[Security Solution][PoC] AI 4 SOC navigation

[semd]

Summary

This is an example of navigation changes to implement the AI 4 SOC.

It's built on top of existing functionalities (navigationTree, ProductFeatures, AppLinks configs, capabilities...). It does not require any modification of existing frameworks.

Note

When the classic navigation is deprecated we won't need to support both config formats, so we'll be able to clean and simplify the navigation links infrastructure. For now, we need to stay compatible, this is a simple way to accomplish the goal without major changes. When we do the refactor we will be able to create a static nav tree for "AI 4 SOC".

Test:

in your config/serverless.security.dev.yml:

xpack.securitySolutionServerless.productTypes:
  [
    # { product_line: 'security', product_tier: 'complete' },
    { product_line: 'ai', product_tier: 'essentials' },
    # { product_line: 'endpoint', product_tier: 'complete' },
    # { product_line: 'cloud', product_tier: 'complete' },
  ]

Important parts:

Left nav links

The applyAiSocNavigation is where we update the navigationTree only when the productLevel.ai is enabled. Here we can make any modifications to the tree:

kibana/x-pack/solutions/security/plugins/security_solution_serverless/public/navigation/ai_soc_navigation.ts

Lines 30 to 62 in ea0fcac

	export const applyAiSocNavigation = (
	draft: WritableDraft<NavigationTreeDefinition<AppDeepLinkId>>
	): void => {
	const group = draft.body[0] as WritableDraft<GroupDefinition<AppDeepLinkId, string, string>>;
	const [attachDiscovery] = group.children.reduce<Array<NodeDefinition<AppDeepLinkId>>>(
	(nodes, category) => {
	const [attachDiscoveryNode] = remove(category.children ?? [], {
	id: SecurityPageName.attackDiscovery,
	});
	if (attachDiscoveryNode) {
	nodes.push(attachDiscoveryNode);
	}
	return nodes;
	},
	[]
	);
	if (attachDiscovery) {
	group.appendHorizontalRule = true; // does not seem to work :( talk with sharedUx team
	const aiGroup: GroupDefinition<AppDeepLinkId, string, string> = {
	type: 'navGroup',
	id: 'security_solution_ai_nav',
	title: 'AI for SOC',
	icon: AssistantIcon,
	children: [attachDiscovery],
	breadcrumbStatus: 'hidden',
	defaultIsCollapsed: false,
	isCollapsible: false,
	};
	draft.body = [aiGroup];
	}
	};

Disable links

With the current approach, the easiest way to make links inaccessible (left nav, global search, direct URL access...) it to use the capabilities property of the links, and add the capabilities conditionally for the ProductFeature, creating new if necessary.

I implemented the example for rules, alerts, explore, dashboards, timeline, and notes.

[elasticmachine]

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

• Click to trigger kibana-pull-request for this PR!
• Click to trigger kibana-deploy-project-from-pr for this PR!
• Click to trigger kibana-deploy-cloud-from-pr for this PR!