[Security Solution] [Response Ops] ecsRowData in alerts table improperly formatted

[kqualters-elastic]

Kibana version:
8.8+

ecsRowData passed to each row and ultimately to the onClick handler that runs when a user selects "Investigate in Timeline" from an alert row has the kibana.alert.rule.exception_list property formatted very strangely when there is 1 entry in the list, it's an Object who's keys are arrays of 1 string. This makes the code https://github.com/elastic/kibana/blob/051ac85c07bd883550236e6ebca763ef64801507/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_investigate_in_timeline.tsx#LL72C48-L72C48 here that was working for most of 8.0 no longer function correctly. I'm not sure if the format of the exception list being passed is correct and this code needs to be updated to account for it, or if there's a bug in the logic in

kibana/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/hooks/use_fetch_alerts.tsx

Line 222 in 051ac85

const alerts = rawResponse.hits.hits.reduce<Alerts>((acc, hit) => {

seems more likely to be the latter, but need to confirm that.

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[PhilippeOberti]

@kqualters-elastic can you take a look at this and comment if this has been fixed or still needs to be worked on?
Thanks!

[cnasikas]

@umbopepato is working on a lot of improvements related to the alerts table. @umbopepato Any idea if this issue will be resolved at some point by your work?

[umbopepato]

I didn't know about this issue but yes, it's the perfect occasion to solve this especially since it's my understanding that both ResOps and Security want to finally remove the deprecated alert formats (oldAlertsData and ecsData) 🙂

In any case, I don't know exactly what's the old format and how it changed (I tried to create a Security rule with exceptions but the generated alerts don't have the kibana.alert.rule.exceptions_list field at all... @kqualters-elastic do you have an example before/after document to share?) but I bet it's the conversion to ecsData that produces objects with a wrong format (perhaps lodash's set creates deep keys even where you don't expect them?).

Considered this, the very poor/missing typing information and other issues I'd say the best solution overall would be to finally deprecate these old formats. We'll follow up on this as soon as I finish moving the alerts table code to its dedicated package!