Skip to content

[AI4DSOC] Alert summary page performance improvements#218632

Merged
PhilippeOberti merged 1 commit intoelastic:mainfrom
PhilippeOberti:alert-summary-performance-improvements
Apr 18, 2025
Merged

[AI4DSOC] Alert summary page performance improvements#218632
PhilippeOberti merged 1 commit intoelastic:mainfrom
PhilippeOberti:alert-summary-performance-improvements

Conversation

@PhilippeOberti
Copy link
Contributor

@PhilippeOberti PhilippeOberti commented Apr 18, 2025

Summary

This PR applies some performance improvements to the newly created Alert summary page (for AI for SOC).

Here are the multiple changes:

  • instead of fetching all rules in multiple places (components and hooks), we're now fetching all rules in the most top level alert_summary.tsx pages component. We're then passing the result down via props to the children components. Though some of the components inside the alerts_table component for example cannot be passed via props, so we're leveraging the additionalContext property to pass down rules information. Also, for the components working within the grouping_alerts_table, we had to wrap the whole component with a local context.
  • similarly, the packages were already fetched in the very top alert_summary.tsx pages component and were passed via props to the children components, but we applied the same logic for the alerts_table and the grouping_alerts_table components.

The PR also improves the integration_icon.tsx component to make it more generic, and reused in all places to avoid the previous code duplication.

No UI or behavior changes are introduced!

Screen.Recording.2025-04-17.at.8.20.47.PM.mov

How to test

This needs to be ran in Serverless:

  • yarn es serverless --projectType security
  • yarn serverless-security --no-base-path

You also need to enable the AI for SOC tier, by adding the following to your serverless.security.dev.yaml file:

xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]

Use one of these Serverless users:

  • platform_engineer
  • endpoint_operations_analyst
  • endpoint_policy_manager
  • admin
  • system_indices_superuser

Then:

  • generate data: yarn test:generate:serverless-dev
  • create 4 catch all rules, each with a name of a AI for SOC integration (google_secops, microsoft_sentinel,, sentinel_one and crowdstrike)
  • change this line to installedPackages: availablePackages to force having some packages installed
  • change this line to r.name === p.name to make sure there will be matches between integrations and rules

Checklist

@PhilippeOberti PhilippeOberti added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team Team:Security Generative AI Security Generative AI v9.1.0 labels Apr 18, 2025
@PhilippeOberti PhilippeOberti requested review from a team as code owners April 18, 2025 01:44
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

@PhilippeOberti PhilippeOberti force-pushed the alert-summary-performance-improvements branch from 9bb6449 to 45f0d15 Compare April 18, 2025 01:53
@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 9.0MB 9.0MB +545.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
securitySolution 89.4KB 89.4KB -4.0B

globalQuery={globalQuery}
hasIndexMaintenance={hasIndexMaintenance ?? false}
hasIndexWrite={hasIndexWrite ?? false}
loading={false}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is loading handled at a higher level?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But this could potentially be revisited in the future...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But this could potentially be revisited in the future...

Copy link
Contributor

@michaelolo24 michaelolo24 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work, thanks for the improvements!

@PhilippeOberti PhilippeOberti merged commit 112eab3 into elastic:main Apr 18, 2025
9 checks passed
@PhilippeOberti PhilippeOberti deleted the alert-summary-performance-improvements branch April 18, 2025 18:31
davismcphee pushed a commit to davismcphee/kibana that referenced this pull request Apr 22, 2025
## Summary

This PR applies some performance improvements to the newly created Alert
summary page (for AI for SOC).

Here are the multiple changes:
- instead of fetching all rules in multiple places (components and
hooks), we're now fetching all rules in the most top level
`alert_summary.tsx` pages component. We're then passing the result down
via props to the children components. Though some of the components
inside the `alerts_table` component for example cannot be passed via
props, so we're leveraging the `additionalContext` property to pass down
rules information. Also, for the components working within the
`grouping_alerts_table`, we had to wrap the whole component with a local
context.
- similarly, the packages were already fetched in the very top
`alert_summary.tsx` pages component and were passed via props to the
children components, but we applied the same logic for the
`alerts_table` and the `grouping_alerts_table` components.

The PR also improves the `integration_icon.tsx` component to make it
more generic, and reused in all places to avoid the previous code
duplication.

