[Security Solution] Alert flyout overview #105602
Conversation
|
Pinging @elastic/security-threat-hunting (Team:Threat Hunting) |
| const ruleName = useMemo(() => { | ||
| const findRuleName = find({ category: 'signal', field: 'signal.rule.name' }, detailsData) | ||
| ?.values; | ||
| return findRuleName ? findRuleName[0] : ''; |
There was a problem hiding this comment.
Could findRuleName be an empty array? Would it be better to check findRuleName?.length. Also (nit), it might be helpful to rename this to currentRuleName or something similar
There was a problem hiding this comment.
ok, I'll apply that check to other fields as well.
| {!loading ? ( | ||
| <h4>{isAlert && !isEmpty(ruleName) ? ruleName : i18n.EVENT_DETAILS}</h4> | ||
| ) : ( | ||
| <></> |
There was a problem hiding this comment.
Do you know why this was here? Does EuiTitle require some kind of child no matter what? Could we just do
{!loading && (
<h4>{isAlert && !isEmpty(ruleName) ? ruleName : i18n.EVENT_DETAILS}</h4>
)}
There was a problem hiding this comment.
Yeah, EuiTitle needs to have a child in it anyway. My intention was use the empty span as a place holder to avoid the title height jumping on loaded, but seems that It works the same as
{!loading && (
<EuiTitle size="s">
<h4>{isAlert && !isEmpty(ruleName) ? ruleName : i18n.EVENT_DETAILS}</h4>
</EuiTitle>
)}
so I'll just remove the place holder and hide the entire title.
x-pack/plugins/security_solution/public/common/components/event_details/translations.ts
Outdated
Show resolved
Hide resolved
761a049 to
fc1a419
Compare
💚 Build SucceededMetrics [docs]Async chunks
History
To update your PR or re-run it, just comment with: |
* init flyout overview * styling * remove reason block * rm unused i18n key * show data by event category * rename styled component * update snapshot * update overview tab on alert flyout * styling * fix up * update snapshot and remove unused i18n
💚 Backport successful
This backport PR will be merged automatically after passing CI. |
* init flyout overview * styling * remove reason block * rm unused i18n key * show data by event category * rename styled component * update snapshot * update overview tab on alert flyout * styling * fix up * update snapshot and remove unused i18n Co-authored-by: Angela Chuang <6295984+angorayc@users.noreply.github.com>
Summary
https://github.com/elastic/security-team/issues/1271
https://github.com/elastic/security-team/issues/1394
Change the flyout title from
Alert detailsto rule nameChange the tab name from summary to overview
If event.category is network, show extra fields: process.name, destination.address, destination.port