[Security Solution][Attacks] Add connector id filter

[NicholasPeretti]

Summary

Addresses #243156

This PR introduces the "connector" filter.
The filter doesn't do much yet as we need to connect it to the table to filter data

Screen.Recording.2025-12-02.at.21.46.06.mov

[e40pud]

I think we can just reuse existing "filter by connector" component from the attack discovery page. If needed, we can find a common place and move that component there, we can consider starting prioritizing x-pack/solutions/security/plugins/security_solution/public/detections/components/attacks folder and move reusable components there.

Also, in current implementation you fetch all attacks using useFindAttackDiscoveries hook, which I don't think will work correctly:

• it will return first 10 attacks - default search limit
• we need to use other filters (KQL, time range, assignees etc.) while calling this hook to narrow down the attacks that are part of the current search

[NicholasPeretti]

I think we can just reuse existing "filter by connector" component from the attack discovery page. If needed, we can find a common place and move that component there, we can consider starting prioritizing x-pack/solutions/security/plugins/security_solution/public/detections/components/attacks folder and move reusable components there.

Also, in current implementation you fetch all attacks using useFindAttackDiscoveries hook, which I don't think will work correctly:

• it will return first 10 attacks - default search limit
• we need to use other filters (KQL, time range, assignees etc.) while calling this hook to narrow down the attacks that are part of the current search

Hey @e40pud, good point 😄

I am not integrating the other filters here because I don't have them yet (assignee, status, etc..).
Once we merge the other PRs we I can rebase and integrate them 🚀

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: e6fca70

Failed CI Steps

• FTR Configs #30
• FTR Configs #30

Test Failures

• [job] [logs] FTR Configs #30 / Maps endpoints apis search ES|QL should return getValues response in expected shape
• [job] [logs] FTR Configs #30 / Maps endpoints apis search ES|QL should return getValues response in expected shape

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	11.1MB	11.1MB	+523.0B

History

• 💔 Build #368012 failed 7319b3c