Skip to content

[AI4DSOC] Add checkboxes to the alert summary table#219169

Merged
PhilippeOberti merged 4 commits intoelastic:mainfrom
PhilippeOberti:alert-summary-table-checkboxes
Apr 25, 2025
Merged

[AI4DSOC] Add checkboxes to the alert summary table#219169
PhilippeOberti merged 4 commits intoelastic:mainfrom
PhilippeOberti:alert-summary-table-checkboxes

Conversation

@PhilippeOberti
Copy link
Copy Markdown
Contributor

@PhilippeOberti PhilippeOberti commented Apr 24, 2025

Summary

This PR adds bulk actions to the Alert summary table:

  • apply alert tags
  • add to new case
  • add to existing case

Apply alert tags

Screen.Recording.2025-04-24.at.3.50.50.PM.mov

Add to new case

Screen.Recording.2025-04-24.at.3.49.16.PM.mov

Add to existing case

Screen.Recording.2025-04-24.at.3.49.48.PM.mov

Changes were performed to the Attack discovery and cases pages as well!

Screen.Recording.2025-04-24.at.7.26.12.PM.mov
Screen.Recording.2025-04-24.at.7.26.28.PM.mov

Notes

A follow up PR will most likely combine the 3 tables into one reusable table, to avoid the code duplication we have now.

Checklist

relates to https://github.com/elastic/security-team/issues/11973

@PhilippeOberti PhilippeOberti added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team Team:Security Generative AI Security Generative AI v9.1.0 labels Apr 24, 2025
@PhilippeOberti PhilippeOberti requested review from a team as code owners April 24, 2025 20:58
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

@elastic-vault-github-plugin-prod elastic-vault-github-plugin-prod bot requested a review from a team as a code owner April 24, 2025 21:08
@PhilippeOberti PhilippeOberti force-pushed the alert-summary-table-checkboxes branch from bb27a26 to 4340c47 Compare April 24, 2025 21:19
@PhilippeOberti PhilippeOberti removed the request for review from a team April 24, 2025 21:19
@PhilippeOberti PhilippeOberti enabled auto-merge (squash) April 24, 2025 23:39
@PhilippeOberti PhilippeOberti requested review from a team as code owners April 25, 2025 00:27
Copy link
Copy Markdown
Contributor

@andrew-goldstein andrew-goldstein left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the add @PhilippeOberti!
✅ Desk tested locally
LGTM 🚀

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Apr 25, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 7339 7340 +1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 9.1MB 9.1MB +939.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
securitySolution 91.0KB 91.0KB -1.0B

History

Copy link
Copy Markdown
Contributor

@agusruidiazgd agusruidiazgd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - tested locally ✅ Thanks!

@PhilippeOberti PhilippeOberti merged commit ee44e35 into elastic:main Apr 25, 2025
9 checks passed
@PhilippeOberti PhilippeOberti deleted the alert-summary-table-checkboxes branch April 25, 2025 11:54
peluja1012 pushed a commit to peluja1012/kibana that referenced this pull request Apr 25, 2025
## Summary

This PR adds bulk actions to the Alert summary table:
- apply alert tags
- add to new case
- add to existing case

Apply alert tags


https://github.com/user-attachments/assets/e27d40b0-f60e-498b-8845-a5d014117398

Add to new case


https://github.com/user-attachments/assets/9d714948-6123-4e24-ae25-fe504b836aed

Add to existing case


https://github.com/user-attachments/assets/ec51c3e6-3bb9-45e5-a66a-812f67873e98

### TODO

- [x] not mandatory for this PR (as the conference is next week) but I'm
trying to figure the best and simplest way to refresh the table after
performing bulk actions (done in second
[commit](elastic@f71ac3c)!!)

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

relates to elastic/security-team#11973
akowalska622 pushed a commit to akowalska622/kibana that referenced this pull request May 29, 2025
## Summary

This PR adds bulk actions to the Alert summary table:
- apply alert tags
- add to new case
- add to existing case

Apply alert tags


https://github.com/user-attachments/assets/e27d40b0-f60e-498b-8845-a5d014117398

Add to new case


https://github.com/user-attachments/assets/9d714948-6123-4e24-ae25-fe504b836aed

Add to existing case


https://github.com/user-attachments/assets/ec51c3e6-3bb9-45e5-a66a-812f67873e98

### TODO

- [x] not mandatory for this PR (as the conference is next week) but I'm
trying to figure the best and simplest way to refresh the table after
performing bulk actions (done in second
[commit](elastic@f71ac3c)!!)

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

relates to elastic/security-team#11973
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
## Summary

This PR adds bulk actions to the Alert summary table:
- apply alert tags
- add to new case
- add to existing case

Apply alert tags

https://github.com/user-attachments/assets/e27d40b0-f60e-498b-8845-a5d014117398

Add to new case

https://github.com/user-attachments/assets/9d714948-6123-4e24-ae25-fe504b836aed

Add to existing case

https://github.com/user-attachments/assets/ec51c3e6-3bb9-45e5-a66a-812f67873e98

### TODO

- [x] not mandatory for this PR (as the conference is next week) but I'm
trying to figure the best and simplest way to refresh the table after
performing bulk actions (done in second
[commit](elastic@f71ac3c)!!)

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

relates to elastic/security-team#11973

(cherry picked from commit ee44e35)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request May 30, 2025
## Summary

This PR adds bulk actions to the Alert summary table:
- apply alert tags
- add to new case
- add to existing case

Apply alert tags

https://github.com/user-attachments/assets/e27d40b0-f60e-498b-8845-a5d014117398

Add to new case

https://github.com/user-attachments/assets/9d714948-6123-4e24-ae25-fe504b836aed

Add to existing case

https://github.com/user-attachments/assets/ec51c3e6-3bb9-45e5-a66a-812f67873e98

### TODO

- [x] not mandatory for this PR (as the conference is next week) but I'm
trying to figure the best and simplest way to refresh the table after
performing bulk actions (done in second
[commit](elastic@f71ac3c)!!)

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

relates to elastic/security-team#11973

(cherry picked from commit ee44e35)
PhilippeOberti added a commit to PhilippeOberti/kibana that referenced this pull request Jun 4, 2025
## Summary

This PR adds bulk actions to the Alert summary table:
- apply alert tags
- add to new case
- add to existing case

Apply alert tags

https://github.com/user-attachments/assets/e27d40b0-f60e-498b-8845-a5d014117398

Add to new case

https://github.com/user-attachments/assets/9d714948-6123-4e24-ae25-fe504b836aed

Add to existing case

https://github.com/user-attachments/assets/ec51c3e6-3bb9-45e5-a66a-812f67873e98

### TODO

- [x] not mandatory for this PR (as the conference is next week) but I'm
trying to figure the best and simplest way to refresh the table after
performing bulk actions (done in second
[commit](elastic@f71ac3c)!!)

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

relates to elastic/security-team#11973

(cherry picked from commit ee44e35)
PhilippeOberti added a commit that referenced this pull request Jun 4, 2025
…) (#222074)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[AI4DSOC] Alert summary page routing and initialization
(#214889)](#214889)
- [[AI4DSOC] Alert summary landing page
(#215246)](#215246)
- [[AI4DSOC] Alert summary dataview
(#215265)](#215265)
- [[AI4DSOC] Alert summary KQL bar
[#215586]](#215586)
- [[AI4DSOC] Alert summary KPI charts
[#215585]](#215585)
- [[AI4DSOR] Alert summary integrations section
[#215266]](#215266)
- [[AI4DSOC] Fix issue with filtering by integrations
[#216574]](#216574)
- [[AI4DSOC] Alert summary table setup
[#216744]](#216744)
- [Alerty summary table flyout setup
[#217421]](#217421)
- [[AI4DSOC] Alert summary alert actions in table and flyout
[#217696]](#217696)
- [[AI4DSOC] Alert summary table custom cell renderers
[#217124]](#217124)
- [[AI4DSOC] Alert summary table and flyout ai assistant
[#217744]](#217744)
- [[AI4DSOC] Alert summary page performance improvements
[#218632]](#218632)
- [[AI4DSOC] Change the Attack Discovery page to use the AI for SOC
alerts table [#218736]](#218736)
- [[AI4DSOC] Change the Cases page to use the AI for SOC alerts table
[#218742]](#218742)
- [[AI4DSOC] Fix spacing issue on alert summary landing page integration
card [#218868]](#218868)
- [[AI4DSOC][ResponseOps] Fix alerts table not handling undefined
maintenanceWindow capability
[#218999]](#218999)
- [[AI4DSOC] Fix link to the new integrations page
[#219030]](#219030)
- [[AI4DSOC] Disable CellActions and PreviewLinks on the Attack
discovery page [#219033]](#219033)
- [[AI4DSOC] Add cell renderer for datetime fields to the alert summary
table [#219126]](#219126)
- [[AI4DSOC] Remove Assistant icon from row action in alert summary
table [#219141]](#219141)
- [[AI4DSOC] Add checkboxes to the alert summary table
[#219169]](#219169)
- [[Security Solution][AI4DSOC] Fix table not applying alert tags for
Attack discovery and Cases pages in AI4DSOC
[#219410]](#219410)
- [[AI4DSOC] Fix logic that renders the group title when grouping by
integrations [#219430]](#219430)
- [[AI4DSOC] Alert summary table truncates long values and display the
field/value pair in tooltip
[#219438]](#219438)
- [[Security Solution] Fix alerts table potentially not applying alert
assignees [#219460]](#219460)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team:Security Generative AI Security Generative AI Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team v8.19.0 v9.1.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants