[ResponseOps][Alerts] Move the alerts table to a dedicated package #207878

umbopepato · 2025-01-22T16:44:22Z

Summary

This PR turns the AlertsTable into a standalone component, making it independent from the TriggersActionsUI plugin.

Removes the alerts table registry

All configuration is now managed through the AlertsTable component props. Shared configurations are handled by giving consumers the ability to directly provide alerts table wrapper components (see for example the renderAlertsTable prop of getCases).

Moves the alerts table to dedicated package(s)

Following the feature-driven structure we're introducing for ResponseOps (alerting) client-side packages:

@kbn/response-ops-alerts-table
@kbn/response-ops-alerts-apis
@kbn/response-ops-alerts-fields-browser

Initial work on improving composition and organization

Reorganizes the table code into a by-entity-type folder structure (components/, hooks/, ...)
Simplifies some components and breaks into smaller units when possible

To verify

For consumers of the alerts table:

Check that all your tables have the same behavior as before (columns, sort, row actions, bulk actions, etc.)
Check that your "shared" tables (i.e. cases alerts view in O11y and Security) have the expected configuration and behavior

Warning

This PR moves a lot of files. Git might not always recognize the correct delete/add file pairs. If you see weird diffs feel free to reach out for help!

Checklist

Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
Flaky Test Runner was used on any tests changed

Identify risks

Risk	Description	Severity	Mitigation
Table misconfigurations	Some table configurations might slightly differ from the previous AlertsTableRegistry-backed version	Low	Quick fix

References

Closes #195180

elasticmachine · 2025-01-23T10:18:47Z

Pinging @elastic/response-ops (Team:ResponseOps)

jennypavlova

ObsUx Infra and Services changes LGTM

packages/response-ops/alerts_table/components/alerts_data_grid.tsx

cnasikas

The ResponseOps team collectively approves.

nikitaindik

I have reviewed the Rule Management table owned code and tested the changes on the Rule Details page. I approved on behalf of the Rule Management.

js-jankisalvi

Tested alerts table in security, o11y and stack management and cases alerts tab. works as expected 👍

logeekal

Thanks @umbopepato for this refactor.

I have requested some very small changes regarding virtualization. Additionally, could I please ask you to create an issue to remove the workaround we added in this PR : #208052

logeekal · 2025-02-05T11:12:29Z

x-pack/solutions/security/plugins/security_solution/common/types/timeline/cells/index.ts

@@ -21,7 +21,7 @@ export type CellValueElementProps = EuiDataGridCellValueElementProps & {
  browserFields?: BrowserFields;
  data: TimelineNonEcsData[];
  ecsData?: Ecs;
-  eventId: string; // _id
+  eventId?: string; // _id


@umbopepato , Could you please elaborate in what case eventId will be undefined?

logeekal · 2025-02-05T11:35:06Z

...tions/security/plugins/security_solution/public/detections/components/alerts_table/index.tsx

+              initialPageSize={50}
+              runtimeMappings={sourcererDataView?.runtimeFieldMap as RunTimeMappings}
+              toolbarVisibility={toolbarVisibility}
+              dynamicRowHeight={isEventRenderedView}


This statement disables the virtualization in Event Rendered View. We fixed this here: https://github.com/elastic/kibana/pull/192827/files#diff-55d89a9f7cd09ba80ef7752e07f2f65922b66e417052cb583f18f741f47608e4L293

This results in degraded performance

when user switches from Grid View to Event Rendered View as shown below.

Any subsequent re-renders

This Branch

Screen.Recording.2025-02-05.at.12.33.06.mov

Main ( 9.0 )

Screen.Recording.2025-02-05.at.12.34.28.mov

Thanks for catching this! I must have missed it while rebasing the feature branch

No problem.. It is a big effort and huge list of changes. Can happen. Thanks for taking care of this.

logeekal · 2025-02-05T11:37:10Z

...tions/security/plugins/security_solution/public/detections/components/alerts_table/index.tsx

+              }
+              cellActionsOptions={cellActionsOptions}
+              showInspectButton
+              services={{


Could you please memoize all the non-primitive objects before passing to the components. This will otherwise result in unneeded renders because each time new instance of that object will be created.

Even if the object is memoized lower in the tree, it would not help since the identity of the object will anyways change at this component.

kqualters-elastic · 2025-02-05T13:57:22Z

...ecurity/plugins/security_solution/public/detections/components/alerts_table/actions_cell.tsx

+      tabType={'query'}
+      tableId={tableType}
+      width={0}
+      setEventsLoading={({ isLoading }) => {


should move this to a useCallback, setEventsDeleted as well, or as a reference outside of the render

kqualters-elastic · 2025-02-05T13:57:46Z

...ecurity/plugins/security_solution/public/detections/components/alerts_table/actions_cell.tsx

+  } = useSelector((state: State) => eventsViewerSelector(state, tableType));
+  const eventContext = useContext(StatefulEventContext);
+
+  const timelineItem: TimelineItem = {


should memoize this as it's creating a new object

kqualters-elastic · 2025-02-05T14:04:03Z

...tions/security/plugins/security_solution/public/detections/components/alerts_table/index.tsx

+const casesConfiguration = { featureId: CASES_FEATURE_ID, owner: [APP_ID], syncAlerts: true };
+const emptyInputFilters: Filter[] = [];
+
+export const AlertsTableComponent: FC<Omit<DetectionEngineAlertTableProps, 'services'>> = ({


should wrap this in a memo

- Removes the alerts table registry in favor of a props-only configuration - Converts all the usages of the alerts table to use only props - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: kibanamachine <[email protected]> Co-authored-by: Christos Nasikas <[email protected]>

Moves the alerts table code and dependencies to dedicated packages in `packages/response-ops/**`. > [!IMPORTANT] > 🚧 Merging to the `alerts-table-refactor` feature branch` - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed --------- Co-authored-by: kibanamachine <[email protected]> Co-authored-by: Christos Nasikas <[email protected]>

…tCases (#207038) ## Summary > [!IMPORTANT] > 🚧 Merging to the `alerts-table-refactor` feature branch, no review needed from teams other than `response-ops` > [!WARNING] > Some tests are intentionally left failing since the converted usages of the alerts table still have to be validated/improved by solutions and may change significantly Adds a `renderAlertsTable` prop to `getCases` to allow solutions to customize the alerts table shown in the `Alerts` tab of their case view.

## Summary The Security Solution alerts table CellValue component was receiving some wrong props when used in the Rule preview table. This PR removes the spread `{...props}` expression and type cast that didn't catch this error and correctly converts props and types.

renderers

…om security flyout (#208052) ## Summary Fixes the toggleColumn functionality not working from the Security Solution flyout. Uses a global context to share a reference to the `toggleColumn` function as a **temporary solution** until the handling of the columns inside the alerts table is refactored to correctly receive updates from the outside.

…erview

…factor

elasticmachine · 2025-02-07T18:58:30Z

💔 Build Failed

Failed CI Steps

Test Failures

[job] [logs] FTR Configs #73 / Cases - group 1 View case Tabs - alerts linked to case should render the alerts table when opening the alerts tab
[job] [logs] FTR Configs #73 / Cases - group 1 View case Tabs - alerts linked to case should render the alerts table when opening the alerts tab
[job] [logs] Jest Tests #16 / Mappings editor: scaled float datatype should require a scaling factor to be provided
[job] [logs] Jest Tests #20 / SolutionFilter when the owner is a single solution should call onChange with selected solution id when no option selected yet

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`alerting`	230	229	-1
`cases`	842	1032	+190
`ml`	2217	2441	+224
`observability`	1355	1450	+95
`securitySolution`	6695	6778	+83
`slo`	1001	1000	-1
`threatIntelligence`	139	177	+38
`triggersActionsUi`	944	927	-17
total			+611

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/alerting-types`	241	248	+7
`@kbn/alerts-ui-shared`	287	282	-5
`@kbn/response-ops-alerts-fields-browser`	-	6	+6
`@kbn/response-ops-alerts-table`	-	6	+6
`observability`	690	699	+9
`ruleRegistry`	222	221	-1
`triggersActionsUi`	570	543	-27
total			-5

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`apm`	4.0MB	4.0MB	-452.0B
`cases`	540.8KB	1.3MB	⚠️ +805.2KB
`cloudSecurityPosture`	537.5KB	537.5KB	+15.0B
`discover`	846.7KB	846.7KB	+15.0B
`infra`	1.2MB	1.2MB	-335.0B
`ml`	4.7MB	5.5MB	⚠️ +798.9KB
`observability`	1.3MB	1.4MB	+88.7KB
`securitySolution`	21.4MB	18.8MB	-2.6MB
`slo`	882.4KB	882.5KB	+168.0B
`synthetics`	918.9KB	918.7KB	-226.0B
`threatIntelligence`	57.6KB	758.0KB	⚠️ +700.3KB
`triggersActionsUi`	1.7MB	1.6MB	-38.5KB
total			-292.0KB

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`@kbn/response-ops-alerts-apis`	-	1	+1
`@kbn/response-ops-alerts-fields-browser`	-	2	+2
`@kbn/response-ops-alerts-table`	-	13	+13
`@kbn/securitysolution-data-table`	6	10	+4
`triggersActionsUi`	51	40	-11
total			+9

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`cases`	162.5KB	163.9KB	+1.4KB
`esqlDataGrid`	9.4KB	9.5KB	+15.0B
`ml`	78.0KB	79.4KB	+1.4KB
`observability`	102.4KB	102.5KB	+108.0B
`securitySolution`	88.7KB	88.2KB	-511.0B
`threatIntelligence`	12.7KB	12.8KB	+102.0B
`triggersActionsUi`	130.2KB	118.8KB	-11.4KB
total			-8.9KB

Unknown metric groups

API count

id	before	after	diff
`@kbn/alerting-types`	244	252	+8
`@kbn/alerts-ui-shared`	303	298	-5
`@kbn/response-ops-alerts-fields-browser`	-	15	+15
`@kbn/response-ops-alerts-table`	-	8	+8
`observability`	698	707	+9
`triggersActionsUi`	596	561	-35
total			-0

async chunk count

id	before	after	diff
`cases`	32	34	+2
`ml`	110	111	+1
`observability`	21	24	+3
`securitySolution`	109	110	+1
`triggersActionsUi`	65	58	-7
total			-0

ESLint disabled in files

id	before	after	diff
`@kbn/response-ops-alerts-apis`	-	1	+1
`@kbn/response-ops-alerts-table`	-	2	+2
total			+3

ESLint disabled line counts

id	before	after	diff
`@kbn/response-ops-alerts-fields-browser`	-	1	+1
`@kbn/response-ops-alerts-table`	-	8	+8
`cases`	64	65	+1
`observability`	42	46	+4
`triggersActionsUi`	130	120	-10
total			+4

miscellaneous assets size

id	before	after	diff
`cases`	0.0B	126.3KB	+126.3KB
`ml`	211.1KB	337.5KB	+126.3KB
total			+252.6KB

References to deprecated APIs

id	before	after	diff
`@kbn/response-ops-alerts-table`	-	15	+15
`triggersActionsUi`	27	10	-17
total			-2

Total ESLint disabled count

id	before	after	diff
`@kbn/response-ops-alerts-apis`	-	1	+1
`@kbn/response-ops-alerts-fields-browser`	-	1	+1
`@kbn/response-ops-alerts-table`	-	10	+10
`cases`	82	83	+1
`observability`	43	47	+4
`triggersActionsUi`	135	125	-10
total			+7

History

💔 Build #273987 failed bd28e28
💔 Build #273954 failed b11c7b9
💔 Build #273219 failed 254d5fa
💛 Build #271488 was flaky 5016bcc
💛 Build #270733 was flaky 5459a7d

umbopepato force-pushed the alerts-table-refactor branch from 99c6d4d to 72b83e5 Compare January 22, 2025 17:44

umbopepato added release_note:skip Skip the PR/issue when compiling release notes backport:skip This commit does not require backporting Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) labels Jan 23, 2025

umbopepato force-pushed the alerts-table-refactor branch from 72b83e5 to 002f502 Compare January 23, 2025 09:47

umbopepato marked this pull request as ready for review January 23, 2025 10:18

umbopepato requested review from a team as code owners January 23, 2025 10:18

umbopepato requested review from machadoum, pzl, szwarckonrad, nkhristinin and nikitaindik January 23, 2025 10:18

darnautov self-requested a review January 23, 2025 12:08

jennypavlova self-requested a review January 23, 2025 14:01

jennypavlova approved these changes Jan 23, 2025

View reviewed changes

kqualters-elastic reviewed Jan 24, 2025

View reviewed changes

packages/response-ops/alerts_table/components/alerts_data_grid.tsx Outdated Show resolved Hide resolved

umbopepato force-pushed the alerts-table-refactor branch from 5459a7d to 4df554f Compare January 29, 2025 11:22

umbopepato mentioned this pull request Jan 29, 2025

[ResponseOps][Alerts] Move the alerts table into a dedicated package #195180

Open

umbopepato force-pushed the alerts-table-refactor branch from 4df554f to 1428348 Compare January 29, 2025 11:32

cnasikas approved these changes Jan 29, 2025

View reviewed changes

nikitaindik approved these changes Jan 29, 2025

View reviewed changes

js-jankisalvi approved these changes Jan 29, 2025

View reviewed changes

szwarckonrad approved these changes Jan 30, 2025

View reviewed changes

umbopepato force-pushed the alerts-table-refactor branch from 5016bcc to 254d5fa Compare February 4, 2025 15:49

cnasikas added the v9.1.0 label Feb 5, 2025

logeekal requested changes Feb 5, 2025

View reviewed changes

kqualters-elastic reviewed Feb 5, 2025

View reviewed changes

umbopepato and others added 13 commits February 6, 2025 12:39

[ResponseOps][Alerts] Fix optional eventId in security cell value

a7d4bf2

renderers

Fix documentation

87ff005

Make the actions cell renderer a standalone memoized component

34f4ad5

Memoize toolbarVisibility.columnIds

214a66b

Fix tests

84450b7

Show column id when column dislpay name is not available in flyout ov…

bcc025b

…erview

[CI] Auto-commit changed files from 'node scripts/notice'

cced19e

Fix Security alerts table regression and perf

b11c7b9

umbopepato force-pushed the alerts-table-refactor branch from 254d5fa to b11c7b9 Compare February 6, 2025 12:17

umbopepato added 2 commits February 6, 2025 14:36

Fix test

bd28e28

Merge branch 'main' of github.com:elastic/kibana into alerts-table-re…

077de1f

…factor

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ResponseOps][Alerts] Move the alerts table to a dedicated package #207878

[ResponseOps][Alerts] Move the alerts table to a dedicated package #207878

umbopepato commented Jan 22, 2025 •

edited

Loading

elasticmachine commented Jan 23, 2025

jennypavlova left a comment

cnasikas left a comment

nikitaindik left a comment

js-jankisalvi left a comment

logeekal left a comment

logeekal Feb 5, 2025

logeekal Feb 5, 2025

umbopepato Feb 6, 2025

logeekal Feb 6, 2025

logeekal Feb 5, 2025

umbopepato Feb 6, 2025

kqualters-elastic Feb 5, 2025

kqualters-elastic Feb 5, 2025

kqualters-elastic Feb 5, 2025

elasticmachine commented Feb 7, 2025 •

edited

Loading

API count

async chunk count

ESLint disabled in files

ESLint disabled line counts

miscellaneous assets size

References to deprecated APIs

Total ESLint disabled count

[ResponseOps][Alerts] Move the alerts table to a dedicated package #207878

Are you sure you want to change the base?

[ResponseOps][Alerts] Move the alerts table to a dedicated package #207878

Conversation

umbopepato commented Jan 22, 2025 • edited Loading

Summary

Removes the alerts table registry

Moves the alerts table to dedicated package(s)

Initial work on improving composition and organization

To verify

Checklist

Identify risks

References

elasticmachine commented Jan 23, 2025

jennypavlova left a comment

Choose a reason for hiding this comment

cnasikas left a comment

Choose a reason for hiding this comment

nikitaindik left a comment

Choose a reason for hiding this comment

js-jankisalvi left a comment

Choose a reason for hiding this comment

logeekal left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

This Branch

Main ( 9.0 )

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Feb 7, 2025 • edited Loading

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Public APIs missing exports

Page load bundle

API count

async chunk count

ESLint disabled in files

ESLint disabled line counts

miscellaneous assets size

References to deprecated APIs

Total ESLint disabled count

History

umbopepato commented Jan 22, 2025 •

edited

Loading

elasticmachine commented Feb 7, 2025 •

edited

Loading