[Security Solution] Update "Execution events" tab UI by nikitaindik · Pull Request #252168 · elastic/kibana

nikitaindik · 2026-02-06T18:46:48Z

Resolves: #251206

Summary

This PR adds some polishing to the "Execution events" tab on the rule details page to make it more user-friendly and usable for debugging issues with rule execution. Cypress tests were also added.

NOTE: Currently this functionality is hidden behind a feature flag and is not visible by default.

Screenshots

Click to see screenshots

Before

After

Changes

Replaced the "Message" column with a "Summary" column. It shows more user friendly summaries of "status changes" and "metrics" events and truncated "message" for "message" events.
Simplified the display of the details in the expandable sections: displaying only what's relevant to current event, without duplicating info that's shown elsewhere in UI.
Made event message filtering send a request only on hitting "Enter" (previously it was on every keypress).
Replaced event type icons with ones that are are more directly related to event types.
Updated the Event Log Reader to pass additional details, specific to an event type. This helps to display proper rule statuses in UI, for example ("Warning" instead of technical "partial failure").
Added Cypress tests to cover the functionality.

How to test

Enable the feature flag and the advanced settings in Kibana config

xpack.securitySolution.enableExperimental:
  ['extendedRuleExecutionLoggingEnabled']

uiSettings.overrides:
  'securitySolution:extendedRuleExecutionLoggingEnabled': true
  'securitySolution:extendedRuleExecutionLoggingMinLevel': 'debug'

You can use this script to create rules of different types that will generate execution events.

https://gist.github.com/nikitaindik/6e9eb707a0f5a53c8fbb65510caa8807

kibanamachine · 2026-02-07T00:22:21Z

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#10695

[✅] Security Solution Rule Management - Cypress: 50/50 tests passed.

see run history

elasticmachine · 2026-02-09T10:03:32Z

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine · 2026-02-09T10:03:34Z

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine · 2026-02-09T10:03:36Z

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

nkhristinin

Nice update! DE changes LGTM!

maximpn

@nikitaindik Thanks for polishing the execution events tab 🙏

I left a few comments regarding the diff but overall it LGTM. And local testing didn't reveal any issues.

I'd recommend considering to move out rule execution id to the table row. UUID is quite long so we could show a short version displaying the full value upon hovering. Different rule execution it could be shown in badge style with colored background. It should help to visually distinguish event from different rule executions.

… declarations

nikitaindik · 2026-02-12T11:53:32Z

@maximpn

I left a few comments regarding the diff

Thanks. I addressed the comments.

I'd recommend considering to move out rule execution id to the table row. UUID is quite long so we could show a short version displaying the full value upon hovering. Different rule execution it could be shown in badge style with colored background. It should help to visually distinguish event from different rule executions.

I was also thinking about something like this. Kind of like table rows are rendered with alternating colors to easily distinguish between rows (in our case this would be groups of rows). I agree that we def need some visual separation between events from different executions. I'd say let's get back to this once we start implementing the filtering by rule execution IDs.

elasticmachine · 2026-02-12T12:44:00Z

⏳ Build in-progress, with failures

Buildkite Build
Commit: 71a556c

Failed CI Steps

FTR Configs #49

History

💚 Build #391604 succeeded 7ab62c8
💛 Build #391250 was flaky b96e499
💔 Build #391234 failed 95a789c

cc @nikitaindik

## Summary I accidentally merged a commit in PR [#252168](#252168) that was destined for another PR #252374. 🤦‍♂️ The commit adjusted log levels for rule executors. Opening this PR to revert the unwanted commit.

**Resolves: elastic#251206 ## Summary This PR adds some polishing to the "Execution events" tab on the rule details page to make it more user-friendly and usable for debugging issues with rule execution. Cypress tests were also added. > NOTE: Currently this functionality is hidden behind a feature flag and is not visible by default. ## Screenshots <details> <summary>Click to see screenshots</summary> **Before** <img width="1441" height="669" alt="543710465-c3cc2781-1e80-4a34-af25-65e70d880623" src="https://github.com/user-attachments/assets/e8e3a326-84b1-4dae-bfba-c1d25ea41979" /> **After** <img width="1611" height="862" alt="Screenshot 2026-02-09 at 10 31 34" src="https://github.com/user-attachments/assets/59fa9829-1d60-41cf-82d3-d72904430763" /> </details> ## Changes - Replaced the "Message" column with a "Summary" column. It shows more user friendly summaries of "status changes" and "metrics" events and truncated "message" for "message" events. - Simplified the display of the details in the expandable sections: displaying only what's relevant to current event, without duplicating info that's shown elsewhere in UI. - Made event message filtering send a request only on hitting "Enter" (previously it was on every keypress). - Replaced event type icons with ones that are are more directly related to event types. - Updated the Event Log Reader to pass additional details, specific to an event type. This helps to display proper rule statuses in UI, for example ("Warning" instead of technical "partial failure"). - Added Cypress tests to cover the functionality. ## How to test Enable the feature flag and the advanced settings in Kibana config ``` xpack.securitySolution.enableExperimental: ['extendedRuleExecutionLoggingEnabled'] uiSettings.overrides: 'securitySolution:extendedRuleExecutionLoggingEnabled': true 'securitySolution:extendedRuleExecutionLoggingMinLevel': 'debug' ``` You can use this script to create rules of different types that will generate execution events. https://gist.github.com/nikitaindik/6e9eb707a0f5a53c8fbb65510caa8807

