[8.19] [Security Solution] One Discover Security Profile Enable + Event timeline redirection (#204756)

[logeekal]

Backport

This will backport the following commits from main to 8.19:

• [Security Solution] Add Host/User flyout in One Discover. (#199279)
• [ Security Solution ] One discover security context functional tests (#199818)
• [Security Solution] Discover Security Profile Changes + Event timeline redirection (#204756)

Questions ?

Please refer to the Backport tool documentation

discoverShared\n discover -- \"consume Features\" --> discoverShared\n\n```\n\n## How to Test\n\n>[!Note]\n>This PR adds `security-root-profile` in One discover which is currently\nin `experimental mode`. All changes below can only be tested when\nprofile is activated. Profile can activated by adding below lines in\n`config/kibana.dev.yml`\n> ```yaml\n> discover.experimental.enabledProfiles:\n> - security-root-profile\n> ```\n>\n\n1. As mentioned above, adding above experimental flag in\n`kibana.dev.yml`.\n2. Spin up Security Serverless project and add some alert Data.\n3. Navigate to Discover and add columns `host.name` and `user.name` in\ntable. Now `host` and `user` flyouts should be available on clicking\n`host.name`, `user.name`, `source.ip` & `destination.ip`.\n4. Flyout should work without any error.\n5. Below things are not working and will be tackled in followup PR :\n - Security Hover actions\n - Actions such as `Add to Timeline` or `Add to Case` \n\n\n\n### Checklist\n\nDelete any items that are not applicable to this PR.\n\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"c80f91efebfc783c1b8f64dbad479deeb6586d1c","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Fleet","v9.0.0","Team:Threat Hunting:Investigations","Project:OneDiscover","backport:version","v9.1.0","v8.19.0"],"title":"[Security Solution] Add Host/User flyout in One Discover.","number":199279,"url":"https://github.com//pull/199279","mergeCommit":{"message":"[Security Solution] Add Host/User flyout in One Discover. (#199279)\n\n## Summary\n\nHandles https://github.com//issues/191998\n\nFollow up work:\n - https://github.com/elastic/security-team/issues/11112\n - https://github.com//issues/196667\n\n\nThis PR add below entity flyouts for below entities in One Discover:\n- host.name\n- user.name\n- source.ip\n- destination.ip\n\n\nIn this PR we re-use the security solution code by making use of below\nmodel based on `discover-shared` plugin.\n\n```mermaid\nflowchart TD\n discoverShared[\"Discover Shared\"]\n securitySolution[\"Security Solution\"]\n discover[\"Discover\"]\n\n\n securitySolution -- \"registers Features\" --> discoverShared\n discover -- \"consume Features\" --> discoverShared\n\n```\n\n## How to Test\n\n>[!Note]\n>This PR adds `security-root-profile` in One discover which is currently\nin `experimental mode`. All changes below can only be tested when\nprofile is activated. Profile can activated by adding below lines in\n`config/kibana.dev.yml`\n> ```yaml\n> discover.experimental.enabledProfiles:\n> - security-root-profile\n> ```\n>\n\n1. As mentioned above, adding above experimental flag in\n`kibana.dev.yml`.\n2. Spin up Security Serverless project and add some alert Data.\n3. Navigate to Discover and add columns `host.name` and `user.name` in\ntable. Now `host` and `user` flyouts should be available on clicking\n`host.name`, `user.name`, `source.ip` & `destination.ip`.\n4. Flyout should work without any error.\n5. Below things are not working and will be tackled in followup PR :\n - Security Hover actions\n - Actions such as `Add to Timeline` or `Add to Case` \n\n\n\n### Checklist\n\nDelete any items that are not applicable to this PR.\n\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"c80f91efebfc783c1b8f64dbad479deeb6586d1c"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com//pull/199279","number":199279,"mergeCommit":{"message":"[Security Solution] Add Host/User flyout in One Discover. (#199279)\n\n## Summary\n\nHandles https://github.com//issues/191998\n\nFollow up work:\n - https://github.com/elastic/security-team/issues/11112\n - https://github.com//issues/196667\n\n\nThis PR add below entity flyouts for below entities in One Discover:\n- host.name\n- user.name\n- source.ip\n- destination.ip\n\n\nIn this PR we re-use the security solution code by making use of below\nmodel based on `discover-shared` plugin.\n\n```mermaid\nflowchart TD\n discoverShared[\"Discover Shared\"]\n securitySolution[\"Security Solution\"]\n discover[\"Discover\"]\n\n\n securitySolution -- \"registers Features\" --> discoverShared\n discover -- \"consume Features\" --> discoverShared\n\n```\n\n## How to Test\n\n>[!Note]\n>This PR adds `security-root-profile` in One discover which is currently\nin `experimental mode`. All changes below can only be tested when\nprofile is activated. Profile can activated by adding below lines in\n`config/kibana.dev.yml`\n> ```yaml\n> discover.experimental.enabledProfiles:\n> - security-root-profile\n> ```\n>\n\n1. As mentioned above, adding above experimental flag in\n`kibana.dev.yml`.\n2. Spin up Security Serverless project and add some alert Data.\n3. Navigate to Discover and add columns `host.name` and `user.name` in\ntable. Now `host` and `user` flyouts should be available on clicking\n`host.name`, `user.name`, `source.ip` & `destination.ip`.\n4. Flyout should work without any error.\n5. Below things are not working and will be tackled in followup PR :\n - Security Hover actions\n - Actions such as `Add to Timeline` or `Add to Case` \n\n\n\n### Checklist\n\nDelete any items that are not applicable to this PR.\n\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"c80f91efebfc783c1b8f64dbad479deeb6586d1c"}},{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]},{"author":{"name":"Jatin Kathuria","email":"jtn.kathuria@gmail.com"},"sourceCommit":{"committedDate":"2024-12-10T09:38:43Z","message":"[ Security Solution ] One discover security context functional tests (#199818)\n\n## Summary\n\nFixes https://github.com/elastic/security-team/issues/11112\n\nFollow up to \n- https://github.com//pull/199279\n\nAdds functional test for Security Profiles in One Discover.\n\n\n### Checklist\n\nDelete any items that are not applicable to this PR.\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"9619d610d17e056564365015858011e5e41b2209","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","backport:skip","v9.0.0","Team:Threat Hunting:Investigations","Project:OneDiscover"],"title":"[ Security Solution ] One discover security context functional tests","number":199818,"url":"https://github.com//pull/199818","mergeCommit":{"message":"[ Security Solution ] One discover security context functional tests (#199818)\n\n## Summary\n\nFixes https://github.com/elastic/security-team/issues/11112\n\nFollow up to \n- https://github.com//pull/199279\n\nAdds functional test for Security Profiles in One Discover.