[AI4DSOC] Alert summary alert actions in table and flyout

[PhilippeOberti]

Summary

This PR adds some alert actions to the AI for SOC alert summary page:

• table row action via a more actions icon button, to allow users to add the alert to a new case, an existing case, or to apply tags to the current alert
• a take action in the footer of the flyout, to allow the user to perform the same actions

Table row actions:

Screen.Recording.2025-04-10.at.11.41.21.AM.mov

Flyout footer actions:

Screen.Recording.2025-04-10.at.12.02.43.PM.mov

Notes

The code is extremely similar between the 2 components added in this PR. The difference between the 2 is the type of button that is used to open the popover.
I debated 2 others approaches, but was not happy with either:

• create a hook that would return the items and panels for cases and tags, then use that hook to limit the amount of duplicated code in both components. I decided against this as I hate having hooks that return components (in this case EuiContextMenuItems...
• create a shared component that would do the logic and have some props to conditionally decide how the button is being displayed. Here also, I decided against this approach because I feel like components that allow these sort of UI customization quickly end up hard to maintain, because we want to change the text, then the color of the button, then the type of icon...

If you feel strongly about the choice I made here, let me know and I'll reconsider the approach! 😄

How to test

This needs to be ran in Serverless:

• yarn es serverless --projectType security
• yarn serverless-security --no-base-path

You also need to enable the AI for SOC tier, by adding the following to your serverless.security.dev.yaml file:

xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]

Use one of these Serverless users:

• platform_engineer
• endpoint_operations_analyst
• endpoint_policy_manager
• admin
• system_indices_superuser

Then:

• generate data: yarn test:generate:serverless-dev
• create 4 catch all rules, each with a name of a AI for SOC integration (google_secops, microsoft_sentinel,, sentinel_one and crowdstrike) => to do that you'll need to temporary comment the serverless.security.dev.yaml config changes as the rules page is not accessible in AI for SOC.
• change this line to installedPackages: availablePackages to force having some packages installed
• change this line to r.name === p.name to make sure there will be matches between integrations and rules

Checklist

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Unit or functional tests were updated or added to match the most common scenarios

https://github.com/elastic/security-team/issues/11973

[elasticmachine]

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

[kqualters-elastic]

LGTM 👍

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 10c1452

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	7218	7221	+3

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	9.0MB	9.0MB	+2.3KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
securitySolution	88.8KB	88.8KB	+1.0B

History

• 💚 Build #292428 succeeded 7b3a541
• 💚 Build #292085 succeeded 6b754c4