[Security Solution][UX] Disable hover actions for unmapped fields in the Table tab of Alert/Event flyout. #136351
Labels
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Team:Threat Hunting:Investigations
Security Solution Investigations Team
UX
When we are using Hover Actions (like add/remove to filter) in the Alert or Event flyout Table for the unmapped fields (object to strings array representation):
![Screen Shot 2022-07-13 at 3 16 09 PM](https://user-images.githubusercontent.com/55110838/178847635-de9fe0e7-3926-4005-baa8-4afd9720e321.png)
it can lead to the confusing UX where we are not able to filter correctly by that value:
![Screen Shot 2022-07-13 at 3 17 45 PM](https://user-images.githubusercontent.com/55110838/178847803-b5315015-c334-4d03-9c93-d07afdf868f0.png)
As a solution for that issue, I'm suggesting to disable hover actions in the table for that type of fields.
cc: @paulewing
The similar experience in Discover:
![Screen Shot 2022-07-15 at 12 24 03 PM](https://user-images.githubusercontent.com/55110838/179297104-25d98cf3-788f-4b52-8a78-c41b5eecc7bd.png)
The text was updated successfully, but these errors were encountered: