[Security Solution] [Exceptions] Fix Exception Auto-populate from Alert actions

[WafaaNasr]

Summary

• Addresses [Security Solution] [Exceptions] Auto-populate Endpoint Exception from Alert's summary action button doesn't work #159784

[yctercero]

@elasticmachine merge upstream

[yctercero]

Is this change related to the bug fix or something else you found?

[WafaaNasr]

It is related to the Event Filters component
The component was throwing the below issue, when we updated useEffect with the deps

[yctercero]

Pulled down and tested the fix - it all seems to be working as expected now 👍🏽 We also tested together during an earlier meeting today. Didn't see values resetting to initial state like before.

I do agree with others that it's not our ideal fix, but you had noted this from the beginning and we'd chatted about whether to do a more in depth fix to revisit how we're setting initial state. We're in that post feature freeze time where we want to minimize the surface area we touch on fixes to avoid even more possible side effects. I think there's already things you've identified that could be done to improve the stability and maintainability of the component (and created an issue to track). Hoping we can do this work in 8.10.

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: eab421e

Failed CI Steps

• Security Solution Tests #4

Test Failures

• [job] [logs] Security Solution Tests #4 / Alerts generated by building block rules Alerts should be visible on the Rule Detail page and not visible on the Overview page

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
lists	260	261	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
lists	143.2KB	144.0KB	+844.0B
securitySolution	11.0MB	11.0MB	+33.0B
total			+877.0B

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
enterpriseSearch	14	16	+2
lists	18	17	-1
securitySolution	413	417	+4
total			+5

Total ESLint disabled count

id	before	after	diff
enterpriseSearch	15	17	+2
lists	23	22	-1
securitySolution	492	496	+4
total			+5

History

• 💛 Build #138330 was flaky f147868
• 💔 Build #138236 failed 046574c
• 💔 Build #138175 failed e5cae86
• 💔 Build #138103 failed cbaf0ec
• 💔 Build #138007 failed ab3b222
• 💔 Build #137804 failed f676400

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @WafaaNasr

[WafaaNasr]

💚 All backports created successfully

Status	Branch	Result
✅	8.9

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

[nastasha-solomon]

@WafaaNasr @yctercero what's the field that stores the alert ID value? Is it the _id field? If it is, here's the revision I suggest:

    'Exception conditions are pre-filled with relevant data from an alert with the alert id (_id): {alertId}.',

If you think including the field name is too much or would be confusing, you can remove it, for ex:

    'Exception conditions are pre-filled with relevant data from an alert with the alert id: {alertId}.',

[nastasha-solomon]

One more note: In the first option, I included the field that stores the alert value in case users need to know what field value pair to query when searching for the alert.