[Fleet]: Tooltip is not available on the "View agents" under Agent Activity Flyout for performed actions.

[harshitgupta-qasource]

Kibana Build details:

VERSION: 8.14.0 SNAPSHOT
BUILD: 73332
COMMIT: 3f75f6aa5da418e85d03a43e89f0dbb89afe75a2

Host OS: All

Preconditions:

1. 8.14.0-SNAPSHOT Kibana cloud environment should be available.
2. Agent upgrade should be failed from any lower version
3. Agent policies should be changed to other Policy

Steps to reproduce:

1. Navigate to Fleet>Agents tab.
2. Click on Agent Activity
3. Observe that Tooltip is not available on the "View agents" under Agent Activity flyout after changing Policy.

Expected Result: Tooltip should be available on the "View agents" under Agent Activity of changed Policy.

Screen Recording:

https://github.com/elastic/kibana/assets/101545338/1d424e11-d8b5-49d4-ad8a-b8f734fd11e9

Feature:

https://github.com/elastic/kibana/issues/153232

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[harshitgupta-qasource]

@amolnater-qasource Kindly review

[amolnater-qasource]

Secondary review for this ticket is Done

[jen-huang]

@jillguyonnet This tooltip only kicks in for POLICY_CHANGE actions and not POLICY_REASSIGN (such as the first action in the above screenshot). Do you think it makes sense to apply it to both?

LOC for future reference: https://github.com/elastic/kibana/blob/980d8bf3012265c2c2da6d695ace343d3d1f8d80/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_activity_flyout/view_agents_button.tsx#L53

[jillguyonnet]

Hey @jen-huang 👋

It seems to me that the current behaviour is correct, i.e. that this tooltip is only relevant for policy change events.

• For policy reassign events, the View agents button correctly filters for the agents that were reassigned at the time of the change. This is because these change events are done at agent level and contain the information of which agent(s) were affected. Therefore, this tooltip would provide incorrect information.
• In contrast, when a policy is modified (POLICY_CHANGE), the change events are generated on the fly from the policy data and contain no such history. This implies that the filtering is done for agents currently assigned (i.e. at the time when the flyout is opened), which may differ from the ones who were assigned at the time of the change. While this is probably not completely ideal, it is a known case and the reason why this tooltip was added for this type of change.

The above can be validated as follows.

Policy reassign

1. Have 2 agents assigned to Agent policy 1.
2. Create a second policy Agent policy 2.
3. Assign 1 agent to Agent policy 2. Wait until the reassign is complete.
4. Assign the other agent to Agent policy 2. Wait until the reassign is complete.
5. Open the agent activity flyout: there should be two events labelled as 1 agent assigned to a new policy. When clicking the View agents button, the oldest event should filter for the first agent only, the newest event should filter for the second agent only.

Policy change

1. Have 2 agents, one assigned to Agent policy 1 and the other assigned to Agent policy 2.
2. Edit the description (or any other field) in Agent policy 1 and save the policy.
3. Open the agent activity flyout: there should be a new event labelled as 1 agent applied policy change. When clicking the View agents button, it should filter for the first agent.
4. Assign the second agent to Agent policy 2. Wait until the reassign is complete.
5. Open the agent activity flyout: there should be a new reassign event, but the thing to notice here is that the previous event (policy change) is now labelled 2 agents applied policy change (instead of 1 agent). When clicking the View agents button, it will now filter for both agents.

Hope this helps, let me know if anything is unclear.

[jen-huang]

Thanks for the clarification Jill! This helps a lot.

@harshitgupta-qasource @amolnater-qasource I will close this as expected behavior based on Jill's notes above. The reassignment action shown in your video is not expected to have a tooltip.

[harshitgupta-qasource]

Thank you for confirming the expected behavior and we will update our test content accordingly. Thanks