## Summary I accidentally merged a commit in PR [elastic#252168](elastic#252168) that was destined for another PR elastic#252374. 🤦‍♂️ The commit adjusted log levels for rule executors. Opening this PR to revert the unwanted commit.

… rule executors (#252374) **Resolves: #251211 ## Summary We'd like to provide a user-friendly way to view rule execution events to our customers, so that they could do some basic rule execution troubleshooting. To achieve this we are currently working ([PR](#252168)) on improving the "Execution events" tab on the Rule Details page (currently hidden behind a feature flag). The "Execution events" tab would show execution events logged to event log, filtered by selected log levels. Ideally, we'd like to give users the most helpful information right away (like which indices are queried, how many alerts were created, how many were filtered by exceptions, etc) and let. Currently, we don't log a lot of info useful for customers, but we do log a lot of developer-useful info. <details> <summary>Screenshot of how "Execution events" messages look currently</summary> <img width="2932" height="675" alt="Screenshot 2026-02-09 at 17 33 56" src="https://github.com/user-attachments/assets/5ec58dd8-6032-49f3-83ec-bfbd13a6fa03" /> </details> <details> <summary>Screenshot of how "Execution events" would look after we apply changes from this PR (much cleaner)</summary> <img width="2291" height="854" alt="Screenshot 2026-02-12 at 12 07 04" src="https://github.com/user-attachments/assets/da74a5da-e6d5-4a07-885c-39ed3a55a132" /> </details> **Changes** This PR adjusts "message" logs written to event log from rule executors: - No new logs added, no information was removed. - Updated log levels: "info" for less technical user-useful info, "debug" for rule execution stages and basic stats, "trace" is for very small details, mostly useful for devs. - Updated the wording to be a bit more UI friendly and consistent. - Edited long log messages to have a summary/most useful piece of info in the first sentence, then details, separated by a newline char. We could show the first line in the "Execution events" table right away and the full message with all the details in the expandable section. > **NOTE**: You'll need to enable these Advanced Settings in Kibana config to write logs of all levels. ``` uiSettings.overrides: 'securitySolution:extendedRuleExecutionLoggingEnabled': true 'securitySolution:extendedRuleExecutionLoggingMinLevel': 'trace' ``` --------- Co-authored-by: Devin W. Hurley <snowmiser111@gmail.com>

… rule executors (elastic#252374) **Resolves: elastic#251211 ## Summary We'd like to provide a user-friendly way to view rule execution events to our customers, so that they could do some basic rule execution troubleshooting. To achieve this we are currently working ([PR](elastic#252168)) on improving the "Execution events" tab on the Rule Details page (currently hidden behind a feature flag). The "Execution events" tab would show execution events logged to event log, filtered by selected log levels. Ideally, we'd like to give users the most helpful information right away (like which indices are queried, how many alerts were created, how many were filtered by exceptions, etc) and let. Currently, we don't log a lot of info useful for customers, but we do log a lot of developer-useful info. <details> <summary>Screenshot of how "Execution events" messages look currently</summary> <img width="2932" height="675" alt="Screenshot 2026-02-09 at 17 33 56" src="https://github.com/user-attachments/assets/5ec58dd8-6032-49f3-83ec-bfbd13a6fa03" /> </details> <details> <summary>Screenshot of how "Execution events" would look after we apply changes from this PR (much cleaner)</summary> <img width="2291" height="854" alt="Screenshot 2026-02-12 at 12 07 04" src="https://github.com/user-attachments/assets/da74a5da-e6d5-4a07-885c-39ed3a55a132" /> </details> **Changes** This PR adjusts "message" logs written to event log from rule executors: - No new logs added, no information was removed. - Updated log levels: "info" for less technical user-useful info, "debug" for rule execution stages and basic stats, "trace" is for very small details, mostly useful for devs. - Updated the wording to be a bit more UI friendly and consistent. - Edited long log messages to have a summary/most useful piece of info in the first sentence, then details, separated by a newline char. We could show the first line in the "Execution events" table right away and the full message with all the details in the expandable section. > **NOTE**: You'll need to enable these Advanced Settings in Kibana config to write logs of all levels. ``` uiSettings.overrides: 'securitySolution:extendedRuleExecutionLoggingEnabled': true 'securitySolution:extendedRuleExecutionLoggingMinLevel': 'trace' ``` --------- Co-authored-by: Devin W. Hurley <snowmiser111@gmail.com>

