[Cases] Auto-extract cases observables in add to case workflow #233027

christineweng · 2025-08-26T20:33:26Z

Summary

This is part 2 of the auto-extract observables work. Dependency: #236028 to be merged first.

This PR adds functionality to auto-extract case observables when attaching alerts to a case via alert flyout. This is enabled in security solution cases only. The toggle should not appear in Observability and Stack cases.

With platinum+ license, users in security can now:

See a toggle to auto-extract observables when attaching alert to a case
Configure the toggle in case templates
Access the toggle in case view
Access the default observables type to ecs mapping via the gear icon

This feature is disabled by default, to enable it, revert this commit efc88aa
Fixes #234513

Screen.Recording.2025-09-10.at.11.53.14.PM.mov

Not in scope in this PR

Adding toggle in alerts table (bulk actions and row actions)
Observable actions in activity (X observables were extracted)
Currently the case setting activity include both sync alert and auto-extract observables, they can be split into their own user actions
When user toggle it on in case view, perform a look back and extract all the net new observables

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

christineweng · 2025-09-11T05:03:34Z

x-pack/platform/plugins/shared/cases/common/constants/observables.ts

+} as const;
+
+export const OBSERVABLE_TYPE_HOSTNAME = {
+  label: 'Host name',


Updated label from Hostname to Host name. this should be fine, right? @lgestc

christineweng · 2025-09-15T18:47:00Z

src/platform/packages/shared/response-ops/alerts-table/components/alerts_table.tsx

+                alerts: { sync: casesConfiguration?.syncAlerts ?? false },
+                observables: {
+                  enabled: true,
+                  autoExtract: false,


Use this flag to enable/disable auto extract observables in alerts table. Currently add to case from row action is working as expected, but bulk action isn't working yet and will be tackled in a separate PR

kibanamachine · 2025-09-15T22:34:26Z

Cloud deployment initiated, see credentials at: https://buildkite.com/elastic/kibana-deploy-cloud-from-pr/builds/416

michaelolo24 · 2025-09-26T02:29:17Z

x-pack/platform/plugins/shared/cases/public/api/utils.ts


 export const convertCaseToCamelCase = (theCase: Case): CaseUI => {
  const { comments, ...restCase } = theCase;
+  const settings = restCase.settings;


I understand why you would do this here, but I would actually create it's own dedicated function for it rather than making the mutation a side effect of a separate function.

Technically, we shouldn't need this anymore with the backfill, but this is a safeguard?

yeah it was added pre-backfill. removed and confirm it's not breaking anything

michaelolo24 · 2025-09-26T02:45:59Z

x-pack/solutions/security/plugins/security_solution/public/app/routes.tsx

  history: History;
 }

+const features = { observables: { enabled: true, autoExtract: false } } as const;


Suggestion. Create a case config file or similar in security that exports
const observablesFeatureConfig = { observables: { enabled: true, autoExtract: false } } as const and use everywhere in security where you have to pass that config currently

It looks like it's only 2 places. Here and cases/pages/index.tsx

michaelolo24 · 2025-09-26T02:47:30Z

...tions/security/plugins/security_solution/public/detections/components/alerts_table/index.tsx

+  featureId: CASES_FEATURE_ID,
+  owner: [APP_ID],
+  syncAlerts: true,
+  extractObservables: true,


should this be set to false until the other alerts table pr is resolved?

…236028) ## Summary This is part 1 of introducing auto-extract observables in cases. This PR adds mapping and default value of false to a new setting called `extractObservables`. Part 2 that introduces the actual feature is in elastic#233027 ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [ ] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ...

michaelolo24 · 2025-09-26T18:23:58Z

x-pack/platform/plugins/shared/cases/public/containers/use_bulk_post_observables.test.tsx

+    );
+  });
+
+  it('shows an info toast when the api call is successful and the maximum number of observables is reached', async () => {


michaelolo24 · 2025-09-26T18:28:38Z

x-pack/platform/plugins/shared/cases/server/client/cases/observables.ts

+      },
+    });
+
+    const res = flattenCaseSavedObject({


future enhancement: We can return the Observables that weren't added, so users can decide if they're important or not

michaelolo24 · 2025-09-26T18:29:54Z

x-pack/platform/plugins/shared/cases/server/client/cases/utils.ts

+    observablesMap.set(key, {
+      ...observable,
+      id: v4(),
+      createdAt: new Date().toISOString(),


nit: can just run this once and use the same value for both.

michaelolo24

Awesome work with this @christineweng 👏🏾 👏🏾 . Only had a few minor nits left, but nothing blocking.

## Summary This is part 1 of introducing auto-extract observables in cases. This PR adds mapping and default value of false to a new setting called `extractObservables`. Part 2 that introduces the actual feature is in #233027 ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [ ] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ...

elasticmachine · 2025-09-30T12:09:59Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: f25e848

Failed CI Steps

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`cases`	1166	1172	+6

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/securitysolution-ecs`	351	352	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`cases`	1.4MB	1.4MB	+6.8KB
`embeddableAlertsTable`	1004.5KB	1004.6KB	+40.0B
`ml`	5.4MB	5.4MB	+62.0B
`observability`	1.6MB	1.6MB	+40.0B
`securitySolution`	10.8MB	10.8MB	-2.1KB
`triggersActionsUi`	1.6MB	1.6MB	+40.0B
total			+4.9KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`cases`	137.7KB	141.7KB	+4.0KB
`securitySolution`	97.4KB	97.3KB	-126.0B
total			+3.8KB

Unknown metric groups

API count

id	before	after	diff
`@kbn/securitysolution-ecs`	355	356	+1

async chunk count

id	before	after	diff
`securitySolution`	104	101	-3

History

cc @christineweng

## Summary Dependency: #233027 to be merged first. This PR enables auto-extract toggle in alerts table when user adds alerts to a case. This applies to row actions and bulk actions. To enable the feature in security update the [case configuration](https://github.com/elastic/kibana/blob/b37878b28188ba72f42f2d0fd1271024dc3a6fd9/x-pack/solutions/security/plugins/security_solution/public/detections/components/alerts_table/index.tsx#L143) to `extractObservables: true,` <img width="1490" height="730" alt="image" src="https://github.com/user-attachments/assets/1c31cfee-a086-490b-b2d8-69306eb3ae4c" /> ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. --------- Co-authored-by: kibanamachine <[email protected]>

…236028) ## Summary This is part 1 of introducing auto-extract observables in cases. This PR adds mapping and default value of false to a new setting called `extractObservables`. Part 2 that introduces the actual feature is in elastic#233027 ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [ ] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ...

…ic#233027) ## Summary This is part 2 of the auto-extract observables work. Dependency: elastic#236028 to be merged first. This PR adds functionality to auto-extract case observables when attaching alerts to a case via alert flyout. This is enabled in security solution cases only. The toggle should not appear in Observability and Stack cases. With platinum+ license, users in security can now: - See a toggle to auto-extract observables when attaching alert to a case - Configure the toggle in case templates - Access the toggle in case view - Access the default observables type to ecs mapping via the gear icon This feature is disabled by default, to enable it, revert this commit efc88aa Fixes elastic#234513 https://github.com/user-attachments/assets/d74eb7bc-feb7-4208-8f4c-a99495563609 #### Not in scope in this PR - Adding toggle in alerts table (bulk actions and row actions) - Observable actions in activity (X observables were extracted) - Currently the case setting activity include both sync alert and auto-extract observables, they can be split into their own user actions - When user toggle it on in case view, perform a look back and extract all the net new observables ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. --------- Co-authored-by: Michael Olorunnisola <[email protected]> Co-authored-by: lgestc <[email protected]>

## Summary Dependency: elastic#233027 to be merged first. This PR enables auto-extract toggle in alerts table when user adds alerts to a case. This applies to row actions and bulk actions. To enable the feature in security update the [case configuration](https://github.com/elastic/kibana/blob/50299491246af6cc8055a1ff8a975ce82b114495/x-pack/solutions/security/plugins/security_solution/public/detections/components/alerts_table/index.tsx#L143) to `extractObservables: true,` <img width="1490" height="730" alt="image" src="https://github.com/user-attachments/assets/1c31cfee-a086-490b-b2d8-69306eb3ae4c" /> ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. --------- Co-authored-by: kibanamachine <[email protected]>

christineweng force-pushed the cases-extract-observables branch from 3dad123 to efb3103 Compare August 28, 2025 19:55

christineweng force-pushed the cases-extract-observables branch from efb3103 to a78f5bb Compare September 11, 2025 04:40

christineweng self-assigned this Sep 11, 2025

christineweng changed the title ~~[Cases] POC - Automatically extract cases observables in add to case workflow~~ [Cases] Auto-extract cases observables in add to case workflow Sep 11, 2025

christineweng added backport:skip This PR does not require backporting release_note:feature Makes this part of the condensed release notes Team:Cases Security Solution Cases team 9.2 candidate labels Sep 11, 2025

christineweng commented Sep 11, 2025

View reviewed changes

christineweng added ci:cloud-deploy Create or update a Cloud deployment ci:cloud-persist-deployment Persist cloud deployment indefinitely labels Sep 11, 2025

christineweng force-pushed the cases-extract-observables branch 4 times, most recently from 9a5172e to c358fe4 Compare September 12, 2025 23:31

christineweng commented Sep 15, 2025

View reviewed changes

christineweng force-pushed the cases-extract-observables branch from 2a0cb68 to 3723204 Compare September 15, 2025 21:44

christineweng marked this pull request as ready for review September 16, 2025 01:05

christineweng requested review from a team as code owners September 16, 2025 01:05

christineweng removed the ci:cloud-persist-deployment Persist cloud deployment indefinitely label Sep 25, 2025

christineweng mentioned this pull request Sep 26, 2025

Test Only - Cases observables #236500

Closed

10 tasks

michaelolo24 reviewed Sep 26, 2025

View reviewed changes

christineweng added 2 commits September 26, 2025 12:06

auto extract observables

b7c0935

disable by default and comments

b6d91e9

christineweng force-pushed the cases-extract-observables branch from efc88aa to b6d91e9 Compare September 26, 2025 18:15

michaelolo24 reviewed Sep 26, 2025

View reviewed changes

michaelolo24 approved these changes Sep 26, 2025

View reviewed changes

michaelolo24 and others added 3 commits September 28, 2025 22:26

Merge branch 'main' into cases-extract-observables

47e2501

Merge branch 'main' into cases-extract-observables

64ecb55

Merge branch 'main' into cases-extract-observables

791b434

michaelolo24 enabled auto-merge (squash) September 29, 2025 19:18

michaelolo24 added 3 commits September 29, 2025 16:45

Merge branch 'main' into cases-extract-observables

43614ec

Merge branch 'main' into cases-extract-observables

480e8c8

Merge branch 'main' into cases-extract-observables

329d623

Merge branch 'main' into cases-extract-observables

f25e848

michaelolo24 disabled auto-merge September 30, 2025 12:26

michaelolo24 merged commit 8b8d972 into elastic:main Sep 30, 2025
12 checks passed

kibanamachine added the v9.2.0 label Sep 30, 2025

[Cases] Auto-extract cases observables in add to case workflow #233027

[Cases] Auto-extract cases observables in add to case workflow #233027

Uh oh!

Conversation

christineweng commented Aug 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Not in scope in this PR

Checklist

Uh oh!

christineweng Sep 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

christineweng Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kibanamachine commented Sep 15, 2025

Uh oh!

michaelolo24 Sep 26, 2025

Choose a reason for hiding this comment

Uh oh!

christineweng Sep 26, 2025

Choose a reason for hiding this comment

Uh oh!

michaelolo24 Sep 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michaelolo24 Sep 26, 2025

Choose a reason for hiding this comment

Uh oh!

michaelolo24 Sep 26, 2025

Choose a reason for hiding this comment

Uh oh!

michaelolo24 Sep 26, 2025

Choose a reason for hiding this comment

Uh oh!

michaelolo24 Sep 26, 2025

Choose a reason for hiding this comment

Uh oh!

michaelolo24 left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Page load bundle

API count

async chunk count

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

christineweng commented Aug 26, 2025 •

edited

Loading

christineweng Sep 11, 2025 •

edited

Loading

christineweng Sep 15, 2025 •

edited

Loading

michaelolo24 Sep 26, 2025 •

edited

Loading

elasticmachine commented Sep 30, 2025 •

edited

Loading