[Security team: AWP] Session view: Alert details tab

[mitodrummer]

Summary

Issue: #126065

Implementation complete for the Alerts tab in the Session View details panel. I've also broken the loading of alerts and process events apart into their own routes. The new alerts_route will load a fixed number of alerts for the session (currently 1000). This is done so we don't need to coordinate loading pages of process events and alert events in order to show status in process tree.

The alerts tab will show all alerts for the session with the ability to focus on an investigatedAlert (e.g when loading session view from the alerts page). This alert appears sticky at the top of the scroll area with special UX treament.

The alerts tab also supports the ability to group alerts by rule.

The following actions can be taken on each alert in the list:

• View alert details (loads the alert flyout from security solution TODO: https://github.com/elastic/security-team/issues/3266
• Jump to alerted process (selects and scrolls to the alert in process tree)

Checklist

Delete any items that are not applicable to this PR.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
• Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
• This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
• This was checked for cross-browser compatibility

[zizhouW]

Looking good!

[kqualters-elastic]

doing this directly is probably kinda dangerous, and there's some hidden nuance in this index I think, with rbac and building block alerts and things like that. Probably what should be done is make the session_view dependent on the ruleRegistry plugin, and make use of the AlertsClient exported by that plugin.

[mitodrummer]

Examples of this would be appreciated, not sure how to go about accessing AlertsClient after making rule_registry a dep. I assume it's not as simple as just importing AlertsClient from rule_registry/server/index.ts

[YulNaumenko]

@mitodrummer you can use the rule_registry plugin start contract RuleRegistryPluginStartContract for accessing AlertsClient, by calling the method getRacClientWithRequest.
I didn't find the code for AlertsClient , but here is the similar usage of RulesClient: you get it by calling getRulesClientWithRequest, code x-pack/plugins/monitoring/server/plugin.ts

https://github.com/elastic/kibana/blob/main/x-pack/plugins/monitoring/server/plugin.ts#L333-L340

[mitodrummer]

rule_registry is added as a dep and I'm making use of getRacClientWithRequest in alerts_route.ts. Let me know if the plugin setup looks good.

[zizhouW]

is alerts here in case fetching alerts ran into error? Because I imagine if we don't have alerts, it will just be a truthy []. If it is for errors, would the alertsError be enough for error handling?

[mitodrummer]

It's to avoid passing an undefined to ProcessTree as the prop expects an array.

[mitodrummer]

alerts is initially undefined until the react-query fetch completes.

[YulNaumenko]

This test is great, but it tests the function executed inside and it doesn't test the route itself. Please check the examples here.
As the long term vision I suggest to split the routes and its internal logic to the library files or SessionViewClient, if you want to expose this logic not only with the routs.

[YulNaumenko]

LGTM! Suggesting to add the routes tests, could be a follow up PR and very useful.

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: eb6865d
• Storybooks Preview
• Webpack Bundle Analyzer

Test Failures

• [job] [logs] Default Accessibility Tests / Maps app meets ally validations single cancel modal

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
sessionView	88	94	+6

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
sessionView	39.1KB	48.1KB	+9.0KB

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
sessionView	7	5	-2

Total ESLint disabled count

id	before	after	diff
sessionView	7	5	-2

History

• 💔 Build #32911 failed f076a62
• 💔 Build #32874 failed c056ac9
• 💔 Build #32868 failed 6ad0f9e
• 💔 Build #32849 failed 74098ed
• 💚 Build #32481 succeeded 38288cf
• 💔 Build #32479 failed a28fa39

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream