Security Solution] render session view in tools flyout in Security Solution and Discover by PhilippeOberti · Pull Request #257543 · elastic/kibana

PhilippeOberti · 2026-03-13T02:32:05Z

Summary

This PR adds the new Session View tools flyout, that can be opened in the Security Solution and in Discover.

Code changes

The PR focuses on the Session View component, which is an item that can be opened from the Session View preview component under the Visualizations section in the alert flyout. Here are the main changes introduced here:

create a new session view component under the flyout_v2 folder. Because a lot of the logic related to the expandable flyout was baked in the code, it was easier to have a little bit of duplication here, instead of moving the entire component from the flyout folder
move the ProcessTab, MetadataTab and AlertsTab components to the flyout_v2 folder.
move the useSessionViewConfig from the flyout_v2/document/hooks folder to the new session_view/hooks folder, to have the code colocated

Tip

Session View is used both in the expandable flyout (in Security Solution) and in this new EUI flyout system (in Security Solution and Discover). The UIUX experience in the expandable flyout remains totally unchanged.

UI changes

The UI of the current alert/event flyouts (using the expandable flyout framework) in Security Solution should remain unchanged after this PR (when the feature flag is off).

Screen.Recording.2026-03-18.at.4.05.21.PM.mov

Then when the feature flag is on, the new flyout show the prevalence overview. This is accessible both in Security Solution and in Discover:

Screen.Recording.2026-03-18.at.4.05.50.PM.mov

How to test

To see the new (emtpy) flyout in Security Solution, add this to your kibana.dev.yml file:
xpack.securitySolution.enableExperimental: [ 'newFlyoutSystemEnabled' ]

Too see the new (emtpy) flyout in Discover, add this to your kibana.dev.yml file:
discover.experimental.enabledProfiles: [ 'enhanced-security-document-profile' ]

What to look for when testing

verify that the Session View on the Security Solution side has not changed in the expandable flyout (newFlyoutSystemEnabled feature flag off)
verify that Session View in the new flyout (newFlyoutSystemEnabled feature flag on)
verify that Session View shows up in Discover

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

#251805

_PR developed with Cursor + gpt-5.2

elasticmachine · 2026-03-19T00:18:05Z

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

DennisKo

looks good. just some clarifications.

DennisKo · 2026-03-20T13:10:17Z

x-pack/solutions/security/plugins/security_solution/public/flyout_v2/session_view/index.tsx

+      ]
+    );
+
+    const closeDetails = useCallback(() => {}, []);


no-op intentional?

Yes, that prop is mandatory on the Session View component but we're not using it... I guess I could make a change on their end to make it optional, but that would require an approval from their end and I'd like to avoid that for now if possible?

DennisKo · 2026-03-20T13:11:49Z

...ions/security/plugins/security_solution/public/flyout/document_details/session_view/tabs.tsx

+  const alertsIndex = useMemo(() => selectedPatterns.join(','), [selectedPatterns]);
+
+  const onShowAlertDetails = useCallback(
+    (alertId: string) => {


isnt this defined das onShowAlertDetails: (alertId: string, alertIndex: string) => void; or am I following this incorrectly?

Good catch, I think I had made that improvement in another PR and forgot to update the code it after merging it. I'm surprised typescript didn't complain.... Fixed!

DennisKo · 2026-03-20T13:15:27Z

x-pack/solutions/security/plugins/security_solution/public/flyout_v2/session_view/index.tsx

+    return (
+      <div data-test-subj={SESSION_VIEW_TEST_ID}>
+        {sessionView.getSessionView({
+          ...(sessionViewConfig as SessionViewConfig),


SessionViewConfig | null -> SessionViewConfig

what happens if SessionViewConfig is null?

At this point it is actually not possible for sessionViewConfig to be null. The Session View tools flyout can only be opened from the alert flyout's session view preview, and the link is only enabled if sessionViewConfig is defined. So I made the conscious decision to not have to worry about it here...

DennisKo · 2026-03-20T13:18:42Z

x-pack/solutions/security/plugins/security_solution/public/flyout_v2/session_view/index.tsx

+            ),
+          }),
+          {
+            ownFocus: false,


don't we need type: 'overlay' here?

I don't think it's really necessary, but I'm not sure. In doubt I've added it here as well in the second callback a bit below in the same file. Thanks!

…olution and Discover

elasticmachine · 2026-03-23T03:51:59Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 166bff9

Failed CI Steps

x-pack/platform/test/search_sessions_integration/config.ts

Test Failures

[job] [logs] x-pack/platform/test/search_sessions_integration/config.ts / Discover discover in space Storing search sessions in space Saves and restores a session

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	9232	9235	+3

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	11.4MB	11.4MB	+4.7KB

History

💛 Build #413413 was flaky a1d96f9
💚 Build #412906 succeeded 2123a9c
💛 Build #412581 was flaky 61e2b57
💔 Build #412528 failed af75cf7

…lution and Discover (#257543) ## Summary This PR adds the new Session View tools flyout, that can be opened in the Security Solution and in Discover. ### Code changes The PR focuses on the Session View component, which is an item that can be opened from the Session View preview component under the Visualizations section in the alert flyout. Here are the main changes introduced here: - create a new session view component under the `flyout_v2` folder. Because a lot of the logic related to the expandable flyout was baked in the code, it was easier to have a little bit of duplication here, instead of moving the entire component from the `flyout` folder - move the `ProcessTab`, `MetadataTab` and `AlertsTab` components to the `flyout_v2` folder. - move the `useSessionViewConfig` from the `flyout_v2/document/hooks` folder to the new `session_view/hooks` folder, to have the code colocated > [!TIP] > Session View is used both in the expandable flyout (in Security Solution) and in this new EUI flyout system (in Security Solution and Discover). The UIUX experience in the expandable flyout remains totally unchanged. ### UI changes The UI of the current alert/event flyouts (using the expandable flyout framework) in Security Solution should remain unchanged after this PR (when the feature flag is off). https://github.com/user-attachments/assets/39a26d24-3896-4567-860a-cd9c3ba2ece3 Then when the feature flag is on, the new flyout show the prevalence overview. This is accessible both in Security Solution and in Discover: https://github.com/user-attachments/assets/b5b4a441-daae-40e6-9333-0dd334e4aa4e ## How to test To see the new (emtpy) flyout in Security Solution, add this to your `kibana.dev.yml` file: ```xpack.securitySolution.enableExperimental: [ 'newFlyoutSystemEnabled' ]``` Too see the new (emtpy) flyout in Discover, add this to your `kibana.dev.yml` file: ```discover.experimental.enabledProfiles: [ 'enhanced-security-document-profile' ]``` ## What to look for when testing - verify that the Session View on the Security Solution side has not changed in the expandable flyout (`newFlyoutSystemEnabled` feature flag off) - verify that Session View in the new flyout (`newFlyoutSystemEnabled` feature flag on) - verify that Session View shows up in Discover ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. #251805 _PR developed with Cursor + gpt-5.2

## Summary #258166 - renamed in #257543 - used in

…lution and Discover (elastic#257543) ## Summary This PR adds the new Session View tools flyout, that can be opened in the Security Solution and in Discover. ### Code changes The PR focuses on the Session View component, which is an item that can be opened from the Session View preview component under the Visualizations section in the alert flyout. Here are the main changes introduced here: - create a new session view component under the `flyout_v2` folder. Because a lot of the logic related to the expandable flyout was baked in the code, it was easier to have a little bit of duplication here, instead of moving the entire component from the `flyout` folder - move the `ProcessTab`, `MetadataTab` and `AlertsTab` components to the `flyout_v2` folder. - move the `useSessionViewConfig` from the `flyout_v2/document/hooks` folder to the new `session_view/hooks` folder, to have the code colocated > [!TIP] > Session View is used both in the expandable flyout (in Security Solution) and in this new EUI flyout system (in Security Solution and Discover). The UIUX experience in the expandable flyout remains totally unchanged. ### UI changes The UI of the current alert/event flyouts (using the expandable flyout framework) in Security Solution should remain unchanged after this PR (when the feature flag is off). https://github.com/user-attachments/assets/39a26d24-3896-4567-860a-cd9c3ba2ece3 Then when the feature flag is on, the new flyout show the prevalence overview. This is accessible both in Security Solution and in Discover: https://github.com/user-attachments/assets/b5b4a441-daae-40e6-9333-0dd334e4aa4e ## How to test To see the new (emtpy) flyout in Security Solution, add this to your `kibana.dev.yml` file: ```xpack.securitySolution.enableExperimental: [ 'newFlyoutSystemEnabled' ]``` Too see the new (emtpy) flyout in Discover, add this to your `kibana.dev.yml` file: ```discover.experimental.enabledProfiles: [ 'enhanced-security-document-profile' ]``` ## What to look for when testing - verify that the Session View on the Security Solution side has not changed in the expandable flyout (`newFlyoutSystemEnabled` feature flag off) - verify that Session View in the new flyout (`newFlyoutSystemEnabled` feature flag on) - verify that Session View shows up in Discover ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. elastic#251805 _PR developed with Cursor + gpt-5.2

