[AI4SOC] Add rules management table by xcrzx · Pull Request #219111 · elastic/kibana

xcrzx · 2025-04-24T14:46:33Z

Resolves: https://github.com/elastic/security-team/issues/11787

Summary

Added the rule management and rule monitoring table to the AI4SOC tier.

Rule Monitoring

Rule Management

Empty state

UPD: I had to disable links to the rule details page for now. Will be working on enabling them separately

tomsonpl · 2025-04-25T11:25:03Z

/ci

elasticmachine · 2025-04-25T11:57:09Z

Pinging @elastic/security-solution (Team: SecuritySolution)

logeekal

Code Review only. LGTM 🚀

semd · 2025-04-25T14:15:24Z

...lutions/security/plugins/security_solution/public/common/hooks/use_is_search_ai_lake_tier.ts

+import { hasCapabilities } from '../lib/capabilities';
+import { useKibana } from '../lib/kibana';
+
+export const useIsSearchAiLakeTier = () => {


Suggested change

export const useIsSearchAiLakeTier = () => {

export const useIsExternalDetectionsEnabled = () => {

We should not need to care about tiers here, only if externalDetections functionality is enabled or not

What we're trying to do here doesn't map well to the product features, since we essentially need to disable multiple parts of the page on the AI4SOC tier. A more robust approach might be to add a key in the config for each feature we want to disable, but that would inflate the product feature config we support. So I'm not sure which approach is best here.

Anyway, reverting the changes for now to give us time for a more well-thought-out solution.

If for some reason you do need to check the capability in a future PR you can use this hook:

const { hasSearchAILakeConfigurations } = useAssistantAvailability();

If for some reason you do need to check the capability in a future PR you can use this hook:

Thanks, I was looking for something like that 👍

It's hard to grep for these variables that have AI in them because half of the people capitalize it Ai and the other half AI 😂

What we're trying to do here doesn't map well to the product features, since we essentially need to disable multiple parts of the page on the AI4SOC tier.

That's why we created new capabilities: detections (traditional in-house siem detections functionalities) and external_detections (new external detections rules functionality, for now it's only used in the new ai serverless tier)

Here we are hiding stuff when the user has external_detections (or does not have detections), the implementation of the hook looked correct to me, it was only the name of the hook that was misleading. In the security_solution plugin we should be agnostic and not know anything serverless-specific stuff, such as tiers.

And about using this here:

const { hasSearchAILakeConfigurations } = useAssistantAvailability();

I don't recommend this either, the assistant stuff should be checked in places where we do assistant-related things, not here. And the configurations capability should be checked only for logic related to the configuration page functionality.

Not saying this would now work, yes it would right now. But this would introduce coupling, if someday configurations (or external_detections) capability is changed and granted by another serverless tier, we will need to remember to come here to change this code, or we'll be introducing a bug. Which should not be necessary.

stephmilovic

Code review and manual testing LGTM

maximpn

@xcrzx Thanks for adding a simple Rules Management table for AI4SOC 🙏

I've tested the PR locally and it works fine. There are non critical comments.

maximpn · 2025-04-25T13:54:24Z

...ugins/security_solution/public/configurations/tabs/promotion_rules/promotion_rules_table.tsx

+        append:
+          installedTotal > 0 ? (
+            <EuiNotificationBadge size="m" color="subdued">
+              {installedTotal}
+            </EuiNotificationBadge>
+          ) : undefined,


Suggested change

append:

installedTotal > 0 ? (

<EuiNotificationBadge size="m" color="subdued">

{installedTotal}

</EuiNotificationBadge>

) : undefined,

append: installedTotal > 0 && (

<EuiNotificationBadge size="m" color="subdued">

{installedTotal}

</EuiNotificationBadge>

),,

maximpn · 2025-04-25T13:54:54Z

...ugins/security_solution/public/configurations/tabs/promotion_rules/promotion_rules_table.tsx

