[Response Ops] Align Alert Counts Between Case and Alert Table for Correlation Rule Types

[pborgonovi]

Description:

Currently, when using the functionality to automatically open a Case as an action from a rule run, there is a discrepancy in the number of alerts displayed in the Case compared to the Alert Table, specifically for Correlation rule types.

Current behavior:

• In the Alert Table, “building block alerts” are hidden, reducing the visible number of alerts.
• In the Case, “building block alerts” are displayed, resulting in a higher number of alerts.

This difference is seen when Cases are automatically opened due to rule runs, creating an inconsistency in the user experience, as they see different alert counts in different parts of the application. After discussions with the Detection Engine and ResponseOps teams, it was determined that this is the current intended behavior and not a bug. However, it would be beneficial for product consistency if both components behaved the same way regarding “building block alerts.”

Alerts table view:

Case alerts view:

When selecting Include building block alerts in Alerts table we have the amounts matching:

Proposal:

Align the behavior of the Alert Table and the Case so that both consistently display or hide “building block alerts.”

• Option 1: Make “building block alerts” visible in the Alert Table, aligning it with the Case behavior.
• Option 2: Make “building block alerts” hidden in the Case, aligning it with the Alert Table behavior.

Justification:

• Improved user experience: Aligning the behavior will avoid confusion when comparing the number of alerts between the Alert Table and the Case.
• Consistency: Both views should display the same number of alerts, preventing discrepancies and potential misunderstandings.

Impact:

This change directly impacts the usability and trust in the information presented, especially when monitoring critical alerts and automatically creating Cases through rule runs.

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[elasticmachine]

Pinging @elastic/response-ops-cases (Feature:Cases)