[Osquery] Remove @kbn/timelines-plugin dependency from osquery plugin by tomsonpl · Pull Request #250055 · elastic/kibana

tomsonpl · 2026-01-22T13:49:14Z

This PR fixes a bug where Add to timelines functionality doesn't work in Osquery. It removes the dependency between Osquery and Timelines plugins. Timelines in Osquery is being used only from the Security Solution context - so we pass down Timelines logic through props. Instead of using it out of Osquery context (since the bug prevented this logic anyway, we were missing proper confiugration in kibana.jsonc file)

- Create local DataProvider and AddToTimelineHandler types in osquery to avoid direct dependency on timelines plugin - Refactor AddToTimelineButton to require addToTimeline callback prop instead of using timelines service directly - Pass addToTimeline handler from security solution context (OsqueryFlyout, ResponseActionsResults) down to osquery components - Remove timelines from osquery's StartPlugins, moon.yml, and tsconfig.json - Re-enable previously broken timelines and cases cypress test

tomsonpl · 2026-01-22T14:13:40Z

/ci

tomsonpl · 2026-01-22T14:20:48Z

/ci

tomsonpl · 2026-01-22T14:31:44Z

/ci

tomsonpl · 2026-01-22T15:20:28Z

/ci

…ry-fix-timeline

tomsonpl · 2026-01-23T07:52:25Z

/ci

tomsonpl · 2026-01-23T13:13:25Z

/ci

tomsonpl · 2026-01-23T14:46:02Z

/ci

tomsonpl · 2026-01-23T17:45:50Z

/ci

elasticmachine · 2026-01-27T09:44:25Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 1624be7

Failed CI Steps

Scout: [ platform / streams_app-stateful ] plugin

Test Failures

[job] [logs] Scout: [ platform / streams_app-stateful ] plugin / stateful - Stream data processing - outdated documents - with up to date documents - should not display warning tip for kql samples datasource
[job] [logs] Scout: [ platform / streams_app-stateful ] plugin / with up to date documents - should not display warning tip for kql samples datasource

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	8688	8689	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`osquery`	1.1MB	1.1MB	+424.0B
`securitySolution`	10.8MB	10.8MB	+764.0B
total			+1.2KB

Unknown metric groups

References to deprecated APIs

id	before	after	diff
`osquery`	45	44	-1

Unreferenced deprecated APIs

id	before	after	diff
`osquery`	45	44	-1

History

💔 Build #385419 failed 18eea29
💔 Build #385246 failed a72aa3a
💔 Build #385018 failed 8b3e0f6
💔 Build #384975 failed bc952eb
💔 Build #384966 failed 307921d
💔 Build #384960 failed d8530ff

cc @tomsonpl

ashokaditya

Did code review only and looks good to me. I've a few questions and suggestions but otherwise good to go.

ashokaditya · 2026-01-28T13:09:50Z

x-pack/platform/plugins/shared/osquery/cypress/e2e/all/cases.cy.ts

    });

-    it('should add result a case and have add to timeline in result', () => {
+    it('should add result a case and not have add to timeline in result', () => {


This test description doesn't make sense. Consider updating it. should add result to a case and not show timeline in result? Also is this test asserting two things?

Thanks, rephrased 👍

ashokaditya · 2026-01-28T13:20:13Z

x-pack/solutions/security/plugins/security_solution/public/common/hooks/use_add_to_timeline.ts

+ * Hook that returns a callback to add data providers to the active timeline.
+ * Shows a success toast notification after adding.
+ */
+export const useAddToTimeline = () => {


Consider adding a return type to this hook.

ashokaditya · 2026-01-28T13:41:02Z

x-pack/platform/plugins/shared/osquery/public/types.ts

+    value: string | string[];
+    operator: ':' | ':*' | 'includes';
+  };
+  and: DataProvider[];


You need to exclude this and from the type assigned to and no? Something like
and: Omit<DataProvider, 'and'>[] unless you want a recursive entry for and?

Good catch! However, the recursive and: DataProvider[] (now OsqueryDataProvider[]) is intentional here.

The original DataProvider type in @kbn/timelines-plugin uses the same recursive structure:

// From timelines plugin export interface DataProvider { // ... and: DataProvider[]; }

Since this local type is meant to be compatible with the timelines plugin's type (so that useAddToTimeline in security_solution can accept it), I've kept the same recursive structure to ensure type compatibility at the boundary where osquery passes providers to security_solution.

In practice, the osquery code always sets and: [] (empty array), so the recursion is never actually used - but keeping the type signature aligned avoids potential type mismatches.

Would that be ok with you?

Just to confirm, I notice the the original Timelines DataProvider['and'] (and also the security solutions copy) also excludes itself from the type.

Oh, you're actually right, I missed it. Fixed with Omit<> :) Thanks! 👍

ashokaditya · 2026-01-28T13:50:22Z

x-pack/platform/plugins/shared/osquery/public/types.ts

+ * This is a local definition to avoid direct dependency on @kbn/timelines-plugin.
+ * The structure is compatible with the timelines plugin's DataProvider type.
+ */
+export interface DataProvider {


Maybe name this something else so devs don't auto-import this type by mistake (via code editors) instead of the timelines one? @deprecated might also help warn devs.

Good point, renamed to OsqueryDataProvider 👍

- Fix test description grammar in cases.cy.ts - Add return type to useAddToTimeline hook - Rename DataProvider → OsqueryDataProvider to avoid import confusion

…ry-fix-timeline

…ern and prevent unnecessary recursion

…ry-fix-timeline

ashokaditya

Thanks for the changes!

tomsonpl · 2026-01-29T14:40:16Z

/ci

## Summary #250055 is removing the dependency `osquery => timelines`, which was forcing the `@kbn/timelines-plugin` to be part of _platform/shared_. The goal of this PR is to relocate the `@kbn/timelines-plugin` to _security/private_ (after the PR above is merged). --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

## Summary elastic#250055 is removing the dependency `osquery => timelines`, which was forcing the `@kbn/timelines-plugin` to be part of _platform/shared_. The goal of this PR is to relocate the `@kbn/timelines-plugin` to _security/private_ (after the PR above is merged). --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 3b61978)

…iew_cps * commit '5f7fec57cb01883038810bd735a0666683b49904': (116 commits) [Security Solution][Attacks/Alerts][Setup and miscellaneous] Advanced setting to control feature visibility (elastic#250157) (elastic#250830) Fix synthtrace `fetch` usage (elastic#250950) [APM] Add Nodes and Edges components and selection logic (elastic#250937) [Docs] Update alerting-settings.md and add serverless value for one parameter (elastic#250842) [Agent Builder] filestore: initial implementation (elastic#250043) [CPS] Support CPS in Vega ESQL (elastic#250693) Adjustments to cascade document esql helpers (elastic#250560) [Security Solutions] Trial Companion - adds ai chat and elastic agent detectors (elastic#250908) [Obs Presentation] Code Scanning Alert Fixes (elastic#250858) [performance] add return and refresh render scenarios to dashboard journeys (elastic#250939) skip failing test suite (elastic#245458) Add Cloud Forwarder onboarding tile to O11y Solution (elastic#250325) [Traces] Remove APM unified trace waterall embeddable registration (elastic#250808) [Discover] [Metrics] Fix: metrics grid titles do not update on order change (elastic#250963) [a11y] Fix Eui modal title annoucment (elastic#250459) [Cloud Security] [Fleet] Add cloud connector access scope for input or package level credential definitions (elastic#250280) [WorkplaceAI] SharePoint Online stack connector (elastic#248737) [Response Ops][Task Manager] Update functions do not handle API key invalidation (elastic#249109) [Osquery] Remove @kbn/timelines-plugin dependency from osquery plugin (elastic#250055) [One Discover][Logs UX] Update OpenTelemetry Semantic Conventions (elastic#250346) ...

…elastic#250055)

## Summary elastic#250055 is removing the dependency `osquery => timelines`, which was forcing the `@kbn/timelines-plugin` to be part of _platform/shared_. The goal of this PR is to relocate the `@kbn/timelines-plugin` to _security/private_ (after the PR above is merged). --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

tomsonpl self-assigned this Jan 22, 2026

Merge branch 'main' into osquery-fix-timeline

307921d

Merge branch 'main' into osquery-fix-timeline

bc952eb

Merge branch 'main' into osquery-fix-timeline

8b3e0f6

tomsonpl added 2 commits January 23, 2026 08:46

Fix tests

f9bf124

Merge remote-tracking branch 'origin/osquery-fix-timeline' into osque…

a72aa3a

…ry-fix-timeline

tomsonpl added release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution Osquery v9.4.0 labels Jan 23, 2026

Merge branch 'main' into osquery-fix-timeline

18eea29

Merge branch 'main' into osquery-fix-timeline

59b6178

Merge branch 'main' into osquery-fix-timeline

8e5dc7a

Merge branch 'main' into osquery-fix-timeline

de26dd6

tomsonpl marked this pull request as ready for review January 26, 2026 12:12

tomsonpl requested review from a team as code owners January 26, 2026 12:12

tomsonpl requested review from ashokaditya, gergoabraham, paul-tavares and szwarckonrad January 26, 2026 12:12

tomsonpl removed request for paul-tavares and szwarckonrad January 26, 2026 12:12

tomsonpl added the backport:skip This PR does not require backporting label Jan 26, 2026

Merge branch 'main' into osquery-fix-timeline

1624be7

gsoldevila mentioned this pull request Jan 27, 2026

Relocate @kbn/timelines-plugin #250597

Merged

ashokaditya approved these changes Jan 28, 2026

View reviewed changes

tomsonpl added 5 commits January 29, 2026 09:58

Address PR review feedback

c97d372

- Fix test description grammar in cases.cy.ts - Add return type to useAddToTimeline hook - Rename DataProvider → OsqueryDataProvider to avoid import confusion

Merge remote-tracking branch 'origin/osquery-fix-timeline' into osque…

e146b2e

…ry-fix-timeline

Merge branch 'main' into osquery-fix-timeline

7307fb2

Use Omit<OsqueryDataProvider, 'and'>[] to match timelines plugin patt…

89de899

…ern and prevent unnecessary recursion

Merge remote-tracking branch 'origin/osquery-fix-timeline' into osque…

5eec391

…ry-fix-timeline

ashokaditya approved these changes Jan 29, 2026

View reviewed changes

Merge branch 'main' into osquery-fix-timeline

988c560

tomsonpl merged commit dbbc994 into elastic:main Jan 29, 2026
16 checks passed

hannahbrooks pushed a commit to hannahbrooks/kibana that referenced this pull request Jan 30, 2026

[Osquery] Remove @kbn/timelines-plugin dependency from osquery plugin (…

4abc936

…elastic#250055)

Conversation

tomsonpl commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tomsonpl commented Jan 22, 2026

Uh oh!

tomsonpl commented Jan 22, 2026

Uh oh!

tomsonpl commented Jan 22, 2026

Uh oh!

tomsonpl commented Jan 22, 2026

Uh oh!

tomsonpl commented Jan 23, 2026

Uh oh!

tomsonpl commented Jan 23, 2026

Uh oh!

tomsonpl commented Jan 23, 2026

Uh oh!

tomsonpl commented Jan 23, 2026

Uh oh!

elasticmachine commented Jan 27, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Async chunks

References to deprecated APIs

Unreferenced deprecated APIs

History

Uh oh!

ashokaditya left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ashokaditya left a comment

Choose a reason for hiding this comment

Uh oh!

tomsonpl commented Jan 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tomsonpl commented Jan 22, 2026 •

edited

Loading