[Cases][AttachmentV2] Migrate Lens to unified registry by christineweng · Pull Request #261407 · elastic/kibana

christineweng · 2026-04-06T19:26:35Z

Summary

This PR is part 1 of migrating persistable state attachment type to V2 architecture. Lens is migrated, and other persistable state attachments (such as single metric viewer, more in this ticket) should continue to behave with the feature flag off.

Feature flag: xpack.cases.attachments.enabled: true (restart kibana after turning the flag on/off)

How to test:

Lens attachment can be added via dashboards. In Security, go to Dashboard, Overview, click more action to add the lens chart to a case

Lens added before the change should continue to show
Feature flag off: Lens attachment can be added and saved to cases-comments SO
Feature flag on: Lens attachment can be added and saved to cases-attachments SO

Note: turning off the feature flag will exclude attachments from the attachments SO, attachments added with flag on and disappearing when the flag is off is expected

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

elasticmachine · 2026-04-06T19:26:45Z

Pinging @elastic/kibana-cases (Team:Cases)

janmonschke · 2026-04-09T06:25:26Z

+    data: {
+      state: { attributes, timeRange, metadata },
+    },
+  } as unknown as UnifiedValueAttachmentWithoutOwner);


Do you think there is a way we can fix this type cast?

The lens data contains LensSavedObjectAttributes (from @kbn/lens-plugin/public) which is a deeply nested type with specific Lens-domain properties -- these are structurally incompatible with JsonValue even though they serialize to JSON just fine at runtime.

Since { state: { attributes: LensSavedObjectAttributes, ... } } is not assignable to Record<string, JsonValue>, TypeScript requires the unknown intermediary. There is no way to avoid this without changing either the Lens types or the UnifiedValueAttachmentPayload type definition.

janmonschke · 2026-04-09T07:51:37Z

I wonder if we need to update getCommentContent as well now or if an empty string is good enough for lens attachments.

kibana/x-pack/platform/plugins/shared/cases/server/client/cases/utils.ts

Lines 93 to 114 in b9f9ec0

    
           const getCommentContent = (comment: AttachmentV2): string => { 
        
             if (isLegacyAttachmentRequest(comment)) { 
        
               if (comment.type === AttachmentType.user) { 
        
                 return comment.comment; 
        
               } else if (comment.type === AttachmentType.alert) { 
        
                 const ids = getAlertIds(comment); 
        
                 return `Alert with ids ${ids.join(', ')} added to case`; 
        
               } else if ( 
        
                 comment.type === AttachmentType.actions && 
        
                 (comment.actions.type === 'isolate' || comment.actions.type === 'unisolate') 
        
               ) { 
        
                 const firstHostname = 
        
                   comment.actions.targets?.length > 0 ? comment.actions.targets[0].hostname : 'unknown'; 
        
                 const totalHosts = comment.actions.targets.length; 
        
                 const actionText = comment.actions.type === 'isolate' ? 'Isolated' : 'Released'; 
        
                 const additionalHostsText = totalHosts - 1 > 0 ? `and ${totalHosts - 1} more ` : ``; 
        
                 return `${actionText} host ${firstHostname} ${additionalHostsText}with comment: ${comment.comment}`; 
        
               } 
        
             } 
        
             return '';

janmonschke · 2026-04-09T08:01:08Z

+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null;


You can use isPlainObject from lodash instead of this helper.

isPlainObject alone is not enough because it's not a type guard, but I've updated the helper to use isPlainObject instead

janmonschke · 2026-04-09T08:07:01Z

+   * Internal unified types are registered in
+   * x-pack/platform/plugins/shared/cases/server/internal_attachments/index.ts
+   */
+  describe('Unified attachment types', () => {


What do you think about adding a full roundtrip for the new attachment types in an API test as well? E.g. with flag on, create a new attachment and read it back, same with flag off.

wdyt if i do it in a separate PR and covers this, comment and event?

christineweng · 2026-04-09T21:35:53Z

I wonder if we need to update getCommentContent as well now or if an empty string is good enough for lens attachments.

persistable state / lens was filtered out before this function is called

kibana/x-pack/platform/plugins/shared/cases/server/client/cases/utils.ts

Lines 270 to 281 in 87ac14f

    
           const commentsToBeUpdated = theCase.comments?.filter( 
        
             (comment) => 
        
               // We push only user's comments 
        
               (comment.type === AttachmentType.user || comment.type === AttachmentType.actions) && 
        
               commentsIdsToBeUpdated.has(comment.id) 
        
           ); 
        
           let comments: ExternalServiceComment[] = []; 
        
           if (commentsToBeUpdated && Array.isArray(commentsToBeUpdated) && commentsToBeUpdated.length > 0) { 
        
             comments = addKibanaInformationToComments(commentsToBeUpdated, userProfiles); 
        
           }

janmonschke · 2026-04-10T08:04:48Z

persistable state / lens was filtered out before this function is called

Could you add a comment to getCommentContent that explains that we do not need to handle lens here since they're filtered out before?

PhilippeOberti

LGTM for the @elastic/security-threat-hunting-investigations team

elasticmachine · 2026-04-13T18:40:21Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 92c8046

Failed CI Steps

Test Failures

[job] [logs] Defend Workflows Cypress Tests #9 / Workflow Insights (AB path) should trigger a scan with selected connector should trigger a scan with selected connector
[job] [logs] Defend Workflows Cypress Tests #9 / Workflow Insights (AB path) should trigger a scan with selected connector should trigger a scan with selected connector

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`cases`	1992	1991	-1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`cases`	2.0MB	2.0MB	-52.0B
`exploratoryView`	138.8KB	138.7KB	-86.0B
`securitySolution`	11.7MB	11.7MB	-172.0B
total			-310.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`cases`	167.9KB	167.9KB	+56.0B

History

cc @christineweng

## Summary This PR is part 1 of migrating persistable state attachment type to V2 architecture. Lens is migrated, and other persistable state attachments (such as single metric viewer, more in [this ticket](elastic/security-team#15569 (comment))) should continue to behave with the feature flag off. Feature flag: `xpack.cases.attachments.enabled: true` (restart kibana after turning the flag on/off) How to test: - Lens attachment can be added via dashboards. In Security, go to Dashboard, Overview, click more action to add the lens chart to a case <img width="1011" height="325" alt="image" src="https://github.com/user-attachments/assets/fe566665-bab8-42b6-97e3-6340a90addbe" /> - Lens added before the change should continue to show - Feature flag off: Lens attachment can be added and saved to `cases-comments` SO - Feature flag on: Lens attachment can be added and saved to `cases-attachments` SO Note: turning off the feature flag will exclude attachments from the attachments SO, attachments added with flag on and disappearing when the flag is off is expected ### Checklist - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [ ] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels.

… charts (#262597) ## Summary Dependecy: #261407 to be merged first This PR migrates the remaining persistable state attachments to the unified attachment registry. Case attachment type constants are moved to cases plugin, and a naming conversion is added to keep type names follow the same convention. Feature flag: xpack.cases.attachments.enabled: true (restart kibana after turning the flag on/off) ### Key changes per plugin: Cases: - Removed persistable state registry in user actions, updated related tests - Added schema validator on the client side Machine learning: - Updated persistable state registry to unified registry, updated the shape to match the new schema - Removed locally defined constants related to cases AiOps: - Updated persistable state registry to unified registry, updated the shape to match the new schema - Removed locally defined constants related to cases ### How to test: Check and confirm the charts can be added and viewed in a case with the feature flag off/on. Note that turning the flag on then off will hide any attachments added when the flag is on, this is expected. ### Checklist - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels.

christineweng self-assigned this Apr 6, 2026

christineweng requested review from a team as code owners April 6, 2026 19:26

christineweng added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Cases Security Solution Cases team v9.4.0 labels Apr 6, 2026

christineweng changed the title ~~[Cases][Attachment] Migrate Lens to unified registry~~ [Cases][AttachmentV2] Migrate Lens to unified registry Apr 6, 2026

macroscopeapp Bot reviewed Apr 6, 2026

View reviewed changes

Comment thread x-pack/platform/plugins/shared/cases/server/common/attachments/persistable_state.ts Outdated

Comment thread x-pack/platform/plugins/shared/cases/server/common/attachments/persistable_state.ts Outdated

christineweng added v9.5.0 and removed v9.4.0 labels Apr 7, 2026

christineweng force-pushed the cases-migrate-persistable-1 branch from ef1545b to acca786 Compare April 7, 2026 19:43

janmonschke reviewed Apr 9, 2026

View reviewed changes

Comment thread x-pack/platform/plugins/shared/cases/common/constants/attachments.ts Outdated

janmonschke reviewed Apr 9, 2026

View reviewed changes

Comment thread x-pack/platform/plugins/shared/cases/public/components/attachments/lens/index.tsx Outdated

janmonschke reviewed Apr 9, 2026

View reviewed changes

Comment thread x-pack/platform/plugins/shared/cases/server/internal_attachments/index.ts

janmonschke reviewed Apr 9, 2026

View reviewed changes

christineweng force-pushed the cases-migrate-persistable-1 branch from acca786 to 35a1211 Compare April 9, 2026 21:50

macroscopeapp Bot reviewed Apr 9, 2026

View reviewed changes

Comment thread x-pack/platform/plugins/shared/cases/public/components/attachments/lens/index.tsx

christineweng added 4 commits April 10, 2026 10:02

WIP

3baff87

fix tests and refactor utils

cb04253

comments

c41dffb

fix merge conflict and add comment

842d0f6

christineweng force-pushed the cases-migrate-persistable-1 branch from 35a1211 to 842d0f6 Compare April 10, 2026 16:06

christineweng mentioned this pull request Apr 10, 2026

[Cases][AttachmentV2] Migrate persistable state part 2 - ML and AIOps charts #262597

Merged

8 tasks

fix ftr

c0ee3dc

janmonschke approved these changes Apr 10, 2026

View reviewed changes

baileycash-elastic approved these changes Apr 10, 2026

View reviewed changes

Merge branch 'main' into cases-migrate-persistable-1

73c50f0

PhilippeOberti approved these changes Apr 13, 2026

View reviewed changes

Merge branch 'main' into cases-migrate-persistable-1

92c8046

christineweng enabled auto-merge (squash) April 13, 2026 17:39

christineweng merged commit 358b711 into elastic:main Apr 13, 2026
19 checks passed

		const isRecord = (value: unknown): value is Record<string, unknown> =>
		typeof value === 'object' && value !== null;

Conversation

christineweng commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

elasticmachine commented Apr 6, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

janmonschke Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

christineweng Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

janmonschke commented Apr 9, 2026

Uh oh!

janmonschke Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

christineweng Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

janmonschke Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

christineweng Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

christineweng commented Apr 9, 2026

Uh oh!

Uh oh!

janmonschke commented Apr 10, 2026

Uh oh!

PhilippeOberti left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Async chunks

Page load bundle

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

christineweng commented Apr 6, 2026 •

edited

Loading

elasticmachine commented Apr 13, 2026 •

edited

Loading