[Request] New previews in expandable flyout

[christineweng]

Description

In 8.15, we are introducing new previews for host and user (from existing entity analytics flyout), and alert previews. All the updates mentioned in this issue are within the document details flyout (alerts and events), denoted as Details flyout.

There are existing preview experiences in the expandable flyout (i.e. rule preview and alert reason preview). But they are isolated, and once opened, user cannot click another preview.

With the updates in 8.15 (see PRs below), users can now open multiple previews at a time, and there is a back button to go back to the previous previews.

New host and user previews

Details flyout right section

• Highlighted fields: host and user names are hyperlinked and open the respective preview
• Insights -> entities: host and user names are hyperlinked and open the respective preview

Details flyout right section

• Entities tab:
  • host and user names are hyperlinked and open the respective preview
  • In the related users and related hosts table, the names are also hyperlinked
• Prevalence tab: host and user names are hyperlinked and open the respective preview

New alert preview

Details flyout left section

• Correlations: in each tables, related alerts now have an expand button that opens an alert preview

Background & resources

• PRs: [Security Solution] Enable alert preview in document details flyout kibana#186857, [Security Solution] Enable entity previews in document details flyout kibana#186850
• Issues/metas: https://github.com/elastic/security-team/issues/9510
• Point of contact: Christine Weng
• Test environments: available in https://kibana.endpoint.elastic.dev/

Which documentation set does this change impact?

ESS and serverless

ESS release

8.15

Serverless release

Currently behind a feature flag, plan to turn on before July 26

Feature differences

N/A

API docs impact

N/A

Prerequisites, privileges, feature flags

feature flag entityAlertPreviewEnabled

Doc updates

• View detection alert details:
  • Make the Preview panel section more generic so that users know that previews exist in multiple places throughout the flyout.
  • Update the screenshot in the Expanded entities view section:
    • expanded-entities-view.png
    • -detections-expanded-entities-view.png
  • Update the screenshot in the Expanded correlations view section:
    • expanded-correlations-view.png
    • expanded-correlations-view.png