Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

I can tab through all the elements on the page when in the Query tab, but I can't tab past the events table on the Correlation tab. I'm wondering if we need to update the onTimelineTabKeyPressed function, or one of the helpers invoked by it.

The event count badge on the Correlation tab doesn't appear to be reset when a new timeline is created:

Per the following screenshot, when a case is created from a Resolver view, additional URL state is included to re-open the Resolver view when users click the rule from a case:

Consider appending the active tab to the URL state such that when users click on a timeline link from a case, timeline opens the Correlation tab, because the Query tab will likely be empty when the timeline is opened, which may be confusing.

Would you be willing to confirm that the 200 results shown in the screenshot below is the expected behavior because size is a multiplier that's applied to each instance of a [ ] in the EQL syntax?

I'm 99% sure this is the intended behavior, and experimentally, when I add a third event.category, registry in the example below:

sequence
  [ file where file.extension == "exe" ]
  [ process where true ]
  [ registry where true ]

i get 300 results, so I think it's working as intended.

Yes it is working as expected

The event count badge on the Correlation tab doesn't appear to be reset when a new timeline is created:

I can not reproduce it

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: c888f33

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

Saved Objects .kibana field count

Every field in each saved object type adds overhead to Elasticsearch. Kibana needs to keep the total field count below Elasticsearch's default limit of 1000 fields. Only specify field mappings for the fields you wish to search on or query. See https://www.elastic.co/guide/en/kibana/master/development-plugin-saved-objects.html#_mappings

History

• 💚 Build #106539 succeeded 3f7b62e
• 💔 Build #106516 failed 70d6e55
• 💔 Build #106391 failed ab8f02e
• 💔 Build #106388 failed 4c42158
• 💔 Build #105465 failed 909941f

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream