[Security Solution] Change alerts page data view and add help text by christineweng · Pull Request #231374 · elastic/kibana

christineweng · 2025-08-11T22:06:15Z

Summary

Security changes

Security users have been able to add run time fields to the security default data view. While implementing the managed data view feature #223451, the conflict arise where we want the default data view to be kibana managed, but we do not want to take away user's ability to add run time fields.

As a result, it was decided to exclude security default data view as managed, and the data view in alerts page is changed to security default. With these changes, users can see run time fields created before they upgrade to 9.2, and they will be able to continue adding run time fields.

Discover / Data view picker changes

Even though we can't have the default data view as managed, we want to bring awareness of the security advanced setting to users. Currently, indices in advanced settings always override user changes in editor flyout. To minimize confusion, this PR added an optional prop getDataViewHelpText in the data view picker component. This will allow a help text to be shown when user is editing the security default data view.

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

elasticmachine · 2025-08-12T21:33:01Z

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

jughosta · 2025-08-13T09:12:40Z

...ity/plugins/security_solution/public/data_view_manager/components/data_view_picker/index.tsx

+    if (dataViewId === defaultDataViewId) {
+      return i18n.translate('xpack.securitySolution.dataViewManager.indexHelpText', {
+        defaultMessage:
+          'Security default indices are managed in advanced settings. To change the indices permanently, edit the indices in advanced settings.',


Suggested change

'Security default indices are managed in advanced settings. To change the indices permanently, edit the indices in advanced settings.',

'Security default indices are managed in Advanced Settings. To change the indices permanently, edit the indices in Advanced Settings.',

jughosta · 2025-08-13T09:13:56Z

src/platform/plugins/shared/data_view_editor/public/components/form_fields/title_field.tsx

  isRollup: boolean;
  matchedIndices: MatchedItem[];
  rollupIndicesCapabilities: RollupIndicesCapsResponse;
+  indexHelpText?: string;


Or indexPatternHelpText everywhere as it can be more than one index.

I changed it to titleHelpText, as it sits closer to getTitleConfig and TitleField. let me know what you think :)

jughosta · 2025-08-13T09:19:45Z

src/platform/plugins/shared/unified_search/public/dataview_picker/data_view_picker.tsx

+  /**
+   * Message to show when editing a managed data view
+   */
+  indexHelpText?: string;


For this component it might be more generic to rather have it as a callback getDataViewPatternHelpTextWhenEditing(<dataView as a param>) so a help label can be derived based on active data view.

++ to changing parameter to a callback to allow data view context to influence help text. Maybe a shorter name though - something like getDataViewHelpText.

thank you both, updated

jughosta

Data Discovery changes LGTM, thanks!

nreese

kibana-presentation changes LGTM
code review only

natasha-moore-elastic · 2025-08-14T15:51:17Z

...ity/plugins/security_solution/public/data_view_manager/components/data_view_picker/index.tsx

+      if (dv.id === defaultDataViewId) {
+        return i18n.translate('xpack.securitySolution.dataViewManager.getDataViewHelpText', {
+          defaultMessage:
+            'Security default indices are managed in Advanced Settings. To change the indices permanently, edit the indices in Advanced Settings.',


How does this sound:
"Changes made here won’t be saved permanently. To update the default Security indices, edit securitySolution:defaultIndex in Advanced Settings."

PhilippeOberti

Thanks for making this change, code LGTM and desk tested, looks good :)

…no-cache --fix'

elasticmachine · 2025-08-15T21:57:50Z

💚 Build Succeeded

Buildkite Build
Commit: f77dc81

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`dataViewEditor`	26	27	+1
`unifiedSearch`	117	118	+1
total			+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`dataViewEditor`	42.2KB	42.4KB	+183.0B
`securitySolution`	10.4MB	10.4MB	+380.0B
`unifiedSearch`	345.6KB	345.7KB	+90.0B
total			+653.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`dataViewEditor`	7.0KB	7.0KB	+88.0B

Unknown metric groups

API count

id	before	after	diff
`dataViewEditor`	36	38	+2
`unifiedSearch`	155	157	+2
total			+4

History

💚 Build #329426 succeeded a2baee2
💚 Build #328559 succeeded 82162ad

cc @christineweng

…lastic#231374) ## Summary **Security changes** Security users have been able to add run time fields to the security default data view. While implementing the managed data view feature elastic#223451, the conflict arise where we want the default data view to be kibana managed, but we do not want to take away user's ability to add run time fields. As a result, it was decided to exclude security default data view as `managed`, and the data view in alerts page is changed to security default. With these changes, users can see run time fields created before they upgrade to `9.2`, and they will be able to continue adding run time fields. <img width="488" height="306" alt="image" src="https://github.com/user-attachments/assets/9026ef05-3adb-4b23-9abf-b5e12d6d95d9" /> **Discover / Data view picker changes** Even though we can't have the default data view as `managed`, we want to bring awareness of the security advanced setting to users. Currently, indices in advanced settings always override user changes in editor flyout. To minimize confusion, this PR added an optional prop `getDataViewHelpText` in the data view picker component. This will allow a help text to be shown when user is editing the security default data view. <img width="987" height="470" alt="image" src="https://github.com/user-attachments/assets/f2cfb169-c0f6-4e32-8081-f186b010d0ee" /> ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [ ] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels.

…and Security solution alerts data views when needed (#238354) ## Summary This PR aims at fixing a UI issue related to the data view picker changes we made recently in Security Solution. After enabling the `dataViewPickerEnabled` feature flag (see [this PR](#234101)) we realized that the `Security solution default` and `Security solution alerts` aren't displayed properly. This is only visible within an environment that had those data view existing before turning on the feature flag. Instead of showing `Security solution default` we show this <img width="562" height="366" alt="Screenshot 2025-10-09 at 4 10 40 PM" src="https://github.com/user-attachments/assets/3b59501e-f1ae-460d-b26c-b46f876ea772" /> And instead of showing `Security solution alerts` we show this <img width="558" height="404" alt="Screenshot 2025-10-09 at 4 10 18 PM" src="https://github.com/user-attachments/assets/f50a0eb7-a5f2-41e0-8018-28d9ddf92ee6" /> Looking at the Data Views screen under Stack Management, we indeed see that the names are matching what we see in the data view picker <img width="734" height="655" alt="Screenshot 2025-10-09 at 4 11 46 PM" src="https://github.com/user-attachments/assets/ebc743e8-91d9-4ac1-8992-85290db59f10" /> For the `Security solution default` data view, we added the name in [this PR](#224333). For the `Security solution alerts` data view, we created the alert index and the corresponding data view in [this PR](#224144). But we changed both names in [this PR](#231374) (from `Default security data view` to `Security solution default` and from `Security alert data view` to `Security solution alerts` respectively). This means that if one of these data views was created either without a name or with an old name, that name would persist and be visible within the new data view picker. ## The fix This PR makes a simple fix: if the names of the saved object differ from what we expect (only for the `default` and `alerts` data views), we update the saved object. Here's en example of the data view being updated after a refresh https://github.com/user-attachments/assets/4ef8c623-3e45-4a57-93bb-0464c3189f67 ### Checklist - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels.

…and Security solution alerts data views when needed (elastic#238354) ## Summary This PR aims at fixing a UI issue related to the data view picker changes we made recently in Security Solution. After enabling the `dataViewPickerEnabled` feature flag (see [this PR](elastic#234101)) we realized that the `Security solution default` and `Security solution alerts` aren't displayed properly. This is only visible within an environment that had those data view existing before turning on the feature flag. Instead of showing `Security solution default` we show this <img width="562" height="366" alt="Screenshot 2025-10-09 at 4 10 40 PM" src="https://github.com/user-attachments/assets/3b59501e-f1ae-460d-b26c-b46f876ea772" /> And instead of showing `Security solution alerts` we show this <img width="558" height="404" alt="Screenshot 2025-10-09 at 4 10 18 PM" src="https://github.com/user-attachments/assets/f50a0eb7-a5f2-41e0-8018-28d9ddf92ee6" /> Looking at the Data Views screen under Stack Management, we indeed see that the names are matching what we see in the data view picker <img width="734" height="655" alt="Screenshot 2025-10-09 at 4 11 46 PM" src="https://github.com/user-attachments/assets/ebc743e8-91d9-4ac1-8992-85290db59f10" /> For the `Security solution default` data view, we added the name in [this PR](elastic#224333). For the `Security solution alerts` data view, we created the alert index and the corresponding data view in [this PR](elastic#224144). But we changed both names in [this PR](elastic#231374) (from `Default security data view` to `Security solution default` and from `Security alert data view` to `Security solution alerts` respectively). This means that if one of these data views was created either without a name or with an old name, that name would persist and be visible within the new data view picker. ## The fix This PR makes a simple fix: if the names of the saved object differ from what we expect (only for the `default` and `alerts` data views), we update the saved object. Here's en example of the data view being updated after a refresh https://github.com/user-attachments/assets/4ef8c623-3e45-4a57-93bb-0464c3189f67 ### Checklist - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. (cherry picked from commit 4f30b77)

…fault and Security solution alerts data views when needed (#238354) (#238525) # Backport This will backport the following commits from `main` to `9.2`: - [[Security Solution] update the name of the Security solution default and Security solution alerts data views when needed (#238354)](#238354)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Philippe Oberti <philippe.oberti@elastic.co>

…and Security solution alerts data views when needed (elastic#238354) ## Summary This PR aims at fixing a UI issue related to the data view picker changes we made recently in Security Solution. After enabling the `dataViewPickerEnabled` feature flag (see [this PR](elastic#234101)) we realized that the `Security solution default` and `Security solution alerts` aren't displayed properly. This is only visible within an environment that had those data view existing before turning on the feature flag. Instead of showing `Security solution default` we show this <img width="562" height="366" alt="Screenshot 2025-10-09 at 4 10 40 PM" src="https://github.com/user-attachments/assets/3b59501e-f1ae-460d-b26c-b46f876ea772" /> And instead of showing `Security solution alerts` we show this <img width="558" height="404" alt="Screenshot 2025-10-09 at 4 10 18 PM" src="https://github.com/user-attachments/assets/f50a0eb7-a5f2-41e0-8018-28d9ddf92ee6" /> Looking at the Data Views screen under Stack Management, we indeed see that the names are matching what we see in the data view picker <img width="734" height="655" alt="Screenshot 2025-10-09 at 4 11 46 PM" src="https://github.com/user-attachments/assets/ebc743e8-91d9-4ac1-8992-85290db59f10" /> For the `Security solution default` data view, we added the name in [this PR](elastic#224333). For the `Security solution alerts` data view, we created the alert index and the corresponding data view in [this PR](elastic#224144). But we changed both names in [this PR](elastic#231374) (from `Default security data view` to `Security solution default` and from `Security alert data view` to `Security solution alerts` respectively). This means that if one of these data views was created either without a name or with an old name, that name would persist and be visible within the new data view picker. ## The fix This PR makes a simple fix: if the names of the saved object differ from what we expect (only for the `default` and `alerts` data views), we update the saved object. Here's en example of the data view being updated after a refresh https://github.com/user-attachments/assets/4ef8c623-3e45-4a57-93bb-0464c3189f67 ### Checklist - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels.

christineweng changed the title ~~[Security Solutionchange alerts page data view and add help text~~ [Security Solution] Change alerts page data view and add help text Aug 11, 2025

christineweng self-assigned this Aug 11, 2025

christineweng force-pushed the fix-alerts-page-dataview branch from c8f3e25 to 82162ad Compare August 11, 2025 22:29

christineweng added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team v9.2.0 labels Aug 12, 2025

christineweng marked this pull request as ready for review August 12, 2025 21:32

christineweng requested review from a team as code owners August 12, 2025 21:32

jughosta reviewed Aug 13, 2025

View reviewed changes

christineweng mentioned this pull request Aug 13, 2025

[UI copy]: Help text for security managed data view elastic/docs-content#2570

Closed

christineweng force-pushed the fix-alerts-page-dataview branch 2 times, most recently from 6179a4c to a2baee2 Compare August 14, 2025 00:14

jughosta approved these changes Aug 14, 2025

View reviewed changes

nreese approved these changes Aug 14, 2025

View reviewed changes

natasha-moore-elastic reviewed Aug 14, 2025

View reviewed changes

christineweng force-pushed the fix-alerts-page-dataview branch from a2baee2 to 4154203 Compare August 14, 2025 19:02

PhilippeOberti approved these changes Aug 15, 2025

View reviewed changes

christineweng added 3 commits August 15, 2025 14:17

change alerts page data view and add help text

d69a1bc

PR comments

7ca268e

copy update

f77f3f9

christineweng force-pushed the fix-alerts-page-dataview branch from 4154203 to f77f3f9 Compare August 15, 2025 19:19

christineweng enabled auto-merge (squash) August 15, 2025 19:20

[CI] Auto-commit changed files from 'node scripts/eslint_all_files --…

f77dc81

…no-cache --fix'

christineweng merged commit 2a9ff04 into elastic:main Aug 15, 2025
12 checks passed

PhilippeOberti mentioned this pull request Oct 9, 2025

[Security Solution] update the name of the Security solution default and Security solution alerts data views when needed #238354

Merged

2 tasks

	'Security default indices are managed in advanced settings. To change the indices permanently, edit the indices in advanced settings.',
	'Security default indices are managed in Advanced Settings. To change the indices permanently, edit the indices in Advanced Settings.',

Conversation

christineweng commented Aug 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

elasticmachine commented Aug 12, 2025

Uh oh!

jughosta Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

jughosta Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

christineweng Aug 14, 2025

Choose a reason for hiding this comment

Uh oh!

jughosta Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

nreese Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

christineweng Aug 14, 2025

Choose a reason for hiding this comment

Uh oh!

jughosta left a comment

Choose a reason for hiding this comment

Uh oh!

nreese left a comment

Choose a reason for hiding this comment

Uh oh!

natasha-moore-elastic Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

PhilippeOberti left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticmachine commented Aug 15, 2025

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Async chunks

Page load bundle

API count

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

christineweng commented Aug 11, 2025 •

edited

Loading

natasha-moore-elastic Aug 14, 2025 •

edited

Loading