diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/left/components/correlations_details_alerts_table.test.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/left/components/correlations_details_alerts_table.test.tsx
index fec6a1efaa08f..ebea2481ab829 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/left/components/correlations_details_alerts_table.test.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/left/components/correlations_details_alerts_table.test.tsx
@@ -11,7 +11,6 @@ import { TestProviders } from '../../../../common/mock';
import { useExpandableFlyoutApi } from '@kbn/expandable-flyout';
import { CorrelationsDetailsAlertsTable } from './correlations_details_alerts_table';
import { usePaginatedAlerts } from '../hooks/use_paginated_alerts';
-import { CORRELATIONS_DETAILS_ALERT_PREVIEW_BUTTON_TEST_ID } from './test_ids';
import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
import { mockFlyoutApi } from '../../shared/mocks/mock_flyout_context';
import { mockContextValue } from '../../shared/mocks/mock_context';
@@ -94,9 +93,7 @@ describe('CorrelationsDetailsAlertsTable', () => {
expect(getByTestId(`${TEST_ID}InvestigateInTimeline`)).toBeInTheDocument();
expect(getByTestId(`${TEST_ID}Table`)).toBeInTheDocument();
- expect(
- queryByTestId(CORRELATIONS_DETAILS_ALERT_PREVIEW_BUTTON_TEST_ID)
- ).not.toBeInTheDocument();
+ expect(queryByTestId(`${TEST_ID}AlertPreviewButton`)).not.toBeInTheDocument();
expect(jest.mocked(usePaginatedAlerts)).toHaveBeenCalled();
@@ -116,9 +113,9 @@ describe('CorrelationsDetailsAlertsTable', () => {
});
expect(getByTestId(`${TEST_ID}InvestigateInTimeline`)).toBeInTheDocument();
- expect(getAllByTestId(CORRELATIONS_DETAILS_ALERT_PREVIEW_BUTTON_TEST_ID).length).toBe(2);
+ expect(getAllByTestId(`${TEST_ID}AlertPreviewButton`).length).toBe(2);
- getAllByTestId(CORRELATIONS_DETAILS_ALERT_PREVIEW_BUTTON_TEST_ID)[0].click();
+ getAllByTestId(`${TEST_ID}AlertPreviewButton`)[0].click();
expect(mockFlyoutApi.openPreviewPanel).toHaveBeenCalledWith({
id: DocumentDetailsPreviewPanelKey,
params: {
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/left/components/correlations_details_alerts_table.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/left/components/correlations_details_alerts_table.tsx
index 5253aa1cd272b..cf55e02d9d478 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/left/components/correlations_details_alerts_table.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/left/components/correlations_details_alerts_table.tsx
@@ -15,7 +15,6 @@ import { ALERT_REASON, ALERT_RULE_NAME } from '@kbn/rule-data-utils';
import { FormattedMessage } from '@kbn/i18n-react';
import { i18n } from '@kbn/i18n';
import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
-import { CORRELATIONS_DETAILS_ALERT_PREVIEW_BUTTON_TEST_ID } from './test_ids';
import { CellTooltipWrapper } from '../../shared/components/cell_tooltip_wrapper';
import type { DataProvider } from '../../../../../common/types';
import { SeverityBadge } from '../../../../common/components/severity_badge';
@@ -133,7 +132,7 @@ export const CorrelationsDetailsAlertsTable: FC
),
@@ -210,7 +209,7 @@ export const CorrelationsDetailsAlertsTable: FC {
+ cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_HOST_DETAILS_LINK).should(
+ 'contain.text',
+ 'siem-kibana'
+ );
+ cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_HOST_DETAILS_LINK).click();
+
+ cy.get(PREVIEW_SECTION).should('exist');
+ cy.get(PREVIEW_BANNER).should('have.text', 'Preview host details');
+ cy.get(HOST_PANEL_HEADER).should('exist');
+ cy.get(HOST_PREVIEW_PANEL_FOOTER).should('exist');
+
+ cy.log('click on footer link');
+
+ cy.get(OPEN_HOST_FLYOUT_LINK).click();
+ cy.get(HOST_PANEL_HEADER).should('exist');
+ cy.get(PREVIEW_SECTION).should('not.exist');
+ cy.get(HOST_PREVIEW_PANEL_FOOTER).should('not.exist');
+ });
+
+ // github.com/elastic/security-team/issues/9933
+ // Enable when feature flag 'entityAlertPreviewEnabled' is enabled
+ it.skip('should open user preview when click on user details title', () => {
+ cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_USER_DETAILS_LINK).should('contain.text', 'test');
+ cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_USER_DETAILS_LINK).click();
+
+ cy.get(PREVIEW_SECTION).should('exist');
+ cy.get(PREVIEW_BANNER).should('have.text', 'Preview user details');
+ cy.get(USER_PANEL_HEADER).should('exist');
+ cy.get(USER_PREVIEW_PANEL_FOOTER).should('exist');
+
+ cy.log('click on footer link');
+
+ cy.get(OPEN_USER_FLYOUT_LINK).click();
+ cy.get(USER_PANEL_HEADER).should('exist');
+ cy.get(PREVIEW_SECTION).should('not.exist');
+ cy.get(USER_PREVIEW_PANEL_FOOTER).should('not.exist');
+ });
}
);
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_left_panel_prevalence_tab.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_left_panel_prevalence_tab.cy.ts
index f3bed7fab6b81..813c4f2c1229a 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_left_panel_prevalence_tab.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_left_panel_prevalence_tab.cy.ts
@@ -19,7 +19,23 @@ import {
DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_TABLE_HOST_PREVALENCE_CELL,
DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_TABLE_USER_PREVALENCE_CELL,
DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_DATE_PICKER,
+ DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_TABLE_HOST_CELL,
+ DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_TABLE_USER_CELL,
} from '../../../../screens/expandable_flyout/alert_details_left_panel_prevalence_tab';
+import {
+ HOST_PANEL_HEADER,
+ HOST_PREVIEW_PANEL_FOOTER,
+ OPEN_HOST_FLYOUT_LINK,
+} from '../../../../screens/hosts/flyout_host_panel';
+import {
+ USER_PANEL_HEADER,
+ USER_PREVIEW_PANEL_FOOTER,
+ OPEN_USER_FLYOUT_LINK,
+} from '../../../../screens/users/flyout_user_panel';
+import {
+ PREVIEW_SECTION,
+ PREVIEW_BANNER,
+} from '../../../../screens/expandable_flyout/alert_details_preview_panel';
import { deleteAlertsAndRules } from '../../../../tasks/api_calls/common';
import { login } from '../../../../tasks/login';
import { visit } from '../../../../tasks/navigation';
@@ -83,5 +99,41 @@ describe(
100
);
});
+
+ // github.com/elastic/security-team/issues/9933
+ // Enable when feature flag 'entityAlertPreviewEnabled' is enabled
+ it.skip('should open host preview when click on host details title', () => {
+ cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_TABLE_HOST_CELL).click();
+
+ cy.get(PREVIEW_SECTION).should('exist');
+ cy.get(PREVIEW_BANNER).should('have.text', 'Preview host details');
+ cy.get(HOST_PANEL_HEADER).should('exist');
+ cy.get(HOST_PREVIEW_PANEL_FOOTER).should('exist');
+
+ cy.log('should open host flyout when click on footer link');
+
+ cy.get(OPEN_HOST_FLYOUT_LINK).click();
+ cy.get(HOST_PANEL_HEADER).should('exist');
+ cy.get(PREVIEW_SECTION).should('not.exist');
+ cy.get(HOST_PREVIEW_PANEL_FOOTER).should('not.exist');
+ });
+
+ // github.com/elastic/security-team/issues/9933
+ // Enable when feature flag 'entityAlertPreviewEnabled' is enabled
+ it.skip('should open user preview when click on user details title', () => {
+ cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_TABLE_USER_CELL).click();
+
+ cy.get(PREVIEW_SECTION).should('exist');
+ cy.get(PREVIEW_BANNER).should('have.text', 'Preview user details');
+ cy.get(USER_PANEL_HEADER).should('exist');
+ cy.get(USER_PREVIEW_PANEL_FOOTER).should('exist');
+
+ cy.log('should open host flyout when click on footer link');
+
+ cy.get(OPEN_USER_FLYOUT_LINK).click();
+ cy.get(USER_PANEL_HEADER).should('exist');
+ cy.get(PREVIEW_SECTION).should('not.exist');
+ cy.get(HOST_PREVIEW_PANEL_FOOTER).should('not.exist');
+ });
}
);
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_preview_panel.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_preview_panel.cy.ts
new file mode 100644
index 0000000000000..c000b06ff1016
--- /dev/null
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_preview_panel.cy.ts
@@ -0,0 +1,175 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { openInsightsTab } from '../../../../tasks/expandable_flyout/alert_details_left_panel';
+import { expandAlertAtIndexExpandableFlyout } from '../../../../tasks/expandable_flyout/common';
+import { deleteAlertsAndRules } from '../../../../tasks/api_calls/common';
+import { login } from '../../../../tasks/login';
