Skip to content

[Cases] Enable auto-extraction by default and add user actions for observable actions#236524

Merged
christineweng merged 6 commits intoelastic:mainfrom
christineweng:cases-observables-actions
Oct 6, 2025
Merged

[Cases] Enable auto-extraction by default and add user actions for observable actions#236524
christineweng merged 6 commits intoelastic:mainfrom
christineweng:cases-observables-actions

Conversation

@christineweng
Copy link
Contributor

@christineweng christineweng commented Sep 25, 2025 •
edited
Loading

Summary

Ref: #234007

This PR enables auto-extraction in alerts and adds activity entry for observable actions (manually add/update/delete 1 observable, bulk add from auto-extraction).

Before
Observable actions are not reflected in the activity tab

After

image

Checklist

  • Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
  • Documentation was added for features that require explanation or tutorials
  • Unit or functional tests were updated or added to match the most common scenarios
  • If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
  • This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
  • Flaky Test Runner was used on any tests changed
  • The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
  • Review the backport guidelines and apply applicable backport:* labels.
@christineweng christineweng self-assigned this Sep 25, 2025
@christineweng christineweng added release_note:fix backport:skip This PR does not require backporting Team:Cases Security Solution Cases team v9.2.0 labels Sep 25, 2025
@christineweng christineweng force-pushed the cases-observables-actions branch from 86a442a to f8ea5b1 Compare September 26, 2025 01:19
@christineweng christineweng mentioned this pull request Sep 26, 2025
Closed
10 tasks
@christineweng christineweng force-pushed the cases-observables-actions branch from f8ea5b1 to 798bea9 Compare September 26, 2025 20:36
@michaelolo24 michaelolo24 force-pushed the cases-observables-actions branch from 798bea9 to 54bdd1f Compare September 30, 2025 19:19
@michaelolo24 michaelolo24 marked this pull request as ready for review September 30, 2025 19:19
@michaelolo24 michaelolo24 requested a review from a team as a code owner September 30, 2025 19:20
@elasticmachine
Copy link
Contributor

elasticmachine commented Sep 30, 2025

Pinging @elastic/kibana-cases (Team:Cases)
@michaelolo24 michaelolo24 force-pushed the cases-observables-actions branch from 54bdd1f to 700546b Compare October 2, 2025 14:17
@michaelolo24 michaelolo24 requested a review from a team as a code owner October 2, 2025 14:23
PhilippeOberti
PhilippeOberti approved these changes Oct 2, 2025
View reviewed changes
Copy link
Contributor

@PhilippeOberti PhilippeOberti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review only for @elastic/security-threat-hunting-investigations, LGTM, only one file impacted
@elasticmachine
Copy link
Contributor

elasticmachine commented Oct 6, 2025 •
edited
Loading

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] Detection Engine - Security Solution Cypress Tests #5 / Saved query rules, rule edit Allows to update saved_query rule with non-existent query by selecting another saved query Allows to update saved_query rule with non-existent query by selecting another saved query

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
cases 1176 1178 +2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
cases 1.4MB 1.4MB +2.4KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
cases 140.5KB 140.8KB +234.0B

History

cc @christineweng
@christineweng christineweng changed the title [Cases] Add user actions for observable actions Oct 6, 2025
@christineweng christineweng merged commit 435b225 into elastic:main Oct 6, 2025
12 checks passed
@christineweng christineweng mentioned this pull request Oct 7, 2025
Closed
@christineweng christineweng mentioned this pull request Oct 14, 2025
Merged
@christineweng
Copy link
Contributor Author

christineweng commented Oct 14, 2025

💚 All backports created successfully

Status Branch Result
✅ 9.2

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation
christineweng added a commit to christineweng/kibana that referenced this pull request Oct 14, 2025
@christineweng @michaelolo24
[Cases] Enable auto-extraction by default and add user actions for ob…
0a6cb5c 
…servable actions (elastic#236524)

## Summary

Ref: elastic#234007

This PR enables auto-extraction in alerts and adds activity entry for
observable actions (manually add/update/delete 1 observable, bulk add
from auto-extraction).

Before
Observable actions are not reflected in the activity tab

After

<img width="513" height="263" alt="image"
src="https://github.com/user-attachments/assets/28bf5e20-ed80-40b0-9100-24e5132902a9"
/>

### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

---------

Co-authored-by: Michael Olorunnisola <michael.olorunnisola@elastic.co>
(cherry picked from commit 435b225)
christineweng added a commit that referenced this pull request Oct 14, 2025
@christineweng @michaelolo24
[9.2] [Cases] Enable auto-extraction by default and add user actions …
aef27a9 
…for observable actions (#236524) (#238884)

# Backport

This will backport the following commits from `main` to `9.2`:
- [[Cases] Enable auto-extraction by default and add user actions for
observable actions
(#236524)](#236524)

<!--- Backport version: 10.0.2 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT
[{"author":{"name":"christineweng","email":"18648970+christineweng@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-10-06T18:50:20Z","message":"[Cases]
Enable auto-extraction by default and add user actions for observable
actions (#236524)\n\n## Summary\n\nRef:
https://github.com/elastic/kibana/issues/234007\n\nThis PR enables
auto-extraction in alerts and adds activity entry for\nobservable
actions (manually add/update/delete 1 observable, bulk add\nfrom
auto-extraction).\n\nBefore\nObservable actions are not reflected in the
activity tab\n\nAfter\n\n<img width=\"513\" height=\"263\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/28bf5e20-ed80-40b0-9100-24e5132902a9\"\n/>\n\n\n\n###
Checklist\n\n- [x] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n---------\n\nCo-authored-by:
Michael Olorunnisola
<michael.olorunnisola@elastic.co>","sha":"435b22513d15851e695ca3f1dedfff21609c4d9e","branchLabelMapping":{"^v9.3.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","backport:skip","Team:Cases","v9.2.0","v9.3.0"],"title":"[Cases]
Enable auto-extraction by default and add user actions for observable
actions","number":236524,"url":"https://github.com/elastic/kibana/pull/236524","mergeCommit":{"message":"[Cases]
Enable auto-extraction by default and add user actions for observable
actions (#236524)\n\n## Summary\n\nRef:
https://github.com/elastic/kibana/issues/234007\n\nThis PR enables
auto-extraction in alerts and adds activity entry for\nobservable
actions (manually add/update/delete 1 observable, bulk add\nfrom
auto-extraction).\n\nBefore\nObservable actions are not reflected in the
activity tab\n\nAfter\n\n<img width=\"513\" height=\"263\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/28bf5e20-ed80-40b0-9100-24e5132902a9\"\n/>\n\n\n\n###
Checklist\n\n- [x] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n---------\n\nCo-authored-by:
Michael Olorunnisola
<michael.olorunnisola@elastic.co>","sha":"435b22513d15851e695ca3f1dedfff21609c4d9e"}},"sourceBranch":"main","suggestedTargetBranches":["9.2"],"targetPullRequestStates":[{"branch":"9.2","label":"v9.2.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.3.0","branchLabelMappingKey":"^v9.3.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/236524","number":236524,"mergeCommit":{"message":"[Cases]
Enable auto-extraction by default and add user actions for observable
actions (#236524)\n\n## Summary\n\nRef:
https://github.com/elastic/kibana/issues/234007\n\nThis PR enables
auto-extraction in alerts and adds activity entry for\nobservable
actions (manually add/update/delete 1 observable, bulk add\nfrom
auto-extraction).\n\nBefore\nObservable actions are not reflected in the
activity tab\n\nAfter\n\n<img width=\"513\" height=\"263\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/28bf5e20-ed80-40b0-9100-24e5132902a9\"\n/>\n\n\n\n###
Checklist\n\n- [x] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n---------\n\nCo-authored-by:
Michael Olorunnisola
<michael.olorunnisola@elastic.co>","sha":"435b22513d15851e695ca3f1dedfff21609c4d9e"}}]}]
BACKPORT-->

Co-authored-by: Michael Olorunnisola <michael.olorunnisola@elastic.co>
rylnd pushed a commit to rylnd/kibana that referenced this pull request Oct 17, 2025
@christineweng @michaelolo24
[Cases] Enable auto-extraction by default and add user actions for ob…
238b155 
…servable actions (elastic#236524)

## Summary

Ref: elastic#234007

This PR enables auto-extraction in alerts and adds activity entry for
observable actions (manually add/update/delete 1 observable, bulk add
from auto-extraction).

Before
Observable actions are not reflected in the activity tab

After

<img width="513" height="263" alt="image"
src="https://github.com/user-attachments/assets/28bf5e20-ed80-40b0-9100-24e5132902a9"
/>



### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

---------

Co-authored-by: Michael Olorunnisola <michael.olorunnisola@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:skip This PR does not require backporting release_note:fix Team:Cases Security Solution Cases team v9.2.0 v9.3.0

6 participants

@christineweng @elasticmachine @lgestc @PhilippeOberti @kibanamachine @michaelolo24