Skip to content

[AI4DSOC] Alert summary landing page#215246

Merged
PhilippeOberti merged 3 commits intoelastic:mainfrom
PhilippeOberti:alerty-summary-landing-page
Mar 21, 2025
Merged

[AI4DSOC] Alert summary landing page#215246
PhilippeOberti merged 3 commits intoelastic:mainfrom
PhilippeOberti:alerty-summary-landing-page

Conversation

@PhilippeOberti
Copy link
Copy Markdown
Contributor

@PhilippeOberti PhilippeOberti commented Mar 19, 2025

Summary

This PR continues the work done in #214889 and implements the landing page for the new alert summary page. This landing page should only be visible by users if none of the AI for SOC integrations have been installed (more info in the previous PR).

The landing page consist of 2 main sections:

  • the top section with a title and an image
  • the bottom section where we list the top 2 AI for SOC integrations - Splunk and GoogleSecOps - which are clickable and will redirect the users to the respective integration detail pages, as well as a View all integrations button which will redirect the users to the integrations page.

Screenshot 2025-03-19 at 3 37 46 PM

Screen.Recording.2025-03-19.at.3.38.28.PM.mov

Link to mocks: https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=4408-128249&t=GaxMP8OEZ9Qsjl0R-0

Notes

  • The current image is only temporary and acts as a placeholder while the UIUX team is creating a gif or video (no ETA on when it will be available).
  • The integration links are subject to change in the future, but that work is handled by a different team and as not being completed yet

How to test

This needs to be ran in Serverless:

  • yarn es serverless --projectType security
  • yarn serverless-security --no-base-path

You also need to enable the AI for SOC tier, by adding the following to your serverless.security.dev.yaml file:

xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]

Use one of these Serverless users:

  • platform_engineer
  • endpoint_operations_analyst
  • endpoint_policy_manager
  • admin
  • system_indices_superuser

Checklist

Contributes to https://github.com/elastic/security-team/issues/11979

@PhilippeOberti PhilippeOberti added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team Team:Security Generative AI Security Generative AI v9.1.0 labels Mar 19, 2025
@PhilippeOberti PhilippeOberti requested review from a team as code owners March 19, 2025 20:55
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

@botelastic botelastic bot added the Team:Fleet Team label for Observability Data Collection Fleet team label Mar 19, 2025
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/fleet (Team:Fleet)

@PhilippeOberti PhilippeOberti force-pushed the alerty-summary-landing-page branch from 7bd6051 to 830a4b6 Compare March 19, 2025 21:02
@PhilippeOberti PhilippeOberti force-pushed the alerty-summary-landing-page branch from 830a4b6 to 44b1326 Compare March 20, 2025 19:37
@PhilippeOberti PhilippeOberti requested a review from a team as a code owner March 20, 2025 19:37
@PhilippeOberti PhilippeOberti force-pushed the alerty-summary-landing-page branch 2 times, most recently from caf9885 to c3df2b9 Compare March 20, 2025 20:47
Copy link
Copy Markdown
Member

@nchaulet nchaulet left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fleet changes LGTM 🚀

@PhilippeOberti PhilippeOberti force-pushed the alerty-summary-landing-page branch from c3df2b9 to b6f26dd Compare March 21, 2025 03:49
@PhilippeOberti PhilippeOberti force-pushed the alerty-summary-landing-page branch from b6f26dd to dd2ab55 Compare March 21, 2025 14:44
@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 7093 7095 +2

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id before after diff
fleet 1353 1356 +3

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 8.9MB 8.9MB +2.4KB

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id before after diff
fleet 88 90 +2

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
fleet 159.8KB 160.0KB +137.0B
securitySolution 88.3KB 88.3KB +2.0B
total +139.0B
Unknown metric groups

API count

id before after diff
fleet 1481 1484 +3

miscellaneous assets size

id before after diff
securitySolution 7.7MB 7.8MB +99.1KB

History

@PhilippeOberti PhilippeOberti merged commit 11a512e into elastic:main Mar 21, 2025
9 checks passed
@PhilippeOberti PhilippeOberti deleted the alerty-summary-landing-page branch March 21, 2025 16:42
JoseLuisGJ pushed a commit to JoseLuisGJ/kibana that referenced this pull request Mar 24, 2025
## Summary

This PR continues the work done in
elastic#214889 and implements the landing
page for the new alert summary page. This landing page should only be
visible by users if none of the AI for SOC integrations have been
installed (more info in [the previous
PR](elastic#214889)).

