Skip to content

[AI4DSOC] Fix link to the new integrations page#219030

Merged
PhilippeOberti merged 1 commit intoelastic:mainfrom
PhilippeOberti:fix-link-integration-page
Apr 24, 2025
Merged

[AI4DSOC] Fix link to the new integrations page#219030
PhilippeOberti merged 1 commit intoelastic:mainfrom
PhilippeOberti:fix-link-integration-page

Conversation

@PhilippeOberti
Copy link
Copy Markdown
Contributor

@PhilippeOberti PhilippeOberti commented Apr 24, 2025

Summary

This PR fixes the links to the integrations page, introduced in this PR and that one. At the time of the previous PRs, the new AI4DSOC integration page had not been created, so we were using the link to the normal integrations page. This recent PR added the new page, so we need to update those links

From the landing page

Screen.Recording.2025-04-23.at.6.11.52.PM.mov

From the alert summary page

Screen.Recording.2025-04-23.at.9.13.25.PM.mov

How to test

This needs to be ran in Serverless:

  • yarn es serverless --projectType security
  • yarn serverless-security --no-base-path

You also need to enable the AI for SOC tier, by adding the following to your serverless.security.dev.yaml file:

xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]

Use one of these Serverless users:

  • platform_engineer
  • endpoint_operations_analyst
  • endpoint_policy_manager
  • admin
  • system_indices_superuser

Then:

  • generate data: yarn test:generate:serverless-dev
  • create 4 catch all rules, each with a name of a AI for SOC integration (google_secops, microsoft_sentinel,, sentinel_one and crowdstrike)
  • change this line to installedPackages: availablePackages to force having some packages installed
  • change this line to r.name === p.name to make sure there will be matches between integrations and rules

Checklist

Relates to https://github.com/elastic/security-team/issues/11955

@PhilippeOberti PhilippeOberti added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team Team:Security Generative AI Security Generative AI v9.1.0 labels Apr 24, 2025
@PhilippeOberti PhilippeOberti requested review from a team as code owners April 24, 2025 02:19
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

@PhilippeOberti PhilippeOberti force-pushed the fix-link-integration-page branch from d5271bb to e7acca7 Compare April 24, 2025 04:19
@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 7332 7333 +1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 9.1MB 9.1MB +541.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
securitySolution 89.8KB 89.8KB -1.0B

History

@PhilippeOberti PhilippeOberti merged commit 10cfa31 into elastic:main Apr 24, 2025
9 checks passed
@PhilippeOberti PhilippeOberti deleted the fix-link-integration-page branch April 24, 2025 13:14
akowalska622 pushed a commit to akowalska622/kibana that referenced this pull request May 29, 2025
## Summary

This PR fixes the links to the integrations page, introduced in [this
PR](elastic#215246) and [that
one](elastic#215266). At the time of the
previous PRs, the new AI4DSOC integration page had not been created, so
we were using the link to the normal integrations page. [This recent
PR](elastic#217905) added the new page,
so we need to update those links

From the landing page


https://github.com/user-attachments/assets/907c12be-84dc-4bbd-a161-c8b16e2ecdba

From the alert summary page


https://github.com/user-attachments/assets/c25be7b3-f7ef-4e5f-8948-40def6a8d026

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

Then:
- generate data: `yarn test:generate:serverless-dev`
- create 4 catch all rules, each with a name of a AI for SOC integration
(`google_secops`, `microsoft_sentinel`,, `sentinel_one` and
`crowdstrike`)
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73)
to `installedPackages: availablePackages` to force having some packages
installed
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63)
to `r.name === p.name` to make sure there will be matches between
integrations and rules

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Relates to elastic/security-team#11955
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
## Summary

This PR fixes the links to the integrations page, introduced in [this
PR](elastic#215246) and [that
one](elastic#215266). At the time of the
previous PRs, the new AI4DSOC integration page had not been created, so
we were using the link to the normal integrations page. [This recent
PR](elastic#217905) added the new page,
so we need to update those links

From the landing page

https://github.com/user-attachments/assets/907c12be-84dc-4bbd-a161-c8b16e2ecdba

From the alert summary page

https://github.com/user-attachments/assets/c25be7b3-f7ef-4e5f-8948-40def6a8d026

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

Then:
- generate data: `yarn test:generate:serverless-dev`
- create 4 catch all rules, each with a name of a AI for SOC integration
(`google_secops`, `microsoft_sentinel`,, `sentinel_one` and
`crowdstrike`)
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73)
to `installedPackages: availablePackages` to force having some packages
installed
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63)
to `r.name === p.name` to make sure there will be matches between
integrations and rules

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Relates to elastic/security-team#11955

(cherry picked from commit 10cfa31)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
## Summary

This PR fixes the links to the integrations page, introduced in [this
PR](elastic#215246) and [that
one](elastic#215266). At the time of the
previous PRs, the new AI4DSOC integration page had not been created, so
we were using the link to the normal integrations page. [This recent
PR](elastic#217905) added the new page,
so we need to update those links

From the landing page

https://github.com/user-attachments/assets/907c12be-84dc-4bbd-a161-c8b16e2ecdba

From the alert summary page

https://github.com/user-attachments/assets/c25be7b3-f7ef-4e5f-8948-40def6a8d026

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

Then:
- generate data: `yarn test:generate:serverless-dev`
- create 4 catch all rules, each with a name of a AI for SOC integration
(`google_secops`, `microsoft_sentinel`,, `sentinel_one` and
`crowdstrike`)
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73)
to `installedPackages: availablePackages` to force having some packages
installed
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63)
to `r.name === p.name` to make sure there will be matches between
integrations and rules

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Relates to elastic/security-team#11955

(cherry picked from commit 10cfa31)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request Jun 4, 2025
## Summary

This PR fixes the links to the integrations page, introduced in [this
PR](elastic#215246) and [that
one](elastic#215266). At the time of the
previous PRs, the new AI4DSOC integration page had not been created, so
we were using the link to the normal integrations page. [This recent
PR](elastic#217905) added the new page,
so we need to update those links

From the landing page

https://github.com/user-attachments/assets/907c12be-84dc-4bbd-a161-c8b16e2ecdba

From the alert summary page

https://github.com/user-attachments/assets/c25be7b3-f7ef-4e5f-8948-40def6a8d026

## How to test

This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`

You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]
```

Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`

Then:
- generate data: `yarn test:generate:serverless-dev`
- create 4 catch all rules, each with a name of a AI for SOC integration
(`google_secops`, `microsoft_sentinel`,, `sentinel_one` and
`crowdstrike`)
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_fetch_integrations.ts#L73)
to `installedPackages: availablePackages` to force having some packages
installed
- change [this
line](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alert_summary/use_integrations.ts#L63)
to `r.name === p.name` to make sure there will be matches between
integrations and rules

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Relates to elastic/security-team#11955

(cherry picked from commit 10cfa31)
PhilippeOberti added a commit that referenced this pull request Jun 4, 2025
…) (#222074)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[AI4DSOC] Alert summary page routing and initialization
(#214889)](#214889)
- [[AI4DSOC] Alert summary landing page
(#215246)](#215246)
- [[AI4DSOC] Alert summary dataview
(#215265)](#215265)
- [[AI4DSOC] Alert summary KQL bar
[#215586]](#215586)
- [[AI4DSOC] Alert summary KPI charts
[#215585]](#215585)
- [[AI4DSOR] Alert summary integrations section
[#215266]](#215266)
- [[AI4DSOC] Fix issue with filtering by integrations
[#216574]](#216574)
- [[AI4DSOC] Alert summary table setup
[#216744]](#216744)
- [Alerty summary table flyout setup
[#217421]](#217421)
- [[AI4DSOC] Alert summary alert actions in table and flyout
[#217696]](#217696)
- [[AI4DSOC] Alert summary table custom cell renderers
[#217124]](#217124)
- [[AI4DSOC] Alert summary table and flyout ai assistant
[#217744]](#217744)
- [[AI4DSOC] Alert summary page performance improvements
[#218632]](#218632)
- [[AI4DSOC] Change the Attack Discovery page to use the AI for SOC
alerts table [#218736]](#218736)
- [[AI4DSOC] Change the Cases page to use the AI for SOC alerts table
[#218742]](#218742)
- [[AI4DSOC] Fix spacing issue on alert summary landing page integration
card [#218868]](#218868)
- [[AI4DSOC][ResponseOps] Fix alerts table not handling undefined
maintenanceWindow capability
[#218999]](#218999)
- [[AI4DSOC] Fix link to the new integrations page
[#219030]](#219030)
- [[AI4DSOC] Disable CellActions and PreviewLinks on the Attack
discovery page [#219033]](#219033)
- [[AI4DSOC] Add cell renderer for datetime fields to the alert summary
table [#219126]](#219126)
- [[AI4DSOC] Remove Assistant icon from row action in alert summary
table [#219141]](#219141)
- [[AI4DSOC] Add checkboxes to the alert summary table
[#219169]](#219169)
- [[Security Solution][AI4DSOC] Fix table not applying alert tags for
Attack discovery and Cases pages in AI4DSOC
[#219410]](#219410)
- [[AI4DSOC] Fix logic that renders the group title when grouping by
integrations [#219430]](#219430)
- [[AI4DSOC] Alert summary table truncates long values and display the
field/value pair in tooltip
[#219438]](#219438)
- [[Security Solution] Fix alerts table potentially not applying alert
assignees [#219460]](#219460)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team:Security Generative AI Security Generative AI Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team v8.19.0 v9.1.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants