+
+ );
+
+ expect(getByTestId('internalAlertsPageLoading')).toBeInTheDocument();
+ });
+});
diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/ai_for_soc/table.tsx b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/ai_for_soc/table.tsx
new file mode 100644
index 0000000000000..5f97d2d2d6f86
--- /dev/null
+++ b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/ai_for_soc/table.tsx
@@ -0,0 +1,134 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { memo, useCallback, useMemo, useRef } from 'react';
+import type { DataView } from '@kbn/data-views-plugin/common';
+import { AlertsTable } from '@kbn/response-ops-alerts-table';
+import type { PackageListItem } from '@kbn/fleet-plugin/common';
+import type { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/types';
+import type { AlertsTableImperativeApi } from '@kbn/response-ops-alerts-table/types';
+import type { AdditionalTableContext } from '../../../../../../../detections/components/alert_summary/table/table';
+import {
+ ACTION_COLUMN_WIDTH,
+ ALERT_TABLE_CONSUMERS,
+ CASES_CONFIGURATION,
+ columns,
+ EuiDataGridStyleWrapper,
+ GRID_STYLE,
+ ROW_HEIGHTS_OPTIONS,
+ RULE_TYPE_IDS,
+ TOOLBAR_VISIBILITY,
+} from '../../../../../../../detections/components/alert_summary/table/table';
+import { ActionsCell } from '../../../../../../../detections/components/alert_summary/table/actions_cell';
+import { getDataViewStateFromIndexFields } from '../../../../../../../common/containers/source/use_data_view';
+import { useKibana } from '../../../../../../../common/lib/kibana';
+import { CellValue } from '../../../../../../../detections/components/alert_summary/table/render_cell';
+import type { RuleResponse } from '../../../../../../../../common/api/detection_engine';
+import { useAdditionalBulkActions } from '../../../../../../../detections/hooks/alert_summary/use_additional_bulk_actions';
+
+export interface TableProps {
+ /**
+ * DataView created for the alert summary page
+ */
+ dataView: DataView;
+ /**
+ * Id to pass down to the ResponseOps alerts table
+ */
+ id: string;
+ /**
+ * List of installed AI for SOC integrations
+ */
+ packages: PackageListItem[];
+ /**
+ * Query that contains the id of the alerts to display in the table
+ */
+ query: Pick;
+ /**
+ * Result from the useQuery to fetch all rules
+ */
+ ruleResponse: {
+ /**
+ * Result from fetching all rules
+ */
+ rules: RuleResponse[];
+ /**
+ * True while rules are being fetched
+ */
+ isLoading: boolean;
+ };
+}
+
+/**
+ * Component used in the Attack Discovery alerts table, only in the AI4DSOC tier.
+ * It leverages a lot of configurations and constants from the Alert summary page alerts table, and renders the ResponseOps AlertsTable.
+ */
+export const Table = memo(({ dataView, id, packages, query, ruleResponse }: TableProps) => {
+ const {
+ services: { application, cases, data, fieldFormats, http, licensing, notifications, settings },
+ } = useKibana();
+ const services = useMemo(
+ () => ({
+ cases,
+ data,
+ http,
+ notifications,
+ fieldFormats,
+ application,
+ licensing,
+ settings,
+ }),
+ [application, cases, data, fieldFormats, http, licensing, notifications, settings]
+ );
+
+ const dataViewSpec = useMemo(() => dataView.toSpec(), [dataView]);
+
+ const { browserFields } = useMemo(
+ () => getDataViewStateFromIndexFields('', dataViewSpec.fields),
+ [dataViewSpec.fields]
+ );
+
+ const additionalContext: AdditionalTableContext = useMemo(
+ () => ({
+ packages,
+ ruleResponse,
+ }),
+ [packages, ruleResponse]
+ );
+
+ const refetchRef = useRef(null);
+ const refetch = useCallback(() => {
+ refetchRef.current?.refresh();
+ }, []);
+
