[Security solution] Value report data view filtering fix

[stephmilovic]

Summary

I incorrectly believed that adding the scopeId={SourcererScopeName.detections} property to the VisualizationEmbeddable component would filter the queries on the value report page to search only the alerts index. However, useDataView(SourcererScopeName.detections) actually returns the full security solution data view. In order to only search the signals index, I added signal index filtering to all the AI value report lens visualizations. I also introduce a hook to provide a default signal index name, as useSignalIndex() can return { signalIndexName: null }.

Steps to reproduce

1. Be in serverless complete with admin or soc_manager role. Have alerts data and attack discoveries. Have additional non-alert events (I used yarn start generate-logs with security-documents-generator).
2. Navigate to value reports

Before fix:
The cost savings metric did not match the cost savings in the description. Additionally, time saved, alert filtering rate, and cost savings trend were incorrect.

After fix:
The cost savings metric matches the cost savings in the description. Time saved, alert filtering rate, and cost savings trend are now accurate.

Changes

• New helper function (helpers.ts): getAlertIndexFilter creates index filters for lens attributes
• Updated lens attributes functions: Added signalIndexName parameter and integrated getAlertIndexFilter in:
  • alert_filtering_metric.ts
  • cost_savings_metric.ts
  • time_saved_metric.ts
  • cost_savings_trend_area.ts
• New hook (use_signal_index_with_default.tsx): Returns signal index name with fallback to .alerts-security.alerts-{spaceId}
• Updated React components: Components now use useSignalIndexWithDefault to get alerts index name
• Fixed translation: Updated statType value to be correct

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 125e0f0

Failed CI Steps

• Jest Integration Tests #15
• FTR Configs #76
• FTR Configs #82
• Scout Test Run Builder

Test Failures

• [job] [logs] FTR Configs #76 / Agents fleet_list_agent should return metrics if available and called with withMetrics
• [job] [logs] Scout Test Run Builder / serverless-security - EUI testing wrapper: EuiDataGrid - data grid, run
• [job] [logs] Jest Integration Tests #15 / workflow level timeout should invoke connector only 3 times timeout
• [job] [logs] Jest Integration Tests #15 / workflow with wait step when duration is short should wait for the specified duration between firstConnectorStep and lastConnectorStep

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	8318	8320	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	11.0MB	11.0MB	+742.0B

History

• 💔 Build #357836 failed 97f3197

[angorayc]

LGTM