Skip to content

[9.4] [Entity Analytics] Auditing usages of documentEntityIdentifiers in user/host flyout (#265887)#266439

Merged
ymao1 merged 1 commit intoelastic:9.4from
ymao1:backport/9.4/pr-265887
Apr 29, 2026
Merged

[9.4] [Entity Analytics] Auditing usages of documentEntityIdentifiers in user/host flyout (#265887)#266439
ymao1 merged 1 commit intoelastic:9.4from
ymao1:backport/9.4/pr-265887

Conversation

@ymao1
Copy link
Copy Markdown
Contributor

@ymao1 ymao1 commented Apr 29, 2026

Backport

This will backport the following commits from main to 9.4:

Questions ?

Please refer to the Backport tool documentation

…user/host flyout (elastic#265887)

## Summary

This PR addresses 2 items:
* Updates the click behavior in the User Risk and Host Risk tabs on the
User/Host Explore pages to open in a flyout instead of redirecting to
the details page. This tab was missed in the first PR:
elastic#265132.
* Audits usages of `documentEntityIdentifiers` in the User and Host
right flyouts. These identifiers are generated [here
(user)](https://github.com/elastic/kibana/blob/1b2ff3f8bb198c259a5155f1bf486f6e4e084078/x-pack/solutions/security/plugins/security_solution/public/flyout/entity_details/user_right/index.tsx#L112)
and [here
(host)](https://github.com/elastic/kibana/blob/1b2ff3f8bb198c259a5155f1bf486f6e4e084078/x-pack/solutions/security/plugins/security_solution/public/flyout/entity_details/host_right/index.tsx#L110)
and used throughout the flyouts in the EUID
`getEuidFilterBasedOnDocument` helper function, however, the document
identifiers for user are incorrect as they return an `entity.namespace`
field that exists in the entity store but does not exist in any source
log/alert document. This PR replaces the input to
`getEuidFilterBasedOnDocument` from the `documentEntityIdentifiers` to
the full entity store record to ensure that a correct EUID filter is
generated for queries against source documents.

**User Risk/Host Risk tab click behavior**

https://github.com/user-attachments/assets/39049641-91b5-457e-a859-4bf2783aae48

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 812ff1b)

# Conflicts:
#	x-pack/solutions/security/plugins/security_solution/public/cloud_security_posture/components/misconfiguration/misconfiguration_preview.tsx
@ymao1 ymao1 requested a review from kibanamachine as a code owner April 29, 2026 15:38
@ymao1 ymao1 added the backport This PR is a backport of another PR label Apr 29, 2026
@ymao1 ymao1 enabled auto-merge (squash) April 29, 2026 15:38
@kibanamachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 12.0MB 12.0MB +1.1KB

@ymao1 ymao1 merged commit dfd36b8 into elastic:9.4 Apr 29, 2026
28 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants