Looks like the z-index is off In the Saved Queries

[XavierM]

Looks like the z-index is off in the SIEM app as the Saved Queries popover shows above the full page frosting. To be honest, I feel like the Saved Queries popover should just dismiss automatically as that's what it does on initial click within the active popover anyway. May want to open a core bug instead of fixing here?

Discover:

SIEM

Originally posted by @spong in #47306 (comment)

[XavierM]

@Bargs @TinaHeiligers what do you think?

[TinaHeiligers]

@XavierM I'm not sure if we want to automatically have the Saved Queries popover dismiss when deleting a saved query. Say. for example, I want to delete one from a list of saved queries and then use a different one, right now, I can delete one and still immediately have access to the others:

[spong]

I agree @TinaHeiligers, that makes sense for providing a better UX when wanting to delete multiple queries.

As for saving queries though, the popover closes on its own once you click on the Save Query popover.

Note, since the Saved Queries popover is given focus when initially displayed, it is possible to enter a name and save the query using the keyboard, which will then result in the Saved Queries popover staying open.

So either way @XavierM, sounds like we'll need to fix the z-index issue present in the SIEM app.

[spong]

This also manifests itself here within the Timeline Save Query UI: