[Security Solution] Update alert kpi to exclude closed alerts in document details flyout

[christineweng]

Summary

This PR made some changes to the alert count API in document details flyout. Closed alerts are now removed when showing total count and distributions. Data fetching logic is updated to match the one used in host flyout (#197102).

Notable changes:

• Closed alerts are now excluded
• Number of alerts in alerts flyout should match the ones in host flyout
• Clicking the number will open timeline with the specific entity and NOT kibana.alert.workflow_status: closed filters
• If a host/user does not have active alerts (all closed), no distribution bar is shown

Screen.Recording.2024-11-14.at.4.05.08.PM.mov

Checklist

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[elasticmachine]

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

[PhilippeOberti]

thanks for bringing the consistent behavior between the entity and the alerts details flyout. Desk tested and code LGTM!

[PhilippeOberti]

do you know why there are changes to this file? I see that these were introduced by an auto CI commit... weird...

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 13423c2

Failed CI Steps

• Jest Tests #5
• Jest Tests #5
• FTR Configs #1
• FTR Configs #1
• FTR Configs #96
• Post-Build

Test Failures

• [job] [logs] Jest Tests #5 / distribution bar insights should not render if no data is available
• [job] [logs] Jest Tests #5 / distribution bar insights should not render if no data is available
• [job] [logs] Jest Tests #5 / distribution bar insights should not render if no data is available
• [job] [logs] Jest Tests #5 / distribution bar insights should not render if no data is available
• [job] [logs] Jest Tests #5 / distribution bar insights should not render if no data is available
• [job] [logs] Jest Tests #5 / distribution bar insights should not render if no data is available
• [job] [logs] Jest Tests #5 / distribution bar insights should not render if no data is available
• [job] [logs] Jest Tests #5 / distribution bar insights should not render if no data is available
• [job] [logs] FTR Configs #96 / Screenshots - serverless observability UI response ops docs observability cases Observability case settings case settings screenshots
• [job] [logs] FTR Configs #1 / serverless search UI Elasticsearch Start [Onboarding Empty State] developer should show the api key in code view
• [job] [logs] FTR Configs #1 / serverless search UI Elasticsearch Start [Onboarding Empty State] developer should show the api key in code view

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [16127fc]

History

cc @christineweng