search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.48k stars 8.05k forks source link

[Feature Request][Security] Pop out the alert flyout to a new window to allow a larger view of the alert details #153240

Open aarju opened 1 year ago

aarju commented 1 year ago

Describe the feature: This feature would provide the user with a button in the alert details flyout to 'Open in a new window'. Once open the details window would stay synchronized with the original window Alert View window so that if a new alert is selected in the list of alerts the details view would update to show the newly selected alert.

Describe a specific use case for the feature: When viewing the alert detail flyout the view will often become very compressed when the alert contains long field names or values. Most SOC Analysts have multiple monitors so having the ability to view the details in a separate monitor from the list of alerts would help speed up their triage workflows.

cc @paulewing

elasticmachine commented 1 year ago

Pinging @elastic/security-solution (Team: SecuritySolution)

PhilippeOberti commented 10 months ago

@michaelolo24 I think the Share Alert feature you implemented in this PR and that was ported to the new expandable flyout could solve the use case of this ticket?

michaelolo24 commented 10 months ago

@PhilippeOberti . Not completely...we'd have to

  1. Enable the flyout to full screen and take up the whole window (full screen flyout....sound familiar? lol)
  2. Enable cross tab communication either via localstorage events or window.postMessage to update the active event id
  3. Optional, but have the ability to "re-dock" the flyout if the other window is closed
PhilippeOberti commented 10 months ago

  1. Enable the flyout to full screen and take up the whole window (full screen flyout....sound familiar? lol) The expandable flyout isn't completely full page but it's pretty wide, so we could think about adding new section in the left panel for this?

  2. Enable cross tab communication either via localstorage events or window.postMessage to update the active event id Adding the alert navigation in our expandable flyout (like done in Discover) would help here. No need to synchronize things between tabs... just navigate within the flyout

I see what you mean though, to answer the feature asked exactly, these 3 points would have to be done. I just feel like there might be other UIUX patterns we could apply that would allow us to get these without implementing something extremely complex.