[Security Solution]Toggle Column not working on Alert Table

[karanbirsingh-qasource]

Describe the bug
Toggle Column not working on Alert Table

Build Details:

Version: Mains

Pre-conditions

• Alert data should be present on the kibana instance

Steps

• Navigate to Alert Page
• Click on View Details
• Go to Table Tab
• Choose any field e.g. _id
• Click on three dots
• Observe the action Toggle column in table

Actual	Expected
Toggle Column to table "Field" name not showing	Toggle index Column to Table
Column is not added to Alert Table	Column should get added to Alert Table

Screen-Cast

• Group view

127.0.0.1_25901.karansingh.s.X.desktop.karanbir-singh-karanbir-singh-newgui_1.-.VNC.Viewer.2023-04-19.15-58-15.mp4

• Alert Table

127.0.0.1_25901.karansingh.s.X.desktop.karanbir-singh-karanbir-singh-newgui_1.-.VNC.Viewer.2023-04-19.16-40-34.mp4

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[karanbirsingh-qasource]

@sukhwindersingh-qasource please review

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[michaelolo24]

@logeekal I would sync with @YulNaumenko or @stephmilovic about what the ideal behavior is here

[logeekal]

The issue is that new alert table does not understand the toggle functionality of the security solution flyout.

We need help here from @elastic/response-ops team to expose the toggle functionality which we can use to add/remove columns to the alert table from anywhere in security solution.

[michaelolo24]

The issue is that new alert table does not understand the toggle functionality of the security solution flyout.

We need help here from @elastic/response-ops team to expose the toggle functionality which we can use to add/remove columns to the alert table from anywhere in security solution.

@XavierM can you help out here?

[damianpfister]

@XavierM - any idea whether this is something that might be considered low-hanging-fruit or will it require a bit more time, on the roadmap, to work through?

[spong]

This was fixed in #168158 @XavierM, no? Can we close this?

[shayfeld]

Hi @spong ,

Previously, in version 8.6, I had the option of toggling unknown fields, but not in version 8.11.

[spong]

Interesting, thanks for sharing @shayfeld! Sounds like we should keep this open then @XavierM

[umbopepato]

It looks like now the actions are only accessible from a tooltip while hovering over the value cells, but the unknown fields don't show such tooltip. In particular, fieldData is empty for those fields and thus the value is not wrapped in <CellActions>:

kibana/x-pack/plugins/security_solution/public/common/components/cell_actions/index.tsx

Lines 62 to 88 in 884b94e

	const getFieldSpec = useGetFieldSpec(sourcererScopeId);
	const dataViewId = useDataViewId(sourcererScopeId);
	// Make a dependency key to prevent unnecessary re-renders when data object is defined inline
	// It is necessary because the data object is an array or an object and useMemo would always re-render
	const dependencyKey = JSON.stringify(data);
	const fieldData: CellActionsData[] = useMemo(
	() =>
	(Array.isArray(data) ? data : [data])
	.map(({ field, value }) => ({
	field: getFieldSpec(field),
	value,
	}))
	.filter((item): item is CellActionsData => !!item.field),
	// eslint-disable-next-line react-hooks/exhaustive-deps -- Use the dependencyKey to prevent unnecessary re-renders
	[dependencyKey, getFieldSpec]
	);
	const metadataWithDataView = useMemo(() => ({ ...metadata, dataViewId }), [dataViewId, metadata]);
	return fieldData.length > 0 ? (
	<CellActions data={fieldData} metadata={metadataWithDataView} {...props}>
	{children}
	</CellActions>
	) : (
	<>{children}</>
	);