Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] [Cases] Introduce case observables (phase 0 & 1) #190237

Merged
merged 315 commits into from
Dec 23, 2024
Merged

[Security Solution] [Cases] Introduce case observables (phase 0 & 1) #190237

merged 315 commits into from
Dec 23, 2024

Conversation

lgestc
Copy link
Contributor

@lgestc lgestc commented Aug 9, 2024 •
edited by kibanamachine
Loading

Summary

Introducting Case Observables - phases 0 and 1

This pull request introduces case observables to Kibana, enhancing the platform's case management capabilities. It adds support for capturing and displaying observables (e.g., IP addresses, URLs, file hashes) linked to cases. The feature integrates with the Cases UI, allowing users to easily associate observables with cases for better tracking and analysis in incident response workflows. This improves investigative efficiency by correlating observables across multiple cases.

Requirements:

https://docs.google.com/document/d/12hZTpyn0eXy3Xnq8qLBd6_sJxBhNZoI7vXztxWHhUds/edit#heading=h.srf6mb8ifiad

Design document: https://docs.google.com/document/d/1MeDLl6OEWast1RC1M3_hQXnRCd8frrXdGkFnypIYKJQ/edit#heading=h.kb5lrp2j62id

Notable Cases sections are added in this pr:

1. Observables section in the case view, allowing for adding and listing up to 10 observables for the case

image

2. Similar cases view for every case, allowing for similar case discovery

image

3. Observable types management view in Cases settings

image

Original issue:

#180360

Things skipped for now from MVP:

  • Allow users to manually create observables from the cases alerts table using the table actions (Phase 1)
  • Allow users to manually create observables of type “hash” from the files table using the table actions (Phase 1)

@lgestc lgestc changed the title --wip-- [skip ci] WIP case observables Aug 12, 2024
@lgestc lgestc force-pushed the cases_observables branch 2 times, most recently from b7c8f0e to b70f7cc Compare August 20, 2024 08:37
@lgestc lgestc force-pushed the cases_observables branch 2 times, most recently from 3ea6323 to 1dfdc9b Compare September 16, 2024 10:13
@lgestc lgestc force-pushed the cases_observables branch 2 times, most recently from ad86b09 to fa8ed50 Compare October 1, 2024 10:10
@lgestc lgestc changed the title WIP case observables [Security Solution] [Cases] Introduce case observables (phase 0 & 1) Oct 2, 2024
@lgestc lgestc added Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. 8.16 candidate release_note:feature Makes this part of the condensed release notes labels Oct 2, 2024
@lgestc lgestc marked this pull request as ready for review October 2, 2024 15:07
@lgestc lgestc requested a review from a team as a code owner October 2, 2024 15:07
@lgestc lgestc added backport:skip This commit does not require backporting Team:Threat Hunting:Investigations Security Solution Investigations Team labels Oct 2, 2024
@lgestc lgestc force-pushed the cases_observables branch from eb73134 to e1c0dd4 Compare October 2, 2024 15:24
@elastic-vault-github-plugin-prod elastic-vault-github-plugin-prod bot requested a review from a team as a code owner October 2, 2024 16:05
@lgestc lgestc force-pushed the cases_observables branch from cc054cc to cc94167 Compare October 3, 2024 09:24
@elastic elastic deleted a comment from kibana-ci Oct 3, 2024
@lgestc lgestc force-pushed the cases_observables branch from 83f88e2 to 5646f2f Compare October 3, 2024 10:48
jloleysens
jloleysens reviewed Oct 3, 2024
View reviewed changes
Copy link
Contributor

@jloleysens jloleysens left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a non-blocker question about mapped fields.

@lgestc lgestc force-pushed the cases_observables branch from 1a58c5d to 050d36b Compare October 3, 2024 12:40
@lgestc lgestc requested review from a team as code owners October 3, 2024 12:40
@lgestc lgestc force-pushed the cases_observables branch from cfa120c to 3f3b97f Compare October 3, 2024 14:05
@elastic elastic deleted a comment from kibana-ci Oct 3, 2024
@cnasikas cnasikas removed backport:skip This commit does not require backporting 8.16 candidate labels Oct 3, 2024
banderror
banderror approved these changes Dec 23, 2024
View reviewed changes
Copy link
Contributor

@banderror banderror left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving the change in x-pack/test/security_solution_cypress/cypress/objects/case.ts

@lgestc lgestc enabled auto-merge (squash) December 23, 2024 11:27
@elasticmachine
Copy link
Contributor

elasticmachine commented Dec 23, 2024 •
edited
Loading

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #77 / Screenshots - serverless security UI response ops docs security cases list view cases list screenshot

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
cases 828 859 +31

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
cases 491.4KB 535.4KB +44.0KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
cases 160.4KB 164.7KB +4.3KB
Unknown metric groups

ESLint disabled in files

id before after diff
cases 17 18 +1

ESLint disabled line counts

id before after diff
@kbn/test-suites-xpack 728 730 +2

Total ESLint disabled count

id before after diff
@kbn/test-suites-xpack 753 755 +2
cases 79 80 +1
total +3

History

cc @adcoelho @cnasikas

@lgestc lgestc disabled auto-merge December 23, 2024 13:12
gsoldevila
gsoldevila approved these changes Dec 23, 2024
View reviewed changes
Copy link
Contributor

@gsoldevila gsoldevila left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Core changes LGTM (additive mappings only)

@lgestc lgestc merged commit 3083706 into elastic:main Dec 23, 2024
8 checks passed
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/12467561269

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Dec 23, 2024
@lgestc
[Security Solution] [Cases] Introduce case observables (phase 0 & 1) (e…
a4d80f4 
…lastic#190237)

## Summary

### Introducting Case Observables - _phases 0 and 1_

This pull request introduces case observables to Kibana, enhancing the
platform's case management capabilities. It adds support for capturing
and displaying observables (e.g., IP addresses, URLs, file hashes)
linked to cases. The feature integrates with the Cases UI, allowing
users to easily associate observables with cases for better tracking and
analysis in incident response workflows. This improves investigative
efficiency by correlating observables across multiple cases.

#### Requirements:

https://docs.google.com/document/d/12hZTpyn0eXy3Xnq8qLBd6_sJxBhNZoI7vXztxWHhUds/edit#heading=h.srf6mb8ifiad

#### Design document:
https://docs.google.com/document/d/1MeDLl6OEWast1RC1M3_hQXnRCd8frrXdGkFnypIYKJQ/edit#heading=h.kb5lrp2j62id

Notable Cases sections are added in this pr:

**1. Observables section in the case view, allowing for adding and
listing up to 10 observables for the case**

![image](https://github.com/user-attachments/assets/f517803d-a6a3-4428-b3e3-478e70c60050)

**2. Similar cases view for every case, allowing for similar case
discovery**

![image](https://github.com/user-attachments/assets/388fddfb-9533-4f0d-aa8b-f5601e5323e0)

**3. Observable types management view in Cases settings**

![image](https://github.com/user-attachments/assets/2d76f8be-c234-4f24-a419-da54228fb111)

Original issue:

elastic#180360

Things skipped for now from MVP:
- [ ] Allow users to manually create observables from the cases alerts
table using the table actions (Phase 1)
- [ ] Allow users to manually create observables of type “hash” from the
files table using the table actions (Phase 1)

---------

Co-authored-by: Christos Nasikas <[email protected]>
Co-authored-by: kibanamachine <[email protected]>
Co-authored-by: Christos Nasikas <[email protected]>
(cherry picked from commit 3083706)
@kibanamachine kibanamachine mentioned this pull request Dec 23, 2024
Merged
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
✅ 8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Dec 23, 2024
@kibanamachine @lgestc
[8.x] [Security Solution] [Cases] Introduce case observables (phase 0…
634c52e 
… &amp; 1) (#190237) (#205089)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution] [Cases] Introduce case observables (phase 0 &amp;
1) (#190237)](#190237)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Luke
Gmys","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-12-23T13:25:58Z","message":"[Security
Solution] [Cases] Introduce case observables (phase 0 & 1)
(#190237)\n\n## Summary\r\n\r\n### Introducting Case Observables -
_phases 0 and 1_\r\n\r\nThis pull request introduces case observables to
Kibana, enhancing the\r\nplatform's case management capabilities. It
adds support for capturing\r\nand displaying observables (e.g., IP
addresses, URLs, file hashes)\r\nlinked to cases. The feature integrates
with the Cases UI, allowing\r\nusers to easily associate observables
with cases for better tracking and\r\nanalysis in incident response
workflows. This improves investigative\r\nefficiency by correlating
observables across multiple cases.\r\n\r\n####
Requirements:\r\n\r\nhttps://docs.google.com/document/d/12hZTpyn0eXy3Xnq8qLBd6_sJxBhNZoI7vXztxWHhUds/edit#heading=h.srf6mb8ifiad\r\n\r\n####
Design
document:\r\nhttps://docs.google.com/document/d/1MeDLl6OEWast1RC1M3_hQXnRCd8frrXdGkFnypIYKJQ/edit#heading=h.kb5lrp2j62id\r\n\r\nNotable
Cases sections are added in this pr:\r\n\r\n**1. Observables section in
the case view, allowing for adding and\r\nlisting up to 10 observables
for the
case**\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/f517803d-a6a3-4428-b3e3-478e70c60050)\r\n\r\n**2.
Similar cases view for every case, allowing for similar
case\r\ndiscovery**\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/388fddfb-9533-4f0d-aa8b-f5601e5323e0)\r\n\r\n**3.
Observable types management view in Cases
settings**\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/2d76f8be-c234-4f24-a419-da54228fb111)\r\n\r\nOriginal
issue:\r\n\r\nhttps://github.com//issues/180360\r\n\r\nThings
skipped for now from MVP:\r\n- [ ] Allow users to manually create
observables from the cases alerts\r\ntable using the table actions
(Phase 1)\r\n- [ ] Allow users to manually create observables of type
“hash” from the\r\nfiles table using the table actions (Phase
1)\r\n\r\n---------\r\n\r\nCo-authored-by: Christos Nasikas
<[email protected]>\r\nCo-authored-by: kibanamachine
<[email protected]>\r\nCo-authored-by:
Christos Nasikas
<[email protected]>","sha":"3083706bc9541d84700b81252f0e4880949e4ea0","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["Team:ResponseOps","v9.0.0","Team:
SecuritySolution","release_note:feature","Team:Threat
Hunting:Investigations","backport:prev-minor","ci:cloud-deploy","ci:build-serverless-image"],"title":"[Security
Solution] [Cases] Introduce case observables (phase 0 &
1)","number":190237,"url":"https://github.com/elastic/kibana/pull/190237","mergeCommit":{"message":"[Security
Solution] [Cases] Introduce case observables (phase 0 & 1)
(#190237)\n\n## Summary\r\n\r\n### Introducting Case Observables -
_phases 0 and 1_\r\n\r\nThis pull request introduces case observables to
Kibana, enhancing the\r\nplatform's case management capabilities. It
adds support for capturing\r\nand displaying observables (e.g., IP
addresses, URLs, file hashes)\r\nlinked to cases. The feature integrates
with the Cases UI, allowing\r\nusers to easily associate observables
with cases for better tracking and\r\nanalysis in incident response
workflows. This improves investigative\r\nefficiency by correlating
observables across multiple cases.\r\n\r\n####
Requirements:\r\n\r\nhttps://docs.google.com/document/d/12hZTpyn0eXy3Xnq8qLBd6_sJxBhNZoI7vXztxWHhUds/edit#heading=h.srf6mb8ifiad\r\n\r\n####
Design
document:\r\nhttps://docs.google.com/document/d/1MeDLl6OEWast1RC1M3_hQXnRCd8frrXdGkFnypIYKJQ/edit#heading=h.kb5lrp2j62id\r\n\r\nNotable
Cases sections are added in this pr:\r\n\r\n**1. Observables section in
the case view, allowing for adding and\r\nlisting up to 10 observables
for the
case**\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/f517803d-a6a3-4428-b3e3-478e70c60050)\r\n\r\n**2.
Similar cases view for every case, allowing for similar
case\r\ndiscovery**\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/388fddfb-9533-4f0d-aa8b-f5601e5323e0)\r\n\r\n**3.
Observable types management view in Cases
settings**\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/2d76f8be-c234-4f24-a419-da54228fb111)\r\n\r\nOriginal
issue:\r\n\r\nhttps://github.com//issues/180360\r\n\r\nThings
skipped for now from MVP:\r\n- [ ] Allow users to manually create
observables from the cases alerts\r\ntable using the table actions
(Phase 1)\r\n- [ ] Allow users to manually create observables of type
“hash” from the\r\nfiles table using the table actions (Phase
1)\r\n\r\n---------\r\n\r\nCo-authored-by: Christos Nasikas
<[email protected]>\r\nCo-authored-by: kibanamachine
<[email protected]>\r\nCo-authored-by:
Christos Nasikas
<[email protected]>","sha":"3083706bc9541d84700b81252f0e4880949e4ea0"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/190237","number":190237,"mergeCommit":{"message":"[Security
Solution] [Cases] Introduce case observables (phase 0 & 1)
(#190237)\n\n## Summary\r\n\r\n### Introducting Case Observables -
_phases 0 and 1_\r\n\r\nThis pull request introduces case observables to
Kibana, enhancing the\r\nplatform's case management capabilities. It
adds support for capturing\r\nand displaying observables (e.g., IP
addresses, URLs, file hashes)\r\nlinked to cases. The feature integrates
with the Cases UI, allowing\r\nusers to easily associate observables
with cases for better tracking and\r\nanalysis in incident response
workflows. This improves investigative\r\nefficiency by correlating
observables across multiple cases.\r\n\r\n####
Requirements:\r\n\r\nhttps://docs.google.com/document/d/12hZTpyn0eXy3Xnq8qLBd6_sJxBhNZoI7vXztxWHhUds/edit#heading=h.srf6mb8ifiad\r\n\r\n####
Design
document:\r\nhttps://docs.google.com/document/d/1MeDLl6OEWast1RC1M3_hQXnRCd8frrXdGkFnypIYKJQ/edit#heading=h.kb5lrp2j62id\r\n\r\nNotable
Cases sections are added in this pr:\r\n\r\n**1. Observables section in
the case view, allowing for adding and\r\nlisting up to 10 observables
for the
case**\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/f517803d-a6a3-4428-b3e3-478e70c60050)\r\n\r\n**2.
Similar cases view for every case, allowing for similar
case\r\ndiscovery**\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/388fddfb-9533-4f0d-aa8b-f5601e5323e0)\r\n\r\n**3.
Observable types management view in Cases
settings**\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/2d76f8be-c234-4f24-a419-da54228fb111)\r\n\r\nOriginal
issue:\r\n\r\nhttps://github.com//issues/180360\r\n\r\nThings
skipped for now from MVP:\r\n- [ ] Allow users to manually create
observables from the cases alerts\r\ntable using the table actions
(Phase 1)\r\n- [ ] Allow users to manually create observables of type
“hash” from the\r\nfiles table using the table actions (Phase
1)\r\n\r\n---------\r\n\r\nCo-authored-by: Christos Nasikas
<[email protected]>\r\nCo-authored-by: kibanamachine
<[email protected]>\r\nCo-authored-by:
Christos Nasikas
<[email protected]>","sha":"3083706bc9541d84700b81252f0e4880949e4ea0"}}]}]
BACKPORT-->

Co-authored-by: Luke Gmys <[email protected]>
stratoula pushed a commit to stratoula/kibana that referenced this pull request Jan 2, 2025
@lgestc @cnasikas
@kibanamachine @stratoula
[Security Solution] [Cases] Introduce case observables (phase 0 & 1) (e…
aef3940 
…lastic#190237)

## Summary

### Introducting Case Observables - _phases 0 and 1_

This pull request introduces case observables to Kibana, enhancing the
platform's case management capabilities. It adds support for capturing
and displaying observables (e.g., IP addresses, URLs, file hashes)
linked to cases. The feature integrates with the Cases UI, allowing
users to easily associate observables with cases for better tracking and
analysis in incident response workflows. This improves investigative
efficiency by correlating observables across multiple cases.

#### Requirements:

https://docs.google.com/document/d/12hZTpyn0eXy3Xnq8qLBd6_sJxBhNZoI7vXztxWHhUds/edit#heading=h.srf6mb8ifiad

#### Design document:
https://docs.google.com/document/d/1MeDLl6OEWast1RC1M3_hQXnRCd8frrXdGkFnypIYKJQ/edit#heading=h.kb5lrp2j62id

Notable Cases sections are added in this pr:

**1. Observables section in the case view, allowing for adding and
listing up to 10 observables for the case**


![image](https://github.com/user-attachments/assets/f517803d-a6a3-4428-b3e3-478e70c60050)

**2. Similar cases view for every case, allowing for similar case
discovery**


![image](https://github.com/user-attachments/assets/388fddfb-9533-4f0d-aa8b-f5601e5323e0)

**3. Observable types management view in Cases settings**


![image](https://github.com/user-attachments/assets/2d76f8be-c234-4f24-a419-da54228fb111)

Original issue:

elastic#180360

Things skipped for now from MVP:
- [ ] Allow users to manually create observables from the cases alerts
table using the table actions (Phase 1)
- [ ] Allow users to manually create observables of type “hash” from the
files table using the table actions (Phase 1)

---------

Co-authored-by: Christos Nasikas <[email protected]>
Co-authored-by: kibanamachine <[email protected]>
Co-authored-by: Christos Nasikas <[email protected]>
benakansara pushed a commit to benakansara/kibana that referenced this pull request Jan 2, 2025
@lgestc @cnasikas
@kibanamachine @benakansara
[Security Solution] [Cases] Introduce case observables (phase 0 & 1) (e…
ad6d2cf 
…lastic#190237)

## Summary

### Introducting Case Observables - _phases 0 and 1_

This pull request introduces case observables to Kibana, enhancing the
platform's case management capabilities. It adds support for capturing
and displaying observables (e.g., IP addresses, URLs, file hashes)
linked to cases. The feature integrates with the Cases UI, allowing
users to easily associate observables with cases for better tracking and
analysis in incident response workflows. This improves investigative
efficiency by correlating observables across multiple cases.

#### Requirements:

https://docs.google.com/document/d/12hZTpyn0eXy3Xnq8qLBd6_sJxBhNZoI7vXztxWHhUds/edit#heading=h.srf6mb8ifiad

#### Design document:
https://docs.google.com/document/d/1MeDLl6OEWast1RC1M3_hQXnRCd8frrXdGkFnypIYKJQ/edit#heading=h.kb5lrp2j62id

Notable Cases sections are added in this pr:

**1. Observables section in the case view, allowing for adding and
listing up to 10 observables for the case**


![image](https://github.com/user-attachments/assets/f517803d-a6a3-4428-b3e3-478e70c60050)

**2. Similar cases view for every case, allowing for similar case
discovery**


![image](https://github.com/user-attachments/assets/388fddfb-9533-4f0d-aa8b-f5601e5323e0)

**3. Observable types management view in Cases settings**


![image](https://github.com/user-attachments/assets/2d76f8be-c234-4f24-a419-da54228fb111)

Original issue:

elastic#180360

Things skipped for now from MVP:
- [ ] Allow users to manually create observables from the cases alerts
table using the table actions (Phase 1)
- [ ] Allow users to manually create observables of type “hash” from the
files table using the table actions (Phase 1)

---------

Co-authored-by: Christos Nasikas <[email protected]>
Co-authored-by: kibanamachine <[email protected]>
Co-authored-by: Christos Nasikas <[email protected]>
@nastasha-solomon nastasha-solomon mentioned this pull request Jan 7, 2025
Closed
13 tasks
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Jan 13, 2025
@lgestc @cnasikas
@kibanamachine @CAWilson94
[Security Solution] [Cases] Introduce case observables (phase 0 & 1) (e…
e0d1454 
…lastic#190237)

## Summary

### Introducting Case Observables - _phases 0 and 1_

This pull request introduces case observables to Kibana, enhancing the
platform's case management capabilities. It adds support for capturing
and displaying observables (e.g., IP addresses, URLs, file hashes)
linked to cases. The feature integrates with the Cases UI, allowing
users to easily associate observables with cases for better tracking and
analysis in incident response workflows. This improves investigative
efficiency by correlating observables across multiple cases.

#### Requirements:

https://docs.google.com/document/d/12hZTpyn0eXy3Xnq8qLBd6_sJxBhNZoI7vXztxWHhUds/edit#heading=h.srf6mb8ifiad

#### Design document:
https://docs.google.com/document/d/1MeDLl6OEWast1RC1M3_hQXnRCd8frrXdGkFnypIYKJQ/edit#heading=h.kb5lrp2j62id

Notable Cases sections are added in this pr:

**1. Observables section in the case view, allowing for adding and
listing up to 10 observables for the case**


![image](https://github.com/user-attachments/assets/f517803d-a6a3-4428-b3e3-478e70c60050)

**2. Similar cases view for every case, allowing for similar case
discovery**


![image](https://github.com/user-attachments/assets/388fddfb-9533-4f0d-aa8b-f5601e5323e0)

**3. Observable types management view in Cases settings**


![image](https://github.com/user-attachments/assets/2d76f8be-c234-4f24-a419-da54228fb111)

Original issue:

elastic#180360

Things skipped for now from MVP:
- [ ] Allow users to manually create observables from the cases alerts
table using the table actions (Phase 1)
- [ ] Allow users to manually create observables of type “hash” from the
files table using the table actions (Phase 1)

---------

Co-authored-by: Christos Nasikas <[email protected]>
Co-authored-by: kibanamachine <[email protected]>
Co-authored-by: Christos Nasikas <[email protected]>
This was referenced Jan 15, 2025
Open
Open
viduni94 pushed a commit to viduni94/kibana that referenced this pull request Jan 23, 2025
@lgestc @cnasikas
@kibanamachine @viduni94
[Security Solution] [Cases] Introduce case observables (phase 0 & 1) (e…
56b8d69 
…lastic#190237)

## Summary

### Introducting Case Observables - _phases 0 and 1_

This pull request introduces case observables to Kibana, enhancing the
platform's case management capabilities. It adds support for capturing
and displaying observables (e.g., IP addresses, URLs, file hashes)
linked to cases. The feature integrates with the Cases UI, allowing
users to easily associate observables with cases for better tracking and
analysis in incident response workflows. This improves investigative
efficiency by correlating observables across multiple cases.

#### Requirements:

https://docs.google.com/document/d/12hZTpyn0eXy3Xnq8qLBd6_sJxBhNZoI7vXztxWHhUds/edit#heading=h.srf6mb8ifiad

#### Design document:
https://docs.google.com/document/d/1MeDLl6OEWast1RC1M3_hQXnRCd8frrXdGkFnypIYKJQ/edit#heading=h.kb5lrp2j62id

Notable Cases sections are added in this pr:

**1. Observables section in the case view, allowing for adding and
listing up to 10 observables for the case**


![image](https://github.com/user-attachments/assets/f517803d-a6a3-4428-b3e3-478e70c60050)

**2. Similar cases view for every case, allowing for similar case
discovery**


![image](https://github.com/user-attachments/assets/388fddfb-9533-4f0d-aa8b-f5601e5323e0)

**3. Observable types management view in Cases settings**


![image](https://github.com/user-attachments/assets/2d76f8be-c234-4f24-a419-da54228fb111)

Original issue:

elastic#180360

Things skipped for now from MVP:
- [ ] Allow users to manually create observables from the cases alerts
table using the table actions (Phase 1)
- [ ] Allow users to manually create observables of type “hash” from the
files table using the table actions (Phase 1)

---------

Co-authored-by: Christos Nasikas <[email protected]>
Co-authored-by: kibanamachine <[email protected]>
Co-authored-by: Christos Nasikas <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cnasikas cnasikas cnasikas left review comments

@banderror banderror banderror approved these changes

@dmlemeshko dmlemeshko dmlemeshko approved these changes

@gsoldevila gsoldevila gsoldevila approved these changes

@js-jankisalvi js-jankisalvi js-jankisalvi approved these changes

@kqualters-elastic kqualters-elastic Awaiting requested review from kqualters-elastic

@michaelolo24 michaelolo24 Awaiting requested review from michaelolo24

@adcoelho adcoelho Awaiting requested review from adcoelho

@jloleysens jloleysens Awaiting requested review from jloleysens

Assignees

@adcoelho adcoelho

@cnasikas cnasikas

Labels
backport:prev-minor Backport to (9.0) the previous minor version (i.e. one version back from main) ci:build-serverless-image ci:cloud-deploy Create or update a Cloud deployment release_note:feature Makes this part of the condensed release notes Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Investigations Security Solution Investigations Team v8.18.0 v9.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.