[Security Solution] Enabling,Disabling Include building block alerts checkbox, On group by alerts table Navigates UI to alert charts.

[sukhwindersingh-qasource]

Describe the bug:
Enabling,Disabling Include building block alerts checkbox, On group by alerts table Navigates UI to alert charts.

Build Details:

VERSION: 8.7.0
BUILD: 60614
COMMIT: d3b239d76aa04f073836f6100782134ac86887e2

Preconditions

• Kibana should be running.
• One Host should be present on kibana.
• Create two rules with the Following details
• Rule 1 : Custom query as - process.name : *
• Rule 2 : Custom query as - process.name : * and enabling Mark all generated alerts as "building block" alerts check box.

Steps to Reproduce

• Navigate to Security
• Now navigate to alerts tab.
• Select Group alerts by Host name.
• Now open the group alert table.
• Enable,Disable Include building block alerts checkbox

Actual Result
Enabling,Disabling Include building block alerts checkbox, On group by alerts table Navigates UI to alert charts.

Expected Result
Enabling,Disabling Include building block alerts checkbox, On group by alerts table, UI should remains as it is and group by alerts table remain in open state.

Alerts.-.Kibana.-.Google.Chrome.2023-02-10.13-06-08.mp4

Screen-Recording

Alerts.-.Kibana.-.Google.Chrome.2023-02-10.13-06-42.mp4

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[sukhwindersingh-qasource]

@karanbirsingh-qasource Please review this.

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[stephmilovic]

Not sure how we should handle this... @YulNaumenko I noticed something else. If I have a alerts grouped by rule name, and all of the rule's alerts are building block, when the checkbox is toggled off, this rule group disappears. I can get it back by checking the building block back on in a different rule group. How should we handle this, it's a bit weird. cc: @paulewing

uhoh.mov

PS - this video was taken on main, where building block alert highlighting is broken due to an unrelated change

Also this can get you in a weird state if you only have one rule and it is building block. Toggle it off, all groups disappear and query empty. You have no way to toggle it back on unless you add a new rule to bring a group back and toggle it back on. This video sort of demonstrates that, but luckily in this scenario we have other rules we can use to bring it back:

uhoh2.mov

[sukhwindersingh-qasource]

Hi @MadameSheema

We have validated this issue on 8.7.0 BC4 build and observed that issue is not occurring, It is Fixed. ✔️

Please find the below Testing Details:

Build info

VERSION: 8.7.0
BUILD: 60949
COMMIT: de22cd9361a0dbf429f9648d3c7b7c45aa862e90

Screen-Recording

Alerts.-.Kibana.Mozilla.Firefox.2023-03-02.13-28-22.mp4

Hence, We are Closing this issue and marking it as QA Validated!!
Thanks!!