[EDR Workflows][Artifacts Regrouping] Re-organize all artifacts to a single page with separate tabs by parkiino · Pull Request #257001 · elastic/kibana

parkiino · 2026-03-10T21:20:33Z

Summary

Updates the Endpoint Management navigation so that Endpoint Exceptions, Trusted Apps, Trusted Devices, Event Filters, Host Isolation Exceptions and Blocklist are under a single dynamic Artifacts link that points to the artifact tab that is visible to the user.
Creates a new artifacts page with individual artifacts as tabs within the page and an updated design where the "Add artifact" button and "3-dot menu" are in line with the search filters
The Artifacts link will be visible if the user has permissions for at least one of the individual artifact pages. The specific artifact tabs will only be visible if the user has the correct permissions for that artifact
All artifact urls will remain the same and the link to the artifact page is dynamically generated to the first available artifact page.
Unit tests

Screenshots

elasticmachine · 2026-03-20T18:04:01Z

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

denar50

Code review only. LGTM for files owned by the Detection Engine.

…nto task/regroup-artifacts

gergoabraham

hey hey, nice work!

tested it out together with #257983, by merging them locally on top of each other, and happy to share, that, apart from a trivial merge conflict, they work together without any issue 👍

also tested your PR on its own, and works nice. 👏 I got one finding: if a user doesn't have any artifact access, the 'Artifacts' link is still shown, both in Classic and Security views

Screen.Recording.2026-04-02.at.13.43.20.mov

gergoabraham · 2026-04-02T12:19:25Z

+    canReadTrustedDevices ||
+    canReadEventFilters ||
+    canReadHostIsolationExceptions ||
+    canReadBlocklist;


+1 on making experimentalFeatures a required parameter, it doesn't seem like an optional thing for calculating the links.

gergoabraham · 2026-04-02T12:22:19Z

  core: CoreStart,
-  plugins: StartPlugins
+  plugins: StartPlugins,
+  params?: GetFilteredLinksParams


this also should be mandatory. and experimentalFeatures up in line 56 as well.

nit: also, GetFilteredLinksParams doesn't seem to be very useful, maybe it'd be enough to simply have experimentalFeatures as the 3rd parameter here. same for getManagementFilteredLinks()

gergoabraham · 2026-04-02T12:27:54Z

+export interface GetManagementFilteredLinksParams {
+  experimentalFeatures?: Pick<
+    ExperimentalFeatures,
+    'endpointExceptionsMovedUnderManagement' | 'trustedDevices'
+  >;
+}


nit: same as in my other comment above: this interface seems superfluous. it's perfectly fine to just pass the experimentalFeatures as the 3rd parameter, without wrapping it inside an interface, or without picking the 2 parameters we actually use.

parkiino · 2026-04-02T16:28:13Z

@parkiino it would be nice to have a bit more details on the PR description. I've pulled the branch locally to test things but I'm failing to see a difference between the endpointExceptionsMovedUnderManagement feature flag on or off. I'm sure I'm doing something wrong but can't figure out why.

The reason I wanted to test things is because I'm not sure I understand why we're making a change to the useHiddenTimelineRoutes hook, so I wanted to make sure this was really necessary...

Thanks!

Hi @PhilippeOberti, the endpointExceptionsMovedUnderManagement feature flag controls the visibility of the Endpoint Exceptions tab, since it was previously in the Detections page and not in the endpoint management section. As long as you're using a superuser role or a role that has Endpoint Exceptions privileges + the experimental flag turned on, the endpoint exceptions tab should show on the new artifact page.

The useHiddenTimelineRoutes hook changes are separate from the flag. The change to the hook was necessary because we previously hid the timeline on the individual artifact pages, but now that we have combined all the artifacts onto one page with different tabs, we needed a way to still hide the timeline on those tabs.

Let me know if that makes sense or if there were any other questions.

…nto task/regroup-artifacts

szwarckonrad

Good job on this one, thanks for addressing all the review comments! The RBAC-aware artifact link resolution, telemetry preservation, and the cleanup of old container files all look solid. 👍

A few minor non-blocking observations for your consideration (can be addressed in a follow-up if you'd like):

getActiveTabFromPathname hardcoded fallback — the function still falls back to AdministrationSubTab.trustedApps when the pathname doesn't match any tab. It would be slightly more defensive to fall back to visibleTabs[0] instead, so it always lands on a tab the user can actually see.
getFirstAllowedArtifactPath final fallback — when no artifact is accessible, the function returns getTrustedAppsListPath(). This should be unreachable since canReadAnyArtifact would be false and the link excluded, but a small comment documenting that assumption would help future readers.
Redundant condition in canReadAnyArtifact — (showHostIsolationExceptions && canReadHostIsolationExceptions) — the && canReadHostIsolationExceptions is redundant since showHostIsolationExceptions already factors in canReadHostIsolationExceptions. Not wrong, just unnecessary.

…nto task/regroup-artifacts

elasticmachine · 2026-04-06T18:50:52Z

💛 Build succeeded, but was flaky

Failed CI Steps

Defend Workflows Cypress Tests on Serverless #3

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	9344	9335	-9

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	11.7MB	11.7MB	+227.0B
`streamsApp`	1.9MB	1.9MB	+24.0B
total			+251.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`elasticAssistant`	272.5KB	272.5KB	+24.0B
`securitySolution`	129.1KB	129.1KB	+6.0B
`securitySolutionEss`	36.6KB	36.7KB	+160.0B
`securitySolutionServerless`	48.6KB	48.7KB	+135.0B
total			+325.0B

Unknown metric groups

async chunk count

id	before	after	diff
`securitySolution`	96	97	+1

History

kqualters-elastic · 2026-04-06T19:04:50Z

  core: CoreStart,
-  plugins: StartPlugins
+  plugins: StartPlugins,
+  experimentalFeatures: ExperimentalFeatures


probably want to coordinate with @ashokaditya , he's making very similar changes to this exact function for this same reason https://github.com/elastic/kibana/pull/260429/files#diff-d7b43749c559b9c4036c0e2cc6d922ea086a41ed1ea89097fb37b5372166b9e6R58 experimentalFeatures is an optional param in that branch, so whoever ends up merging 2nd should be careful.

Sorry I just approved the PR! Thanks for pointing this out @kqualters-elastic I missed that

PhilippeOberti

LGTM and thanks for the explanation on the Timeline hook!

…#261845) The artifacts regrouping PR (#257001) reorganized all endpoint artifacts into a unified page with tabs. This changed the page structure so that `header-page-title` now belongs to the unified "Artifacts" page and is always present, regardless of whether individual tabs have entries. Previously, `trusted_apps_list.ts` was skipped (flaky). Our PR #261180 unskipped it after fixing the underlying flakiness — but by that point the regrouping had already landed, making the `header-page-title` assertions invalid. The test immediately started failing on merge. `artifact_entries_list.ts` has the same `header-page-title` assertions for all artifact types (trusted apps, event filters, blocklist, host isolation exceptions) — these would fail for the same reason once hit. **Fix:** Replace `missingOrFail('header-page-title')` with `existOrFail('*-emptyState')` in both test files. The empty state test subject is the correct indicator that a tab has no entries. Closes #261827 Closes #261829 Closes #261833 Closes #261849 Closes #261850

parkiino added 10 commits March 10, 2026 17:00

combine artifacts into one main page with separate tabs

3c9bdbf

Merge remote-tracking branch 'upstream/main' into task/regroup-artifacts

f02eb23

move old pages into one artifacts navigation link

79684b6

Merge remote-tracking branch 'upstream/main' into task/regroup-artifacts

f3c8e89

add artifacts light and dark icon

dfd7e80

adjust artifact page to fit design

a4f4999

remove unnecessary files

28ab571

remove unnecessary file, add breadcrumbs

f4a1501

add unit tests

04423b0

hide timeline for artifacts tabs

12b2b05

parkiino added ci:cloud-deploy Create or update a Cloud deployment release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v9.4.0 labels Mar 20, 2026

parkiino marked this pull request as ready for review March 20, 2026 18:03

parkiino requested review from a team as code owners March 20, 2026 18:03

parkiino requested review from ashokaditya and paul-tavares March 20, 2026 18:03

parkiino removed the request for review from ashokaditya March 20, 2026 18:06

parkiino added 2 commits March 20, 2026 14:06

Merge remote-tracking branch 'upstream/main' into task/regroup-artifacts

26d69d3

remove docs folder

c8ee881

parkiino requested review from gergoabraham and szwarckonrad and removed request for paul-tavares March 20, 2026 18:08

parkiino added the backport:skip This PR does not require backporting label Mar 20, 2026

kibanamachine and others added 2 commits March 20, 2026 18:36

Changes from node scripts/eslint_all_files --no-cache --fix

13fbc0e

Merge remote-tracking branch 'upstream/main' into task/regroup-artifacts

1ecf551

denar50 approved these changes Apr 1, 2026

View reviewed changes

parkiino added 5 commits April 1, 2026 20:51

fix flashing assets side menu on artifacts page in serverless

45f49e7

restore missing back button

bbb081d

Merge remote-tracking branch 'upstream/main' into task/regroup-artifacts

6d1f36a

Merge branch 'task/regroup-artifacts' of github.com:parkiino/kibana i…

f702ad2

…nto task/regroup-artifacts

Merge remote-tracking branch 'upstream/main' into task/regroup-artifacts

540b50b

gergoabraham reviewed Apr 2, 2026

View reviewed changes

make experimental features a direct parameter

aa6bf12

macroscopeapp Bot reviewed Apr 2, 2026

View reviewed changes

Comment thread x-pack/solutions/security/plugins/security_solution/public/management/links.ts

kibanamachine and others added 4 commits April 2, 2026 17:02

Changes from node scripts/eslint_all_files --no-cache --fix

1007f2d

make canReadAnyArtifact more robust with experimental features check

466bfee

Merge remote-tracking branch 'upstream/main' into task/regroup-artifacts

7369be9

Merge branch 'task/regroup-artifacts' of github.com:parkiino/kibana i…

854005e

…nto task/regroup-artifacts

parkiino requested review from PhilippeOberti, gergoabraham and szwarckonrad April 2, 2026 20:46

Changes from node scripts/eslint_all_files --no-cache --fix

3ee83e2

szwarckonrad approved these changes Apr 2, 2026

View reviewed changes

parkiino added 5 commits April 3, 2026 17:45

incorporate konrads pr reviews

04d004e

Merge branch 'task/regroup-artifacts' of github.com:parkiino/kibana i…

1ca780c

…nto task/regroup-artifacts

Merge remote-tracking branch 'upstream/main' into task/regroup-artifacts

3b87f3c

adjust test mock

b29ddd9

Merge remote-tracking branch 'upstream/main' into task/regroup-artifacts

1dfd650

kqualters-elastic reviewed Apr 6, 2026

View reviewed changes

PhilippeOberti approved these changes Apr 6, 2026

View reviewed changes

parkiino merged commit 9d02ae2 into elastic:main Apr 6, 2026
18 checks passed

szwarckonrad mentioned this pull request Apr 7, 2026

[EDR Workflows] Fix artifact FTR tests broken by artifacts regrouping #261845

Merged

Conversation

parkiino commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Screenshots

Uh oh!

elasticmachine commented Mar 20, 2026

Uh oh!

denar50 left a comment

Choose a reason for hiding this comment

Uh oh!

gergoabraham left a comment

Choose a reason for hiding this comment

Uh oh!

gergoabraham Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

gergoabraham Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

gergoabraham Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

parkiino commented Apr 2, 2026

Uh oh!

Uh oh!

szwarckonrad left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Module Count

Async chunks

Page load bundle

async chunk count

History

Uh oh!

kqualters-elastic Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

PhilippeOberti Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

PhilippeOberti left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

parkiino commented Mar 10, 2026 •

edited

Loading

elasticmachine commented Apr 6, 2026 •

edited

Loading