Skip to content

[Security Solution][Atack/Alerts] Flyout header: Assignees #252190

Merged
agusruidiazgd merged 8 commits intoelastic:mainfrom
agusruidiazgd:feat/attacks-alerts-flyout-header-asignees
Feb 10, 2026
Merged

[Security Solution][Atack/Alerts] Flyout header: Assignees #252190
agusruidiazgd merged 8 commits intoelastic:mainfrom
agusruidiazgd:feat/attacks-alerts-flyout-header-asignees

Conversation

@agusruidiazgd
Copy link
Copy Markdown
Contributor

@agusruidiazgd agusruidiazgd commented Feb 6, 2026 •
edited
Loading

Summary

Closes: #242344

Adds assignees to the Attack details flyout header, next to the Alerts count. Users can view and update assignees from the flyout with the same behavior as the Take action assignees on the attacks table (including the confirmation modal for attack-only vs attack + related alerts).

What's changed

Data & context

  • use_header_data.ts – Reads ALERT_WORKFLOW_ASSIGNEE_IDS from the attack document and exposes assignees.
  • use_attack_details.ts – Returns refetch from useTimelineEventsDetails so the flyout can reload after assignee updates.
  • context.tsx – Adds refetch to AttackDetailsContext so components can refresh flyout data after updating assignees.

New hook

  • use_attack_details_assignees.ts – Hook that:
    • Uses useApplyAttackAssignees (same apply flow as attacks table, including modal).
    • Uses useBulkGetUserProfiles, useAttacksPrivileges, useLicense, and useUpsellingMessage.
    • On success, calls refetch() and invalidateFindAttackDiscoveries() so the flyout and attacks list stay in sync.

How to test

  1. Open the Attacks page and open an attack’s details flyout.
  2. In the header, confirm an "Assignees" block appears next to "Alerts".
  3. With sufficient permissions and license, use the + button to add/change assignees; confirm the same modal and behavior as the attacks table Take action.
  4. After updating, confirm the flyout updates without closing and the attacks list refreshes when applicable.

Checklist

  • Assignees block appears in the flyout header next to Alerts.
  • UI matches document_details assignees (avatars + popover).
  • Apply flow matches attacks table (modal when related alerts exist).
  • Permissions and upsell are respected.
  • Flyout refetches after update; attacks list invalidates.
Screen.Recording.2026-02-09.at.07.51.53.mov

@agusruidiazgd agusruidiazgd self-assigned this Feb 6, 2026
@agusruidiazgd agusruidiazgd marked this pull request as ready for review February 9, 2026 11:00
@agusruidiazgd agusruidiazgd requested a review from a team as a code owner February 9, 2026 11:00
@agusruidiazgd agusruidiazgd added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team v9.4.0 labels Feb 9, 2026
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Feb 9, 2026

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Feb 9, 2026

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

@agusruidiazgd agusruidiazgd added the ci:cloud-deploy Create or update a Cloud deployment label Feb 9, 2026
@agusruidiazgd agusruidiazgd enabled auto-merge (squash) February 9, 2026 14:57
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Feb 10, 2026

⏳ Build in-progress

History

cc @agusruidiazgd

@agusruidiazgd agusruidiazgd merged commit e9b9de4 into elastic:main Feb 10, 2026
16 checks passed
e40pud
e40pud reviewed Feb 10, 2026
View reviewed changes
Comment thread ...ons/security/plugins/security_solution/public/flyout/attack_details/components/assignees.tsx
* Assignees block for the Attack details flyout header.
* Matches the look of document_details assignees (avatars + popover with AssigneesApplyPanel).
*/
export const Assignees = memo(() => {
Copy link
Copy Markdown
Contributor

@e40pud e40pud Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm wondering if we could follow the pattern that we have in the https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/flyout/attack_details/components/status_popover_button.tsx

There we:

  • Pass enrichedFieldInfo which from my understanding holds needed info (status)
  • Call useAttackWorkflowStatusContextMenuItems which returns context menu items
  • Show popover with the context menu items from prev step

The useAttackWorkflowStatusContextMenuItems handles all logic that updates status for the attack and related alerts (showing modal etc.).

Following it will allow us to get rid of this new hook x-pack/solutions/security/plugins/security_solution/public/flyout/attack_details/hooks/use_attack_details_assignees.ts and just use existing useAttackDetailsContext.

Copy link
Copy Markdown
Contributor Author

@agusruidiazgd agusruidiazgd Feb 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Implemented here: #253729

mbondyra added a commit to mbondyra/kibana that referenced this pull request Feb 10, 2026
@mbondyra
Merge commit '7dcc1fe3c205d2de0c3ca3f65804f21de09013c3' into pr/250229
6e982cb 
* commit '7dcc1fe3c205d2de0c3ca3f65804f21de09013c3': (285 commits)
  Enrich kbn-check-saved-objects-cli README with CI and manual usage docs (elastic#252557)
  [Discover] Add feature flag to make ESQL the default query mode (elastic#252268)
  Add maskProps.headerZindexLocation above to inspect component flyout (elastic#252543)
  [Security Solution][Atack/Alerts] Flyout header: Assignees  (elastic#252190)
  Upgrade EUI to v112.3.0 (elastic#252315)
  [Fleet] Make save_knowledge_base async in streaming state machine (elastic#252328)
  Upgrade @smithy/config-resolver 4.3.0 → 4.4.6 (elastic#252457)
  [Lens as API] Add colorMapping support for XY charts (ES|QL data layers) (elastic#252051)
  [WorkplaceAI] Add Google Drive data source and connector (elastic#250677)
  [Scout] Move GlobalSearch FTR tests to Scout (elastic#252201)
  [EDR Workflows] Fix osquery pack results display when agent clock is skewed (elastic#251417)
  [Observability Onboarding] Apply integrations limit after dedup in parseIntegrationsTSV (elastic#252486)
  [Entity Analytics] Update `host.ip` aggregation to remove painless script (elastic#252426)
  Address `@elastic/eui/require-table-caption` lint violations across `@elastic/obs-presentation-team` files (elastic#251050)
  Consolidate JSON stringify dependencies (elastic#251890)
  [index mgmt] Use esql instead of query dsl to get the index count (elastic#252422)
  Add Usage API Plugin (elastic#252434)
  Cases All Templates page (elastic#250372)
  [Agent Builder] Default value for optional params in ESQL tools (elastic#238472)
  [Fleet] Add upgrade_details.metadata.reason to AgentResponseSchema (elastic#252485)
  ...
@agusruidiazgd agusruidiazgd mentioned this pull request Feb 18, 2026
Merged
agusruidiazgd added a commit that referenced this pull request Feb 23, 2026
@agusruidiazgd
[Security Solution][Attacks] Flyout: improving assignees functionality (
7c5c404 
#253729)

## Summary

Address this
[comment](#252190)
implementing a improvement to the assignees functionality on the Attack
Details Flyour header
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@e40pud e40pud e40pud left review comments

@NicholasPeretti NicholasPeretti NicholasPeretti approved these changes

Assignees

@agusruidiazgd agusruidiazgd

Labels

backport:skip This PR does not require backporting ci:cloud-deploy Create or update a Cloud deployment release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team v9.4.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Security Solution][Attacks/Alerts][Attack flyout] Assignees

5 participants

@agusruidiazgd @elasticmachine @e40pud @NicholasPeretti @kibanamachine