**No UI or behavior changes are introduced!**


https://github.com/user-attachments/assets/1fc1b6d0-290c-4b8e-b3e1-6ccb82f4f82b

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

Then:
- generate data: `yarn test:generate:serverless-dev`
- create 4 catch all rules, each with a name of a AI for SOC integration
(`google_secops`, `microsoft_sentinel`,, `sentinel_one` and
`crowdstrike`)
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73)
to `installedPackages: availablePackages` to force having some packages
installed
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63)
to `r.name === p.name` to make sure there will be matches between
integrations and rules


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
PhilippeOberti added a commit that referenced this pull request Apr 22, 2025
… card (#218868)

## Summary

This PR a small UI issue with the AI4DSOC alert summary landing page.
Originally added via [this
PR](#215246), some of that logic
was changed in [this more recent
PR](#218632), where the
`IntegrationIcon` logic was extracted into a reusable component,
packages with a `EuiSkeletonText` component, which somehow breaks the
`inlineMargingEnd` value applied to the icon...

This PR fixes the spacing issue now seen on the integration card.

| Before | After |
| ------------- | ------------- |
| ![Screenshot 2025-04-22 at 12 42
54 PM](https://github.com/user-attachments/assets/402af5e9-69ef-46db-9d53-faf8d617a307)
| ![Screenshot 2025-04-22 at 12 38
19 PM](https://github.com/user-attachments/assets/3c290f46-8c79-424c-b478-e55736917429)
|
akowalska622 pushed a commit to akowalska622/kibana that referenced this pull request May 29, 2025
## Summary

This PR applies some performance improvements to the newly created Alert
summary page (for AI for SOC).

Here are the multiple changes:
- instead of fetching all rules in multiple places (components and
hooks), we're now fetching all rules in the most top level
`alert_summary.tsx` pages component. We're then passing the result down
via props to the children components. Though some of the components
inside the `alerts_table` component for example cannot be passed via
props, so we're leveraging the `additionalContext` property to pass down
rules information. Also, for the components working within the
`grouping_alerts_table`, we had to wrap the whole component with a local
context.
- similarly, the packages were already fetched in the very top
`alert_summary.tsx` pages component and were passed via props to the
children components, but we applied the same logic for the
`alerts_table` and the `grouping_alerts_table` components.

The PR also improves the `integration_icon.tsx` component to make it
more generic, and reused in all places to avoid the previous code
duplication.

**No UI or behavior changes are introduced!**


https://github.com/user-attachments/assets/1fc1b6d0-290c-4b8e-b3e1-6ccb82f4f82b

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

Then:
- generate data: `yarn test:generate:serverless-dev`
- create 4 catch all rules, each with a name of a AI for SOC integration
(`google_secops`, `microsoft_sentinel`,, `sentinel_one` and
`crowdstrike`)
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73)
to `installedPackages: availablePackages` to force having some packages
installed
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63)
to `r.name === p.name` to make sure there will be matches between
integrations and rules


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
akowalska622 pushed a commit to akowalska622/kibana that referenced this pull request May 29, 2025
… card (elastic#218868)

## Summary

This PR a small UI issue with the AI4DSOC alert summary landing page.
Originally added via [this
PR](elastic#215246), some of that logic
was changed in [this more recent
PR](elastic#218632), where the
`IntegrationIcon` logic was extracted into a reusable component,
packages with a `EuiSkeletonText` component, which somehow breaks the
`inlineMargingEnd` value applied to the icon...

This PR fixes the spacing issue now seen on the integration card.

| Before | After |
| ------------- | ------------- |
| ![Screenshot 2025-04-22 at 12 42
54 PM](https://github.com/user-attachments/assets/402af5e9-69ef-46db-9d53-faf8d617a307)
| ![Screenshot 2025-04-22 at 12 38
19 PM](https://github.com/user-attachments/assets/3c290f46-8c79-424c-b478-e55736917429)
|
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
## Summary

This PR applies some performance improvements to the newly created Alert
summary page (for AI for SOC).

Here are the multiple changes:
- instead of fetching all rules in multiple places (components and
hooks), we're now fetching all rules in the most top level
`alert_summary.tsx` pages component. We're then passing the result down
via props to the children components. Though some of the components
inside the `alerts_table` component for example cannot be passed via
props, so we're leveraging the `additionalContext` property to pass down
rules information. Also, for the components working within the
`grouping_alerts_table`, we had to wrap the whole component with a local
context.
- similarly, the packages were already fetched in the very top
`alert_summary.tsx` pages component and were passed via props to the
children components, but we applied the same logic for the
`alerts_table` and the `grouping_alerts_table` components.

The PR also improves the `integration_icon.tsx` component to make it
more generic, and reused in all places to avoid the previous code
duplication.

**No UI or behavior changes are introduced!**

https://github.com/user-attachments/assets/1fc1b6d0-290c-4b8e-b3e1-6ccb82f4f82b

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

Then:
- generate data: `yarn test:generate:serverless-dev`
- create 4 catch all rules, each with a name of a AI for SOC integration
(`google_secops`, `microsoft_sentinel`,, `sentinel_one` and
`crowdstrike`)
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73)
to `installedPackages: availablePackages` to force having some packages
installed
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63)
to `r.name === p.name` to make sure there will be matches between
integrations and rules

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

(cherry picked from commit 112eab3)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
… card (elastic#218868)

## Summary

This PR a small UI issue with the AI4DSOC alert summary landing page.
Originally added via [this
PR](elastic#215246), some of that logic
was changed in [this more recent
PR](elastic#218632), where the
`IntegrationIcon` logic was extracted into a reusable component,
packages with a `EuiSkeletonText` component, which somehow breaks the
`inlineMargingEnd` value applied to the icon...

This PR fixes the spacing issue now seen on the integration card.

| Before | After |
| ------------- | ------------- |
| ![Screenshot 2025-04-22 at 12 42
54 PM](https://github.com/user-attachments/assets/402af5e9-69ef-46db-9d53-faf8d617a307)
| ![Screenshot 2025-04-22 at 12 38
19 PM](https://github.com/user-attachments/assets/3c290f46-8c79-424c-b478-e55736917429)
|

(cherry picked from commit 0a4268c)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
## Summary

This PR applies some performance improvements to the newly created Alert
summary page (for AI for SOC).

Here are the multiple changes:
- instead of fetching all rules in multiple places (components and
hooks), we're now fetching all rules in the most top level
`alert_summary.tsx` pages component. We're then passing the result down
via props to the children components. Though some of the components
inside the `alerts_table` component for example cannot be passed via
props, so we're leveraging the `additionalContext` property to pass down
rules information. Also, for the components working within the
`grouping_alerts_table`, we had to wrap the whole component with a local
context.
- similarly, the packages were already fetched in the very top
`alert_summary.tsx` pages component and were passed via props to the
children components, but we applied the same logic for the
`alerts_table` and the `grouping_alerts_table` components.

The PR also improves the `integration_icon.tsx` component to make it
more generic, and reused in all places to avoid the previous code
duplication.

**No UI or behavior changes are introduced!**

https://github.com/user-attachments/assets/1fc1b6d0-290c-4b8e-b3e1-6ccb82f4f82b

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

Then:
- generate data: `yarn test:generate:serverless-dev`
- create 4 catch all rules, each with a name of a AI for SOC integration
(`google_secops`, `microsoft_sentinel`,, `sentinel_one` and
`crowdstrike`)
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73)
to `installedPackages: availablePackages` to force having some packages
installed
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63)
to `r.name === p.name` to make sure there will be matches between
integrations and rules

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

(cherry picked from commit 112eab3)

# Conflicts:
#	x-pack/solutions/security/plugins/security_solution/public/detections/components/alert_summary/table/render_cell.test.tsx
#	x-pack/solutions/security/plugins/security_solution/public/detections/components/alert_summary/table/table_section.tsx
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
… card (elastic#218868)

## Summary

This PR a small UI issue with the AI4DSOC alert summary landing page.
Originally added via [this
PR](elastic#215246), some of that logic
was changed in [this more recent
PR](elastic#218632), where the
`IntegrationIcon` logic was extracted into a reusable component,
packages with a `EuiSkeletonText` component, which somehow breaks the
`inlineMargingEnd` value applied to the icon...

This PR fixes the spacing issue now seen on the integration card.

| Before | After |
| ------------- | ------------- |
| ![Screenshot 2025-04-22 at 12 42
54 PM](https://github.com/user-attachments/assets/402af5e9-69ef-46db-9d53-faf8d617a307)
| ![Screenshot 2025-04-22 at 12 38
19 PM](https://github.com/user-attachments/assets/3c290f46-8c79-424c-b478-e55736917429)
|

(cherry picked from commit 0a4268c)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request Jun 4, 2025
## Summary

This PR applies some performance improvements to the newly created Alert
summary page (for AI for SOC).

Here are the multiple changes:
- instead of fetching all rules in multiple places (components and
hooks), we're now fetching all rules in the most top level
`alert_summary.tsx` pages component. We're then passing the result down
via props to the children components. Though some of the components
inside the `alerts_table` component for example cannot be passed via
props, so we're leveraging the `additionalContext` property to pass down
rules information. Also, for the components working within the
`grouping_alerts_table`, we had to wrap the whole component with a local
context.
- similarly, the packages were already fetched in the very top
`alert_summary.tsx` pages component and were passed via props to the
children components, but we applied the same logic for the
`alerts_table` and the `grouping_alerts_table` components.

The PR also improves the `integration_icon.tsx` component to make it
more generic, and reused in all places to avoid the previous code
duplication.

**No UI or behavior changes are introduced!**

https://github.com/user-attachments/assets/1fc1b6d0-290c-4b8e-b3e1-6ccb82f4f82b

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

Then:
- generate data: `yarn test:generate:serverless-dev`
- create 4 catch all rules, each with a name of a AI for SOC integration
(`google_secops`, `microsoft_sentinel`,, `sentinel_one` and
`crowdstrike`)
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73)
to `installedPackages: availablePackages` to force having some packages
installed
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63)
to `r.name === p.name` to make sure there will be matches between
integrations and rules

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

(cherry picked from commit 112eab3)

# Conflicts:
#	x-pack/solutions/security/plugins/security_solution/public/detections/components/alert_summary/table/render_cell.test.tsx
#	x-pack/solutions/security/plugins/security_solution/public/detections/components/alert_summary/table/table_section.tsx
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request Jun 4, 2025
… card (elastic#218868)

## Summary

This PR a small UI issue with the AI4DSOC alert summary landing page.
Originally added via [this
PR](elastic#215246), some of that logic
was changed in [this more recent
PR](elastic#218632), where the
`IntegrationIcon` logic was extracted into a reusable component,
packages with a `EuiSkeletonText` component, which somehow breaks the
`inlineMargingEnd` value applied to the icon...

This PR fixes the spacing issue now seen on the integration card.

| Before | After |
| ------------- | ------------- |
| ![Screenshot 2025-04-22 at 12 42
54 PM](https://github.com/user-attachments/assets/402af5e9-69ef-46db-9d53-faf8d617a307)
| ![Screenshot 2025-04-22 at 12 38
19 PM](https://github.com/user-attachments/assets/3c290f46-8c79-424c-b478-e55736917429)
|

(cherry picked from commit 0a4268c)
PhilippeOberti added a commit that referenced this pull request Jun 4, 2025
…) (#222074)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[AI4DSOC] Alert summary page routing and initialization
(#214889)](#214889)
- [[AI4DSOC] Alert summary landing page
(#215246)](#215246)
- [[AI4DSOC] Alert summary dataview
(#215265)](#215265)
- [[AI4DSOC] Alert summary KQL bar
[#215586]](#215586)
- [[AI4DSOC] Alert summary KPI charts
[#215585]](#215585)
- [[AI4DSOR] Alert summary integrations section
[#215266]](#215266)
- [[AI4DSOC] Fix issue with filtering by integrations
[#216574]](#216574)
- [[AI4DSOC] Alert summary table setup
[#216744]](#216744)
- [Alerty summary table flyout setup
[#217421]](#217421)
- [[AI4DSOC] Alert summary alert actions in table and flyout
[#217696]](#217696)
- [[AI4DSOC] Alert summary table custom cell renderers
[#217124]](#217124)
- [[AI4DSOC] Alert summary table and flyout ai assistant
[#217744]](#217744)
- [[AI4DSOC] Alert summary page performance improvements
[#218632]](#218632)
- [[AI4DSOC] Change the Attack Discovery page to use the AI for SOC
alerts table [#218736]](#218736)
- [[AI4DSOC] Change the Cases page to use the AI for SOC alerts table
[#218742]](#218742)
- [[AI4DSOC] Fix spacing issue on alert summary landing page integration
card [#218868]](#218868)
- [[AI4DSOC][ResponseOps] Fix alerts table not handling undefined
maintenanceWindow capability
[#218999]](#218999)
- [[AI4DSOC] Fix link to the new integrations page
[#219030]](#219030)
- [[AI4DSOC] Disable CellActions and PreviewLinks on the Attack
discovery page [#219033]](#219033)
- [[AI4DSOC] Add cell renderer for datetime fields to the alert summary
table [#219126]](#219126)
- [[AI4DSOC] Remove Assistant icon from row action in alert summary
table [#219141]](#219141)
- [[AI4DSOC] Add checkboxes to the alert summary table
[#219169]](#219169)
- [[Security Solution][AI4DSOC] Fix table not applying alert tags for
Attack discovery and Cases pages in AI4DSOC
[#219410]](#219410)
- [[AI4DSOC] Fix logic that renders the group title when grouping by
integrations [#219430]](#219430)
- [[AI4DSOC] Alert summary table truncates long values and display the
field/value pair in tooltip
[#219438]](#219438)
- [[Security Solution] Fix alerts table potentially not applying alert
assignees [#219460]](#219460)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team:Security Generative AI Security Generative AI Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team v8.19.0 v9.1.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants