[Security Solution][AI4DSOC] Fix table not applying alert tags for Attack discovery and Cases pages in AI4DSOC by PhilippeOberti · Pull Request #219410 · elastic/kibana

PhilippeOberti · 2025-04-28T14:31:14Z

Summary

This PR fixes an issue with the apply alert tags functionality. This setAlertTags hook introduced in this PR was making use of a useRef and a useCallback which lead to the table having a null reference when it was expecting a function.

This meant that for parent table components that were written efficiently (meaning that do not render too many times), the set alert tags bulk actions was just plain not working. As can be seen in the following video:

Screen.Recording.2025-04-28.at.9.36.08.AM.mov

And this is with the fix in this PR

Screen.Recording.2025-04-28.at.9.33.08.AM.mov

The PR also makes 2 very small adjustments to the AI4DSOC alerts table in the Cases and Attack discovery pages, to make sure that the table refreshes after applying alert tags.

Checklist

Unit or functional tests were updated or added to match the most common scenarios

…tack discovery and Cases pages in AI4DSOC

elasticmachine · 2025-04-28T15:11:59Z

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

...c/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/ai_for_soc/table.tsx

...ugins/security_solution/public/common/components/toolbar/bulk_actions/use_set_alert_tags.tsx

dplumlee

LGTM, talked about this with @PhilippeOberti offline. This bug likely also exists in the useSetAlertAssignees hook but can be addressed in a separate PR

PhilippeOberti · 2025-04-28T15:50:41Z

LGTM, talked about this with @PhilippeOberti offline. This bug likely also exists in the useSetAlertAssignees hook but can be addressed in a separate PR

That is correct, I did notice that during my investigation. I'm already working on it separately, as I wanted this to go in asap for the conference.
Thank you!!

michaelolo24

Thanks!

elasticmachine · 2025-04-28T17:18:19Z

💚 Build Succeeded

Buildkite Build
Commit: 0f10b67

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	9.1MB	9.1MB	-40.0B

History

💔 Build #296776 failed dc05ea5

…ssignees (#219460) ## Summary This PR implements a similar change that was just merged a few hours ago. While [that change](#219410) was made to the alert tags not always working on the alerts table, this current change is applied to the alert assignees that faced a potential similar issue. The alert assignee code was introduced in [this PR](#170579), and I believe the code was using the similar logic of [the alert tag PR](#157786). The issue is related to the fact that we have a `useRef` for a function that is returned before the `useEffect` in the same hook runs, and setting the value of the function returned is happening within that `useEffect`. This has not caused any issues because the few places where this code is being used (the alerts page alerts table) is extremely not efficient and renders multiple times. This gives enough tries to the hook to actually get a value and return the correct function. This PR fixes that by returning the function directly. Here's a video showing that the functionality still works correctly for bulk actions: https://github.com/user-attachments/assets/b3394ffe-8333-4e0a-9bf7-831ef8ea8aea And also for normal row actions: https://github.com/user-attachments/assets/5f8c9d23-f0ef-4c65-b7de-4dc34478a8e7 ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

…tack discovery and Cases pages in AI4DSOC (elastic#219410) ## Summary This PR fixes an issue with the `apply alert tags` functionality. This [setAlertTags](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/common/components/toolbar/bulk_actions/use_set_alert_tags.tsx) hook introduced in [this PR](elastic#157786) was making use of a `useRef` and a `useCallback` which lead to the table having a `null` reference when it was expecting a `function`. This meant that for parent table components that were written efficiently (meaning that do not render too many times), the set alert tags bulk actions was just plain not working. As can be seen in the following video: https://github.com/user-attachments/assets/50545677-d7a7-4d45-828e-89bdd7b2de34 And this is with the fix in this PR https://github.com/user-attachments/assets/b1f07e55-43bb-4d01-bfd9-3b0dd23e30cc The PR also makes 2 very small adjustments to the AI4DSOC alerts table in the Cases and Attack discovery pages, to make sure that the table refreshes after applying alert tags. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

…ssignees (elastic#219460) ## Summary This PR implements a similar change that was just merged a few hours ago. While [that change](elastic#219410) was made to the alert tags not always working on the alerts table, this current change is applied to the alert assignees that faced a potential similar issue. The alert assignee code was introduced in [this PR](elastic#170579), and I believe the code was using the similar logic of [the alert tag PR](elastic#157786). The issue is related to the fact that we have a `useRef` for a function that is returned before the `useEffect` in the same hook runs, and setting the value of the function returned is happening within that `useEffect`. This has not caused any issues because the few places where this code is being used (the alerts page alerts table) is extremely not efficient and renders multiple times. This gives enough tries to the hook to actually get a value and return the correct function. This PR fixes that by returning the function directly. Here's a video showing that the functionality still works correctly for bulk actions: https://github.com/user-attachments/assets/b3394ffe-8333-4e0a-9bf7-831ef8ea8aea And also for normal row actions: https://github.com/user-attachments/assets/5f8c9d23-f0ef-4c65-b7de-4dc34478a8e7 ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

…tack discovery and Cases pages in AI4DSOC (elastic#219410) ## Summary This PR fixes an issue with the `apply alert tags` functionality. This [setAlertTags](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/common/components/toolbar/bulk_actions/use_set_alert_tags.tsx) hook introduced in [this PR](elastic#157786) was making use of a `useRef` and a `useCallback` which lead to the table having a `null` reference when it was expecting a `function`. This meant that for parent table components that were written efficiently (meaning that do not render too many times), the set alert tags bulk actions was just plain not working. As can be seen in the following video: https://github.com/user-attachments/assets/50545677-d7a7-4d45-828e-89bdd7b2de34 And this is with the fix in this PR https://github.com/user-attachments/assets/b1f07e55-43bb-4d01-bfd9-3b0dd23e30cc The PR also makes 2 very small adjustments to the AI4DSOC alerts table in the Cases and Attack discovery pages, to make sure that the table refreshes after applying alert tags. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios (cherry picked from commit 6f4d780)

…ssignees (elastic#219460) ## Summary This PR implements a similar change that was just merged a few hours ago. While [that change](elastic#219410) was made to the alert tags not always working on the alerts table, this current change is applied to the alert assignees that faced a potential similar issue. The alert assignee code was introduced in [this PR](elastic#170579), and I believe the code was using the similar logic of [the alert tag PR](elastic#157786). The issue is related to the fact that we have a `useRef` for a function that is returned before the `useEffect` in the same hook runs, and setting the value of the function returned is happening within that `useEffect`. This has not caused any issues because the few places where this code is being used (the alerts page alerts table) is extremely not efficient and renders multiple times. This gives enough tries to the hook to actually get a value and return the correct function. This PR fixes that by returning the function directly. Here's a video showing that the functionality still works correctly for bulk actions: https://github.com/user-attachments/assets/b3394ffe-8333-4e0a-9bf7-831ef8ea8aea And also for normal row actions: https://github.com/user-attachments/assets/5f8c9d23-f0ef-4c65-b7de-4dc34478a8e7 ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios (cherry picked from commit 254477e)

…tack discovery and Cases pages in AI4DSOC (elastic#219410) ## Summary This PR fixes an issue with the `apply alert tags` functionality. This [setAlertTags](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/common/components/toolbar/bulk_actions/use_set_alert_tags.tsx) hook introduced in [this PR](elastic#157786) was making use of a `useRef` and a `useCallback` which lead to the table having a `null` reference when it was expecting a `function`. This meant that for parent table components that were written efficiently (meaning that do not render too many times), the set alert tags bulk actions was just plain not working. As can be seen in the following video: https://github.com/user-attachments/assets/50545677-d7a7-4d45-828e-89bdd7b2de34 And this is with the fix in this PR https://github.com/user-attachments/assets/b1f07e55-43bb-4d01-bfd9-3b0dd23e30cc The PR also makes 2 very small adjustments to the AI4DSOC alerts table in the Cases and Attack discovery pages, to make sure that the table refreshes after applying alert tags. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios (cherry picked from commit 6f4d780)

…ssignees (elastic#219460) ## Summary This PR implements a similar change that was just merged a few hours ago. While [that change](elastic#219410) was made to the alert tags not always working on the alerts table, this current change is applied to the alert assignees that faced a potential similar issue. The alert assignee code was introduced in [this PR](elastic#170579), and I believe the code was using the similar logic of [the alert tag PR](elastic#157786). The issue is related to the fact that we have a `useRef` for a function that is returned before the `useEffect` in the same hook runs, and setting the value of the function returned is happening within that `useEffect`. This has not caused any issues because the few places where this code is being used (the alerts page alerts table) is extremely not efficient and renders multiple times. This gives enough tries to the hook to actually get a value and return the correct function. This PR fixes that by returning the function directly. Here's a video showing that the functionality still works correctly for bulk actions: https://github.com/user-attachments/assets/b3394ffe-8333-4e0a-9bf7-831ef8ea8aea And also for normal row actions: https://github.com/user-attachments/assets/5f8c9d23-f0ef-4c65-b7de-4dc34478a8e7 ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

…tack discovery and Cases pages in AI4DSOC (elastic#219410) ## Summary This PR fixes an issue with the `apply alert tags` functionality. This [setAlertTags](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/common/components/toolbar/bulk_actions/use_set_alert_tags.tsx) hook introduced in [this PR](elastic#157786) was making use of a `useRef` and a `useCallback` which lead to the table having a `null` reference when it was expecting a `function`. This meant that for parent table components that were written efficiently (meaning that do not render too many times), the set alert tags bulk actions was just plain not working. As can be seen in the following video: https://github.com/user-attachments/assets/50545677-d7a7-4d45-828e-89bdd7b2de34 And this is with the fix in this PR https://github.com/user-attachments/assets/b1f07e55-43bb-4d01-bfd9-3b0dd23e30cc The PR also makes 2 very small adjustments to the AI4DSOC alerts table in the Cases and Attack discovery pages, to make sure that the table refreshes after applying alert tags. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios (cherry picked from commit 6f4d780)

…ssignees (elastic#219460) ## Summary This PR implements a similar change that was just merged a few hours ago. While [that change](elastic#219410) was made to the alert tags not always working on the alerts table, this current change is applied to the alert assignees that faced a potential similar issue. The alert assignee code was introduced in [this PR](elastic#170579), and I believe the code was using the similar logic of [the alert tag PR](elastic#157786). The issue is related to the fact that we have a `useRef` for a function that is returned before the `useEffect` in the same hook runs, and setting the value of the function returned is happening within that `useEffect`. This has not caused any issues because the few places where this code is being used (the alerts page alerts table) is extremely not efficient and renders multiple times. This gives enough tries to the hook to actually get a value and return the correct function. This PR fixes that by returning the function directly. Here's a video showing that the functionality still works correctly for bulk actions: https://github.com/user-attachments/assets/b3394ffe-8333-4e0a-9bf7-831ef8ea8aea And also for normal row actions: https://github.com/user-attachments/assets/5f8c9d23-f0ef-4c65-b7de-4dc34478a8e7 ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios (cherry picked from commit 254477e)

…) (#222074) # Backport This will backport the following commits from `main` to `8.19`: - [[AI4DSOC] Alert summary page routing and initialization (#214889)](#214889) - [[AI4DSOC] Alert summary landing page (#215246)](#215246) - [[AI4DSOC] Alert summary dataview (#215265)](#215265) - [[AI4DSOC] Alert summary KQL bar [#215586]](#215586) - [[AI4DSOC] Alert summary KPI charts [#215585]](#215585) - [[AI4DSOR] Alert summary integrations section [#215266]](#215266) - [[AI4DSOC] Fix issue with filtering by integrations [#216574]](#216574) - [[AI4DSOC] Alert summary table setup [#216744]](#216744) - [Alerty summary table flyout setup [#217421]](#217421) - [[AI4DSOC] Alert summary alert actions in table and flyout [#217696]](#217696) - [[AI4DSOC] Alert summary table custom cell renderers [#217124]](#217124) - [[AI4DSOC] Alert summary table and flyout ai assistant [#217744]](#217744) - [[AI4DSOC] Alert summary page performance improvements [#218632]](#218632) - [[AI4DSOC] Change the Attack Discovery page to use the AI for SOC alerts table [#218736]](#218736) - [[AI4DSOC] Change the Cases page to use the AI for SOC alerts table [#218742]](#218742) - [[AI4DSOC] Fix spacing issue on alert summary landing page integration card [#218868]](#218868) - [[AI4DSOC][ResponseOps] Fix alerts table not handling undefined maintenanceWindow capability [#218999]](#218999) - [[AI4DSOC] Fix link to the new integrations page [#219030]](#219030) - [[AI4DSOC] Disable CellActions and PreviewLinks on the Attack discovery page [#219033]](#219033) - [[AI4DSOC] Add cell renderer for datetime fields to the alert summary table [#219126]](#219126) - [[AI4DSOC] Remove Assistant icon from row action in alert summary table [#219141]](#219141) - [[AI4DSOC] Add checkboxes to the alert summary table [#219169]](#219169) - [[Security Solution][AI4DSOC] Fix table not applying alert tags for Attack discovery and Cases pages in AI4DSOC [#219410]](#219410) - [[AI4DSOC] Fix logic that renders the group title when grouping by integrations [#219430]](#219430) - [[AI4DSOC] Alert summary table truncates long values and display the field/value pair in tooltip [#219438]](#219438) - [[Security Solution] Fix alerts table potentially not applying alert assignees [#219460]](#219460) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

[Security Solution][AI4DSOC] Fix table not applying alert tags for At…

dc05ea5

…tack discovery and Cases pages in AI4DSOC

PhilippeOberti force-pushed the fix-alert-tags branch from 8c98b54 to dc05ea5 Compare April 28, 2025 14:59

PhilippeOberti marked this pull request as ready for review April 28, 2025 15:11

PhilippeOberti requested review from a team as code owners April 28, 2025 15:11

PhilippeOberti requested a review from dplumlee April 28, 2025 15:11

stephmilovic reviewed Apr 28, 2025

View reviewed changes

...c/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/ai_for_soc/table.tsx Outdated Show resolved Hide resolved

stephmilovic approved these changes Apr 28, 2025

View reviewed changes

kqualters-elastic reviewed Apr 28, 2025

View reviewed changes

...ugins/security_solution/public/common/components/toolbar/bulk_actions/use_set_alert_tags.tsx Outdated Show resolved Hide resolved

remove console.log, remove unnecessary ignore and add unit test

0f10b67

kqualters-elastic approved these changes Apr 28, 2025

View reviewed changes

dplumlee approved these changes Apr 28, 2025

View reviewed changes

michaelolo24 approved these changes Apr 28, 2025

View reviewed changes

PhilippeOberti enabled auto-merge (squash) April 28, 2025 16:19

PhilippeOberti merged commit 6f4d780 into elastic:main Apr 28, 2025
9 checks passed

PhilippeOberti deleted the fix-alert-tags branch April 28, 2025 17:17

PhilippeOberti mentioned this pull request Apr 28, 2025

[Security Solution] Fix alerts table potentially not applying alert assignees #219460

Merged

1 task

PhilippeOberti mentioned this pull request May 30, 2025

[8.19] [AI4DSOC] Backport of AI4DSOC alert summary related PRs (#214889) #222074

Merged

PhilippeOberti added the v8.19.0 label Jun 4, 2025

kibanamachine mentioned this pull request Jul 7, 2025

[Investigations] - Improve useFieldBrowser performance #225859

Merged

kibanamachine mentioned this pull request Aug 28, 2025

[EASE] change cases alerts tab to use kibana.alert.rule.rule_id to kibana.rule.parameters.related_integration.package #233158

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][AI4DSOC] Fix table not applying alert tags for Attack discovery and Cases pages in AI4DSOC#219410

[Security Solution][AI4DSOC] Fix table not applying alert tags for Attack discovery and Cases pages in AI4DSOC#219410
PhilippeOberti merged 2 commits intoelastic:mainfrom
PhilippeOberti:fix-alert-tags

PhilippeOberti commented Apr 28, 2025 •

edited

Loading

Uh oh!

elasticmachine commented Apr 28, 2025

Uh oh!

Uh oh!

Uh oh!

dplumlee left a comment

Uh oh!

PhilippeOberti commented Apr 28, 2025

Uh oh!

michaelolo24 left a comment

Uh oh!

Uh oh!

elasticmachine commented Apr 28, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

PhilippeOberti commented Apr 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

elasticmachine commented Apr 28, 2025

Uh oh!

Uh oh!

Uh oh!

dplumlee left a comment

Choose a reason for hiding this comment

Uh oh!

PhilippeOberti commented Apr 28, 2025

Uh oh!

michaelolo24 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticmachine commented Apr 28, 2025

💚 Build Succeeded

Metrics [docs]

Async chunks

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

PhilippeOberti commented Apr 28, 2025 •

edited

Loading