[Epic] [Security Solution] One Discover Custom Cell Rendering for Security Solution

[logeekal]

Blockers 🔴

• Do we need kibana.alert.rule.name as Link to a Flyout or as a redirection ? [ Yes, we will want Rule Name to act as link to the rule details page so that users can navigate appropriately. ]
• Do we need to customize kibana.alert.severity to show as badges ? [ Anyways an enhancement. Ask Paul but we can move forward without it as well. ]

🔴 Open questions

• What happens when there is no metadata available record.
  • Yes, we do show the flyout with basic JSON and Table tab.
    • There are 2 options to go about it, we can simple returns discover's flyout in the extension point when metadata is not available. See if there is that capability available.

Describe the feature:

According to the One Discover Program, Discover now has a support for custom cell Rendering in Unified Data Table. This enabled security solution to provide a consistent experience to its users.

Note

This issue is only applicable to representation of the table cells and not the Security Cell Actions.

Dependencies

Preview Give feedback

1. [Security Solution] Implement Expandable Flyout in One Discover Cell Renderer Extension #189151
   Feature:Discover in Security Team:Threat Hunting:Investigations +2
   
2. [Security Solution] Implement Host/User/IP Flyouts in One Discover #191998
   Feature:Discover in Security Team:Threat Hunting:Investigations +2
   
3. [Security Solution ] Add One Discover hover actions to above entity Flyouts #196667
   Feature:Discover in Security Team:Threat Hunting:Investigations +2
   
4. [Security Solution] Entity Flyout navigation to Document viewer flyout #199660
   Feature:Discover in Security Team:Threat Hunting:Investigations +2
   

Entity Flyout Interactions

1. Link to HostName/User name leads to new tab with corresponding Entity details.

Hover Actions on Observed Data

1. Filter In
2. Filter Out
3. TopN
4. Copy to Clipboard
5. Toggle Column in Table

Expandable Section

1. Risk Contribution

• This Leads to Alert Listing and further Alert Actions such as
• Alert Detail
• Add to New/Existing Case

Preview Section

1. Alert Details
   • Can lead to complete Alert Flyout ( Refer to Alert Flyout Ticket )

🟡 Caveats

1. There are some actions within cell flyouts such as Host Details flyout where user can perform actions on certain entities.
   • Until Discover enables the ability to add those actions, those actions should be disabled.
     

✅ Acceptance Criteria

Below columns in Unified Data table should custmized as given below and very similar to how they are today in security solution.

host.name

• Should be a link
• Should open a Entity Flyout for hosts.
• Ability to change Asset Criticality in Flyouts

user.name

• Should be a link
• Should open a Entity Flyout for hosts.
• Ability to change Asset Criticality in Flyouts

source.ip

• Should be a link
• Should open a Entity Flyout for hosts.

destination.ip

• Should be a link
• Should open a Entity Flyredout for hosts.

kibana.alert.rule.name

• should be link to Entity Flyout for Rule? ( Create as a separate ticket @logeekal )

[elasticmachine]

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)