+ const bulkActions = useAdditionalBulkActions({ refetch });
+
+ return (
+
+
+
+ );
+});
+
+Table.displayName = 'Table';
diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/ai_for_soc/wrapper.test.tsx b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/ai_for_soc/wrapper.test.tsx
new file mode 100644
index 0000000000000..b2f578928b4a9
--- /dev/null
+++ b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/ai_for_soc/wrapper.test.tsx
@@ -0,0 +1,134 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { render, screen, waitFor } from '@testing-library/react';
+import { AiForSOCAlertsTab, CONTENT_TEST_ID, ERROR_TEST_ID, SKELETON_TEST_ID } from './wrapper';
+import { useKibana } from '../../../../../../../common/lib/kibana';
+import { TestProviders } from '../../../../../../../common/mock';
+import { useFetchIntegrations } from '../../../../../../../detections/hooks/alert_summary/use_fetch_integrations';
+import { useFindRulesQuery } from '../../../../../../../detection_engine/rule_management/api/hooks/use_find_rules_query';
+
+jest.mock('./table', () => ({
+ Table: () => ,
+}));
+jest.mock('../../../../../../../common/lib/kibana');
+jest.mock('../../../../../../../detections/hooks/alert_summary/use_fetch_integrations');
+jest.mock('../../../../../../../detection_engine/rule_management/api/hooks/use_find_rules_query');
+
+const id = 'id';
+const query = { ids: { values: ['abcdef'] } };
+
+describe('', () => {
+ beforeEach(() => {
+ jest.clearAllMocks();
+
+ (useFetchIntegrations as jest.Mock).mockReturnValue({
+ installedPackages: [],
+ isLoading: false,
+ });
+ (useFindRulesQuery as jest.Mock).mockReturnValue({
+ data: [],
+ isLoading: false,
+ });
+ });
+
+ it('should render a loading skeleton while creating the dataView', async () => {
+ (useKibana as jest.Mock).mockReturnValue({
+ services: {
+ data: {
+ dataViews: {
+ create: jest.fn(),
+ clearInstanceCache: jest.fn(),
+ },
+ },
+ http: { basePath: { prepend: jest.fn() } },
+ },
+ });
+
+ render();
+
+ await waitFor(() => {
+ expect(screen.getByTestId(SKELETON_TEST_ID)).toBeInTheDocument();
+ });
+ });
+
+ it('should render a loading skeleton while fetching packages (integrations)', async () => {
+ (useKibana as jest.Mock).mockReturnValue({
+ services: {
+ data: {
+ dataViews: {
+ create: jest.fn(),
+ clearInstanceCache: jest.fn(),
+ },
+ },
+ http: { basePath: { prepend: jest.fn() } },
+ },
+ });
+ (useFetchIntegrations as jest.Mock).mockReturnValue({
+ installedPackages: [],
+ isLoading: true,
+ });
+
+ render();
+
+ expect(await screen.findByTestId(SKELETON_TEST_ID)).toBeInTheDocument();
+ });
+
+ it('should render an error if the dataView fail to be created correctly', async () => {
+ (useKibana as jest.Mock).mockReturnValue({
+ services: {
+ data: {
+ dataViews: {
+ create: jest.fn().mockReturnValue(undefined),
+ clearInstanceCache: jest.fn(),
+ },
+ },
+ },
+ });
+
+ jest.mock('react', () => ({
+ ...jest.requireActual('react'),
+ useEffect: jest.fn((f) => f()),
+ }));
+
+ render();
+
+ expect(await screen.findByTestId(ERROR_TEST_ID)).toHaveTextContent(
+ 'Unable to create data view'
+ );
+ });
+
+ it('should render the content', async () => {
+ (useKibana as jest.Mock).mockReturnValue({
+ services: {
+ data: {
+ dataViews: {
+ create: jest
+ .fn()
+ .mockReturnValue({ getIndexPattern: jest.fn(), id: 'id', toSpec: jest.fn() }),
+ clearInstanceCache: jest.fn(),
+ },
+ query: { filterManager: { getFilters: jest.fn() } },
+ },
+ },
+ });
+
+ jest.mock('react', () => ({
+ ...jest.requireActual('react'),
+ useEffect: jest.fn((f) => f()),
+ }));
+
+ render(
+
+
+
+ );
+
+ expect(await screen.findByTestId(CONTENT_TEST_ID)).toBeInTheDocument();
+ });
+});
diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/ai_for_soc/wrapper.tsx b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/ai_for_soc/wrapper.tsx
new file mode 100644
index 0000000000000..5e2b43cc563f2
--- /dev/null
+++ b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/ai_for_soc/wrapper.tsx
@@ -0,0 +1,117 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { memo, useEffect, useMemo, useState } from 'react';
+import type { DataView, DataViewSpec } from '@kbn/data-views-plugin/common';
+import { EuiEmptyPrompt, EuiSkeletonRectangle } from '@elastic/eui';
+import type { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/types';
+import { i18n } from '@kbn/i18n';
+import { Table } from './table';
+import { useFetchIntegrations } from '../../../../../../../detections/hooks/alert_summary/use_fetch_integrations';
+import { useFindRulesQuery } from '../../../../../../../detection_engine/rule_management/api/hooks/use_find_rules_query';
+import { useKibana } from '../../../../../../../common/lib/kibana';
+
+const DATAVIEW_ERROR = i18n.translate(
+ 'xpack.securitySolution.attackDiscovery.aiForSocTableTab.dataViewError',
+ {
+ defaultMessage: 'Unable to create data view',
+ }
+);
+
+export const ERROR_TEST_ID = 'attack-discovery-alert-error';
+export const SKELETON_TEST_ID = 'attack-discovery-alert-skeleton';
+export const CONTENT_TEST_ID = 'attack-discovery-alert-content';
+
+const dataViewSpec: DataViewSpec = { title: '.alerts-security.alerts-default' };
+
+interface AiForSOCAlertsTabProps {
+ /**
+ * Id to pass down to the ResponseOps alerts table
+ */
+ id: string;
+ /**
+ * Query that contains the id of the alerts to display in the table
+ */
+ query: Pick;
+}
+
+/**
+ * Component used in the Attack Discovery alerts table, only in the AI4DSOC tier.
+ * It fetches rules, packages (integrations) and creates a local dataView.
+ * It renders a loading skeleton while packages are being fetched and while the dataView is being created.
+ */
+export const AiForSOCAlertsTab = memo(({ id, query }: AiForSOCAlertsTabProps) => {
+ const { data } = useKibana().services;
+ const [dataView, setDataView] = useState(undefined);
+ const [dataViewLoading, setDataViewLoading] = useState(true);
+
+ // Fetch all integrations
+ const { installedPackages, isLoading: integrationIsLoading } = useFetchIntegrations();
+
+ // Fetch all rules. For the AI for SOC effort, there should only be one rule per integration (which means for now 5-6 rules total)
+ const { data: ruleData, isLoading: ruleIsLoading } = useFindRulesQuery({});
+ const ruleResponse = useMemo(
+ () => ({
+ rules: ruleData?.rules || [],
+ isLoading: ruleIsLoading,
+ }),
+ [ruleData, ruleIsLoading]
+ );
+
+ useEffect(() => {
+ let dv: DataView;
+ const createDataView = async () => {
+ try {
+ dv = await data.dataViews.create(dataViewSpec);
+ setDataView(dv);
+ setDataViewLoading(false);
+ } catch (err) {
+ setDataViewLoading(false);
+ }
+ };
+ createDataView();
+
+ // clearing after leaving the page
+ return () => {
+ if (dv?.id) {
+ data.dataViews.clearInstanceCache(dv.id);
+ }
+ };
+ }, [data.dataViews]);
+
+ return (
+
+ <>
+ {!dataView || !dataView.id ? (
+ {DATAVIEW_ERROR}}
+ />
+ ) : (
+
+
+
+ )}
+
+
+ );
+});
+
+AiForSOCAlertsTab.displayName = 'AiForSOCAlertsTab';
diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/index.test.tsx b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/index.test.tsx
index dd9b3b1189cc4..2c5efbc61ba38 100644
--- a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/index.test.tsx
+++ b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/index.test.tsx
@@ -5,23 +5,71 @@
* 2.0.
*/
-import { render, screen } from '@testing-library/react';
+import { render } from '@testing-library/react';
import React from 'react';
import { TestProviders } from '../../../../../../common/mock';
import { mockAttackDiscovery } from '../../../../mock/mock_attack_discovery';
import { AlertsTab } from '.';
+import { useKibana } from '../../../../../../common/lib/kibana';
+import { SECURITY_FEATURE_ID } from '../../../../../../../common';
+
+jest.mock('../../../../../../common/lib/kibana');
+jest.mock('../../../../../../detections/components/alerts_table', () => ({
+ DetectionEngineAlertsTable: () => ,
+}));
+jest.mock('./ai_for_soc/wrapper', () => ({
+ AiForSOCAlertsTab: () => ,
+}));
describe('AlertsTab', () => {
- it('renders the alerts tab', () => {
- render(
+ beforeEach(() => {
+ jest.clearAllMocks();
+ });
+
+ it('renders the alerts tab with DetectionEngineAlertsTable', () => {
+ (useKibana as jest.Mock).mockReturnValue({
+ services: {
+ application: {
+ capabilities: {
+ [SECURITY_FEATURE_ID]: {
+ configurations: false,
+ },
+ },
+ },
+ },
+ });
+
+ const { getByTestId } = render(
);
- const alertsTab = screen.getByTestId('alertsTab');
+ expect(getByTestId('alertsTab')).toBeInTheDocument();
+ expect(getByTestId('detection-engine-alerts-table')).toBeInTheDocument();
+ });
+
+ it('renders the alerts tab with AI4DSOC alerts table', () => {
+ (useKibana as jest.Mock).mockReturnValue({
+ services: {
+ application: {
+ capabilities: {
+ [SECURITY_FEATURE_ID]: {
+ configurations: true,
+ },
+ },
+ },
+ },
+ });
+
+ const { getByTestId } = render(
+
+
+
+ );
- expect(alertsTab).toBeInTheDocument();
+ expect(getByTestId('alertsTab')).toBeInTheDocument();
+ expect(getByTestId('ai4dsoc-alerts-table')).toBeInTheDocument();
});
});
diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/index.tsx b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/index.tsx
index a848a04bb6317..bb767cb81a071 100644
--- a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/index.tsx
+++ b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/alerts_tab/index.tsx
@@ -10,7 +10,9 @@ import type { AttackDiscovery, Replacements } from '@kbn/elastic-assistant-commo
import { SECURITY_SOLUTION_RULE_TYPE_IDS } from '@kbn/securitysolution-rules';
import { TableId } from '@kbn/securitysolution-data-table';
-import { AlertConsumers } from '@kbn/rule-data-utils';
+import { AiForSOCAlertsTab } from './ai_for_soc/wrapper';
+import { useKibana } from '../../../../../../common/lib/kibana';
+import { SECURITY_FEATURE_ID } from '../../../../../../../common';
import { DetectionEngineAlertsTable } from '../../../../../../detections/components/alerts_table';
interface Props {
@@ -19,6 +21,15 @@ interface Props {
}
const AlertsTabComponent: React.FC = ({ attackDiscovery, replacements }) => {
+ const {
+ application: { capabilities },
+ } = useKibana().services;
+
+ // TODO We shouldn't have to check capabilities here, this should be done at a much higher level.
+ // https://github.com/elastic/kibana/issues/218731
+ // For the AI for SOC we need to show the Alert summary page alerts table
+ const AIForSOC = capabilities[SECURITY_FEATURE_ID].configurations;
+
const originalAlertIds = useMemo(
() =>
attackDiscovery.alertIds.map((alertId) =>
@@ -36,16 +47,25 @@ const AlertsTabComponent: React.FC = ({ attackDiscovery, replacements })
[originalAlertIds]
);
+ const id = useMemo(() => `attack-discovery-alerts-${attackDiscovery.id}`, [attackDiscovery.id]);
+
return (
-
+ {AIForSOC ? (
+
+
+
+ ) : (
+
+
+
+ )}
);
};
diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/attack_discovery_tab/index.test.tsx b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/attack_discovery_tab/index.test.tsx
index c6d3d7453a1ed..f143b4722c445 100644
--- a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/attack_discovery_tab/index.test.tsx
+++ b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/attack_discovery_tab/index.test.tsx
@@ -13,6 +13,10 @@ import type { Replacements } from '@kbn/elastic-assistant-common';
import { TestProviders } from '../../../../../../common/mock';
import { mockAttackDiscovery } from '../../../../mock/mock_attack_discovery';
import { ATTACK_CHAIN, DETAILS, SUMMARY } from './translations';
+import { SECURITY_FEATURE_ID } from '../../../../../../../common';
+import { useKibana } from '../../../../../../common/lib/kibana';
+
+jest.mock('../../../../../../common/lib/kibana');
describe('AttackDiscoveryTab', () => {
const mockReplacements: Replacements = {
@@ -44,6 +48,8 @@ describe('AttackDiscoveryTab', () => {
expect(summaryMarkdown).toHaveTextContent(
'A multi-stage malware attack was detected on foo.hostname involving bar.username. A suspicious application delivered malware, attempted credential theft, and established persistence.'
);
+ expect(screen.getAllByTestId('entityButton')[0]).toHaveTextContent('foo.hostname');
+ expect(screen.getAllByTestId('entityButton')[1]).toHaveTextContent('bar.username');
});
it('renders the details using the real host and username', () => {
@@ -53,6 +59,8 @@ describe('AttackDiscoveryTab', () => {
expect(detailsMarkdown).toHaveTextContent(
`The following attack progression appears to have occurred on the host foo.hostname involving the user bar.username: A suspicious application named "My Go Application.app" was launched, likely through a malicious download or installation. This application spawned child processes to copy a malicious file named "unix1" to the user's home directory and make it executable. The malicious "unix1" file was then executed, attempting to access the user's login keychain and potentially exfiltrate credentials. The suspicious application also launched the "osascript" utility to display a fake system dialog prompting the user for their password, a technique known as credentials phishing. This appears to be a multi-stage attack involving malware delivery, privilege escalation, credential access, and potentially data exfiltration. The attacker may have used social engineering techniques like phishing to initially compromise the system. The suspicious "My Go Application.app" exhibits behavior characteristic of malware families that attempt to steal user credentials and maintain persistence. Mitigations should focus on removing the malicious files, resetting credentials, and enhancing security controls around application whitelisting, user training, and data protection.`
);
+ expect(screen.getAllByTestId('entityButton')[0]).toHaveTextContent('foo.hostname');
+ expect(screen.getAllByTestId('entityButton')[1]).toHaveTextContent('bar.username');
});
});
@@ -193,4 +201,51 @@ The user Administrator opened a malicious Microsoft Word document (C:\\Program F
}
);
});
+
+ describe('when configurations capabilities is defined (for AI4DSOC)', () => {
+ beforeEach(() => {
+ (useKibana as jest.Mock).mockReturnValue({
+ services: {
+ application: {
+ capabilities: {
+ [SECURITY_FEATURE_ID]: {
+ configurations: true,
+ },
+ },
+ },
+ },
+ });
+
+ render(
+
+
+
+ );
+ });
+
+ it('renders the summary with disabled badges using the host and username', () => {
+ const markdownFormatters = screen.getAllByTestId('attackDiscoveryMarkdownFormatter');
+ const summaryMarkdown = markdownFormatters[0];
+
+ expect(summaryMarkdown).toHaveTextContent(
+ 'A multi-stage malware attack was detected on foo.hostname involving bar.username. A suspicious application delivered malware, attempted credential theft, and established persistence.'
+ );
+ expect(screen.getAllByTestId('disabledActionsBadge')[0]).toHaveTextContent('foo.hostname');
+ expect(screen.getAllByTestId('disabledActionsBadge')[1]).toHaveTextContent('bar.username');
+ });
+
+ it('renders the details with disabled badgesusing the host and username', () => {
+ const markdownFormatters = screen.getAllByTestId('attackDiscoveryMarkdownFormatter');
+ const detailsMarkdown = markdownFormatters[1];
+
+ expect(detailsMarkdown).toHaveTextContent(
+ `The following attack progression appears to have occurred on the host foo.hostname involving the user bar.username: A suspicious application named "My Go Application.app" was launched, likely through a malicious download or installation. This application spawned child processes to copy a malicious file named "unix1" to the user's home directory and make it executable. The malicious "unix1" file was then executed, attempting to access the user's login keychain and potentially exfiltrate credentials. The suspicious application also launched the "osascript" utility to display a fake system dialog prompting the user for their password, a technique known as credentials phishing. This appears to be a multi-stage attack involving malware delivery, privilege escalation, credential access, and potentially data exfiltration. The attacker may have used social engineering techniques like phishing to initially compromise the system. The suspicious "My Go Application.app" exhibits behavior characteristic of malware families that attempt to steal user credentials and maintain persistence. Mitigations should focus on removing the malicious files, resetting credentials, and enhancing security controls around application whitelisting, user training, and data protection.`
+ );
+ expect(screen.getAllByTestId('disabledActionsBadge')[0]).toHaveTextContent('foo.hostname');
+ expect(screen.getAllByTestId('disabledActionsBadge')[1]).toHaveTextContent('bar.username');
+ });
+ });
});
diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/attack_discovery_tab/index.tsx b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/attack_discovery_tab/index.tsx
index f048cc5e152c7..a29e7b8747318 100644
--- a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/attack_discovery_tab/index.tsx
+++ b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/results/attack_discovery_panel/tabs/attack_discovery_tab/index.tsx
@@ -5,12 +5,13 @@
* 2.0.
*/
-import { replaceAnonymizedValuesWithOriginalValues } from '@kbn/elastic-assistant-common';
import type { AttackDiscovery, Replacements } from '@kbn/elastic-assistant-common';
+import { replaceAnonymizedValuesWithOriginalValues } from '@kbn/elastic-assistant-common';
import { EuiFlexGroup, EuiFlexItem, EuiIcon, EuiSpacer, EuiTitle, useEuiTheme } from '@elastic/eui';
import { css } from '@emotion/react';
import React, { useMemo } from 'react';
+import { useKibana } from '../../../../../../common/lib/kibana';
import { AttackChain } from './attack/attack_chain';
import { InvestigateInTimelineButton } from '../../../../../../common/components/event_details/investigate_in_timeline_button';
import { buildAlertsKqlFilter } from '../../../../../../detections/components/alerts_table/actions';
@@ -18,6 +19,7 @@ import { getTacticMetadata } from '../../../../../helpers';
import { AttackDiscoveryMarkdownFormatter } from '../../../attack_discovery_markdown_formatter';
import * as i18n from './translations';
import { ViewInAiAssistant } from '../../view_in_ai_assistant';
+import { SECURITY_FEATURE_ID } from '../../../../../../../common';
const scrollable: React.CSSProperties = {
overflowX: 'auto',
@@ -35,6 +37,17 @@ const AttackDiscoveryTabComponent: React.FC = ({
replacements,
showAnonymized = false,
}) => {
+ const {
+ application: { capabilities },
+ } = useKibana().services;
+ // TODO We shouldn't have to check capabilities here, this should be done at a much higher level.
+ // https://github.com/elastic/kibana/issues/218731
+ // For the AI for SOC we need to hide cell actions and all preview links that could open non-AI4DSOC flyouts
+ const disabledActions = useMemo(
+ () => showAnonymized || Boolean(capabilities[SECURITY_FEATURE_ID].configurations),
+ [capabilities, showAnonymized]
+ );
+
const { euiTheme } = useEuiTheme();
const { detailsMarkdown, summaryMarkdown } = useMemo(() => attackDiscovery, [attackDiscovery]);
@@ -73,7 +86,7 @@ const AttackDiscoveryTabComponent: React.FC = ({