The landing page consist of 2 main sections:
- the top section with a title and an image
- the bottom section where we list the top 2 AI for SOC integrations -
Splunk and GoogleSecOps - which are clickable and will redirect the
users to the respective integration detail pages, as well as a `View all
integrations` button which will redirect the users to the integrations
page.

![Screenshot 2025-03-19 at 3 37
46 PM](https://github.com/user-attachments/assets/311bb9b9-1bd3-4c7a-bcb9-f929d459aa70)


https://github.com/user-attachments/assets/0d15a65d-7f2e-4e2d-9919-896f5532f08c

Link to mocks:
https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=4408-128249&t=GaxMP8OEZ9Qsjl0R-0

### Notes

- The current image is only temporary and acts as a placeholder while
the UIUX team is creating a gif or video (no ETA on when it will be
available).
- The integration links are subject to change in the future, but that
work is handled by a different team and as not being completed yet

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Contributes to elastic/security-team#11979
cqliu1 pushed a commit to cqliu1/kibana that referenced this pull request Mar 31, 2025
## Summary

This PR continues the work done in
elastic#214889 and implements the landing
page for the new alert summary page. This landing page should only be
visible by users if none of the AI for SOC integrations have been
installed (more info in [the previous
PR](elastic#214889)).

The landing page consist of 2 main sections:
- the top section with a title and an image
- the bottom section where we list the top 2 AI for SOC integrations -
Splunk and GoogleSecOps - which are clickable and will redirect the
users to the respective integration detail pages, as well as a `View all
integrations` button which will redirect the users to the integrations
page.

![Screenshot 2025-03-19 at 3 37
46 PM](https://github.com/user-attachments/assets/311bb9b9-1bd3-4c7a-bcb9-f929d459aa70)


https://github.com/user-attachments/assets/0d15a65d-7f2e-4e2d-9919-896f5532f08c

Link to mocks:
https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=4408-128249&t=GaxMP8OEZ9Qsjl0R-0

### Notes

- The current image is only temporary and acts as a placeholder while
the UIUX team is creating a gif or video (no ETA on when it will be
available).
- The integration links are subject to change in the future, but that
work is handled by a different team and as not being completed yet

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Contributes to elastic/security-team#11979
PhilippeOberti added a commit that referenced this pull request Apr 22, 2025
… card (#218868)

## Summary

This PR a small UI issue with the AI4DSOC alert summary landing page.
Originally added via [this
PR](#215246), some of that logic
was changed in [this more recent
PR](#218632), where the
`IntegrationIcon` logic was extracted into a reusable component,
packages with a `EuiSkeletonText` component, which somehow breaks the
`inlineMargingEnd` value applied to the icon...

This PR fixes the spacing issue now seen on the integration card.

| Before | After |
| ------------- | ------------- |
| ![Screenshot 2025-04-22 at 12 42
54 PM](https://github.com/user-attachments/assets/402af5e9-69ef-46db-9d53-faf8d617a307)
| ![Screenshot 2025-04-22 at 12 38
19 PM](https://github.com/user-attachments/assets/3c290f46-8c79-424c-b478-e55736917429)
|
PhilippeOberti added a commit that referenced this pull request Apr 24, 2025
## Summary

This PR fixes the links to the integrations page, introduced in [this
PR](#215246) and [that
one](#215266). At the time of the
previous PRs, the new AI4DSOC integration page had not been created, so
we were using the link to the normal integrations page. [This recent
PR](#217905) added the new page,
so we need to update those links

From the landing page


https://github.com/user-attachments/assets/907c12be-84dc-4bbd-a161-c8b16e2ecdba

From the alert summary page


https://github.com/user-attachments/assets/c25be7b3-f7ef-4e5f-8948-40def6a8d026

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

Then:
- generate data: `yarn test:generate:serverless-dev`
- create 4 catch all rules, each with a name of a AI for SOC integration
(`google_secops`, `microsoft_sentinel`,, `sentinel_one` and
`crowdstrike`)
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73)
to `installedPackages: availablePackages` to force having some packages
installed
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63)
to `r.name === p.name` to make sure there will be matches between
integrations and rules

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Relates to elastic/security-team#11955
akowalska622 pushed a commit to akowalska622/kibana that referenced this pull request May 29, 2025
… card (elastic#218868)

## Summary

This PR a small UI issue with the AI4DSOC alert summary landing page.
Originally added via [this
PR](elastic#215246), some of that logic
was changed in [this more recent
PR](elastic#218632), where the
`IntegrationIcon` logic was extracted into a reusable component,
packages with a `EuiSkeletonText` component, which somehow breaks the
`inlineMargingEnd` value applied to the icon...

This PR fixes the spacing issue now seen on the integration card.

| Before | After |
| ------------- | ------------- |
| ![Screenshot 2025-04-22 at 12 42
54 PM](https://github.com/user-attachments/assets/402af5e9-69ef-46db-9d53-faf8d617a307)
| ![Screenshot 2025-04-22 at 12 38
19 PM](https://github.com/user-attachments/assets/3c290f46-8c79-424c-b478-e55736917429)
|
akowalska622 pushed a commit to akowalska622/kibana that referenced this pull request May 29, 2025
## Summary

This PR fixes the links to the integrations page, introduced in [this
PR](elastic#215246) and [that
one](elastic#215266). At the time of the
previous PRs, the new AI4DSOC integration page had not been created, so
we were using the link to the normal integrations page. [This recent
PR](elastic#217905) added the new page,
so we need to update those links

From the landing page


https://github.com/user-attachments/assets/907c12be-84dc-4bbd-a161-c8b16e2ecdba

From the alert summary page


https://github.com/user-attachments/assets/c25be7b3-f7ef-4e5f-8948-40def6a8d026

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

Then:
- generate data: `yarn test:generate:serverless-dev`
- create 4 catch all rules, each with a name of a AI for SOC integration
(`google_secops`, `microsoft_sentinel`,, `sentinel_one` and
`crowdstrike`)
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73)
to `installedPackages: availablePackages` to force having some packages
installed
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63)
to `r.name === p.name` to make sure there will be matches between
integrations and rules

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Relates to elastic/security-team#11955
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
## Summary

This PR continues the work done in
elastic#214889 and implements the landing
page for the new alert summary page. This landing page should only be
visible by users if none of the AI for SOC integrations have been
installed (more info in [the previous
PR](elastic#214889)).

The landing page consist of 2 main sections:
- the top section with a title and an image
- the bottom section where we list the top 2 AI for SOC integrations -
Splunk and GoogleSecOps - which are clickable and will redirect the
users to the respective integration detail pages, as well as a `View all
integrations` button which will redirect the users to the integrations
page.

![Screenshot 2025-03-19 at 3 37
46 PM](https://github.com/user-attachments/assets/311bb9b9-1bd3-4c7a-bcb9-f929d459aa70)

https://github.com/user-attachments/assets/0d15a65d-7f2e-4e2d-9919-896f5532f08c

Link to mocks:
https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=4408-128249&t=GaxMP8OEZ9Qsjl0R-0

### Notes

- The current image is only temporary and acts as a placeholder while
the UIUX team is creating a gif or video (no ETA on when it will be
available).
- The integration links are subject to change in the future, but that
work is handled by a different team and as not being completed yet

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Contributes to elastic/security-team#11979

(cherry picked from commit 11a512e)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
… card (elastic#218868)

## Summary

This PR a small UI issue with the AI4DSOC alert summary landing page.
Originally added via [this
PR](elastic#215246), some of that logic
was changed in [this more recent
PR](elastic#218632), where the
`IntegrationIcon` logic was extracted into a reusable component,
packages with a `EuiSkeletonText` component, which somehow breaks the
`inlineMargingEnd` value applied to the icon...

This PR fixes the spacing issue now seen on the integration card.

| Before | After |
| ------------- | ------------- |
| ![Screenshot 2025-04-22 at 12 42
54 PM](https://github.com/user-attachments/assets/402af5e9-69ef-46db-9d53-faf8d617a307)
| ![Screenshot 2025-04-22 at 12 38
19 PM](https://github.com/user-attachments/assets/3c290f46-8c79-424c-b478-e55736917429)
|

(cherry picked from commit 0a4268c)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
## Summary

This PR fixes the links to the integrations page, introduced in [this
PR](elastic#215246) and [that
one](elastic#215266). At the time of the
previous PRs, the new AI4DSOC integration page had not been created, so
we were using the link to the normal integrations page. [This recent
PR](elastic#217905) added the new page,
so we need to update those links

From the landing page

https://github.com/user-attachments/assets/907c12be-84dc-4bbd-a161-c8b16e2ecdba

From the alert summary page

https://github.com/user-attachments/assets/c25be7b3-f7ef-4e5f-8948-40def6a8d026

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

Then:
- generate data: `yarn test:generate:serverless-dev`
- create 4 catch all rules, each with a name of a AI for SOC integration
(`google_secops`, `microsoft_sentinel`,, `sentinel_one` and
`crowdstrike`)
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73)
to `installedPackages: availablePackages` to force having some packages
installed
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63)
to `r.name === p.name` to make sure there will be matches between
integrations and rules

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Relates to elastic/security-team#11955

(cherry picked from commit 10cfa31)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
## Summary

This PR continues the work done in
elastic#214889 and implements the landing
page for the new alert summary page. This landing page should only be
visible by users if none of the AI for SOC integrations have been
installed (more info in [the previous
PR](elastic#214889)).

The landing page consist of 2 main sections:
- the top section with a title and an image
- the bottom section where we list the top 2 AI for SOC integrations -
Splunk and GoogleSecOps - which are clickable and will redirect the
users to the respective integration detail pages, as well as a `View all
integrations` button which will redirect the users to the integrations
page.

![Screenshot 2025-03-19 at 3 37
46 PM](https://github.com/user-attachments/assets/311bb9b9-1bd3-4c7a-bcb9-f929d459aa70)

https://github.com/user-attachments/assets/0d15a65d-7f2e-4e2d-9919-896f5532f08c

Link to mocks:
https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=4408-128249&t=GaxMP8OEZ9Qsjl0R-0

### Notes

- The current image is only temporary and acts as a placeholder while
the UIUX team is creating a gif or video (no ETA on when it will be
available).
- The integration links are subject to change in the future, but that
work is handled by a different team and as not being completed yet

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Contributes to elastic/security-team#11979

(cherry picked from commit 11a512e)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
… card (elastic#218868)

## Summary

This PR a small UI issue with the AI4DSOC alert summary landing page.
Originally added via [this
PR](elastic#215246), some of that logic
was changed in [this more recent
PR](elastic#218632), where the
`IntegrationIcon` logic was extracted into a reusable component,
packages with a `EuiSkeletonText` component, which somehow breaks the
`inlineMargingEnd` value applied to the icon...

This PR fixes the spacing issue now seen on the integration card.

| Before | After |
| ------------- | ------------- |
| ![Screenshot 2025-04-22 at 12 42
54 PM](https://github.com/user-attachments/assets/402af5e9-69ef-46db-9d53-faf8d617a307)
| ![Screenshot 2025-04-22 at 12 38
19 PM](https://github.com/user-attachments/assets/3c290f46-8c79-424c-b478-e55736917429)
|

(cherry picked from commit 0a4268c)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
## Summary

This PR fixes the links to the integrations page, introduced in [this
PR](elastic#215246) and [that
one](elastic#215266). At the time of the
previous PRs, the new AI4DSOC integration page had not been created, so
we were using the link to the normal integrations page. [This recent
PR](elastic#217905) added the new page,
so we need to update those links

From the landing page

https://github.com/user-attachments/assets/907c12be-84dc-4bbd-a161-c8b16e2ecdba

From the alert summary page

https://github.com/user-attachments/assets/c25be7b3-f7ef-4e5f-8948-40def6a8d026

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

Then:
- generate data: `yarn test:generate:serverless-dev`
- create 4 catch all rules, each with a name of a AI for SOC integration
(`google_secops`, `microsoft_sentinel`,, `sentinel_one` and
`crowdstrike`)
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73)
to `installedPackages: availablePackages` to force having some packages
installed
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63)
to `r.name === p.name` to make sure there will be matches between
integrations and rules

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Relates to elastic/security-team#11955

(cherry picked from commit 10cfa31)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request Jun 4, 2025
## Summary

This PR continues the work done in
elastic#214889 and implements the landing
page for the new alert summary page. This landing page should only be
visible by users if none of the AI for SOC integrations have been
installed (more info in [the previous
PR](elastic#214889)).

The landing page consist of 2 main sections:
- the top section with a title and an image
- the bottom section where we list the top 2 AI for SOC integrations -
Splunk and GoogleSecOps - which are clickable and will redirect the
users to the respective integration detail pages, as well as a `View all
integrations` button which will redirect the users to the integrations
page.

![Screenshot 2025-03-19 at 3 37
46 PM](https://github.com/user-attachments/assets/311bb9b9-1bd3-4c7a-bcb9-f929d459aa70)

https://github.com/user-attachments/assets/0d15a65d-7f2e-4e2d-9919-896f5532f08c

Link to mocks:
https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=4408-128249&t=GaxMP8OEZ9Qsjl0R-0

### Notes

- The current image is only temporary and acts as a placeholder while
the UIUX team is creating a gif or video (no ETA on when it will be
available).
- The integration links are subject to change in the future, but that
work is handled by a different team and as not being completed yet

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Contributes to elastic/security-team#11979

(cherry picked from commit 11a512e)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request Jun 4, 2025
… card (elastic#218868)

## Summary

This PR a small UI issue with the AI4DSOC alert summary landing page.
Originally added via [this
PR](elastic#215246), some of that logic
was changed in [this more recent
PR](elastic#218632), where the
`IntegrationIcon` logic was extracted into a reusable component,
packages with a `EuiSkeletonText` component, which somehow breaks the
`inlineMargingEnd` value applied to the icon...

