[Security Solution]Edit Additional Filter not working for field added from few charts visualization

[ghost]

Describe the bug: Edit Additional Filter not working for field added from few charts visualization

Kibana/Elasticsearch Stack version Version: 8.10.0 BC1 Commit: f8121b897dd65b14366a0958b7fc41bd07a91cb5 Build: 66085

Browser and Browser OS Version: Firefox for windows OS Version: 116.0.3(64-bit)

Elastic Endpoint Version: v8.10.2

Original install method: Build summary: https://staging.elastic.co/8.10.0-b637efd3/summary-8.10.0.html

Functional Area: Additional Filter

Initial Setup:

• Agent with Elastic Defend integration need to be installed
• Generate multiple alert data on the kibana instance

Steps to reproduce

• Navigate to Overview page

Additional Observation

• Issue is not occuring under timeline

Current behavior

• Edit filter is not working and filter field name and value are not showing

Issue is occuring on editing additional filter added from below locations: ❌

• Alert Trend > Filter any Rule > Edit Additional filter
• Events > Filter any event.dataset > Edit Additional filter
• Trend chart > Filter any Rule > Edit Additional filter

Issue is not occuring on editing additional filter added from below locations: ✔️

• Counts charts > Filter any Rule name or host name > Edit Additional filter
• Tree Map > Filter any value > Edit Additional filter
• Summary Map > Alert by name > Filter any value > Edit Additional filter
• Summary Map > Top Alert by > Filter any value > Edit Additional filter
• Severity Level > Top Alert by > Filter any value > Edit Additional filter

Note: There must be many more instance in application for this issue but above are few of them to diagnose the issue.

Expected behavior:

• Edit additional Filter should work correct and filter configuration should show for updation

Screen-cast:

https://github.com/elastic/kibana/assets/59917825/730b1ea3-3e5d-4412-b4b6-fce29d2e6651

Errors in browser console: N/A

Any additional context (logs, chat logs, magical formulas, etc.):

N/A

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[ghost]

@amolnater-qasource please review

[amolnater-qasource]

Reviewed & Assigned to @MadameSheema

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[angorayc]

When I click the Filter for from the action in here and edit the filter, it shows me the data view dropdown. But if I open it in Lens, and filter for a legend bucket, it wouldn't show the data view dropdown when editing.

https://github.com/elastic/kibana/assets/6295984/a647eca8-af60-4fd7-a04e-ab83c6125884

[angorayc]

In 8.12 this issue is back again: we could see that data view is not selected by default when editing a filter. I also found that in src/plugins/unified_search/public/filter_bar/filter_editor/filter_editor.tsx line 165, getIndexPatternFromFilter is not returning the correct data view as some of the filters on Security page does not have filter.meta.index

[e40pud]

Here is the list of the places where we create filters without filter.meta.index set:

• packages/kbn-cell-actions/src/actions/filter/create_filter.ts
• x-pack/plugins/timelines/public/components/hover_actions/utils.ts

and there are quite a few places in security solution where we use those methods.

We do not add data view id to a filter within "cell actions".

[semd]

Fix merged into 8.13 and above. @karanbirsingh-qasource could you test again?

[ghost]

Hi @MadameSheema

we have validated this issue on 8.13.1 and found this issue to be fixed now ✔️

Build Details:

Version: 8.13.1
Commit: 091f486ab05863258cf2f3fa18ea0c59097dee80
Build: 72107