[Security Solution][Attacks/Alerts] Telemetry for Attacks and Alerts Alignment (#256117)

[e40pud]

Summary

Closes #256117

This PR implements comprehensive client-side Event-Based Telemetry (EBT) for the new Attacks page. This validation effort aims to track user adoption, feature usage, and key interaction patterns across the Attacks workflow.

Events

The following events are emitted when users interact with the Attacks page components, flyouts, and actions. All events are prefixed with Attacks in their human-readable name and are part of the AttacksEventTypes enum.

Table & View Interactions

• Attacks Table Sort Changed: Emitted when sorting the attacks table.
  • field: The field used for sorting.
  • direction: asc or desc.
• Attacks View Option Changed: Emitted when toggling view options (e.g., anonymization).
  • option: The view option name.
  • enabled: Boolean status.
• Attacks KPI View Changed: Emitted when switching KPI panel views.
  • view: The selected view (summary, trend, count, treemap).
• Attacks Expanded View Tab Clicked: Emitted when switching tabs in the inline expanded attack view.
  • tab: summary or alerts.

Action Interactions

All action events include a source property to distinguish between actions taken from different UI locations:

• attacks_page_group_take_action
• attacks_page_group_summary
• attacks_page_flyout_take_action
• attacks_page_flyout_header

• Attacks Action Status Updated: Emitted when updating attack status (Open, Acknowledge, Close).
  • status: The new status.
  • scope: attack_only or attack_and_related_alerts.
• Attacks Action Assignee Updated: Emitted when modifying assignees.
  • scope: attack_only or attack_and_related_alerts.
• Attacks Action Tags Updated: Emitted when adding/removing tags.
  • scope: attack_only or attack_and_related_alerts.
• Attacks Action Added To Case: Emitted when adding an attack to a case.
  • action: add_to_new_case or add_to_existing_case.
• Attacks Timeline Investigation Opened: Emitted when clicking "Investigate in timeline".
• Attacks AI Assistant Opened: Emitted when opening the AI Assistant for an attack.

Feature & Navigation Events

• Attacks Details Flyout Opened: Emitted when opening the full attack details flyout.
  • id: The ID of the attack.
  • source: Where the flyout was opened from.
• Attacks Schedule Flyout Opened: Emitted when opening the scheduling flyout.
  • source: attacks_page_header or attacks_page_empty_state.
• Attacks Feature Promotion Callout Action: Emitted for interactions with the "Attack Discovery is moving" callout.
  • action: view_attacks or hide.

How to verify (dev)

1. Enable local EBT shipping in kibana.dev.yml (or kibana.yml):

telemetry:
  optIn: true
  localShipper: true

2. In Discover, query the Browser index pattern:

   • Index Pattern: ebt-kibana-browser*

3. Filter for Attacks events:

   • event_type: "Attacks *" or event_name containing "Attacks"

Verification Steps

1. Table Interactions:

   • Sort the Attacks table by any column.
   • Verify Attacks Table Sort Changed event with correct field and direction.
   • Toggle "Show anonymized data".
   • Verify Attacks View Option Changed event.

2. KPI Views:

   • Switch between Summary, Trend, Count, and Treemap views.
   • Verify Attacks KPI View Changed event with correct view.

3. Actions (Table & Flyout):

   • Select an attack and use the "Take action" menu to:
     • Change status (Open/Close/Ack).
     • Add/Remove tags.
     • Assign a user.
     • Add to case.
   • Verify corresponding Attacks Action * events.
   • Check that the source field correctly identifies the location (attacks_page_group_take_action).
   • For Status, Assignee, and Tag updates, verify the scope matches user selection (only attack vs. attack + alerts).
   • For "Add to case", verify the action distinguishes between new and existing cases.

4. Flyout Navigation:

   • Click an attack ID to open the flyout.
   • Verify Attacks Details Flyout Opened.
   • Inside the flyout, perform an action (e.g., status update).
   • Verify the action event has source: "attacks_page_flyout_take_action" (or header source).

5. Promotion Callout:

   • On the legacy Attack Discovery page, interact with the "Moving to Detections" callout.
   • Verify Attacks Feature Promotion Callout Action with view_attacks or hide.

---

PR developed with Cursor + Gemini 3 Pro

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (6)

• reviewer:coderabbit
• Team:Search
• Team:Operations
• Team:QA
• Team:SigEvents
• Team:Kibana Management

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: 098474cc-1328-443e-b119-db90e580be99

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: f8dccd9

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	9135	9137	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	11.3MB	11.3MB	+3.1KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
securitySolution	169.0KB	171.8KB	+2.8KB

History

• 💚 Build #405553 succeeded e781d94
• 💔 Build #405480 failed 42e1d2d
• 💛 Build #405109 was flaky 07751f7

cc @e40pud