+        append:
+          installedTotal > 0 ? (
+            <EuiNotificationBadge size="m" color="subdued">
+              {installedTotal}
+            </EuiNotificationBadge>
+          ) : undefined,


Suggested change

append:

installedTotal > 0 ? (

<EuiNotificationBadge size="m" color="subdued">

{installedTotal}

</EuiNotificationBadge>

) : undefined,

append: installedTotal > 0 && (

<EuiNotificationBadge size="m" color="subdued">

{installedTotal}

</EuiNotificationBadge>

),

maximpn · 2025-04-25T14:13:47Z

...ugins/security_solution/public/configurations/tabs/promotion_rules/promotion_rules_table.tsx

+  });
+  const executionStatusColumn = useRuleExecutionStatusColumn({
+    sortable: true,
+    width: '16%',


Fixed width should work better. Otherwise min width should be set. Relative width gets too narrow on smaller screens

maximpn · 2025-04-25T14:16:32Z

...ugins/security_solution/public/detection_engine/rule_details_ui/pages/rule_details/index.tsx

+                  {isSearchAiLake === false && (
+                    <EuiFlexItem grow={false}>
+                      <EuiFlexGroup alignItems="center" gutterSize="s" responsive={false}>
+                        <EuiFlexItem grow={false}>
+                          <EditRuleSettingButtonLink
+                            ruleId={ruleId}
+                            disabled={
+                              !isExistingRule ||
+                              !hasUserCRUDPermission(canUserCRUD) ||
+                              (isMlRule(rule?.type) && !hasMlPermissions)
+                            }
+                            disabledReason={explainLackOfPermission(
+                              rule,
+                              hasMlPermissions,
+                              hasActionsPrivileges,
+                              canUserCRUD
+                            )}
+                          />
+                        </EuiFlexItem>
+                        <EuiFlexItem grow={false}>
+                          <RuleActionsOverflow
+                            rule={rule}
+                            userHasPermissions={
+                              isExistingRule && hasUserCRUDPermission(canUserCRUD)
+                            }
+                            canDuplicateRuleWithActions={canEditRuleWithActions(
+                              rule,
+                              hasActionsPrivileges
+                            )}
+                            showBulkDuplicateExceptionsConfirmation={showBulkDuplicateConfirmation}
+                            showManualRuleRunConfirmation={showManualRuleRunConfirmation}
+                            confirmDeletion={confirmDeletion}
+                          />
+                        </EuiFlexItem>
+                      </EuiFlexGroup>
+                    </EuiFlexItem>
+                  )}


Should rule actions and settings be extracted to a separate component for better readability?

maximpn · 2025-04-25T14:18:10Z

...y_solution/public/detection_engine/rule_management_ui/components/rules_table/use_columns.tsx

+  },
+  sortable: true,
+  truncateText: true,
+  width: '16%',


Should we have the fixed width?

elasticmachine · 2025-04-25T15:14:43Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: d1999b3

Failed CI Steps

Defend Workflows Cypress Tests on Serverless #12

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	7336	7338	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	9.1MB	9.1MB	+2.7KB

History

💔 Build #296171 failed ce52ff3
💔 Build #296158 failed babf19a

cc @xcrzx

PhilippeOberti

Desk tested and code LGTM for Threat Hunting Investigations team

**Resolves: elastic/security-team#11787 ## Summary Added the rule management and rule monitoring table to the AI4SOC tier. ### Rule Monitoring ![image](https://github.com/user-attachments/assets/6b22e69e-b2a9-4788-a82b-22a2746aafe9) ### Rule Management ![image](https://github.com/user-attachments/assets/97fb35e2-014a-4361-8e77-67ffcc37465d) ### Empty state ![Screenshot 2025-04-24 at 17 03 19](https://github.com/user-attachments/assets/8b86563b-21aa-49c6-beb2-e00ff671fa29) UPD: I had to disable links to the rule details page for now. Will be working on enabling them separately