+import { visit } from '../../../../tasks/navigation';
+import { createRule } from '../../../../tasks/api_calls/rules';
+import { getNewRule } from '../../../../objects/rule';
+import { ALERTS_URL } from '../../../../urls/navigation';
+import { waitForAlertsToPopulate } from '../../../../tasks/create_new_rule';
+import {
+ CORRELATIONS_ANCESTRY_SECTION_TABLE,
+ CORRELATIONS_SESSION_SECTION_TABLE,
+ CORRELATIONS_SOURCE_SECTION_TABLE,
+} from '../../../../screens/expandable_flyout/alert_details_left_panel_correlations_tab';
+import {
+ openCorrelationsTab,
+ clickExpandFromRelatedBySession,
+ clickExpandFromRelatedByAncestry,
+ clickExpandFromRelatedBySource,
+} from '../../../../tasks/expandable_flyout/alert_details_left_panel_correlations_tab';
+import {
+ closePreview,
+ goToPreviousPreview,
+ openNewFlyout,
+} from '../../../../tasks/expandable_flyout/alert_details_preview_panel';
+import {
+ DOCUMENT_DETAILS_FLYOUT_HEADER_LINK_ICON,
+ DOCUMENT_DETAILS_FLYOUT_HEADER_TITLE,
+ DOCUMENT_DETAILS_FLYOUT_FOOTER,
+ DOCUMENT_DETAILS_FLYOUT_FOOTER_TAKE_ACTION_BUTTON,
+} from '../../../../screens/expandable_flyout/alert_details_right_panel';
+import {
+ PREVIEW_SECTION,
+ PREVIEW_BANNER,
+ DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER,
+ DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER_LINK,
+ PREVIEW_BACK_BUTTON,
+ PREVIEW_CLOSE_BUTTON,
+} from '../../../../screens/expandable_flyout/alert_details_preview_panel';
+import {
+ expandDocumentDetailsExpandableFlyoutLeftSection,
+ openJsonTab,
+ openTableTab,
+} from '../../../../tasks/expandable_flyout/alert_details_right_panel';
+
+// github.com/elastic/security-team/issues/9933
+// Enable when feature flag 'entityAlertPreviewEnabled' is enabled
+describe.skip(
+ 'Opening alert previews from alert details flyout',
+ { tags: ['@ess', '@serverless'] },
+ () => {
+ const rule = getNewRule();
+
+ beforeEach(() => {
+ deleteAlertsAndRules();
+ login();
+ createRule(rule);
+ visit(ALERTS_URL);
+ waitForAlertsToPopulate();
+ expandAlertAtIndexExpandableFlyout();
+ expandDocumentDetailsExpandableFlyoutLeftSection();
+ openInsightsTab();
+ openCorrelationsTab();
+ });
+
+ it('should render alert preview', () => {
+ cy.log('related alerts by source');
+ cy.get(CORRELATIONS_SOURCE_SECTION_TABLE).should('exist');
+ clickExpandFromRelatedBySource();
+
+ cy.log('Verify preview section is visible');
+ cy.get(PREVIEW_SECTION).should('exist');
+ cy.get(PREVIEW_BANNER).should('have.text', 'Preview alert details');
+ cy.get(PREVIEW_BACK_BUTTON).should('exist');
+ cy.get(PREVIEW_CLOSE_BUTTON).should('exist');
+
+ cy.log('Verify title and main sections are rendered');
+ cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_TITLE).eq(1).should('have.text', rule.name);
+ cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_LINK_ICON).should('exist');
+
+ cy.log('Verify the open full alert detail footer is visible on all tabs');
+
+ cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER).should('be.visible');
+ cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER_LINK).should('be.visible');
+
+ openTableTab(1);
+ cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER).should('be.visible');
+ cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER_LINK).should('be.visible');
+
+ openJsonTab(1);
+ cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER).should('be.visible');
+ cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER_LINK).should('be.visible');
+ });
+
+ it('should close previews when close button is clicked', () => {
+ cy.log('open alert preview from related alerts by session');
+ cy.get(CORRELATIONS_SESSION_SECTION_TABLE).should('exist');
+ clickExpandFromRelatedBySession();
+
+ cy.log('Verify preview section is visible');
+
+ cy.get(PREVIEW_SECTION).should('exist');
+ cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER).should('be.visible');
+
+ // TO-DO: enable when we can have multiple alerts in correlations
+ // cy.log('open another alert ');
+ // clickExpandFromRelatedBySession(1);
+
+ // cy.get(PREVIEW_SECTION).should('exist');
+ // cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER).should('be.visible');
+
+ cy.log('click close button');
+
+ closePreview();
+ cy.get(PREVIEW_SECTION).should('not.exist');
+ cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER).should('not.exist');
+ });
+
+ // TO-DO: enable when we can have multiple alerts in correlations
+ it('should go to previous previews when back button is clicked', () => {
+ cy.log('open alert preview from related alerts by session');
+ cy.get(CORRELATIONS_SESSION_SECTION_TABLE).should('exist');
+ clickExpandFromRelatedBySession();
+
+ cy.log('Verify preview section is visible');
+
+ cy.get(PREVIEW_SECTION).should('exist');
+ cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER).should('be.visible');
+
+ // TO-DO: enable when we can have multiple alerts in correlations
+ // cy.log('open another alert ');
+ // clickExpandFromRelatedBySession(1);
+
+ // cy.get(PREVIEW_SECTION).should('exist');
+ // cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER).should('be.visible');
+
+ // cy.log('click back button once');
+
+ // goToPreviousPreview();
+ // cy.get(PREVIEW_SECTION).should('exist');
+ // cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER).should('be.visible');
+
+ cy.log('click back button again');
+ goToPreviousPreview();
+ cy.get(PREVIEW_SECTION).should('not.exist');
+ cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER).should('not.exist');
+ });
+
+ it('should open a new flyout when footer link is clicked', () => {
+ cy.log('open alert preview from related alerts by ancestry');
+ cy.get(CORRELATIONS_ANCESTRY_SECTION_TABLE).should('exist');
+ clickExpandFromRelatedByAncestry();
+
+ cy.log('Verify preview section is visible');
+
+ cy.get(PREVIEW_SECTION).should('exist');
+ cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER).should('be.visible');
+
+ cy.log('Click footer link to open alert details flyout');
+ openNewFlyout();
+ cy.get(PREVIEW_SECTION).should('not.exist');
+ cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER).should('not.exist');
+
+ cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER).should('be.visible');
+ cy.get(DOCUMENT_DETAILS_FLYOUT_FOOTER_TAKE_ACTION_BUTTON).should('be.visible');
+ });
+ }
+);
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel_overview_tab.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel_overview_tab.cy.ts
index c4a20c43c6c04..b9c44b4ad5f72 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel_overview_tab.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel_overview_tab.cy.ts
@@ -43,6 +43,8 @@ import {
DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_RESPONSE_BUTTON,
DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_CORRELATIONS_VALUES_RELATED_ALERTS_BY_SAME_SOURCE_EVENT,
DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_ABOUT_SECTION_CONTENT,
+ DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HOST_OVERVIEW_LINK,
+ DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_USER_OVERVIEW_LINK,
} from '../../../../screens/expandable_flyout/alert_details_right_panel_overview_tab';
import {
navigateToCorrelationsDetails,
@@ -76,6 +78,20 @@ import {
import { DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_CORRELATIONS_BUTTON } from '../../../../screens/expandable_flyout/alert_details_left_panel_correlations_tab';
import { DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_THREAT_INTELLIGENCE_BUTTON } from '../../../../screens/expandable_flyout/alert_details_left_panel_threat_intelligence_tab';
import { DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_BUTTON } from '../../../../screens/expandable_flyout/alert_details_left_panel_prevalence_tab';
+import {
+ HOST_PANEL_HEADER,
+ HOST_PREVIEW_PANEL_FOOTER,
+ OPEN_HOST_FLYOUT_LINK,
+} from '../../../../screens/hosts/flyout_host_panel';
+import {
+ USER_PANEL_HEADER,
+ USER_PREVIEW_PANEL_FOOTER,
+ OPEN_USER_FLYOUT_LINK,
+} from '../../../../screens/users/flyout_user_panel';
+import {
+ PREVIEW_SECTION,
+ PREVIEW_BANNER,
+} from '../../../../screens/expandable_flyout/alert_details_preview_panel';
describe(
'Alert details expandable flyout right panel overview tab',
@@ -216,6 +232,15 @@ describe(
'contain.text',
'host.name'
);
+ cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_FIELD_CELL).should(
+ 'contain.text',
+ 'user.name'
+ );
+ });
+
+ // github.com/elastic/security-team/issues/9933
+ // Skip when feature flag 'entityAlertPreviewEnabled' is enabled
+ it('should open entities details when clicking host name and user name', () => {
const hostNameCell =
DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_VALUE_CELL('siem-kibana');
cy.get(hostNameCell).and('have.text', 'siem-kibana');
@@ -225,10 +250,6 @@ describe(
collapseDocumentDetailsExpandableFlyoutLeftSection();
- cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_FIELD_CELL).should(
- 'contain.text',
- 'user.name'
- );
const userNameCell =
DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_VALUE_CELL('test');
cy.get(userNameCell).should('have.text', 'test');
@@ -236,6 +257,51 @@ describe(
cy.get(userNameCell).click();
cy.get(DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_USER_DETAILS).should('exist');
});
+
+ // github.com/elastic/security-team/issues/9933
+ // Enable when feature flag 'entityAlertPreviewEnabled' is enabled
+ it.skip('should open host preview when host name is clicked', () => {
+ toggleOverviewTabAboutSection();
+
+ cy.log('should open host preview when clicked on host name');
+
+ const hostNameCell =
+ DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_VALUE_CELL('siem-kibana');
+ cy.get(hostNameCell).click();
+
+ cy.get(PREVIEW_SECTION).should('exist');
+ cy.get(PREVIEW_BANNER).should('have.text', 'Preview host details');
+ cy.get(HOST_PANEL_HEADER).should('exist');
+ cy.get(HOST_PREVIEW_PANEL_FOOTER).should('exist');
+
+ cy.log('should open host flyout when click on footer link');
+
+ cy.get(OPEN_HOST_FLYOUT_LINK).click();
+ cy.get(HOST_PANEL_HEADER).should('exist');
+ cy.get(PREVIEW_SECTION).should('not.exist');
+ cy.get(HOST_PREVIEW_PANEL_FOOTER).should('not.exist');
+ });
+
+ // github.com/elastic/security-team/issues/9933
+ // Enable when feature flag 'entityAlertPreviewEnabled' is enabled
+ it.skip('should open user preview when user name is clicked', () => {
+ toggleOverviewTabAboutSection();
+
+ const userNameCell =
+ DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HIGHLIGHTED_FIELDS_TABLE_VALUE_CELL('test');
+ cy.get(userNameCell).and('have.text', 'test');
+
+ cy.get(userNameCell).click();
+ cy.get(PREVIEW_SECTION).should('exist');
+ cy.get(PREVIEW_BANNER).should('have.text', 'Preview user details');
+ cy.get(USER_PANEL_HEADER).should('exist');
+ cy.get(USER_PREVIEW_PANEL_FOOTER).should('exist');
+
+ cy.get(OPEN_USER_FLYOUT_LINK).click();
+ cy.get(USER_PANEL_HEADER).should('exist');
+ cy.get(PREVIEW_SECTION).should('not.exist');
+ cy.get(USER_PREVIEW_PANEL_FOOTER).should('not.exist');
+ });
});
describe('insights section', () => {
@@ -262,6 +328,50 @@ describe(
.and('have.class', 'euiButtonGroupButton-isSelected');
});
+ // github.com/elastic/security-team/issues/9933
+ // Enable when feature flag 'entityAlertPreviewEnabled' is enabled
+ it.skip('open host preview when host name is clicked', () => {
+ toggleOverviewTabAboutSection();
+ toggleOverviewTabInvestigationSection();
+ toggleOverviewTabInsightsSection();
+
+ cy.log('should open host preview when clicked on host name');
+
+ cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HOST_OVERVIEW_LINK).click();
+
+ cy.get(PREVIEW_SECTION).should('exist');
+ cy.get(PREVIEW_BANNER).should('have.text', 'Preview host details');
+ cy.get(HOST_PANEL_HEADER).should('exist');
+ cy.get(HOST_PREVIEW_PANEL_FOOTER).should('exist');
+
+ cy.log('should open host flyout when click on footer link');
+
+ cy.get(OPEN_HOST_FLYOUT_LINK).click();
+ cy.get(HOST_PANEL_HEADER).should('exist');
+ cy.get(PREVIEW_SECTION).should('not.exist');
+ cy.get(HOST_PREVIEW_PANEL_FOOTER).should('not.exist');
+ });
+
+ // github.com/elastic/security-team/issues/9933
+ // Enable when feature flag 'entityAlertPreviewEnabled' is enabled
+ it.skip('open user preview when user name is clicked', () => {
+ toggleOverviewTabAboutSection();
+ toggleOverviewTabInvestigationSection();
+ toggleOverviewTabInsightsSection();
+
+ cy.get(DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_USER_OVERVIEW_LINK).click();
+
+ cy.get(PREVIEW_SECTION).should('exist');
+ cy.get(PREVIEW_BANNER).should('have.text', 'Preview user details');
+ cy.get(USER_PANEL_HEADER).should('exist');
+ cy.get(USER_PREVIEW_PANEL_FOOTER).should('exist');
+
+ cy.get(OPEN_USER_FLYOUT_LINK).click();
+ cy.get(USER_PANEL_HEADER).should('exist');
+ cy.get(PREVIEW_SECTION).should('not.exist');
+ cy.get(USER_PREVIEW_PANEL_FOOTER).should('not.exist');
+ });
+
it('should display threat intelligence section', () => {
toggleOverviewTabAboutSection();
toggleOverviewTabInvestigationSection();
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel_correlations_tab.ts b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel_correlations_tab.ts
index 21f20f8679cdc..dc44deb2d5049 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel_correlations_tab.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel_correlations_tab.ts
@@ -24,6 +24,10 @@ export const CORRELATIONS_ANCESTRY_SECTION_INVESTIGATE_IN_TIMELINE_BUTTON =
'securitySolutionFlyoutCorrelationsDetailsAlertsByAncestrySectionInvestigateInTimeline'
);
+export const CORRELATIONS_ANCESTRY_SECTION_PREVIEW_BUTTON = getDataTestSubjectSelector(
+ 'securitySolutionFlyoutCorrelationsDetailsAlertsByAncestrySectionAlertPreviewButton'
+);
+
export const CORRELATIONS_SOURCE_SECTION_TITLE = getDataTestSubjectSelector(
'securitySolutionFlyoutCorrelationsDetailsAlertsBySourceSectionTitleText'
);
@@ -37,6 +41,10 @@ export const CORRELATIONS_SOURCE_SECTION_INVESTIGATE_IN_TIMELINE_BUTTON =
'securitySolutionFlyoutCorrelationsDetailsAlertsBySourceSectionInvestigateInTimeline'
);
+export const CORRELATIONS_SOURCE_SECTION_PREVIEW_BUTTON = getDataTestSubjectSelector(
+ 'securitySolutionFlyoutCorrelationsDetailsAlertsBySourceSectionAlertPreviewButton'
+);
+
export const CORRELATIONS_SESSION_SECTION_TITLE = getDataTestSubjectSelector(
'securitySolutionFlyoutCorrelationsDetailsAlertsBySessionSectionTitleText'
);
@@ -50,6 +58,10 @@ export const CORRELATIONS_SESSION_SECTION_INVESTIGATE_IN_TIMELINE_BUTTON =
'securitySolutionFlyoutCorrelationsDetailsAlertsBySessionSectionInvestigateInTimeline'
);
+export const CORRELATIONS_SESSION_SECTION_PREVIEW_BUTTON = getDataTestSubjectSelector(
+ 'securitySolutionFlyoutCorrelationsDetailsAlertsBySessionSectionAlertPreviewButton'
+);
+
export const CORRELATIONS_CASES_SECTION_TITLE = getDataTestSubjectSelector(
'securitySolutionFlyoutCorrelationsDetailsCasesSectionTitleText'
);
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel_entities_tab.ts b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel_entities_tab.ts
index 37424eeb935fa..fb7ca4fcb5556 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel_entities_tab.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel_entities_tab.ts
@@ -13,11 +13,18 @@ export const DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_ENTITIES_BUTTON = getDataTestS
export const DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_USER_DETAILS_TITLE = getDataTestSubjectSelector(
'securitySolutionFlyoutUsersDetailsTitleText'
);
+export const DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_USER_DETAILS_LINK = getDataTestSubjectSelector(
+ 'securitySolutionFlyoutUsersDetailsTitleLink'
+);
export const DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_USER_DETAILS_RIGHT_SECTION =
getDataTestSubjectSelector('securitySolutionFlyoutUsersDetailsRightSection');
export const DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_USER_DETAILS = getDataTestSubjectSelector(
'securitySolutionFlyoutUsersDetailsContent'
);
+
+export const DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_HOST_DETAILS_LINK = getDataTestSubjectSelector(
+ 'securitySolutionFlyoutHostsDetailsTitleLink'
+);
export const DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_HOST_DETAILS_TITLE = getDataTestSubjectSelector(
'securitySolutionFlyoutHostsDetailsTitleText'
);
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel_prevalence_tab.ts b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel_prevalence_tab.ts
index 4830ef2f28500..5fe3d1ef61338 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel_prevalence_tab.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_left_panel_prevalence_tab.ts
@@ -24,3 +24,8 @@ export const DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_TABLE_HOST_PREVALEN
getDataTestSubjectSelector('securitySolutionFlyoutPrevalenceDetailsTableHostPrevalenceCell');
export const DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_TABLE_USER_PREVALENCE_CELL =
getDataTestSubjectSelector('securitySolutionFlyoutPrevalenceDetailsTableUserPrevalenceCell');
+
+export const DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_TABLE_HOST_CELL =
+ getDataTestSubjectSelector('securitySolutionFlyoutPrevalenceDetailsTableHostCell');
+export const DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_PREVALENCE_TABLE_USER_CELL =
+ getDataTestSubjectSelector('securitySolutionFlyoutPrevalenceDetailsTableUserCell');
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_preview_panel.ts b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_preview_panel.ts
new file mode 100644
index 0000000000000..08326d56ef53b
--- /dev/null
+++ b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_preview_panel.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getDataTestSubjectSelector } from '../../helpers/common';
+
+/* Preview Section */
+
+export const PREVIEW_SECTION = getDataTestSubjectSelector('previewSection');
+
+export const PREVIEW_BANNER = getDataTestSubjectSelector('previewSectionBannerText');
+
+export const PREVIEW_BACK_BUTTON = getDataTestSubjectSelector('previewSectionBackButton');
+
+export const PREVIEW_CLOSE_BUTTON = getDataTestSubjectSelector('previewSectionCloseButton');
+
+/* Preview Footer */
+
+export const DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER = getDataTestSubjectSelector(
+ 'securitySolutionFlyoutPreviewFooter'
+);
+export const DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER_LINK = getDataTestSubjectSelector(
+ 'securitySolutionFlyoutPreviewFooterLink'
+);
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_right_panel_overview_tab.ts b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_right_panel_overview_tab.ts
index 33e625d1db89a..2dbadb730096e 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_right_panel_overview_tab.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_right_panel_overview_tab.ts
@@ -66,6 +66,12 @@ export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_SECTION_CONTENT =
export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_INSIGHTS_ENTITIES_HEADER =
getDataTestSubjectSelector('securitySolutionFlyoutInsightsEntitiesTitleLink');
+export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_HOST_OVERVIEW_LINK = getDataTestSubjectSelector(
+ 'securitySolutionFlyoutInsightsEntitiesHostOverviewLink'
+);
+export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB_USER_OVERVIEW_LINK = getDataTestSubjectSelector(
+ 'securitySolutionFlyoutInsightsEntitiesUserOverviewLink'
+);
/* Insights Threat Intelligence */
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/hosts/flyout_host_panel.ts b/x-pack/test/security_solution_cypress/cypress/screens/hosts/flyout_host_panel.ts
index 12f0256a24a34..e3173bd17d583 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/hosts/flyout_host_panel.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/hosts/flyout_host_panel.ts
@@ -8,3 +8,5 @@
import { getDataTestSubjectSelector } from '../../helpers/common';
export const HOST_PANEL_HEADER = getDataTestSubjectSelector('host-panel-header');
+export const HOST_PREVIEW_PANEL_FOOTER = getDataTestSubjectSelector('host-preview-footer');
+export const OPEN_HOST_FLYOUT_LINK = getDataTestSubjectSelector('open-host-flyout');
diff --git a/x-pack/test/security_solution_cypress/cypress/screens/users/flyout_user_panel.ts b/x-pack/test/security_solution_cypress/cypress/screens/users/flyout_user_panel.ts
index 40507311d424d..66205566bde66 100644
--- a/x-pack/test/security_solution_cypress/cypress/screens/users/flyout_user_panel.ts
+++ b/x-pack/test/security_solution_cypress/cypress/screens/users/flyout_user_panel.ts
@@ -18,3 +18,6 @@ export const OKTA_MANAGED_DATA_TITLE = `${MANAGED_DATA_SECTION} ${getDataTestSub
export const ENTRA_MANAGED_DATA_TITLE = `${MANAGED_DATA_SECTION} ${getDataTestSubjectSelector(
'managed-user-accordion-userAssetEntraLeftSection'
)}`;
+
+export const USER_PREVIEW_PANEL_FOOTER = getDataTestSubjectSelector('user-preview-footer');
+export const OPEN_USER_FLYOUT_LINK = getDataTestSubjectSelector('open-user-flyout');
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/alert_details_left_panel_correlations_tab.ts b/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/alert_details_left_panel_correlations_tab.ts
index a86f9a74b18d0..50736a5b7ab9e 100644
--- a/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/alert_details_left_panel_correlations_tab.ts
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/alert_details_left_panel_correlations_tab.ts
@@ -10,6 +10,9 @@ import {
CORRELATIONS_SESSION_SECTION_INVESTIGATE_IN_TIMELINE_BUTTON,
CORRELATIONS_SOURCE_SECTION_INVESTIGATE_IN_TIMELINE_BUTTON,
DOCUMENT_DETAILS_FLYOUT_INSIGHTS_TAB_CORRELATIONS_BUTTON,
+ CORRELATIONS_ANCESTRY_SECTION_PREVIEW_BUTTON,
+ CORRELATIONS_SESSION_SECTION_PREVIEW_BUTTON,
+ CORRELATIONS_SOURCE_SECTION_PREVIEW_BUTTON,
} from '../../screens/expandable_flyout/alert_details_left_panel_correlations_tab';
/**
@@ -27,15 +30,36 @@ export const openTimelineFromRelatedSourceEvent = () => {
};
/**
- * Open timeline from the related by source event
+ * Click expand button from the related by source table
+ */
+export const clickExpandFromRelatedBySource = (index = 0) => {
+ cy.get(CORRELATIONS_SOURCE_SECTION_PREVIEW_BUTTON).eq(index).click();
+};
+
+/**
+ * Open timeline from the related by ancestry
*/
export const openTimelineFromRelatedByAncestry = () => {
cy.get(CORRELATIONS_ANCESTRY_SECTION_INVESTIGATE_IN_TIMELINE_BUTTON).click();
};
+/**
+ * Click expand button from the related by ancestry table
+ */
+export const clickExpandFromRelatedByAncestry = (index = 0) => {
+ cy.get(CORRELATIONS_ANCESTRY_SECTION_PREVIEW_BUTTON).eq(index).click();
+};
+
/**
* Open timeline from the related by source event
*/
export const openTimelineFromRelatedBySession = () => {
cy.get(CORRELATIONS_SESSION_SECTION_INVESTIGATE_IN_TIMELINE_BUTTON).click();
};
+
+/**
+ * Click expand button from the related by session table
+ */
+export const clickExpandFromRelatedBySession = (index = 0) => {
+ cy.get(CORRELATIONS_SESSION_SECTION_PREVIEW_BUTTON).eq(index).click();
+};
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/alert_details_preview_panel.ts b/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/alert_details_preview_panel.ts
new file mode 100644
index 0000000000000..b3d20d27afbe9
--- /dev/null
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/alert_details_preview_panel.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+ DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER_LINK,
+ PREVIEW_BACK_BUTTON,
+ PREVIEW_CLOSE_BUTTON,
+} from '../../screens/expandable_flyout/alert_details_preview_panel';
+
+/**
+ * Close preview panel
+ */
+export const closePreview = () => {
+ cy.get(PREVIEW_CLOSE_BUTTON).click();
+};
+
+/**
+ * Go to previous preview
+ */
+export const goToPreviousPreview = () => {
+ cy.get(PREVIEW_BACK_BUTTON).click();
+};
+
+/**
+ * Click link in footer to open document details flyout
+ */
+export const openNewFlyout = () => {
+ cy.get(DOCUMENT_DETAILS_FLYOUT_PREVIEW_FOOTER_LINK).click();
+};
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/alert_details_right_panel.ts b/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/alert_details_right_panel.ts
index 3934b170f43c0..e5cd3a0264b33 100644
--- a/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/alert_details_right_panel.ts
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/expandable_flyout/alert_details_right_panel.ts
@@ -42,15 +42,15 @@ export const collapseDocumentDetailsExpandableFlyoutLeftSection = () => {
/**
* Open the Table tab in the document details expandable flyout right section
*/
-export const openTableTab = () => {
- cy.get(DOCUMENT_DETAILS_FLYOUT_TABLE_TAB).click();
+export const openTableTab = (index = 0) => {
+ cy.get(DOCUMENT_DETAILS_FLYOUT_TABLE_TAB).eq(index).click();
};
/**
* Open the Json tab in the document details expandable flyout right section
*/
-export const openJsonTab = () => {
- cy.get(DOCUMENT_DETAILS_FLYOUT_JSON_TAB).click();
+export const openJsonTab = (index = 0) => {
+ cy.get(DOCUMENT_DETAILS_FLYOUT_JSON_TAB).eq(index).click();
};
/**