[EDR Workflows] Osquery: hide query code from dropdown and show Elastic for automated Run By#261394
Merged
szwarckonrad merged 1 commit intoApr 7, 2026
Conversation
…y for automated rows
szwarckonrad
added
release_note:skip
Contributor
|
Pinging @elastic/security-defend-workflows (Team:Defend Workflows) |
szwarckonrad
requested review from
tomsonpl
and removed request for
paul-tavares
2 tasks
mbondyra
added a commit
to Heenawter/kibana
that referenced
this pull request
Apr 7, 2026
* commit 'bfc2446fdbcba2b3183f4518817c9757198c95ef': [Cascade] make cascade layout enabled by default (elastic#260698) [Dashboard Agent] Extract safe dashboard attachment integration refactors (elastic#261422) [One Workflow] Replace workflows:aiAgent:enabled with agentBuilder:experimentalFeatures (elastic#261330) [EDR Workflows] Osquery: hide query code from dropdown and show Elastic for automated Run By (elastic#261394) [Observability Onboarding] Add data detection & loading indicators to onboarding flows (elastic#257870) [Significant events] Format event count with locale-aware number separators (elastic#261570) [Fleet] Fix deprecated filter in browse integrations (elastic#261459) [Lens as code] Split `xyStateSchema` config (elastic#261089) [Data Views as Code] Use `ref_id` and add metadata in data views schemas (elastic#261181) Made-with: Cursor # Conflicts: # x-pack/platform/packages/shared/dashboard-agent/dashboard-agent-common/types.ts
mbondyra
added a commit
to mbondyra/kibana
that referenced
this pull request
Apr 7, 2026
…r-uid-to-id * commit '6868ae2f195462f1f6809a6a544114f54e48239e': [One Workflow] Replace workflows:aiAgent:enabled with agentBuilder:experimentalFeatures (elastic#261330) [EDR Workflows] Osquery: hide query code from dropdown and show Elastic for automated Run By (elastic#261394) [Observability Onboarding] Add data detection & loading indicators to onboarding flows (elastic#257870) [Significant events] Format event count with locale-aware number separators (elastic#261570) [Fleet] Fix deprecated filter in browse integrations (elastic#261459) [Lens as code] Split `xyStateSchema` config (elastic#261089) [Data Views as Code] Use `ref_id` and add metadata in data views schemas (elastic#261181)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses two UX feedback items for the osquery history rework (behind
queryHistoryReworkfeature flag):Saved queries dropdown — removes the SQL code block from dropdown options. Only the query ID and description are shown now, reducing visual noise (especially for queries starting with comments). Row height is reduced accordingly.
Run By column in history table — shows "Elastic" instead of an em dash for scheduled rows and rule-triggered rows (live actions with no
user_id). Live queries with a real user continue to show the user's name/avatar.Both changes are gated behind the
queryHistoryReworkfeature flag.