Skip to content

[Automatic Migration] Add ability to skip Reference Set step in QRadar upload workflow#259959

Merged
logeekal merged 8 commits intoelastic:mainfrom
logeekal:feat/skip_reference_set_step
Apr 2, 2026
Merged

[Automatic Migration] Add ability to skip Reference Set step in QRadar upload workflow#259959
logeekal merged 8 commits intoelastic:mainfrom
logeekal:feat/skip_reference_set_step

Conversation

@logeekal
Copy link
Copy Markdown
Contributor

@logeekal logeekal commented Mar 27, 2026

Summary

Adds the ability for users to skip the Reference Set upload step (Step 2) in the QRadar rule migration workflow, allowing them to proceed directly to the Enhancements step (Step 3 - MITRE Mappings) without uploading all reference sets.

Demo

reference_step_skip_demo.mov

Test plan

  • Upload QRadar rules with missing reference sets
  • Verify "Skip" button appears in the Reference Set step header when step is active
  • Click "Skip" and verify Enhancements step becomes active
  • Verify uploading all reference sets still advances to Enhancements step automatically
  • Re-open the flyout and verify reference set step can still be completed
  • Verify Splunk workflow is unaffected

logeekal and others added 4 commits March 26, 2026 16:42
Allows users to continue past the Reference Set upload step (Step 2) without
uploading all reference sets, so they can proceed to MITRE Mappings (Step 3).

- Add optional `onComplete` callback to `MigrationStepProps`
- Replace `onAllReferenceSetCreated` with generic `onComplete` in
  `ReferenceSetDataInput`, decoupling it from step ordering knowledge
- Add "Continue without uploading" button to Reference Set step
- Parent flyout owns step progression via `onStepComplete` callback

Made-with: Cursor
- Add `onComplete` to default test props
- Test skip button renders when step is current
- Test skip button calls `onComplete` on click
- Test skip button does not render when step is not current
- Test content does not render when `onComplete` is not provided

Made-with: Cursor
- Move Skip button into the header row of the Reference Set step
- Rename button label from "Continue" to "Skip"
- Add aria-label for accessibility
- Add integration test for the full QRadar flyout skip flow

Made-with: Cursor
Relocate the Skip button to sit beside the Upload button inside the
LookupsFileUpload shared component, gated behind an optional onSkip
prop so only the QRadar reference-set flow renders it.

Made-with: Cursor
@logeekal logeekal marked this pull request as ready for review April 1, 2026 10:14
@logeekal logeekal requested a review from a team as a code owner April 1, 2026 10:14
@elasticmachine
Copy link
Copy Markdown
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 11.6MB 11.6MB +329.0B

@logeekal logeekal added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Apr 2, 2026
@logeekal logeekal merged commit 4afde99 into elastic:main Apr 2, 2026
21 checks passed
mbondyra added a commit to mbondyra/kibana that referenced this pull request Apr 2, 2026
…heck

* commit 'af66aadafa7470ca8ba3e3edd3793bde81fa4596': (31 commits)
  [Scout] Update test config manifests (elastic#260850)
  [SLO]: register alerts schema embeddable (elastic#256570)
  [Discover][Flyout] Update overview fields table with new prop headerVisibility set to false (elastic#260692)
  [AiButton/Security] Migrate ai-related buttons to use custom styles (elastic#259847)
  [One Workflow] Fix connector step icons falling back to generic plugs in YAML editor (elastic#260785)
  [Agent Builder] Dashboard skill: Guard against editing non-ESQL based panels (elastic#260714)
  Security quality gate Cypress cleanup - Periodic Pipeline (elastic#260820)
  [Search] Deprecate search indices in favour of index management (elastic#260210)
  Upgrade dependency @elastic/charts to v71.4.0 (elastic#260593)
  [Security Solution] [HDQ]: integration-based targeting and descriptor versioning (elastic#258418)
  docs(saved-objects): consolidate docs and document scoped vs system client (elastic#260743)
  Fix observability UIAM config and add CPS observability variant (elastic#260485)
  [Security Solution] Add "matched_indices_count" rule execution metric (elastic#259938)
  [SigEvents] Add callout with working promote action. (elastic#260433)
  [Alerting V2] Episode table actions (elastic#260195)
  [Automatic Migration] Add ability to skip Reference Set step in QRadar upload workflow (elastic#259959)
  [Rules] KQL-to-DSL conversion without data view produces incorrect queries for keyword fields for Metric threshold rule (elastic#260046)
  Update dependency lightningcss to v1.32.0 (main) (elastic#259017)
  Update postcss (main) (elastic#255420)
  Migrate server-side apm.addLabels to OTel dual-write helpers (elastic#259619)
  ...
paulinashakirova pushed a commit to paulinashakirova/kibana that referenced this pull request Apr 2, 2026
…r upload workflow (elastic#259959)

## Summary

- Handles elastic/security-team#16315

Adds the ability for users to skip the Reference Set upload step (Step
2) in the QRadar rule migration workflow, allowing them to proceed
directly to the Enhancements step (Step 3 - MITRE Mappings) without
uploading all reference sets.



### Demo



https://github.com/user-attachments/assets/a4ce3e18-1020-46f5-9e6f-426ad8f4616b



## Test plan

- [ ] Upload QRadar rules with missing reference sets
- [ ] Verify "Skip" button appears in the Reference Set step header when
step is active
- [ ] Click "Skip" and verify Enhancements step becomes active
- [ ] Verify uploading all reference sets still advances to Enhancements
step automatically
- [ ] Re-open the flyout and verify reference set step can still be
completed
- [ ] Verify Splunk workflow is unaffected
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes v9.4.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants