[Security Solution][Rule with Data View] Analyzer preview details not present under Visualization section of Alert Flyout

karanbirsingh-qasource commented 10 months ago

Describe the bug: [Rule with Data View] Analyzer preview details not present under Visualization section of Alert Flyout

Kibana/Elasticsearch Stack version Version: 8.10.0 BC2 Commit: fa3473f42d7c5e7a3c2d66026a153e01002f5d3c Build: 66107

Browser and Browser OS Version: Firefox for windows OS Version: 116.0.3

Elastic Endpoint Version: v8.10.2

Original install method: Build summary: https://staging.elastic.co/8.10.0-049269aa/summary-8.10.0.html

Functional Area: Alert Flyout

Initial Setup:

Rule with Data View should be available with generated alert
Alert data should have associated analyzer present also

Steps to reproduce

Go to Alert generated from rule using data view not index pattern
click on view details
Expand visualizations section
observed no analyzer preview details

Additional Observation

Analyzer details are available in expanded alert fly out
Analyzer details are available in alert table

Current behavior

[Rule with Data View] Analyzer preview details not present under Visualization section of Alert Flyout

Expected behavior:

[Rule with Data View] Analyzer preview details should be present under Visualization section of Alert Flyout

Screen-Shot:

https://github.com/elastic/kibana/assets/59917825/118c69e5-6781-458b-a162-9b21cb1f2b2b

Errors in browser console:

None

Any additional context (logs, chat logs, magical formulas, etc.):

None

elasticmachine commented 10 months ago

Pinging @elastic/security-solution (Team: SecuritySolution)

amolnater-qasource commented 10 months ago

Reviewed & assigned to @MadameSheema

PhilippeOberti commented 10 months ago

@karanbirsingh-qasource I believe this issue should be fixed by this PR, which will be available in BC3.

The behavior has now changed to:

if the analyzer graph isn't available for this alert we change the link title to plain text (not clickable) and we show a No analyzer graph data available message below
if the analyzer graph is available, we show the summary and when the user clicks on the link title we open timeline to the Analyzer tab

Note: the logic above is also applied to the session preview section.

elasticmachine commented 10 months ago

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

karanbirsingh-qasource commented 10 months ago

Hi @MadameSheema

We have validated this issue on 8.10 BC3 and found the issue to be still occuring ❌ . No Details under Analyzer preview Alert Flyout.

Kibana/Elasticsearch Stack version

Version: 8.10.0 BC3
Commit: 56348fa0ed0719679e24d6c58dc3dbee03928c4e
Build: 66261

Screen-Cast:

https://github.com/elastic/kibana/assets/59917825/71a930eb-526f-4091-b2b4-d07c13fbcc03

thanks !!

MadameSheema commented 10 months ago

@PhilippeOberti can you please take a look at the above? Thanks!!

@karanbirsingh-qasource can you please share the credentials of your instance? Thanks!

PhilippeOberti commented 10 months ago

@karanbirsingh-qasource this PR fixed the issue, and will be available in BC4

karanbirsingh-qasource commented 10 months ago

Hi @PhilippeOberti

we have validated this issue on 8.10 Bc4 and found the issue to fixed now ✔️ .

Build Details:

Version: 8.10.0 BC4
Commit: 913dd8bc6679bec38486d44673ce27a1fb7a107b
Build: 66329

Screen-Shot:

Hence we are closing this issue and adding "QA:Validated" tag to it.

thanks !!

elastic / kibana

[Security Solution][Rule with Data View] Analyzer preview details not present under Visualization section of Alert Flyout #164829