[AI4DSOC] [Attack discovery] In AI4DSOC projects, don't prompt the user to update the kibana.alert.workflow_status of alerts

[andrew-goldstein]

[AI4DSOC] [Attack discovery] In AI4DSOC projects, don't prompt the user to update the kibana.alert.workflow_status of alerts

This PR updates Attack discovery for AI4DSOC projects, such that it does NOT prompt the user with a modal to optionally update the kibana.alert.workflow_status of alerts associated with Attack discoveries, as illustrated by the animated gif below:

Above: AI4DSOC: The modal is NOT displayed, and the associated alerts are NOT updated

The animated gif above illustrates that in AI4DSOC projects:

• The modal prompting the user to update the kibana.alert.workflow_status of alerts is NOT displayed
• Only the workflow status of the Attack discovery is updated

All other serverless projects

All other (non-AI4DSOC) serverless projects display the modal, and optionally update the workflow status of the alerts, as illustrated by the animated gif below:

Above: All other serverless projects: The modal is displayed, and the associated alerts are updated

The animated gif above illustrates that for all other serverless projects:

• The modal prompting the user to update the kibana.alert.workflow_status of alerts is displayed
• The workflow status of the Attack discovery is (optionally) updated

Elastic Cloud and self manged

Elastic Cloud and self manged deployments display the modal, and optionally update the workflow status of the alerts, as illustrated by the animated gif below:

Above: Self managed: The modal is displayed, and the associated alerts are updated

The animated gif above illustrates that for Elastic cloud and self manged:

• The modal prompting the user to update the kibana.alert.workflow_status of alerts is displayed
• The workflow status of the Attack discovery is (optionally) updated

Feature flags

Enable the required and recommended assistantAttackDiscoverySchedulingEnabled features flag in config/kibana.dev.yml:

feature_flags.overrides:
  securitySolution.attackDiscoveryAlertsEnabled: true
  securitySolution.assistantAttackDiscoverySchedulingEnabled: true

AI4DSOC

• To test with an AI4DSOC project, add the following setting to config/serverless.security.dev.yaml:

xpack.securitySolutionServerless.productTypes:
[
  { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
]

Desk testing

1. Navigate to Security > Attack discovery

2. Click Generate to generate attack discoveries

3. Click the Take action dropdown on an Attack discovery

4. Click Mark as acknowledged

Expected result

The modal is displayed, and alerts are (optionally) updated for the deployment, for the deployment-type in the table below:

Deployment	Modal displayed	Alerts (optionally) updated
AI4DSOC	❌	❌
All other serverless projects	✅	✅
Elastic Cloud and self manged	✅	✅

5. Select (at least) 2 discoveries via their checkboxes

6. Click the Selected 2 Attack discoveries popover menu

7. Click Mark as closed from the popover menu

Expected result

Once again, the modal is displayed, and alerts are (optionally) updated for the deployment, for the deployment-type in the table below:

Deployment	Modal displayed	Alerts (optionally) updated
AI4DSOC	❌	❌
All other serverless projects	✅	✅
Elastic Cloud and self manged	✅	✅

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[stephmilovic]

LGTM! Desk tested and all works as expected. Left one comment re: the check for aiForSoc. LGTM!

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: e6df9cc

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	9.8MB	9.8MB	+100.0B

History

• 💚 Build #317776 succeeded 65f7165
• 💚 Build #317486 succeeded b8765dd

cc @andrew-goldstein

[kibanamachine]

Starting backport for target branches: 8.19, 9.1

https://github.com/elastic/kibana/actions/runs/16228952304

[kibanamachine]

💚 All backports created successfully

Status	Branch	Result
✅	8.19
✅	9.1

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation