[Cases] Enable auto-extract observables in alerts table by christineweng · Pull Request #235433 · elastic/kibana

christineweng · 2025-09-17T22:54:55Z

Summary

Dependency: #233027 to be merged first.

This PR enables auto-extract toggle in alerts table when user adds alerts to a case. This applies to row actions and bulk actions.

To enable the feature in security update the case configuration to extractObservables: true,

Checklist

Unit or functional tests were updated or added to match the most common scenarios
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

elasticmachine · 2025-09-30T15:18:00Z

Pinging @elastic/kibana-cases (Team:Cases)

PhilippeOberti

Code review only for the files impacting the @elastic/security-threat-hunting-investigations team.

This code really motivates me to cleanup those ecsData and all objects. We're manipulating these so many times over and over again, we need to find a more performant approach. I know it's a huge effort and will impact so many places within Security Solution...
One day! 😆

elasticmachine · 2025-09-30T17:33:32Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 2f88eea

Failed CI Steps

Post-Build

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [48feb9e]

History

💛 Build #344557 was flaky ab6391b
💔 Build #344549 failed 0a8b410

cc @christineweng

umbopepato · 2025-10-01T11:40:53Z

...atform/packages/shared/response-ops/alerts-table/components/bulk_actions_toolbar_control.tsx

 ): TimelineItem[] => {
  return Array.from(rowSelection.keys()).map((rowIndex: number) => {
    const alert = alerts[rowIndex];
+    const data = Object.entries(alert).map(([key, value]) => ({


nit: how about adding the fallback values for the well known fields here instead of iterating on the fields array each time?

Suggested change

const data = Object.entries(alert).map(([key, value]) => ({

const data = Object.entries({

[ALERT_CASE_IDS]: [],

[ALERT_WORKFLOW_TAGS]: [],

[ALERT_WORKFLOW_ASSIGNEE_IDS]: [],

...alert,

}).map(([key, value]) => ({

Apologies, missed this comment before I merged. Made a tiny pr to fix here: #237307

umbopepato

RO code changes LGTM! Thanks for changing the alert format locally 🙏 🚀

…fix'

## Summary Fix based on feedback [here](#235433 (comment))

elasticmachine · 2025-10-06T15:22:44Z

Pinging @elastic/security-solution (Team: SecuritySolution)

## Summary Dependency: elastic#233027 to be merged first. This PR enables auto-extract toggle in alerts table when user adds alerts to a case. This applies to row actions and bulk actions. To enable the feature in security update the [case configuration](https://github.com/elastic/kibana/blob/50299491246af6cc8055a1ff8a975ce82b114495/x-pack/solutions/security/plugins/security_solution/public/detections/components/alerts_table/index.tsx#L143) to `extractObservables: true,` <img width="1490" height="730" alt="image" src="https://github.com/user-attachments/assets/1c31cfee-a086-490b-b2d8-69306eb3ae4c" /> ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…37307) ## Summary Fix based on feedback [here](elastic#235433 (comment))

christineweng self-assigned this Sep 17, 2025

christineweng added backport:skip This PR does not require backporting release_note:feature Makes this part of the condensed release notes Team:Cases Security Solution Cases team 9.2 candidate labels Sep 17, 2025

christineweng mentioned this pull request Sep 18, 2025

[Cases] Auto-extract cases observables in add to case workflow #233027

Merged

6 tasks

christineweng force-pushed the cases-extract-observables-in-alert-table branch from e50319f to ced2f44 Compare September 19, 2025 17:02

christineweng requested a review from umbopepato September 19, 2025 17:02

christineweng force-pushed the cases-extract-observables-in-alert-table branch 2 times, most recently from 2217a04 to 760557f Compare September 25, 2025 18:24

christineweng mentioned this pull request Sep 26, 2025

Test Only - Cases observables #236500

Closed

10 tasks

christineweng force-pushed the cases-extract-observables-in-alert-table branch 3 times, most recently from 6bc1dfb to 0a8b410 Compare September 26, 2025 20:20

michaelolo24 force-pushed the cases-extract-observables-in-alert-table branch from ab6391b to 2f88eea Compare September 30, 2025 15:17

michaelolo24 marked this pull request as ready for review September 30, 2025 15:17

michaelolo24 requested review from a team as code owners September 30, 2025 15:17

PhilippeOberti approved these changes Sep 30, 2025

View reviewed changes

janmonschke approved these changes Sep 30, 2025

View reviewed changes

umbopepato reviewed Oct 1, 2025

View reviewed changes

umbopepato approved these changes Oct 1, 2025

View reviewed changes

christineweng and others added 4 commits October 1, 2025 07:58

auto extract observables

b4a9f74

disable by default and comments

66b29b5

enable auto extract in alerts table

3adce6f

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

a0825e1

…fix'

michaelolo24 force-pushed the cases-extract-observables-in-alert-table branch from 2f88eea to a0825e1 Compare October 1, 2025 12:00

michaelolo24 enabled auto-merge (squash) October 1, 2025 12:00

michaelolo24 merged commit c32878c into elastic:main Oct 1, 2025
12 checks passed

kibanamachine added the v9.2.0 label Oct 1, 2025

michaelolo24 mentioned this pull request Oct 2, 2025

[Cases][Observables] - Alert table performance improvement #237307

Merged

michaelolo24 added a commit that referenced this pull request Oct 6, 2025

[Cases][Observables] - Alert table performance improvement (#237307)

09552c7

## Summary Fix based on feedback [here](#235433 (comment))

jmikell821 added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Oct 6, 2025

PhilippeOberti mentioned this pull request Oct 14, 2025

[Cases] Fix auto extract observables in EASE #239000

Merged

3 tasks

rylnd pushed a commit to rylnd/kibana that referenced this pull request Oct 17, 2025

[Cases][Observables] - Alert table performance improvement (elastic#2…

c062263

…37307) ## Summary Fix based on feedback [here](elastic#235433 (comment))

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Cases] Enable auto-extract observables in alerts table#235433

[Cases] Enable auto-extract observables in alerts table#235433
michaelolo24 merged 4 commits intoelastic:mainfrom
christineweng:cases-extract-observables-in-alert-table

christineweng commented Sep 17, 2025 •

edited

Loading

Uh oh!

elasticmachine commented Sep 30, 2025

Uh oh!

PhilippeOberti left a comment

Uh oh!

elasticmachine commented Sep 30, 2025 •

edited

Loading

Uh oh!

umbopepato Oct 1, 2025 •

edited

Loading

Uh oh!

michaelolo24 Oct 2, 2025

Uh oh!

umbopepato left a comment

Uh oh!

Uh oh!

elasticmachine commented Oct 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

-    const data = Object.entries(alert).map(([key, value]) => ({
+    const data = Object.entries({
+      [ALERT_CASE_IDS]: [],
+      [ALERT_WORKFLOW_TAGS]: [],
+      [ALERT_WORKFLOW_ASSIGNEE_IDS]: [],
+      ...alert,
+     }).map(([key, value]) => ({

Conversation

christineweng commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

elasticmachine commented Sep 30, 2025

Uh oh!

PhilippeOberti left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

History

Uh oh!

umbopepato Oct 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michaelolo24 Oct 2, 2025

Choose a reason for hiding this comment

Uh oh!

umbopepato left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticmachine commented Oct 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

christineweng commented Sep 17, 2025 •

edited

Loading

elasticmachine commented Sep 30, 2025 •

edited

Loading

umbopepato Oct 1, 2025 •

edited

Loading