[Security Solution][Attacks/Alerts][Setup and miscellaneous] Advanced setting to control feature visibility (#250157)#250830
Merged
e40pud merged 3 commits intoelastic:mainfrom Jan 30, 2026
Conversation
… setting to control feature visibility (elastic#250157)
Contributor
|
Pinging @elastic/security-threat-hunting (Team:Threat Hunting) |
Contributor
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
Contributor
|
Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations) |
andrew-goldstein
approved these changes
Jan 28, 2026
Contributor
💚 Build Succeeded
Metrics [docs]Async chunks
Page load bundle
History
cc @e40pud |
NicholasPeretti
approved these changes
Jan 29, 2026
mbondyra
added a commit
to mbondyra/kibana
that referenced
this pull request
Jan 30, 2026
…iew_cps * commit '5f7fec57cb01883038810bd735a0666683b49904': (116 commits) [Security Solution][Attacks/Alerts][Setup and miscellaneous] Advanced setting to control feature visibility (elastic#250157) (elastic#250830) Fix synthtrace `fetch` usage (elastic#250950) [APM] Add Nodes and Edges components and selection logic (elastic#250937) [Docs] Update alerting-settings.md and add serverless value for one parameter (elastic#250842) [Agent Builder] filestore: initial implementation (elastic#250043) [CPS] Support CPS in Vega ESQL (elastic#250693) Adjustments to cascade document esql helpers (elastic#250560) [Security Solutions] Trial Companion - adds ai chat and elastic agent detectors (elastic#250908) [Obs Presentation] Code Scanning Alert Fixes (elastic#250858) [performance] add return and refresh render scenarios to dashboard journeys (elastic#250939) skip failing test suite (elastic#245458) Add Cloud Forwarder onboarding tile to O11y Solution (elastic#250325) [Traces] Remove APM unified trace waterall embeddable registration (elastic#250808) [Discover] [Metrics] Fix: metrics grid titles do not update on order change (elastic#250963) [a11y] Fix Eui modal title annoucment (elastic#250459) [Cloud Security] [Fleet] Add cloud connector access scope for input or package level credential definitions (elastic#250280) [WorkplaceAI] SharePoint Online stack connector (elastic#248737) [Response Ops][Task Manager] Update functions do not handle API key invalidation (elastic#249109) [Osquery] Remove @kbn/timelines-plugin dependency from osquery plugin (elastic#250055) [One Discover][Logs UX] Update OpenTelemetry Semantic Conventions (elastic#250346) ...
hannahbrooks
pushed a commit
to hannahbrooks/kibana
that referenced
this pull request
Jan 30, 2026
… setting to control feature visibility (elastic#250157) (elastic#250830) ## Summary Closes elastic#250157 Added a new Advanced Setting `Enable alerts and attacks alignment` (`securitySolution:enableAlertsAndAttacksAlignment`) to control the visibility of the new Attacks page and the alignment of Alerts page under the Detections navigation item. ### Architecture and Feature Flags This PR introduces a layered approach to feature visibility: 1. **Experimental Feature Flag (`enableAlertsAndAttacksAlignment`)**: - Defined in `experimental_features.ts` and configured via `xpack.securitySolution.enableExperimental` in `kibana.yml`. - **Purpose**: Controls the _registration_ and visibility of the new Advanced Setting itself. If this flag is disabled, the Advanced Setting is not registered and cannot be seen or toggled by users. 2. **Advanced Setting (`Enable alerts and attacks alignment`)**: - Registered only when the experimental feature flag is enabled. - **Purpose**: Controls the _actual feature visibility_ in the UI. - **Enabled**: The navigation structure changes to show a "Detections" item containing both "Alerts" and "Attacks" sub-items. - **Disabled**: The navigation shows the standard "Alerts" item only. This replaces the previous implementation that relied on the `attacksAlertsAlignment` feature flag (via the `featureFlags` service) and the `ATTACKS_ALERTS_ALIGNMENT_ENABLED` constant, which have been removed. ## Test plan 1. Enable the `enableAlertsAndAttacksAlignment` experimental feature flag in `kibana.dev.yml` or `kibana.yml`: ```yaml xpack.securitySolution.enableExperimental: ['enableAlertsAndAttacksAlignment'] ``` 2. Navigate to **Stack Management > Advanced Settings > Space Settings > Security Solution**. 3. Find the setting **Enable alerts and attacks alignment**. 4. Enable the setting and save. 5. Verify that the **Detections** navigation item now contains **Attacks** and **Alerts** sub-items. 6. Disable the setting and save. 7. Verify that the navigation shows the **Alerts** item directly, and the **Attacks** page is not visible (reverting to the standard navigation structure). --- _PR developed with Cursor + Gemini 3 Pro_
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #250157
Added a new Advanced Setting
Enable alerts and attacks alignment(securitySolution:enableAlertsAndAttacksAlignment) to control the visibility of the new Attacks page and the alignment of Alerts page under the Detections navigation item.Architecture and Feature Flags
This PR introduces a layered approach to feature visibility:
Experimental Feature Flag (
enableAlertsAndAttacksAlignment):experimental_features.tsand configured viaxpack.securitySolution.enableExperimentalinkibana.yml.Advanced Setting (
Enable alerts and attacks alignment):This replaces the previous implementation that relied on the
attacksAlertsAlignmentfeature flag (via thefeatureFlagsservice) and theATTACKS_ALERTS_ALIGNMENT_ENABLEDconstant, which have been removed.Test plan
enableAlertsAndAttacksAlignmentexperimental feature flag inkibana.dev.ymlorkibana.yml:PR developed with Cursor + Gemini 3 Pro