20-85b2-4082-af5e-a8707b2098cb)\n\n</details>\n\n####
Do not show the button when:\n<details>\n<summary>Not an alert
</summary>\n\n\n![image](https://github.com/user-attachments/assets/b5e9afde-f0d0-4a88-aaed-7481ba586850)\n\n</details>\n\n<details>\n<summary>rule
preview</summary>\n\n\n![image](https://github.com/user-attachments/assets/283d7a83-50b2-48ab-af2d-11692501c205)\n\n</details>\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [x] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] The PR
description includes the appropriate Release Notes section,\nand the
correct `release_note:*` label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"a4a11bb46f63ad78399f152257a883d1a35f4ce9"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: christineweng <18648970+christineweng@users.noreply.github.com>
This was referenced Apr 22, 2025
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lgestc lgestc lgestc left review comments

@dhurley14 dhurley14 dhurley14 approved these changes

@PhilippeOberti PhilippeOberti PhilippeOberti approved these changes

@nkhristinin nkhristinin Awaiting requested review from nkhristinin nkhristinin is a code owner automatically assigned from elastic/security-detection-engine

Assignees

@christineweng christineweng

Labels

backport:version Backport to applied version labels release_note:feature Makes this part of the condensed release notes Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team v8.19.0 v9.1.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@christineweng @elasticmachine @kibanamachine @dhurley14 @lgestc @PhilippeOberti