diff --git a/cypress/integration/3_alerts.spec.js b/cypress/integration/3_alerts.spec.js
index 98c8ba03..de17c6bb 100644
--- a/cypress/integration/3_alerts.spec.js
+++ b/cypress/integration/3_alerts.spec.js
@@ -222,7 +222,7 @@ describe('Alerts', () => {
// and matches each entry with the corresponding element line.
const document = JSON.stringify(JSON.parse('{"winlog.event_id": 2003}'), null, 2);
const documentLines = document.split('\n');
- cy.get('[data-test-subj="finding-details-flyout-document-toggle-0"]').click({ force: true });
+
cy.get('[data-test-subj="finding-details-flyout-rule-document-0"]')
.get('[class="euiCodeBlock__line"]')
.each((lineElement, lineIndex) => {
diff --git a/public/pages/Findings/components/FindingDetailsFlyout.tsx b/public/pages/Findings/components/FindingDetailsFlyout.tsx
index 60501b7b..9695c6ac 100644
--- a/public/pages/Findings/components/FindingDetailsFlyout.tsx
+++ b/public/pages/Findings/components/FindingDetailsFlyout.tsx
@@ -90,6 +90,13 @@ export default class FindingDetailsFlyout extends Component<
> {
constructor(props: FindingDetailsFlyoutProps) {
super(props);
+ const relatedDocuments: FindingDocumentItem[] = this.getRelatedDocuments();
+ const docIdToExpandedRowMap: FindingDetailsFlyoutState['docIdToExpandedRowMap'] = {};
+
+ if (relatedDocuments.length === 1) {
+ docIdToExpandedRowMap[relatedDocuments[0].id] = this.createDocumentBlock(relatedDocuments[0]);
+ }
+
this.state = {
loading: false,
ruleViewerFlyoutData: null,
@@ -110,7 +117,7 @@ export default class FindingDetailsFlyout extends Component<
loadingIndexPatternId: true,
areCorrelationsLoading: true,
allRules: {},
- docIdToExpandedRowMap: {},
+ docIdToExpandedRowMap,
};
}
@@ -319,8 +326,7 @@ export default class FindingDetailsFlyout extends Component<
return patternId;
};
- toggleDocumentDetails(item: FindingDocumentItem) {
- const docIdToExpandedRowMapValues = { ...this.state.docIdToExpandedRowMap };
+ createDocumentBlock = (item: FindingDocumentItem) => {
let formattedDocument = '';
try {
formattedDocument = document ? JSON.stringify(JSON.parse(item.document), null, 2) : '';
@@ -328,20 +334,41 @@ export default class FindingDetailsFlyout extends Component<
// no-op
}
+ return (
+
+
+ {formattedDocument}
+
+
+ );
+ };
+
+ getRelatedDocuments() {
+ const {
+ finding: { document_list, related_doc_ids },
+ } = this.props;
+ const relatedDocIdsSet = new Set(related_doc_ids);
+ const relatedDocuments: FindingDocumentItem[] = [];
+ document_list.forEach((documentInfo) => {
+ if (documentInfo.found && relatedDocIdsSet.has(documentInfo.id)) {
+ relatedDocuments.push({ ...documentInfo, itemIdx: relatedDocuments.length });
+ }
+ });
+
+ return relatedDocuments;
+ }
+
+ toggleDocumentDetails(item: FindingDocumentItem) {
+ const docIdToExpandedRowMapValues = { ...this.state.docIdToExpandedRowMap };
+
if (docIdToExpandedRowMapValues[item.id]) {
delete docIdToExpandedRowMapValues[item.id];
} else {
- docIdToExpandedRowMapValues[item.id] = (
-
-
- {formattedDocument}
-
-
- );
+ docIdToExpandedRowMapValues[item.id] = this.createDocumentBlock(item);
}
this.setState({ docIdToExpandedRowMap: docIdToExpandedRowMapValues });
@@ -349,16 +376,10 @@ export default class FindingDetailsFlyout extends Component<
renderFindingDocuments(loadingIndexPatternId: boolean) {
const {
- finding: { index, document_list, related_doc_ids },
+ finding: { index },
} = this.props;
const { indexPatternId, docIdToExpandedRowMap } = this.state;
- const relatedDocIdsSet = new Set(related_doc_ids);
- const relatedDocuments: FindingDocumentItem[] = [];
- document_list.forEach((documentInfo) => {
- if (documentInfo.found && relatedDocIdsSet.has(documentInfo.id)) {
- relatedDocuments.push({ ...documentInfo, itemIdx: relatedDocuments.length });
- }
- });
+ const relatedDocuments: FindingDocumentItem[] = this.getRelatedDocuments();
if (relatedDocuments.length === 0) {
return (
@@ -380,10 +401,10 @@ export default class FindingDetailsFlyout extends Component<
const actions = [
{
render: ({ id }: FindingDocumentItem) => (
-
+
{
if (indexPatternId) {
@@ -425,7 +446,7 @@ export default class FindingDetailsFlyout extends Component<
return (
<>
- Documents
+ Documents ({relatedDocuments.length})