[Security Solution] [Trigger Actions] Alert Table Refactoring

x-pack/plugins/cases/public/components/case_view/components/case_view_alerts.test.tsx

@@ -45,7 +45,7 @@ describe('Case View Page activity tab', () => {
     await waitFor(async () => {
       expect(getAlertsStateTableMock).toHaveBeenCalledWith({
         alertsTableConfigurationRegistry: expect.anything(),
-        configurationId: 'securitySolution',
+        configurationId: 'securitySolution-case',
         featureIds: ['siem', 'observability'],
         id: 'case-details-alerts-securitySolution',
         query: {

x-pack/plugins/cases/public/components/case_view/components/case_view_alerts.tsx

@@ -39,9 +39,12 @@ export const CaseViewAlerts = ({ caseData }: CaseViewAlertsProps) => {
   const { isLoading: isLoadingAlertFeatureIds, data: alertFeatureIds } =
     useGetFeatureIds(alertRegistrationContexts);
 
+  const configId =
+    caseData.owner === SECURITY_SOLUTION_OWNER ? `${caseData.owner}-case` : caseData.owner;
+
   const alertStateProps = {
     alertsTableConfigurationRegistry: triggersActionsUi.alertsTableConfigurationRegistry,
-    configurationId: caseData.owner,
+    configurationId: configId,
     id: `case-details-alerts-${caseData.owner}`,
     flyoutSize: (alertFeatureIds?.includes('siem') ? 'm' : 's') as EuiFlyoutSize,
     featureIds: alertFeatureIds ?? [],

x-pack/plugins/observability/public/config/register_alerts_table_configuration.tsx

@@ -8,8 +8,9 @@
 import type { GetRenderCellValue } from '@kbn/triggers-actions-ui-plugin/public';
 import { TIMESTAMP } from '@kbn/rule-data-utils';
 import { SortOrder } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import { AlertsTableConfigurationRegistry } from '@kbn/triggers-actions-ui-plugin/public/types';
 import { casesFeatureId, observabilityFeatureId } from '../../common';
-import { useBulkAddToCaseActions } from '../hooks/use_alert_bulk_case_actions';
+import { useBulkAddToCaseTriggerActions } from '../hooks/use_alert_bulk_case_actions';
 import { TopAlert, useToGetInternalFlyout } from '../pages/alerts';
 import { getRenderCellValue } from '../pages/alerts/components/render_cell_value';
 import { addDisplayNames } from '../pages/alerts/containers/alerts_table/add_display_names';
@@ -21,7 +22,7 @@ import type { ConfigSchema } from '../plugin';
 const getO11yAlertsTableConfiguration = (
   observabilityRuleTypeRegistry: ObservabilityRuleTypeRegistry,
   config: ConfigSchema
-) => ({
+): AlertsTableConfigurationRegistry => ({
   id: observabilityFeatureId,
   casesFeatureId,
   columns: alertO11yColumns.map(addDisplayNames),
@@ -36,7 +37,7 @@ const getO11yAlertsTableConfiguration = (
     },
   ],
   useActionsColumn: getRowActions(observabilityRuleTypeRegistry, config),
-  useBulkActions: useBulkAddToCaseActions,
+  useBulkActions: useBulkAddToCaseTriggerActions,
   useInternalFlyout: () => {
     const { header, body, footer } = useToGetInternalFlyout(observabilityRuleTypeRegistry);
     return { header, body, footer };

x-pack/plugins/observability/public/hooks/use_alert_bulk_case_actions.ts

@@ -70,3 +70,12 @@ export const useBulkAddToCaseActions = ({ onClose, onSuccess }: UseAddToCaseActi
     selectCaseModal,
   ]);
 };
+
+/*
+ * Wrapper hook to support trigger actions
+ * registry props for the alert table
+ *
+ * */
+export const useBulkAddToCaseTriggerActions = () => {
+  return useBulkAddToCaseActions({});
+};

x-pack/plugins/security_solution/common/constants.ts

@@ -12,7 +12,6 @@
  * https://mariusschulz.com/blog/literal-type-widening-in-typescript
  * Please follow this convention when adding to this file
  */
-
 export const APP_ID = 'securitySolution' as const;
 export const APP_UI_ID = 'securitySolutionUI' as const;
 export const CASES_FEATURE_ID = 'securitySolutionCases' as const;
@@ -497,3 +496,17 @@ export const DEFAULT_DETECTION_PAGE_FILTERS = [
 
 export const CELL_ACTIONS_DEFAULT_TRIGGER = 'security-solution-default-cellActions';
 export const CELL_ACTIONS_TIMELINE_TRIGGER = 'security-solution-timeline-cellActions';
+
+/** This local storage key stores the `Grid / Event rendered view` selection */
+export const ALERTS_TABLE_VIEW_SELECTION_KEY = 'securitySolution.alerts.table.view-selection';
+
+export const VIEW_SELECTION = {
+  gridView: 'gridView',
+  eventRenderedView: 'eventRenderedView',
+} as const;
+
+export const ALERTS_TABLE_REGISTRY_CONFIG_IDS = {
+  ALERTS_PAGE: `${APP_ID}-alerts-page`,
+  RULE_DETAILS: `${APP_ID}-rule-details`,
+  CASE: `${APP_ID}-case`,
+} as const;

x-pack/plugins/security_solution/common/types/data_table/index.ts

@@ -6,6 +6,7 @@
  */
 
 import * as runtimeTypes from 'io-ts';
+import type { VIEW_SELECTION } from '../../constants';
 
 export enum Direction {
   asc = 'asc',
@@ -33,6 +34,7 @@ export enum TableId {
   alternateTest = 'alternateTest',
   rulePreview = 'rule-preview',
   kubernetesPageSessions = 'kubernetes-page-sessions',
+  alertsOnCasePage = 'alerts-case-page',
 }
 
 const TableIdLiteralRt = runtimeTypes.union([
@@ -46,4 +48,9 @@ const TableIdLiteralRt = runtimeTypes.union([
   runtimeTypes.literal(TableId.rulePreview),
   runtimeTypes.literal(TableId.kubernetesPageSessions),
 ]);
+
 export type TableIdLiteral = runtimeTypes.TypeOf<typeof TableIdLiteralRt>;
+
+export type ViewSelectionTypes = keyof typeof VIEW_SELECTION;
+
+export type ViewSelection = typeof VIEW_SELECTION[ViewSelectionTypes];

x-pack/plugins/security_solution/cypress/ccs_e2e/detection_alerts/alerts_details.cy.ts

@@ -7,7 +7,7 @@
 
 import { JSON_TEXT } from '../../screens/alerts_details';
 
-import { expandFirstAlert, waitForAlertsPanelToBeLoaded } from '../../tasks/alerts';
+import { expandFirstAlert, waitForAlerts } from '../../tasks/alerts';
 import { openJsonView } from '../../tasks/alerts_details';
 import { createCustomRuleEnabled } from '../../tasks/api_calls/rules';
 import { cleanKibana } from '../../tasks/common';
@@ -25,7 +25,7 @@ describe('Alert details with unmapped fields', () => {
     esArchiverCCSLoad('unmapped_fields');
     createCustomRuleEnabled(getUnmappedCCSRule());
     visitWithoutDateRange(ALERTS_URL);
-    waitForAlertsPanelToBeLoaded();
+    waitForAlerts();
     expandFirstAlert();
   });
 

x-pack/plugins/security_solution/cypress/e2e/data_sources/create_runtime_field.cy.ts

@@ -16,11 +16,13 @@ import { createCustomRuleEnabled } from '../../tasks/api_calls/rules';
 import { getNewRule } from '../../objects/rule';
 import { refreshPage } from '../../tasks/security_header';
 import { waitForAlertsToPopulate } from '../../tasks/create_new_rule';
-import { openEventsViewerFieldsBrowser } from '../../tasks/hosts/events';
 import { assertFieldDisplayed, createField } from '../../tasks/create_runtime_field';
+import { openAlertsFieldBrowser } from '../../tasks/alerts';
+import { deleteAlertsIndex } from '../../tasks/sourcerer';
 
 describe('Create DataView runtime field', () => {
   before(() => {
+    deleteAlertsIndex();
     login();
   });
 
@@ -30,7 +32,7 @@ describe('Create DataView runtime field', () => {
     createCustomRuleEnabled(getNewRule());
     refreshPage();
     waitForAlertsToPopulate();
-    openEventsViewerFieldsBrowser();
+    openAlertsFieldBrowser();
 
     createField(fieldName);
     assertFieldDisplayed(fieldName, 'alerts');

x-pack/plugins/security_solution/cypress/e2e/detection_alert_details/navigation.cy.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { expandFirstAlert, waitForAlertsPanelToBeLoaded } from '../../tasks/alerts';
+import { expandFirstAlert, waitForAlerts } from '../../tasks/alerts';
 import { createCustomRuleEnabled } from '../../tasks/api_calls/rules';
 import { cleanKibana } from '../../tasks/common';
 import { login, visit } from '../../tasks/login';
@@ -35,7 +35,7 @@ describe('Alert Details Page Navigation', () => {
     describe('context menu', () => {
       beforeEach(() => {
         visit(ALERTS_URL);
-        waitForAlertsPanelToBeLoaded();
+        waitForAlerts();
       });
 
       it('should navigate to the details page from the alert context menu', () => {
@@ -55,7 +55,7 @@ describe('Alert Details Page Navigation', () => {
     describe('flyout', () => {
       beforeEach(() => {
         visit(ALERTS_URL);
-        waitForAlertsPanelToBeLoaded();
+        waitForAlerts();
       });
 
       it('should navigate to the details page from the alert flyout', () => {

x-pack/plugins/security_solution/cypress/e2e/detection_alerts/detection_page_filters.cy.ts

@@ -21,7 +21,6 @@ import { APP_ID, DEFAULT_DETECTION_PAGE_FILTERS } from '../../../common/constant
 import { formatPageFilterSearchParam } from '../../../common/utils/format_page_filter_search_param';
 import {
   markAcknowledgedFirstAlert,
-  refreshAlertPageFilter,
   resetFilters,
   selectCountTable,
   waitForAlerts,
@@ -152,7 +151,7 @@ describe.skip('Detections : Page Filters', () => {
       .then((noOfAlerts) => {
         const originalAlertCount = noOfAlerts.split(' ')[0];
         markAcknowledgedFirstAlert();
-        refreshAlertPageFilter();
+        waitForAlerts();
         cy.get(OPTION_LIST_VALUES).eq(0).click();
         cy.get(OPTION_SELECTABLE(0, 'acknowledged')).should('be.visible');
         cy.get(ALERTS_COUNT)

x-pack/plugins/security_solution/cypress/e2e/exceptions/add_edit_flyout/flyout_validation.cy.ts

@@ -46,6 +46,7 @@ import {
   CONFIRM_BTN,
   VALUES_INPUT,
   EXCEPTION_FLYOUT_TITLE,
+  FIELD_INPUT_PARENT,
 } from '../../../screens/exceptions';
 
 import { DETECTIONS_RULE_MANAGEMENT_URL } from '../../../urls/navigation';
@@ -157,8 +158,9 @@ describe('Exceptions flyout', () => {
 
     // delete second item, invalid values 'a' and 'c' should remain
     cy.get(ENTRY_DELETE_BTN).eq(1).click();
-    cy.get(FIELD_INPUT).eq(0).should('have.text', 'agent.name');
-    cy.get(FIELD_INPUT).eq(1).should('have.text', 'c');
+    cy.get(LOADING_SPINNER).should('not.exist');
+    cy.get(FIELD_INPUT_PARENT).eq(0).should('have.text', 'agent.name');
+    cy.get(FIELD_INPUT_PARENT).eq(1).should('have.text', 'c');
 
     closeExceptionBuilderFlyout();
   });
@@ -187,32 +189,32 @@ describe('Exceptions flyout', () => {
     cy.get(ENTRY_DELETE_BTN).eq(3).click();
     cy.get(EXCEPTION_ITEM_CONTAINER)
       .eq(0)
-      .find(FIELD_INPUT)
+      .find(FIELD_INPUT_PARENT)
       .eq(0)
       .should('have.text', 'agent.name');
     cy.get(EXCEPTION_ITEM_CONTAINER)
       .eq(0)
-      .find(FIELD_INPUT)
+      .find(FIELD_INPUT_PARENT)
       .eq(1)
       .should('have.text', 'user.id.keyword');
     cy.get(EXCEPTION_ITEM_CONTAINER)
       .eq(1)
-      .find(FIELD_INPUT)
+      .find(FIELD_INPUT_PARENT)
       .eq(0)
       .should('have.text', 'user.first');
-    cy.get(EXCEPTION_ITEM_CONTAINER).eq(1).find(FIELD_INPUT).eq(1).should('have.text', 'e');
+    cy.get(EXCEPTION_ITEM_CONTAINER).eq(1).find(FIELD_INPUT_PARENT).eq(1).should('have.text', 'e');
 
     // delete remaining entries in exception item 2
     cy.get(ENTRY_DELETE_BTN).eq(2).click();
     cy.get(ENTRY_DELETE_BTN).eq(2).click();
     cy.get(EXCEPTION_ITEM_CONTAINER)
       .eq(0)
-      .find(FIELD_INPUT)
+      .find(FIELD_INPUT_PARENT)
       .eq(0)
       .should('have.text', 'agent.name');
     cy.get(EXCEPTION_ITEM_CONTAINER)
       .eq(0)
-      .find(FIELD_INPUT)
+      .find(FIELD_INPUT_PARENT)
       .eq(1)
       .should('have.text', 'user.id.keyword');
     cy.get(EXCEPTION_ITEM_CONTAINER).eq(1).should('not.exist');
@@ -245,39 +247,47 @@ describe('Exceptions flyout', () => {
     cy.get(ENTRY_DELETE_BTN).eq(4).click();
     cy.get(EXCEPTION_ITEM_CONTAINER)
       .eq(0)
-      .find(FIELD_INPUT)
+      .find(FIELD_INPUT_PARENT)
       .eq(0)
       .should('have.text', 'agent.name');
-    cy.get(EXCEPTION_ITEM_CONTAINER).eq(0).find(FIELD_INPUT).eq(1).should('have.text', 'b');
+    cy.get(EXCEPTION_ITEM_CONTAINER).eq(0).find(FIELD_INPUT_PARENT).eq(1).should('have.text', 'b');
     cy.get(EXCEPTION_ITEM_CONTAINER)
       .eq(1)
-      .find(FIELD_INPUT)
+      .find(FIELD_INPUT_PARENT)
       .eq(0)
       .should('have.text', 'agent.name');
-    cy.get(EXCEPTION_ITEM_CONTAINER).eq(1).find(FIELD_INPUT).eq(1).should('have.text', 'user');
-    cy.get(EXCEPTION_ITEM_CONTAINER).eq(1).find(FIELD_INPUT).eq(2).should('have.text', 'last');
     cy.get(EXCEPTION_ITEM_CONTAINER)
       .eq(1)
-      .find(FIELD_INPUT)
+      .find(FIELD_INPUT_PARENT)
+      .eq(1)
+      .should('have.text', 'user');
+    cy.get(EXCEPTION_ITEM_CONTAINER)
+      .eq(1)
+      .find(FIELD_INPUT_PARENT)
+      .eq(2)
+      .should('have.text', 'last');
+    cy.get(EXCEPTION_ITEM_CONTAINER)
+      .eq(1)
+      .find(FIELD_INPUT_PARENT)
       .eq(3)
       .should('have.text', '@timestamp');
 
     // deleting the last value of a nested entry, should delete the child and parent
     cy.get(ENTRY_DELETE_BTN).eq(4).click();
     cy.get(EXCEPTION_ITEM_CONTAINER)
       .eq(0)
-      .find(FIELD_INPUT)
+      .find(FIELD_INPUT_PARENT)
       .eq(0)
       .should('have.text', 'agent.name');
-    cy.get(EXCEPTION_ITEM_CONTAINER).eq(0).find(FIELD_INPUT).eq(1).should('have.text', 'b');
+    cy.get(EXCEPTION_ITEM_CONTAINER).eq(0).find(FIELD_INPUT_PARENT).eq(1).should('have.text', 'b');
     cy.get(EXCEPTION_ITEM_CONTAINER)
       .eq(1)
-      .find(FIELD_INPUT)
+      .find(FIELD_INPUT_PARENT)
       .eq(0)
       .should('have.text', 'agent.name');
     cy.get(EXCEPTION_ITEM_CONTAINER)
       .eq(1)
-      .find(FIELD_INPUT)
+      .find(FIELD_INPUT_PARENT)
       .eq(1)
       .should('have.text', '@timestamp');
 

x-pack/plugins/security_solution/cypress/e2e/exceptions/rule_details_flow/add_edit_endpoint_exception.cy.ts

@@ -43,9 +43,9 @@ import {
   CLOSE_SINGLE_ALERT_CHECKBOX,
   EXCEPTION_ITEM_CONTAINER,
   VALUES_INPUT,
-  FIELD_INPUT,
   EXCEPTION_CARD_ITEM_NAME,
   EXCEPTION_CARD_ITEM_CONDITIONS,
+  FIELD_INPUT_PARENT,
 } from '../../../screens/exceptions';
 import { createEndpointExceptionList } from '../../../tasks/api_calls/exceptions';
 
@@ -143,7 +143,11 @@ describe('Add endpoint exception from rule details', () => {
     editExceptionFlyoutItemName(NEW_ITEM_NAME);
 
     // check that the existing item's field is being populated
-    cy.get(EXCEPTION_ITEM_CONTAINER).eq(0).find(FIELD_INPUT).eq(0).should('have.text', ITEM_FIELD);
+    cy.get(EXCEPTION_ITEM_CONTAINER)
+      .eq(0)
+      .find(FIELD_INPUT_PARENT)
+      .eq(0)
+      .should('have.text', ITEM_FIELD);
     cy.get(VALUES_INPUT).should('have.text', 'foo');
 
     // edit conditions

x-pack/plugins/security_solution/cypress/e2e/exceptions/rule_details_flow/add_edit_exception.cy.ts

@@ -8,7 +8,7 @@
 import { getException, getExceptionList } from '../../../objects/exception';
 import { getNewRule } from '../../../objects/rule';
 
-import { ALERTS_COUNT, EMPTY_ALERT_TABLE, NUMBER_OF_ALERTS } from '../../../screens/alerts';
+import { ALERTS_COUNT, EMPTY_ALERT_TABLE } from '../../../screens/alerts';
 import { createCustomRule, createCustomRuleEnabled } from '../../../tasks/api_calls/rules';
 import { goToRuleDetails } from '../../../tasks/alerts_detection_rules';
 import {
@@ -52,10 +52,10 @@ import {
   CONFIRM_BTN,
   ADD_TO_SHARED_LIST_RADIO_INPUT,
   EXCEPTION_ITEM_CONTAINER,
-  FIELD_INPUT,
   VALUES_MATCH_ANY_INPUT,
   EXCEPTION_CARD_ITEM_NAME,
   EXCEPTION_CARD_ITEM_CONDITIONS,
+  FIELD_INPUT_PARENT,
 } from '../../../screens/exceptions';
 import {
   createExceptionList,
@@ -145,7 +145,7 @@ describe('Add/edit exception from rule details', () => {
       // check that the existing item's field is being populated
       cy.get(EXCEPTION_ITEM_CONTAINER)
         .eq(0)
-        .find(FIELD_INPUT)
+        .find(FIELD_INPUT_PARENT)
         .eq(0)
         .should('have.text', ITEM_FIELD);
       cy.get(VALUES_MATCH_ANY_INPUT).should('have.text', 'foo');
@@ -317,7 +317,7 @@ describe('Add/edit exception from rule details', () => {
       // Closed alert should appear in table
       goToClosedAlertsOnRuleDetailsPage();
       cy.get(ALERTS_COUNT).should('exist');
-      cy.get(NUMBER_OF_ALERTS).should('have.text', `${NUMBER_OF_AUDITBEAT_EXCEPTIONS_ALERTS}`);
+      cy.get(ALERTS_COUNT).should('have.text', `${NUMBER_OF_AUDITBEAT_EXCEPTIONS_ALERTS}`);
 
       // Remove the exception and load an event that would have matched that exception
       // to show that said exception now starts to show up again
@@ -332,12 +332,13 @@ describe('Add/edit exception from rule details', () => {
 
       // now that there are no more exceptions, the docs should match and populate alerts
       goToAlertsTab();
+      waitForAlertsToPopulate();
       goToOpenedAlertsOnRuleDetailsPage();
       waitForTheRuleToBeExecuted();
       waitForAlertsToPopulate();
 
       cy.get(ALERTS_COUNT).should('exist');
-      cy.get(NUMBER_OF_ALERTS).should('have.text', '2 alerts');
+      cy.get(ALERTS_COUNT).should('have.text', '2 alerts');
     });
   });
 });