Skip to content

[EDR Workflows][Osquery] Add shared table toolbar components and redesign saved queries list#258394

Merged
szwarckonrad merged 2 commits intoelastic:mainfrom
szwarckonrad:osquery-shared-toolbar-components-v2
Mar 18, 2026
Merged

[EDR Workflows][Osquery] Add shared table toolbar components and redesign saved queries list#258394
szwarckonrad merged 2 commits intoelastic:mainfrom
szwarckonrad:osquery-shared-toolbar-components-v2

Conversation

@szwarckonrad
Copy link
Copy Markdown
Contributor

@szwarckonrad szwarckonrad commented Mar 18, 2026 •
edited
Loading

Adds shared table toolbar components and redesigns the saved queries list page behind the queryHistoryRework feature flag.

Shared toolbar components (components/table_toolbar/):

  • SelectableFilterPopover — generic multi-select filter
  • CreatedByFilterPopover — user filter with avatars from current page data
  • EnabledFilterButtons — enabled/disabled toggle (for packs, used in follow-up)
  • ColumnPickerPopover — show/hide columns ("Columns: N")
  • SortFieldsPopover — sort field + direction picker
  • TableToolbar — composed container with two-row layout

Saved queries table redesign (routes/saved_queries/list/):

  • EuiBasicTable with server-side pagination, sorting, search, and filtering (replaces EuiInMemoryTable)
  • Created-by filter popover with user avatars via useGenericBulkGetUserProfiles
  • Column visibility toggling and sort popover
  • "Save query" action button in toolbar
  • Row actions via kebab menu (edit, duplicate, delete)

Server-side search fix:

  • Replaced SO search/searchFields with KQL filter using wildcards — fixes 400 errors on keyword fields (id)
  • Uses escapeKuery from @kbn/es-query for proper KQL escaping

Layout cleanup (behind feature flag):

  • New/edit saved query pages skip WithHeaderLayout — renders clean layout matching pack pages
  • MainNavigation hides title + tabs on sub-routes (new/edit/details)

All changes gated behind queryHistoryRework feature flag — old UI untouched when flag is off.

Closes https://github.com/elastic/security-team/issues/16312
Closes https://github.com/elastic/security-team/issues/16314

565181203-a721fbf7-8638-45a8-8557-abf622c7bb70.mov

@szwarckonrad szwarckonrad added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Defend Workflows “EDR Workflows” sub-team of Security Solution labels Mar 18, 2026
@szwarckonrad szwarckonrad self-assigned this Mar 18, 2026
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Mar 18, 2026

Caution

Review failed

An error occurred during the review process. Please try again later.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
📝 Coding Plan
  • Generate coding plan for human review comments

Comment @coderabbitai help to get the list of available commands and usage tips.

Tip

CodeRabbit can suggest fixes for GitHub Check annotations.

Configure the reviews.tools.github-checks setting to adjust the time to wait for GitHub Checks to complete.

@szwarckonrad szwarckonrad requested a review from tomsonpl March 18, 2026 16:44
@szwarckonrad szwarckonrad marked this pull request as ready for review March 18, 2026 16:44
@szwarckonrad szwarckonrad requested a review from a team as a code owner March 18, 2026 16:44
@szwarckonrad szwarckonrad requested a review from joeypoon March 18, 2026 16:44
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Mar 18, 2026

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

@szwarckonrad szwarckonrad mentioned this pull request Mar 18, 2026
Closed
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Mar 18, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] Jest Tests #4 / SearchBar add filter
  • [job] [logs] Scout: [ security / entity_store ] plugin / local-serverless-security_complete - Entity Store Main logs extraction - Should extract properly extract service

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
osquery 582 591 +9

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
osquery 1.3MB 1.3MB +15.1KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
osquery 45.2KB 45.2KB +1.0B

cc @szwarckonrad

@szwarckonrad szwarckonrad merged commit 2a7f2e7 into elastic:main Mar 18, 2026
15 checks passed
mbondyra added a commit to mbondyra/kibana that referenced this pull request Mar 19, 2026
@mbondyra
Merge commit '9289d6b5502db245e645e190b0246554396c6c20' into dashboar…
6858d48 
…d_agent_navigation2

* commit '9289d6b5502db245e645e190b0246554396c6c20': (34 commits)
  [api-docs] 2026-03-19 Daily api_docs build (elastic#258471)
  [Shared UX][DateRangePicker] Missing parts (elastic#258229)
  [Dashboard] Keep pinned_panels separate in read response (elastic#258444)
  Move inheritance: true to top level in .coderabbit.yml (elastic#258461)
  [DOCS] 9.3.2 Kibana release notes (elastic#257332)
  adds routing accept metric attribute to the cps metric (elastic#258168)
  [ML] AI/Inference Connector creation: use 'location' field to correctly set provider config  (elastic#250838)
  [Lens] Add e2e test for legend list layout (elastic#258160)
  [SigEvents] Convert feature duplication evaluators to createPrompt pattern (elastic#256534)
  Add actionable-obs author to .coderabbit.yml (elastic#257922)
  [DOCS] 9.2.7 Kibana release notes (elastic#257331)
  Grant Serverless editor/viewer access to ES v2 indices (elastic#258384)
  [SigEvents][Evals] Rename terminology for KI features and KI queries (elastic#258361)
  [EDR Workflows][Osquery] Add shared table toolbar components and redesign saved queries list (elastic#258394)
  [Automatic Import V2] Upload samples using an existing index (elastic#258074)
  Add GET /inference_features route to expose feature registry (elastic#258044)
  fix additional fields not included (elastic#257625)
  [Discover] [Metrics] Add tier 2 journeys for Metrics in Discover E2E (elastic#255036)
  [Lens as code] Support correct X-Axis types in ES|QL visualizations (elastic#258159)
  Update APM (main) (elastic#254880)
  ...
flash1293 pushed a commit to flash1293/kibana that referenced this pull request Mar 19, 2026
@szwarckonrad @kibanamachine @flash1293
[EDR Workflows][Osquery] Add shared table toolbar components and rede…
653ddf5 
…sign saved queries list (elastic#258394)

Adds shared table toolbar components and redesigns the saved queries
list page behind the `queryHistoryRework` feature flag.

**Shared toolbar components** (`components/table_toolbar/`):

- `SelectableFilterPopover` — generic multi-select filter
- `CreatedByFilterPopover` — user filter with avatars from current page
data
- `EnabledFilterButtons` — enabled/disabled toggle (for packs, used in
follow-up)
- `ColumnPickerPopover` — show/hide columns ("Columns: N")
- `SortFieldsPopover` — sort field + direction picker
- `TableToolbar` — composed container with two-row layout

**Saved queries table redesign** (`routes/saved_queries/list/`):

- `EuiBasicTable` with server-side pagination, sorting, search, and
filtering (replaces `EuiInMemoryTable`)
- Created-by filter popover with user avatars via
`useGenericBulkGetUserProfiles`
- Column visibility toggling and sort popover
- "Save query" action button in toolbar
- Row actions via kebab menu (edit, duplicate, delete)

**Server-side search fix**:

- Replaced SO `search`/`searchFields` with KQL filter using wildcards —
fixes 400 errors on `keyword` fields (`id`)
- Uses `escapeKuery` from `@kbn/es-query` for proper KQL escaping

**Layout cleanup** (behind feature flag):

- New/edit saved query pages skip `WithHeaderLayout` — renders clean
layout matching pack pages
- `MainNavigation` hides title + tabs on sub-routes (new/edit/details)

All changes gated behind `queryHistoryRework` feature flag — old UI
untouched when flag is off.

Closes elastic/security-team#16312
Closes elastic/security-team#16314



https://github.com/user-attachments/assets/d4ee723b-1e5f-4467-ae5c-025dc5e7d23a

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
jeramysoucy pushed a commit to jeramysoucy/kibana that referenced this pull request Mar 26, 2026
@szwarckonrad @kibanamachine @jeramysoucy
[EDR Workflows][Osquery] Add shared table toolbar components and rede…
76977dd 
…sign saved queries list (elastic#258394)

Adds shared table toolbar components and redesigns the saved queries
list page behind the `queryHistoryRework` feature flag.

**Shared toolbar components** (`components/table_toolbar/`):

- `SelectableFilterPopover` — generic multi-select filter
- `CreatedByFilterPopover` — user filter with avatars from current page
data
- `EnabledFilterButtons` — enabled/disabled toggle (for packs, used in
follow-up)
- `ColumnPickerPopover` — show/hide columns ("Columns: N")
- `SortFieldsPopover` — sort field + direction picker
- `TableToolbar` — composed container with two-row layout

**Saved queries table redesign** (`routes/saved_queries/list/`):

- `EuiBasicTable` with server-side pagination, sorting, search, and
filtering (replaces `EuiInMemoryTable`)
- Created-by filter popover with user avatars via
`useGenericBulkGetUserProfiles`
- Column visibility toggling and sort popover
- "Save query" action button in toolbar
- Row actions via kebab menu (edit, duplicate, delete)

**Server-side search fix**:

- Replaced SO `search`/`searchFields` with KQL filter using wildcards —
fixes 400 errors on `keyword` fields (`id`)
- Uses `escapeKuery` from `@kbn/es-query` for proper KQL escaping

**Layout cleanup** (behind feature flag):

- New/edit saved query pages skip `WithHeaderLayout` — renders clean
layout matching pack pages
- `MainNavigation` hides title + tabs on sub-routes (new/edit/details)

All changes gated behind `queryHistoryRework` feature flag — old UI
untouched when flag is off.

Closes elastic/security-team#16312
Closes elastic/security-team#16314



https://github.com/user-attachments/assets/d4ee723b-1e5f-4467-ae5c-025dc5e7d23a

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tomsonpl tomsonpl tomsonpl approved these changes

@joeypoon joeypoon Awaiting requested review from joeypoon joeypoon is a code owner automatically assigned from elastic/security-defend-workflows

Assignees

@szwarckonrad szwarckonrad

Labels

backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v9.4.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@szwarckonrad @elasticmachine @tomsonpl @kibanamachine