[AI4DSOC] Alert summary page routing and initialization

[PhilippeOberti]

Summary

This PR is the setting the foundations for the AI for SOC Alert summary page. It has very little UI, instead it focuses on the following:

• add routing for the alert_summary page
• fetches the integrations, filters them to only keep the ones related to AI for SOC, then decides what to render depending on if some AI for SOC packages have been installed or not

The PR also makes a small change to the SecurityRoutePageWrapper component, to allow us to redirect to the Security Solution HomePage instead of the NoPrivilegesPage. While this might not be a long term solution, it is the easiest path forward. In the future, AI for SOC will most likely be its own plugin (leaving outside of Security Solution) hence this will not be needed anymore.

Here's the basic behavior of the Alert summary page:

• The Landing page will be shown if none of the hardcoded AI for SOC packages are installed (these values are hardcoded as we currently do not have a way to filter integrations for the AI for SOC ones only):
  • splunk // doesnt yet exist
  • google_secops
  • microsoft_sentinel
  • sentinel_one
  • crowdstrike
• The Wrapper component will only be shown if you have at least one of the above AI for SOC packages installed.

Very limited UI added in this PR

Loading integrations	No installed packages	Some installed packages

Notes

We need to remove the section at the top of the page that currently shows the Add integrations button. A follow PR will take care of that. This is where that bar is being added. We will have to find a way to not show that for the AI for SOC tier.

How to test

This needs to be ran in Serverless:

• yarn es serverless --projectType security
• yarn serverless-security --no-base-path

You also need to enable the AI for SOC tier, by adding the following to your serverless.security.dev.yaml file:

xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]

The Alert summary navigation will NOT be shown for the following Serverless users: viewer, t1_analyst.
and t2_analyst. For those, the navigation entry is not present, and navigating to the url directly will automatically re-route to the Security home page.

Currently, retrieving the integrations (via the fleet/epm/packages endpoint) is also unauthorized for the following users: editor, t3_analyst, threat_intelligence_analyst, rule_author, soc_manager and detections_admin.

This means that the only users that can be currently used to test this PR are:

• platform_engineer
• endpoint_operations_analyst
• endpoint_policy_manager
• admin
• system_indices_superuser

Checklist

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Unit or functional tests were updated or added to match the most common scenarios

Will help close https://github.com/elastic/security-team/issues/11954 as well as https://github.com/elastic/security-team/issues/11979.

[elasticmachine]

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 030aa78

Failed CI Steps

• FTR Configs #3
• FTR Configs #82

Test Failures

• [job] [logs] FTR Configs #3 / Alerting builtin alertTypes es_query Query DSL only runs correctly: fetches field formatting in esQuery search type
• [job] [logs] FTR Configs #82 / Monitoring app Elasticsearch nodes listing with offline node skipCloud should have a nodes table with correct rows with default sorting

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	7089	7094	+5

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
fleet	1346	1353	+7

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
fleet	1.7MB	1.7MB	-1.0B
securitySolution	8.9MB	8.9MB	+2.1KB
total			+2.1KB

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
fleet	87	88	+1

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
fleet	159.4KB	159.6KB	+256.0B
securitySolution	88.3KB	88.3KB	-1.0B
total			+255.0B

Unknown metric groups

API count

id	before	after	diff
fleet	1474	1481	+7

History

• 💛 Build #285486 was flaky f3a4072
• 💛 Build #285041 was flaky baff599
• 💛 Build #284808 was flaky b00d441

[logeekal]

Overall PR looks good 👏 .

One more small question. If I am adding below lines, i still do not get access to complete security but only to ai_soc. Do we know the reason to this?

xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
    { product_line: 'security', product_tier: 'complete' },
  ]

[PhilippeOberti]

Overall PR looks good 👏 .

One more small question. If I am adding below lines, i still do not get access to complete security but only to ai_soc. Do we know the reason to this?

xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
    { product_line: 'security', product_tier: 'complete' },
  ]

I kinda makes sense to me as you can't have those 2 tiers living next to each other. You're either ai_for_soc OR security. Now as of why ai_for_soc takes priority over security I'm not sure...