\n\n\n### Checklist\n\nDelete any items that are not applicable to this PR.\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"9619d610d17e056564365015858011e5e41b2209"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com//pull/199818","number":199818,"mergeCommit":{"message":"[ Security Solution ] One discover security context functional tests (#199818)\n\n## Summary\n\nFixes https://github.com/elastic/security-team/issues/11112\n\nFollow up to \n- https://github.com//pull/199279\n\nAdds functional test for Security Profiles in One Discover.\n\n\n### Checklist\n\nDelete any items that are not applicable to this PR.\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"9619d610d17e056564365015858011e5e41b2209"}}]},{"author":{"name":"Jatin Kathuria","email":"jatin.kathuria@elastic.co"},"sourceCommit":{"committedDate":"2025-06-24T00:39:29Z","message":"[Security Solution] Discover Security Profile Changes + Event timeline redirection (#204756)\n\n## Summary\n\nThis PR customized Discover's Security Root Profile with 3 new changes.\n\\\n\nWith this change Discover's Security profile ceases to be\n`experimental`. Below are the changes listed one in this profile.\n\n>[!Note]\n> This change also removes the Flyout changes that were added for\nsecurity solution to the Discover's security profile.\n\n\n### Row Indicators.\n\nAdds row indicators based on Alert or an event as shown in the\nscreenshot below. Note the highlights on the left of the row.\n\n`Yellow` for Alerts.\n`Gray` for Events.\n\n\n\n\n### Default list of Columns.\n\nAdds the list of default columns that should appear when security\nprofile is activated.\n\n\n\n\n### Explore in Security Flyout.\n\nAs shown the demo below, this action explores and event or an alert in\nsecurity solution as shown in the screenshot below.\n\n\n\n\nhttps://github.com/user-attachments/assets/4c228bb1-60af-433b-8e8f-1a5d4d049985\n\n\n\n\n\n\n\n\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] Any text added follows [EUI's writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\nsentence case text and includes [i18n\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n### Identify risks\n\nDoes this PR introduce any risks? For example, consider risks like hard\nto test bugs, performance regression, potential of data loss.\n\nDescribe the risk, its severity, and mitigation for each identified\nrisk. Invite stakeholders and evaluate how to proceed before merging.\n\n- [ ] [See some risk\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)\n- [ ] ...\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>\nCo-authored-by: Davis McPhee ","sha":"fbec7db5b09133d0e2a83bc841bf7192f9b648e7","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Threat Hunting:Investigations","backport:version","v9.1.0","v8.19.0"],"title":"[Security Solution] Discover Security Profile Changes + Event timeline redirection","number":204756,"url":"https://github.com//pull/204756","mergeCommit":{"message":"[Security Solution] Discover Security Profile Changes + Event timeline redirection (#204756)\n\n## Summary\n\nThis PR customized Discover's Security Root Profile with 3 new changes.\n\\\n\nWith this change Discover's Security profile ceases to be\n`experimental`. Below are the changes listed one in this profile.\n\n>[!Note]\n> This change also removes the Flyout changes that were added for\nsecurity solution to the Discover's security profile.\n\n\n### Row Indicators.\n\nAdds row indicators based on Alert or an event as shown in the\nscreenshot below. Note the highlights on the left of the row.\n\n`Yellow` for Alerts.\n`Gray` for Events.\n\n\n\n\n### Default list of Columns.\n\nAdds the list of default columns that should appear when security\nprofile is activated.\n\n\n\n\n### Explore in Security Flyout.\n\nAs shown the demo below, this action explores and event or an alert in\nsecurity solution as shown in the screenshot below.\n\n\n\n\nhttps://github.com/user-attachments/assets/4c228bb1-60af-433b-8e8f-1a5d4d049985\n\n\n\n\n\n\n\n\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] Any text added follows [EUI's writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\nsentence case text and includes [i18n\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n### Identify risks\n\nDoes this PR introduce any risks? For example, consider risks like hard\nto test bugs, performance regression, potential of data loss.\n\nDescribe the risk, its severity, and mitigation for each identified\nrisk. Invite stakeholders and evaluate how to proceed before merging.\n\n- [ ] [See some risk\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)\n- [ ] ...\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>\nCo-authored-by: Davis McPhee ","sha":"fbec7db5b09133d0e2a83bc841bf7192f9b648e7"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com//pull/204756","number":204756,"mergeCommit":{"message":"[Security Solution] Discover Security Profile Changes + Event timeline redirection (#204756)\n\n## Summary\n\nThis PR customized Discover's Security Root Profile with 3 new changes.\n\\\n\nWith this change Discover's Security profile ceases to be\n`experimental`. Below are the changes listed one in this profile.\n\n>[!Note]\n> This change also removes the Flyout changes that were added for\nsecurity solution to the Discover's security profile.\n\n\n### Row Indicators.\n\nAdds row indicators based on Alert or an event as shown in the\nscreenshot below. Note the highlights on the left of the row.\n\n`Yellow` for Alerts.\n`Gray` for Events.\n\n\n\n\n### Default list of Columns.\n\nAdds the list of default columns that should appear when security\nprofile is activated.\n\n\n\n\n### Explore in Security Flyout.\n\nAs shown the demo below, this action explores and event or an alert in\nsecurity solution as shown in the screenshot below.\n\n\n\n\nhttps://github.com/user-attachments/assets/4c228bb1-60af-433b-8e8f-1a5d4d049985\n\n\n\n\n\n\n\n\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] Any text added follows [EUI's writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\nsentence case text and includes [i18n\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n### Identify risks\n\nDoes this PR introduce any risks? For example, consider risks like hard\nto test bugs, performance regression, potential of data loss.\n\nDescribe the risk, its severity, and mitigation for each identified\nrisk. Invite stakeholders and evaluate how to proceed before merging.\n\n- [ ] [See some risk\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)\n- [ ] ...\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>\nCo-authored-by: Davis McPhee ","sha":"fbec7db5b09133d0e2a83bc841bf7192f9b648e7"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT-->

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 7529c48

Failed CI Steps

• Jest Tests #3
• Jest Tests #3
• Explore - Security Solution Cypress Tests #2

Test Failures

• [job] [logs] Jest Tests #3 / getCellRendererForGivenRecord should return cell renderer correctly for allowed fields with correct data format
• [job] [logs] Jest Tests #3 / getCellRendererForGivenRecord should return cell renderer correctly for allowed fields with correct data format
• [job] [logs] Explore - Security Solution Cypress Tests #2 / url state sets KQL in host page and detail page and check if href match on breadcrumb, tabs and subTabs sets KQL in host page and detail page and check if href match on breadcrumb, tabs and subTabs
• [job] [logs] Explore - Security Solution Cypress Tests #2 / url state sets the url state when kql is set and check if href reflect this change sets the url state when kql is set and check if href reflect this change

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
discover	1361	1374	+13
securitySolution	7523	7528	+5
total			+18

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
discover	98	162	+64
discoverShared	16	24	+8
securitySolution	122	125	+3
total			+75

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
discover	1.1MB	1.1MB	+13.0KB
securitySolution	9.5MB	9.5MB	+14.6KB
total			+27.6KB

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
discover	22	27	+5
discoverShared	5	4	-1
securitySolution	32	33	+1
total			+5

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
discover	22.3KB	22.3KB	+58.0B
securitySolution	86.6KB	87.0KB	+435.0B
total			+493.0B

Unknown metric groups

API count

id	before	after	diff
discover	147	211	+64
discoverShared	16	26	+10
securitySolution	190	193	+3
total			+77

async chunk count

id	before	after	diff
discover	37	38	+1
securitySolution	102	103	+1
total			+2

History

• 💔 Build #311824 failed 4143112
• 💔 Build #311815 failed 2042cc3
• 💔 Build #311812 failed cc452fd

[PhilippeOberti]

Desk tested LGTM!