[8.19] [AI4DSOC] [Attack discovery] Enable the Attack discovery alerts and Attack discovery scheduling feature flags by default (#228327)#228677
Merged
delanni merged 1 commit intoelastic:8.19from Jul 21, 2025
Conversation
…ttack discovery scheduling feature flags by default (elastic#228327) ## [AI4DSOC] [Attack discovery] Enable the _Attack discovery alerts_ and _Attack discovery scheduling_ feature flags by default This PR programmatically enables (by default) the [Attack discovery alerts](elastic#218906) and [Attack discovery scheduling](elastic#217917) feature flags. Together, these features enable: - Persistence of Attack discoveries as alerts - Scheduling Attack discoveries, with support for actions, and cases integration - Open | Acknowledged | Closed workflow statuses for Attack discoveries - A new UI for searching and sharing previously created Attack discoveries This PR enables the feature flags by default, as illustrated by the following screenshot:  _Above: Attack discovery alerts and scheduling are enabled by default_ When the feature flags are manually _disabled_, the Attack discovery page looks like the following screenshot:  _Above: The feature flags are manually disabled in the screenshot above_ ### Desk testing 1) **Remove** any old feature flag entries that may be present in `config/kibana.dev.yml`, like the following example: ```yaml feature_flags.overrides: securitySolution.attackDiscoveryAlertsEnabled: false securitySolution.assistantAttackDiscoverySchedulingEnabled: false ``` 2) Start a local development instance of Kibana 3) Navigate to Security > Attack discovery **Expected result** - The call to action buttons at the top of the page include the `Run` and `Schedule` buttons, as illustrated by the following animated gif:  - The layout of page is similar to the following screenshot:  4) Disable the feature flags by adding the following entries to `config/kibana.dev.yml`: ```yaml feature_flags.overrides: securitySolution.attackDiscoveryAlertsEnabled: false securitySolution.assistantAttackDiscoverySchedulingEnabled: false ``` 5) Once again, navigate to Security > Attack discovery **Expected results** - The call to action button at the top of the page is `Generate` - The `Schedule` call to action button does NOT appear - The layout of the page is similar to the following screenshot:  (cherry picked from commit 90ed7a1)
Contributor
|
/ci |
1 similar comment
Contributor
|
/ci |
Contributor
|
@elasticmachine merge upstream |
Contributor
|
There are no new commits on the base branch. |
Contributor
|
/ci |
Contributor
|
@elasticmachine merge upstream |
Contributor
|
There are no new commits on the base branch. |
Contributor
|
/ci |
Contributor
|
This backport was admin merged, per the details in https://elastic.slack.com/archives/C5UDAFZQU/p1753103271596779 |
Contributor
💔 Build Failed
Failed CI StepsTest Failures
The CI Stats report is too large to be displayed here, check out the CI build annotation for this information. History
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport
This will backport the following commits from
mainto8.19:Questions ?
Please refer to the Backport tool documentation