This PR fixes the spacing issue now seen on the integration card.

| Before | After |
| ------------- | ------------- |
| ![Screenshot 2025-04-22 at 12 42
54 PM](https://github.com/user-attachments/assets/402af5e9-69ef-46db-9d53-faf8d617a307)
| ![Screenshot 2025-04-22 at 12 38
19 PM](https://github.com/user-attachments/assets/3c290f46-8c79-424c-b478-e55736917429)
|

(cherry picked from commit 0a4268c)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request Jun 4, 2025
## Summary

This PR fixes the links to the integrations page, introduced in [this
PR](elastic#215246) and [that
one](elastic#215266). At the time of the
previous PRs, the new AI4DSOC integration page had not been created, so
we were using the link to the normal integrations page. [This recent
PR](elastic#217905) added the new page,
so we need to update those links

From the landing page

https://github.com/user-attachments/assets/907c12be-84dc-4bbd-a161-c8b16e2ecdba

From the alert summary page

https://github.com/user-attachments/assets/c25be7b3-f7ef-4e5f-8948-40def6a8d026

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

Then:
- generate data: `yarn test:generate:serverless-dev`
- create 4 catch all rules, each with a name of a AI for SOC integration
(`google_secops`, `microsoft_sentinel`,, `sentinel_one` and
`crowdstrike`)
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73)
to `installedPackages: availablePackages` to force having some packages
installed
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63)
to `r.name === p.name` to make sure there will be matches between
integrations and rules

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Relates to elastic/security-team#11955

(cherry picked from commit 10cfa31)
PhilippeOberti added a commit that referenced this pull request Jun 4, 2025
…) (#222074)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[AI4DSOC] Alert summary page routing and initialization
(#214889)](#214889)
- [[AI4DSOC] Alert summary landing page
(#215246)](#215246)
- [[AI4DSOC] Alert summary dataview
(#215265)](#215265)
- [[AI4DSOC] Alert summary KQL bar
[#215586]](#215586)
- [[AI4DSOC] Alert summary KPI charts
[#215585]](#215585)
- [[AI4DSOR] Alert summary integrations section
[#215266]](#215266)
- [[AI4DSOC] Fix issue with filtering by integrations
[#216574]](#216574)
- [[AI4DSOC] Alert summary table setup
[#216744]](#216744)
- [Alerty summary table flyout setup
[#217421]](#217421)
- [[AI4DSOC] Alert summary alert actions in table and flyout
[#217696]](#217696)
- [[AI4DSOC] Alert summary table custom cell renderers
[#217124]](#217124)
- [[AI4DSOC] Alert summary table and flyout ai assistant
[#217744]](#217744)
- [[AI4DSOC] Alert summary page performance improvements
[#218632]](#218632)
- [[AI4DSOC] Change the Attack Discovery page to use the AI for SOC
alerts table [#218736]](#218736)
- [[AI4DSOC] Change the Cases page to use the AI for SOC alerts table
[#218742]](#218742)
- [[AI4DSOC] Fix spacing issue on alert summary landing page integration
card [#218868]](#218868)
- [[AI4DSOC][ResponseOps] Fix alerts table not handling undefined
maintenanceWindow capability
[#218999]](#218999)
- [[AI4DSOC] Fix link to the new integrations page
[#219030]](#219030)
- [[AI4DSOC] Disable CellActions and PreviewLinks on the Attack
discovery page [#219033]](#219033)
- [[AI4DSOC] Add cell renderer for datetime fields to the alert summary
table [#219126]](#219126)
- [[AI4DSOC] Remove Assistant icon from row action in alert summary
table [#219141]](#219141)
- [[AI4DSOC] Add checkboxes to the alert summary table
[#219169]](#219169)
- [[Security Solution][AI4DSOC] Fix table not applying alert tags for
Attack discovery and Cases pages in AI4DSOC
[#219410]](#219410)
- [[AI4DSOC] Fix logic that renders the group title when grouping by
integrations [#219430]](#219430)
- [[AI4DSOC] Alert summary table truncates long values and display the
field/value pair in tooltip
[#219438]](#219438)
- [[Security Solution] Fix alerts table potentially not applying alert
assignees [#219460]](#219460)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team:Fleet Team label for Observability Data Collection Fleet team Team:Security Generative AI Security Generative AI Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team v8.19.0 v9.1.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants