Skip to content

[Security Solution][Attacks/Alerts][Attacks page][Table section] Remember last selected attack details tab (Summary or Alerts) (#247519)#247988

Merged
e40pud merged 7 commits intoelastic:mainfrom
e40pud:security/attack-alerts-alignment/247519-store-selected-tab
Jan 10, 2026
Merged

[Security Solution][Attacks/Alerts][Attacks page][Table section] Remember last selected attack details tab (Summary or Alerts) (#247519)#247988
e40pud merged 7 commits intoelastic:mainfrom
e40pud:security/attack-alerts-alignment/247519-store-selected-tab

Conversation

@e40pud
Copy link
Copy Markdown
Contributor

@e40pud e40pud commented Jan 6, 2026 •
edited
Loading

Summary

Closes #247519

The AttackDetailsContainer component has been updated to persist the selected tab state in local storage using the useLocalStorage hook. This replaces the previous local state implementation.

NOTES:

  • Tabs default to "Attack summary" tab
  • If there is no "Attack summary" tab for a group (e.g. default "-" group), then we fallback to the first existing tab

Feature Flag

Note

The feature is hidden behind the feature flag (in kibana.dev.yml):

feature_flags.overrides:
  securitySolution.attacksAlertsAlignment: true

@e40pud
[Security Solution][Attacks/Alerts][Attacks page][Table section] Reme…
5823acb 
…mber last selected attack details tab (Summary or Alerts) (elastic#247519)
@e40pud e40pud self-assigned this Jan 6, 2026
@e40pud e40pud requested a review from a team as a code owner January 6, 2026 18:25
@e40pud e40pud added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Threat Hunting Security Solution Threat Hunting Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team labels Jan 6, 2026
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jan 6, 2026

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jan 6, 2026

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jan 6, 2026

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

PhilippeOberti
PhilippeOberti requested changes Jan 8, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@PhilippeOberti PhilippeOberti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Something is not working as I was expected with this implementation. If you look at the video below (recorded with audio) when we do not have anything saved in local storage, we basically default to the summary tab, which means that when expanding the generic group, the Alerts tab (which is the only one available) isn't selected.
Then also this happens when doing some changes to a non generic tab then coming back to the generic tab...

Screen.Recording.2026-01-08.at.3.49.53.PM.mov

While this is not at all a big deal, there is a way to make this work perfectly. I don't think we should set the default to be ATTACK_SUMMARY_TAB all the time. Instead we should set the default value depending on what tabs are rendered. This could be done via a useEffect or maybe better, by following the implementation we do for the alert and attack flyouts. For these, we use a useTabs hooks (respectively this one for alert flyout and that one fpr attack flyout). I think it's an option worth looking into?

@e40pud
Copy link
Copy Markdown
Contributor Author

e40pud commented Jan 9, 2026

@PhilippeOberti this PR needs to wait for a discussed changes where we will get rid of tabs for the generic group - -. Here is the PR for those changes #248444.

Once, we have that done this PR will be simplified to always work with both tabs and there won't be corner cases of some tabs absent.

I will mark this PR as draft for now to prioritize reviewing of another one.

@e40pud e40pud marked this pull request as draft January 9, 2026 13:08
@e40pud
Merge branch 'main' into security/attack-alerts-alignment/247519-stor…
15d39f7 
…e-selected-tab

# Conflicts:
#	x-pack/solutions/security/plugins/security_solution/public/detections/components/attacks/table/attack_details/attack_details_container.tsx
@e40pud e40pud marked this pull request as ready for review January 9, 2026 22:39
PhilippeOberti
PhilippeOberti approved these changes Jan 9, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@PhilippeOberti PhilippeOberti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Desk tested and code LGTM now that's it's simplified. Thanks for adding this functionality!

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jan 10, 2026

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 8632 8633 +1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 10.8MB 10.8MB -33.0B

History

cc @e40pud

@e40pud e40pud merged commit 37d4d26 into elastic:main Jan 10, 2026
17 checks passed
devamanv pushed a commit to devamanv/kibana that referenced this pull request Jan 12, 2026
@e40pud @kibanamachine @devamanv
[Security Solution][Attacks/Alerts][Attacks page][Table section] Reme…
cabd2cc 
…mber last selected attack details tab (Summary or Alerts) (elastic#247519) (elastic#247988)

## Summary

Closes elastic#247519

The `AttackDetailsContainer` component has been updated to persist the
selected tab state in local storage using the `useLocalStorage` hook.
This replaces the previous local state implementation.

**NOTES**:
* Tabs default to `"Attack summary"` tab
* If there is no `"Attack summary"` tab for a group (e.g. default `"-"`
group), then we fallback to the first existing tab

## Feature Flag

> [!NOTE]
> The feature is hidden behind the feature flag (in `kibana.dev.yml`):

```
feature_flags.overrides:
  securitySolution.attacksAlertsAlignment: true
```

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
mbondyra added a commit to mbondyra/kibana that referenced this pull request Jan 12, 2026
@mbondyra
Merge commit 'c4304e27736c62f17af20d145770b2ae9d3fae30' into vega_esql
3e8447d 
* commit 'c4304e27736c62f17af20d145770b2ae9d3fae30': (418 commits)
  skip failing suite (elastic#89079)
  [ES|QL] Update grammars (elastic#248600)
  skip failing test suite (elastic#248579)
  [ES|QL] Update function metadata (elastic#248601)
  skip failing test suite (elastic#248554)
  Fix flaky test runner serverless flag for Search solution (elastic#248559)
  [Security Solution][Attacks/Alerts][Attacks page][Table section] Remember last selected attack details tab (Summary or Alerts) (elastic#247519) (elastic#247988)
  Fix ES health check poller (elastic#248496)
  Fix collector schema ownership (elastic#241292)
  [api-docs] 2026-01-10 Daily api_docs build (elastic#248574)
  Update dependency cssstyle to v5.3.5 (main) (elastic#237637)
  Update dependency @octokit/rest to v22.0.1 (main) (elastic#243102)
  skip failing test suite (elastic#248504)
  skip failing test suite (elastic#247685)
  Remove broken ecommerce_dashboard journeys (elastic#248162)
  [Obs AI] Hide AI Insight component when there are no connectors (elastic#248542)
  skip failing suite (elastic#248433)
  [Security Solution][Attacks/Alerts][Attacks page][Table section] Hide tabs for generic attack groups (elastic#248444)
  [Agent Builder] [AI Infra] Adds product documentation tool and task evals (elastic#248370)
  [Controls Anywhere] Keep controls focused when creating + editing other panels (elastic#248021)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PhilippeOberti PhilippeOberti PhilippeOberti approved these changes

Assignees

@e40pud e40pud

Labels

backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team Team:Threat Hunting Security Solution Threat Hunting Team v9.4.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Security Solution][Attacks/Alerts][Attacks page][Table section] Remember last selected attack details tab (Summary or Alerts)

4 participants

@e40pud @elasticmachine @PhilippeOberti @kibanamachine