## Summary elastic#258166 - renamed in elastic#257543 - used in

PhilippeOberti added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team v9.4.0 labels Mar 13, 2026

PhilippeOberti force-pushed the moving-session-view branch 3 times, most recently from af75cf7 to 61e2b57 Compare March 18, 2026 23:14

PhilippeOberti marked this pull request as ready for review March 19, 2026 00:18

PhilippeOberti requested review from a team as code owners March 19, 2026 00:18

PhilippeOberti force-pushed the moving-session-view branch from 61e2b57 to 2123a9c Compare March 19, 2026 13:32

PhilippeOberti removed the request for review from a team March 19, 2026 13:32

PhilippeOberti force-pushed the moving-session-view branch from 2123a9c to a1d96f9 Compare March 20, 2026 01:20

DennisKo reviewed Mar 20, 2026

View reviewed changes

PhilippeOberti added 2 commits March 22, 2026 21:18

[Security Solution] render session view in tools flyout in Security S…

08bc36a

…olution and Discover

PR comments

166bff9

PhilippeOberti force-pushed the moving-session-view branch from a1d96f9 to 166bff9 Compare March 23, 2026 02:29

DennisKo self-requested a review March 23, 2026 13:23

DennisKo approved these changes Mar 23, 2026

View reviewed changes

PhilippeOberti merged commit 61e7252 into elastic:main Mar 24, 2026
18 checks passed

PhilippeOberti deleted the moving-session-view branch March 24, 2026 01:59

delanni mentioned this pull request Mar 24, 2026

[CI] fix bad imports that came from a merge-race #259383

Merged

delanni added a commit that referenced this pull request Mar 24, 2026

[CI] fix bad imports that came from a merge-race (#259383)

3a2c435

## Summary #258166 - renamed in #257543 - used in

jeramysoucy pushed a commit to jeramysoucy/kibana that referenced this pull request Mar 26, 2026

[CI] fix bad imports that came from a merge-race (elastic#259383)

6c5b36d

## Summary elastic#258166 - renamed in elastic#257543 - used in

PhilippeOberti added the OneDiscover label Apr 7, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security Solution] render session view in tools flyout in Security Solution and Discover#257543

Security Solution] render session view in tools flyout in Security Solution and Discover#257543
PhilippeOberti merged 2 commits intoelastic:mainfrom
PhilippeOberti:moving-session-view

PhilippeOberti commented Mar 13, 2026 •

edited

Loading

Uh oh!

elasticmachine commented Mar 19, 2026

Uh oh!

DennisKo left a comment

Uh oh!

DennisKo Mar 20, 2026

Uh oh!

PhilippeOberti Mar 23, 2026

Uh oh!

DennisKo Mar 20, 2026 •

edited

Loading

Uh oh!

PhilippeOberti Mar 23, 2026

Uh oh!

DennisKo Mar 20, 2026

Uh oh!

PhilippeOberti Mar 23, 2026

Uh oh!

DennisKo Mar 20, 2026

Uh oh!

PhilippeOberti Mar 23, 2026

Uh oh!

elasticmachine commented Mar 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

PhilippeOberti commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Code changes

UI changes

How to test

What to look for when testing

Checklist

Uh oh!

elasticmachine commented Mar 19, 2026

Uh oh!

DennisKo left a comment

Choose a reason for hiding this comment

Uh oh!

DennisKo Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

PhilippeOberti Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

DennisKo Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

PhilippeOberti Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

DennisKo Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

PhilippeOberti Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

DennisKo Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

PhilippeOberti Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Mar 23, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Async chunks

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

PhilippeOberti commented Mar 13, 2026 •

edited

Loading

DennisKo Mar 20, 2026 •

edited

Loading