[Security Solution] fix alert flyout threat intelligence section not showing multiple values

PhilippeOberti · PhilippeOberti · commit 77dee7f94eb0 · 2025-12-05T16:01:18.000-06:00
diff --git a/x-pack/solutions/security/plugins/security_solution/public/flyout/document_details/left/components/threat_details_view_enrichment_accordion.tsx b/x-pack/solutions/security/plugins/security_solution/public/flyout/document_details/left/components/threat_details_view_enrichment_accordion.tsx
@@ -11,8 +11,8 @@ import {
   EuiAccordion,
   EuiFlexGroup,
   EuiFlexItem,
-  EuiLink,
   EuiInMemoryTable,
+  EuiLink,
   EuiTitle,
   EuiToolTip,
   useEuiTheme,
@@ -24,8 +24,8 @@ import type { CtiEnrichment } from '../../../../../common/search_strategy';
 import { QUERY_ID } from '../../shared/hooks/use_investigation_enrichment';
 import { InspectButton } from '../../../../common/components/inspect';
 import {
-  getEnrichmentIdentifiers,
   buildThreatDetailsItems,
+  getEnrichmentIdentifiers,
   isInvestigationTimeEnrichment,
 } from '../../shared/utils/threat_intelligence';
 import { EnrichmentButtonContent } from './threat_details_view_enrichment_button_content';
@@ -82,12 +82,19 @@ const columns: Array<EuiBasicTableColumn<ThreatDetailsRow>> = [
     truncateText: false,
     render: (description: ThreatDetailsRow['description']) => {
       const { fieldName, value } = description;
-      const tooltipChild = fieldName.match(REFERENCE) ? (
+      console.log('value', value);
+      const renderedValue = fieldName.match(REFERENCE) ? (
         <EuiLink href={value} target="_blank">
           {value}
         </EuiLink>
       ) : (
-        <span>{value}</span>
+        <EuiFlexGroup direction="column" gutterSize="none">
+          {value.map((val) => (
+            <EuiFlexItem>
+              <span>{val}</span>
+            </EuiFlexItem>
+          ))}
+        </EuiFlexGroup>
       );
       return (
         <EuiToolTip
@@ -100,7 +107,7 @@ const columns: Array<EuiBasicTableColumn<ThreatDetailsRow>> = [
             </EuiFlexGroup>
           }
         >
-          {tooltipChild}
+          {renderedValue}
         </EuiToolTip>
       );
     },
diff --git a/x-pack/solutions/security/plugins/security_solution/public/flyout/document_details/shared/utils/threat_intelligence.tsx b/x-pack/solutions/security/plugins/security_solution/public/flyout/document_details/shared/utils/threat_intelligence.tsx
@@ -18,12 +18,12 @@ import {
 } from '../../../../../common/constants';
 import {
   ENRICHMENT_TYPES,
+  FEED_NAME,
   FIRST_SEEN,
   MATCHED_ATOMIC,
   MATCHED_FIELD,
   MATCHED_ID,
   MATCHED_TYPE,
-  FEED_NAME,
 } from '../../../../../common/cti/constants';
 
 const NESTED_OBJECT_VALUES_NOT_RENDERED = i18n.translate(
@@ -189,10 +189,10 @@ export const buildThreatDetailsItems = (enrichment: CtiEnrichment): ThreatDetail
         ? field.replace(`${DEFAULT_INDICATOR_SOURCE_PATH}`, 'indicator')
         : field;
 
-      let value = getFirstElement(enrichment[field]);
-      if (isObject(value)) {
+      let value = enrichment[field];
+      if (isObject(value) && !Array.isArray(value)) {
         value = NESTED_OBJECT_VALUES_NOT_RENDERED;
       }
 
-      return { title, description: { fieldName: field, value: value as string } };
+      return { title, description: { fieldName: field, value: value as string[] } };
     });
