Summary

Closes #232607

This PR introduces the Attacks Volume Panel to the Attacks page Summary view. It displays a line chart showing the volume of unique attacks detected over time.

Key Features

• "Attacks volume over time" Chart: A line chart visualization using @elastic/charts.
• Accurate Time Representation: Uses a two-step querying strategy to fetch actual attack start times:
  1. Aggregation Query: Retrieves unique kibana.alert.attack_ids within the time range from both alerts and attacks indices.
  2. Details Query: Fetches the exact kibana.alert.start (or @timestamp) for each unique attack ID from the attacks index.
• Dynamic Time Window: The chart's x-axis automatically extends to include the genesis of any attack detected within the selected time range, ensuring visibility of long-running attacks that started before the current window.
• Responsive Design: Uses EuiLoadingChart for loading states and responsive container sizing.

Technical Implementation

Components & Hooks

• AttacksVolumePanel: Main component rendering the chart.
• useAttacksVolumeData: Orchestrator hook that combines data fetching and processing.
• useAttackIds: Hook responsible for the first step: getting unique attack IDs via terms aggregation.
• useAttackTimestamps: Hook responsible for the second step: getting precise timestamps for those IDs.

Advanced Setting

1. Enable the enableAlertsAndAttacksAlignment experimental feature flag in kibana.dev.yml or kibana.yml:

   xpack.securitySolution.enableExperimental: ['enableAlertsAndAttacksAlignment']

2. Navigate to Stack Management > Advanced Settings > Space Settings > Security Solution.
3. Find the setting Enable alerts and attacks alignment (securitySolution:enableAlertsAndAttacksAlignment).
4. Enable the setting and save.
5. Refresh the page if necessary.

Screenshot

PR developed with Cursor + Gemini 3 Pro