[Security Solution] [Attack discovery] Fixes zero connectors and zero alerts empty states

[andrew-goldstein]

[Security Solution] [Attack discovery] Fixes zero connectors and zero alerts empty states

Summary

This PR fixes usability issues in Attack discovery by displaying an Empty prompt for the "zero connectors" and "zero alerts" states.

• When there are zero connectors configured, the empty prompt in the following screenshot is displayed:

• When there are zero open alerts in the last 24 hours to send to the LLM, the empty prompt in the following screenshot is displayed:

The fix for the "no alerts" state required returning an additional stat, the number of alerts sent as context to the LLM:

alertsContextCount

The alertsContextCount stat is now included in telemetry.

Desk testing

The Test setup section describes how to reproduce the states necessary to desk test this PR in an existing environment.

The Steps to verify section updates the test environment from zero to one connector. The connector will then be used to test the zero alerts state.

Test setup

Testing this fix requires no alerts, and no connectors. This section describes how to reset an existing environment (both the deployment and the browser) to test these states.

1. Navigate to Security > Alerts

2. If there are alerts in the last 24 hours, create and login to a new space, because zero alerts are required.

3. Navigate to Stack Management > Connectors

4. Delete any OpenAI or Bedrock connectors (tagged with Generative AI for Security)

5. Remove any pre-configured connectors from kibana.dev.yml

6. Clear local storage (to remove any trace of previously selected connectors)

7. Close all browser tabs with a current session to Kibana (to clear session storage)

8. Restart Kibana server

Steps to verify

1. Navigate to Security > Alerts

Expected result

• There are zero open alerts in the last 24 hours

2. Navigate to Security > Attack discovery

Expected result

• The following empty prompt is displayed:

3. Click OpenAI

Expected result

• The OpenAI connector modal is displayed

4. Enter the new connector details, and then click Save

Expected results

• A toast is displayed, confirming the new connector was successfully created
• The newly-created connector is selected in the connector selector
• The Up to 20 alerts will be analyzed empty state in the following screenshot is displayed:

5. Click Generate

Expected result

• The No alerts to analyze empty state (for zero alerts sent as context to the LLM) is displayed:

6. Generate some alerts

7. Navigate to Security > Alerts

Expected result

• Alerts in the last 24 hours are now available (as shown by the Alerts page)

8. Once again, navigate to Security > Attack discovery

Expected result

• The Up to 20 alerts will be analyzed empty state is displayed

9. Once again, click Generate

Expected results

• The Attack discovery in progress loading callout is displayed
• Attack discoveries are created for the alerts (when applicable)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[spong]

Checked out, tested locally, and code reviewed -- LGTM! Thanks for the added tests and cleaned up flow @andrew-goldstein! 🎉

Added a couple nits, one around updating docs location (should be fine as-as for now though), and one little bug I found myself in around the connector selector. I was deleting localStorage keys, so not sure if it's a real issue users would find themselves in. I will continue to try and repro and post steps on the comment.

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 7f1d99c

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	5485	5490	+5

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	15.3MB	15.3MB	+10.6KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
securitySolution	83.5KB	83.6KB	+114.0B

History

• 💚 Build #208558 succeeded c0af48a

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @andrew-goldstein

[kibanamachine]

💔 All backports failed

Status	Branch	Result
❌	8.14	Backport failed because of merge conflicts You might need to backport the following PRs to 8.14: - [Security solution] Add additional properties to attack discovery telemetry (#182249)

Manual backport

To create the backport manually run:

node scripts/backport --pr 182904

Questions ?

Please refer to the Backport tool documentation

[andrew-goldstein]

💚 All backports created successfully

Status	Branch	Result
✅	8.14

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation