[Security Solution]show top modal of Observed data Table field have raw event by default

[ghost]

Describe the bug: show top modal of Observed data Table field have raw event by default

Kibana/Elasticsearch Stack version

Version: 8.13.0 BC2
Commit: c2fc8da128504d437897970d142efd4d06970c0b
Build: 71815

Functional Area: Asset Criticality

precondition

• Required Feature Flag need to present in kibana yml

Steps to reproduce

• Navigate to Alert Page
• Scroll in table to find hostname or username
• Click on its value to open the fly out
• scroll down to Observed Data
• hover the mouse over the observed data value
• Click on Show top action
• Observed that Raw events filter is selected by default however it should be detection alerts

Additional Result

• N/A

Current Result

• show top modal of Observed data Table field have raw event by default

Expected Result

• show top modal of Observed data Table field should be Detection Alerts

Screen-Shot:

https://github.com/elastic/kibana/assets/59917825/bcbf5828-da4f-418e-952b-caa79597d7f5

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[amolnater-qasource]

Reviewed & assigned to @MadameSheema

[elasticmachine]

Pinging @elastic/security-entity-analytics (Team:Entity Analytics)

[machadoum]

I tested the old flyout, and it also preselects raw events inside the top-n visualization:

https://github.com/elastic/kibana/assets/1490444/dacd69cf-0e6c-4b37-828b-d2bed92f6821

I believe this feature is working as expected. The alerts table shows data from the alerts data view, so when investigating a field inside the table, it preselects "Detection and Alerts". But the entity flyout shows data from the security solution data view, so when investigating a field inside the flyout, it preselects "Raw events". In the video below, you can see how the index patterns are consistent.

https://github.com/elastic/kibana/assets/1490444/9e9deae4-33f4-42e0-96db-d99937bbc6ce

@karanbirsingh-qasource Please let me know if I am missing something here; otherwise, we can close the issue.

[ghost]

thanks @machadoum for sharing the insight we are closing this issue as expected.