nikitaindik self-assigned this Feb 6, 2026

nikitaindik force-pushed the fix-execution-events-filters branch from b96e499 to 7ab62c8 Compare February 9, 2026 09:16

nikitaindik marked this pull request as ready for review February 9, 2026 10:03

nikitaindik requested review from a team as code owners February 9, 2026 10:03

nikitaindik requested review from nkhristinin and sdesalas February 9, 2026 10:03

nikitaindik changed the title ~~[Security Solution] Fix execution events filters~~ [Security Solution] Update "Execution events" tab UI Feb 9, 2026

nikitaindik requested review from maximpn and removed request for sdesalas February 9, 2026 10:05

NicholasPeretti approved these changes Feb 9, 2026

View reviewed changes

nikitaindik mentioned this pull request Feb 9, 2026

[Security Solution] Adjust log level and wording of logs written from rule executors #252374

Merged

nkhristinin approved these changes Feb 11, 2026

View reviewed changes

maximpn approved these changes Feb 11, 2026

View reviewed changes

nikitaindik added 3 commits February 12, 2026 12:11

Make network on pressing "Enter" instead on every keypress

bdb7066

Clean up UI

f58b277

Update i18n JSONs

eb6ef04

nikitaindik added 7 commits February 12, 2026 12:11

Adjust log level and wording of "message" events

f7088b7

Show only the first line of message as a summary

e13b9b9

Update OpenAPI schema and the generated types for Event

bd45213

Add conditional rendering HealthTruncateText, remove OptionalToolTip

fedc895

Rename components for clarity

5c71245

Make components in execution_events_table_row_summary.tsx be function…

7b06a22

… declarations

Go to the correct tab right away in Cypress tests

71a556c

nikitaindik force-pushed the fix-execution-events-filters branch from 7ab62c8 to 71a556c Compare February 12, 2026 11:42

nikitaindik enabled auto-merge (squash) February 12, 2026 13:24

nikitaindik merged commit d9976f6 into elastic:main Feb 12, 2026
16 checks passed

nikitaindik mentioned this pull request Feb 12, 2026

[Security Solution] Revert accidentally merged commit #252895

Merged

nikitaindik mentioned this pull request Feb 24, 2026

[Request] Document the new "Execution Events" tab on Rule Details page elastic/docs-content#5282

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Update "Execution events" tab UI#252168

[Security Solution] Update "Execution events" tab UI#252168
nikitaindik merged 10 commits intoelastic:mainfrom
nikitaindik:fix-execution-events-filters

nikitaindik commented Feb 6, 2026 •

edited

Loading

Uh oh!

kibanamachine commented Feb 7, 2026

Uh oh!

elasticmachine commented Feb 9, 2026

Uh oh!

elasticmachine commented Feb 9, 2026

Uh oh!

elasticmachine commented Feb 9, 2026

Uh oh!

nkhristinin left a comment

Uh oh!

maximpn left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nikitaindik commented Feb 12, 2026

Uh oh!

elasticmachine commented Feb 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

nikitaindik commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Screenshots

Changes

How to test

Uh oh!

kibanamachine commented Feb 7, 2026

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#10695

Uh oh!

elasticmachine commented Feb 9, 2026

Uh oh!

elasticmachine commented Feb 9, 2026

Uh oh!

elasticmachine commented Feb 9, 2026

Uh oh!

nkhristinin left a comment

Choose a reason for hiding this comment

Uh oh!

maximpn left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nikitaindik commented Feb 12, 2026

Uh oh!

elasticmachine commented Feb 12, 2026

⏳ Build in-progress, with failures

Failed CI Steps

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

nikitaindik commented Feb 6, 2026 •

edited

Loading