kibanamachine · 2025-06-16T14:06:25Z

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/15683081338

**Resolves: https://github.com/elastic/security-team/issues/11787** ## Summary Added the rule management and rule monitoring table to the AI4SOC tier. ### Rule Monitoring ![image](https://github.com/user-attachments/assets/6b22e69e-b2a9-4788-a82b-22a2746aafe9) ### Rule Management ![image](https://github.com/user-attachments/assets/97fb35e2-014a-4361-8e77-67ffcc37465d) ### Empty state ![Screenshot 2025-04-24 at 17 03 19](https://github.com/user-attachments/assets/8b86563b-21aa-49c6-beb2-e00ff671fa29) UPD: I had to disable links to the rule details page for now. Will be working on enabling them separately (cherry picked from commit 857bf1d)

kibanamachine · 2025-06-16T14:12:35Z

💚 All backports created successfully

Status	Branch	Result
✅	8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

# Backport This will backport the following commits from `main` to `8.19`: - [[AI4SOC] Add rules management table (#219111)](#219111)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Dmitrii Shevchenko <dmitrii.shevchenko@elastic.co>

xcrzx self-assigned this Apr 24, 2025

xcrzx force-pushed the promotion_rule_management branch from 9312274 to ce52ff3 Compare April 25, 2025 11:50

xcrzx marked this pull request as ready for review April 25, 2025 11:56

xcrzx requested review from a team as code owners April 25, 2025 11:56

xcrzx requested review from nikitaindik and rylnd April 25, 2025 11:56

logeekal approved these changes Apr 25, 2025

View reviewed changes

maximpn requested review from maximpn and removed request for nikitaindik April 25, 2025 12:20

semd reviewed Apr 25, 2025

View reviewed changes

[AI4SOC] Add rules management table

d1999b3

xcrzx force-pushed the promotion_rule_management branch from ce52ff3 to d1999b3 Compare April 25, 2025 14:28

xcrzx removed request for a team and rylnd April 25, 2025 14:29

stephmilovic approved these changes Apr 25, 2025

View reviewed changes

maximpn approved these changes Apr 25, 2025

View reviewed changes

xcrzx enabled auto-merge (squash) April 25, 2025 15:29

tomsonpl mentioned this pull request Apr 25, 2025

[AI4DSOC] Change rules details page capabilities #219260

Merged

PhilippeOberti approved these changes Apr 25, 2025

View reviewed changes

xcrzx merged commit 857bf1d into elastic:main Apr 25, 2025
9 checks passed

xcrzx deleted the promotion_rule_management branch April 25, 2025 16:14

PhilippeOberti mentioned this pull request Apr 25, 2025

[AI4DSOC] Disable actions and replace alerts table on the rule details page for AI4DSOC #219304

Closed

1 task

xcrzx added backport:version Backport to applied version labels v8.19.0 and removed backport:skip This PR does not require backporting labels Jun 16, 2025

kibanamachine mentioned this pull request Jun 16, 2025

[8.19] [AI4SOC] Add rules management table (#219111) #224074

Merged

	export const useIsSearchAiLakeTier = () => {
	export const useIsExternalDetectionsEnabled = () => {

Conversation

xcrzx commented Apr 24, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Rule Monitoring

Rule Management

Empty state

Uh oh!

tomsonpl commented Apr 25, 2025

Uh oh!

elasticmachine commented Apr 25, 2025

Uh oh!

logeekal left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

semd Apr 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stephmilovic left a comment

Choose a reason for hiding this comment

Uh oh!

maximpn left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Apr 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Module Count

Async chunks

History

Uh oh!

PhilippeOberti left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kibanamachine commented Jun 16, 2025

Uh oh!

kibanamachine commented Jun 16, 2025

💚 All backports created successfully

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

xcrzx commented Apr 24, 2025 •

edited by kibanamachine

Loading

semd Apr 25, 2025 •

edited

Loading

elasticmachine commented Apr 25, 2025 •

edited

Loading