Skip to content

[AI4DSOC] Change the Attack Discovery page to use the AI for SOC alerts table#218736

Merged
PhilippeOberti merged 1 commit intoelastic:mainfrom
PhilippeOberti:attack-discovery-ai-for-soc-table
Apr 21, 2025
Merged

[AI4DSOC] Change the Attack Discovery page to use the AI for SOC alerts table#218736
PhilippeOberti merged 1 commit intoelastic:mainfrom
PhilippeOberti:attack-discovery-ai-for-soc-table

Conversation

@PhilippeOberti
Copy link
Copy Markdown
Contributor

@PhilippeOberti PhilippeOberti commented Apr 21, 2025 •
edited
Loading

Summary

While testing, we realized that the Attack Discovery alerts tab was showing the DetectionEngineAlertsTable, even in the AI4DSOC tier. This PR updates the logic to show the correct alerts table depending on the tier:

  • AI4DSOC will show the same table as the Alert summary page
  • the other tiers will continue showing the same table as the Alerts page (DetectionEngineAlertsTable)

Switching the table allows us to tackle at once all the other related issues:

  • wrong flyout was being shown
  • too many row actions were being shown
  • wrong default columns, and wrong cell renderers

Notes

The approach is not ideal. We shouldn't have to check for the following

const AIForSOC = capabilities[SECURITY_FEATURE_ID].configurations;

in the code, but because of time constraints, this was the best approach.
A ticket has been opened to make sure we come back to this and implement the check the correct way later.

Current (wrong) behavior

Screen.Recording.2025-04-21.at.10.46.54.AM.mov

New behavior

Screen.Recording.2025-04-21.at.10.45.48.AM.mov

How to test

This needs to be ran in Serverless:

  • yarn es serverless --projectType security
  • yarn serverless-security --no-base-path

You also need to enable the AI for SOC tier, by adding the following to your serverless.security.dev.yaml file:

xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]

Checklist

Relates to https://github.com/elastic/security-team/issues/11973

@PhilippeOberti PhilippeOberti added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team Team:Security Generative AI Security Generative AI v9.1.0 labels Apr 21, 2025
@PhilippeOberti PhilippeOberti requested review from a team as code owners April 21, 2025 16:40
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Apr 21, 2025

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

christineweng
christineweng approved these changes Apr 21, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@christineweng christineweng left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Investigations changes LGTM

andrew-goldstein
andrew-goldstein approved these changes Apr 21, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@andrew-goldstein andrew-goldstein left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @PhilippeOberti for this update to use the AI for SOC alerts table! 🙏
✅ Desk tested locally
LGTM 🚀

@PhilippeOberti PhilippeOberti enabled auto-merge (squash) April 21, 2025 18:06
@PhilippeOberti PhilippeOberti merged commit c8cbe87 into elastic:main Apr 21, 2025
20 checks passed
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Apr 21, 2025

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 7265 7267 +2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 9.0MB 9.0MB +2.3KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
securitySolution 89.4KB 89.4KB +1.0B

@PhilippeOberti PhilippeOberti deleted the attack-discovery-ai-for-soc-table branch April 21, 2025 23:41
pgayvallet pushed a commit to pgayvallet/kibana that referenced this pull request Apr 22, 2025
@PhilippeOberti @pgayvallet
[AI4DSOC] Change the Attack Discovery page to use the AI for SOC aler…
de05495 
…ts table (elastic#218736)

## Summary

While testing, we realized that the Attack Discovery alerts tab was
showingn the `DetectionEngineAlertsTable`, even in the AI4DSOC tier.
This PR updates the logic to show the correct alerts table depending on
the tier:
- AI4DSOC will show the same table as the Alert summary page
- the other tiers will continue showing the same table as the Alerts
page (`DetectionEngineAlertsTable`)

Switching the table allows us to tackle at once all the other related
issues:
- wrong flyout was being shown
- too many actions were being shown
- wrong default columns, and wrong cell renderes

### Notes

The approach is not ideal. We shouldn't have to check for the following
```typescript
const AIForSOC = capabilities[SECURITY_FEATURE_ID].configurations;
```
in the code, but because of time constraints, this was the best
approach.
[A ticket](elastic#218731) has been
opened to make sure we come back to this and implement the check the
correct way later.

Current (wrong) behavior


https://github.com/user-attachments/assets/c41a25f1-ae9a-4bbf-9c02-9b1054f3a0e3

New behavior


https://github.com/user-attachments/assets/0eb20a2f-ba00-42c0-9353-7ac788c9bea0

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Relates to elastic/security-team#11973
@PhilippeOberti PhilippeOberti mentioned this pull request Apr 25, 2025
Closed
1 task
akowalska622 pushed a commit to akowalska622/kibana that referenced this pull request May 29, 2025
@PhilippeOberti @akowalska622
[AI4DSOC] Change the Attack Discovery page to use the AI for SOC aler…
faa84c3 
…ts table (elastic#218736)

## Summary

While testing, we realized that the Attack Discovery alerts tab was
showingn the `DetectionEngineAlertsTable`, even in the AI4DSOC tier.
This PR updates the logic to show the correct alerts table depending on
the tier:
- AI4DSOC will show the same table as the Alert summary page
- the other tiers will continue showing the same table as the Alerts
page (`DetectionEngineAlertsTable`)

Switching the table allows us to tackle at once all the other related
issues:
- wrong flyout was being shown
- too many actions were being shown
- wrong default columns, and wrong cell renderes

### Notes

The approach is not ideal. We shouldn't have to check for the following
```typescript
const AIForSOC = capabilities[SECURITY_FEATURE_ID].configurations;
```
in the code, but because of time constraints, this was the best
approach.
[A ticket](elastic#218731) has been
opened to make sure we come back to this and implement the check the
correct way later.

Current (wrong) behavior


https://github.com/user-attachments/assets/c41a25f1-ae9a-4bbf-9c02-9b1054f3a0e3

New behavior


https://github.com/user-attachments/assets/0eb20a2f-ba00-42c0-9353-7ac788c9bea0

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Relates to elastic/security-team#11973
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
@PhilippeOberti
[AI4DSOC] Change the Attack Discovery page to use the AI for SOC aler…
27502c6 
…ts table (elastic#218736)

## Summary

While testing, we realized that the Attack Discovery alerts tab was
showingn the `DetectionEngineAlertsTable`, even in the AI4DSOC tier.
This PR updates the logic to show the correct alerts table depending on
the tier:
- AI4DSOC will show the same table as the Alert summary page
- the other tiers will continue showing the same table as the Alerts
page (`DetectionEngineAlertsTable`)

Switching the table allows us to tackle at once all the other related
issues:
- wrong flyout was being shown
- too many actions were being shown
- wrong default columns, and wrong cell renderes

### Notes

The approach is not ideal. We shouldn't have to check for the following
```typescript
const AIForSOC = capabilities[SECURITY_FEATURE_ID].configurations;
```
in the code, but because of time constraints, this was the best
approach.
[A ticket](elastic#218731) has been
opened to make sure we come back to this and implement the check the
correct way later.

Current (wrong) behavior

https://github.com/user-attachments/assets/c41a25f1-ae9a-4bbf-9c02-9b1054f3a0e3

New behavior

https://github.com/user-attachments/assets/0eb20a2f-ba00-42c0-9353-7ac788c9bea0

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Relates to elastic/security-team#11973

(cherry picked from commit c8cbe87)
@PhilippeOberti PhilippeOberti mentioned this pull request May 30, 2025
Merged
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
@PhilippeOberti
[AI4DSOC] Change the Attack Discovery page to use the AI for SOC aler…
319f318 
…ts table (elastic#218736)

## Summary

While testing, we realized that the Attack Discovery alerts tab was
showingn the `DetectionEngineAlertsTable`, even in the AI4DSOC tier.
This PR updates the logic to show the correct alerts table depending on
the tier:
- AI4DSOC will show the same table as the Alert summary page
- the other tiers will continue showing the same table as the Alerts
page (`DetectionEngineAlertsTable`)

Switching the table allows us to tackle at once all the other related
issues:
- wrong flyout was being shown
- too many actions were being shown
- wrong default columns, and wrong cell renderes

### Notes

The approach is not ideal. We shouldn't have to check for the following
```typescript
const AIForSOC = capabilities[SECURITY_FEATURE_ID].configurations;
```
in the code, but because of time constraints, this was the best
approach.
[A ticket](elastic#218731) has been
opened to make sure we come back to this and implement the check the
correct way later.

Current (wrong) behavior

https://github.com/user-attachments/assets/c41a25f1-ae9a-4bbf-9c02-9b1054f3a0e3

New behavior

https://github.com/user-attachments/assets/0eb20a2f-ba00-42c0-9353-7ac788c9bea0

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Relates to elastic/security-team#11973

(cherry picked from commit c8cbe87)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request Jun 4, 2025
@PhilippeOberti
[AI4DSOC] Change the Attack Discovery page to use the AI for SOC aler…
20cb27d 
…ts table (elastic#218736)

## Summary

While testing, we realized that the Attack Discovery alerts tab was
showingn the `DetectionEngineAlertsTable`, even in the AI4DSOC tier.
This PR updates the logic to show the correct alerts table depending on
the tier:
- AI4DSOC will show the same table as the Alert summary page
- the other tiers will continue showing the same table as the Alerts
page (`DetectionEngineAlertsTable`)

Switching the table allows us to tackle at once all the other related
issues:
- wrong flyout was being shown
- too many actions were being shown
- wrong default columns, and wrong cell renderes

### Notes

The approach is not ideal. We shouldn't have to check for the following
```typescript
const AIForSOC = capabilities[SECURITY_FEATURE_ID].configurations;
```
in the code, but because of time constraints, this was the best
approach.
[A ticket](elastic#218731) has been
opened to make sure we come back to this and implement the check the
correct way later.

Current (wrong) behavior

https://github.com/user-attachments/assets/c41a25f1-ae9a-4bbf-9c02-9b1054f3a0e3

New behavior

https://github.com/user-attachments/assets/0eb20a2f-ba00-42c0-9353-7ac788c9bea0

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Relates to elastic/security-team#11973

(cherry picked from commit c8cbe87)
PhilippeOberti added a commit that referenced this pull request Jun 4, 2025
@PhilippeOberti @kibanamachine @elasticmachine
[8.19] [AI4DSOC] Backport of AI4DSOC alert summary related PRs (#214889…
87d17ac 
…) (#222074)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[AI4DSOC] Alert summary page routing and initialization
(#214889)](#214889)
- [[AI4DSOC] Alert summary landing page
(#215246)](#215246)
- [[AI4DSOC] Alert summary dataview
(#215265)](#215265)
- [[AI4DSOC] Alert summary KQL bar
[#215586]](#215586)
- [[AI4DSOC] Alert summary KPI charts
[#215585]](#215585)
- [[AI4DSOR] Alert summary integrations section
[#215266]](#215266)
- [[AI4DSOC] Fix issue with filtering by integrations
[#216574]](#216574)
- [[AI4DSOC] Alert summary table setup
[#216744]](#216744)
- [Alerty summary table flyout setup
[#217421]](#217421)
- [[AI4DSOC] Alert summary alert actions in table and flyout
[#217696]](#217696)
- [[AI4DSOC] Alert summary table custom cell renderers
[#217124]](#217124)
- [[AI4DSOC] Alert summary table and flyout ai assistant
[#217744]](#217744)
- [[AI4DSOC] Alert summary page performance improvements
[#218632]](#218632)
- [[AI4DSOC] Change the Attack Discovery page to use the AI for SOC
alerts table [#218736]](#218736)
- [[AI4DSOC] Change the Cases page to use the AI for SOC alerts table
[#218742]](#218742)
- [[AI4DSOC] Fix spacing issue on alert summary landing page integration
card [#218868]](#218868)
- [[AI4DSOC][ResponseOps] Fix alerts table not handling undefined
maintenanceWindow capability
[#218999]](#218999)
- [[AI4DSOC] Fix link to the new integrations page
[#219030]](#219030)
- [[AI4DSOC] Disable CellActions and PreviewLinks on the Attack
discovery page [#219033]](#219033)
- [[AI4DSOC] Add cell renderer for datetime fields to the alert summary
table [#219126]](#219126)
- [[AI4DSOC] Remove Assistant icon from row action in alert summary
table [#219141]](#219141)
- [[AI4DSOC] Add checkboxes to the alert summary table
[#219169]](#219169)
- [[Security Solution][AI4DSOC] Fix table not applying alert tags for
Attack discovery and Cases pages in AI4DSOC
[#219410]](#219410)
- [[AI4DSOC] Fix logic that renders the group title when grouping by
integrations [#219430]](#219430)
- [[AI4DSOC] Alert summary table truncates long values and display the
field/value pair in tooltip
[#219438]](#219438)
- [[Security Solution] Fix alerts table potentially not applying alert
assignees [#219460]](#219460)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andrew-goldstein andrew-goldstein andrew-goldstein approved these changes

@christineweng christineweng christineweng approved these changes

Assignees

No one assigned

Labels

backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team:Security Generative AI Security Generative AI Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team v8.19.0 v9.1.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@PhilippeOberti @elasticmachine @andrew-goldstein @christineweng