Skip to content

[Cases][AttachmentV2] Attachment tab ui update#270518

Merged
christineweng merged 10 commits into
elastic:mainfrom
christineweng:cases-attachment-tab-refresh
May 29, 2026
Merged

[Cases][AttachmentV2] Attachment tab ui update#270518
christineweng merged 10 commits into
elastic:mainfrom
christineweng:cases-attachment-tab-refresh

Conversation

@christineweng
Copy link
Copy Markdown
Contributor

@christineweng christineweng commented May 21, 2026

Summary

Updates attachment tab per design. Each table only show up if there is attachment (if no alert on a case, alert table does not show up). Observables is always present because it is technically not an attachment and there is no other way to add observables

Update/refresh button is added to improve search experience

Screen.Recording.2026-05-29.at.1.38.09.PM.mov

Checklist

  • Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
  • Documentation was added for features that require explanation or tutorials
  • Unit or functional tests were updated or added to match the most common scenarios
  • If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
  • This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
  • Flaky Test Runner was used on any tests changed
  • The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
  • Review the backport guidelines and apply applicable backport:* labels.

@christineweng christineweng self-assigned this May 21, 2026
@christineweng christineweng requested review from a team as code owners May 21, 2026 22:26
@christineweng christineweng added release_note:enhancement backport:skip This PR does not require backporting Team:Cases Security Solution Cases team v9.5.0 labels May 21, 2026
@infra-vault-gh-plugin-prod
Copy link
Copy Markdown

Pinging @elastic/kibana-cases (Team:Cases)

Comment on lines +99 to +104
.filter(
(type) =>
type.id !== FILE_ATTACHMENT_TYPE &&
type.getAttachmentTabViewObject?.()?.children != null
)
.map((type) => type.id)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💅 filter() and map() can go into a single reduce(). But I guess the list is always short so it does not make a difference.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The list is short and I think this reads better than reduce

.reduce<string[]>((acc, type) => {
  if (
    type.id !== FILE_ATTACHMENT_TYPE &&
    type.getAttachmentTabViewObject?.()?.children != null
  ) {
    acc.push(type.id);
  }
  return acc;
}, [])

@janmonschke
Copy link
Copy Markdown
Contributor

I can reproduce the page height issue when expanding the observables accordion. Should probably be fixed before releasing this. Wdyt?

@christineweng christineweng force-pushed the cases-attachment-tab-refresh branch from 88ee128 to 1fb8517 Compare May 27, 2026 15:59
@christineweng christineweng force-pushed the cases-attachment-tab-refresh branch from 4632996 to d45de7b Compare May 27, 2026 21:03
@christineweng christineweng force-pushed the cases-attachment-tab-refresh branch from d1abbc5 to 56c9992 Compare May 28, 2026 01:18
/>
)}
{ATTACHMENT_TABS.includes(activeTabId as CASE_VIEW_PAGE_TABS) && (
{ATTACHMENT_TAB_ALIASES.has(activeTabId) && (
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

are we going to update the activeTabId as more attachment types are added? Given the breakdown of alert => security.alert, should we create new ones for that so we can have a closer one to one mapping?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

these are params of old tabs, previously tab=alert will go to alert sub-tab. the tabs are dynamic now, so I'm collapsing them to go to attachment instead

We could... types are defined inside cases, but I also feel that this is redundant and create too much hard coded baggage. I need to think about this more and see what the design direction is heading..

const isAttachmentsTabActive = ATTACHMENT_TAB_ALIASES.has(activeTab);

const tabs: CaseViewTab[] = useMemo(
const tabs: Tab[] = useMemo(
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we please add telemetry for which sections users expanded? We still want to track specific attachment interaction as best we can

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can add EBT for this - do you want to do it in this PR, or in a wholistic telemetry PR?

await testSubjects.click('case-view-tab-title-files');
await testSubjects.existOrFail('case-view-tab-content-files');

await cases.casesFilesTable.addFile(require.resolve('./elastic_logo.png'));
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we add a check after the addition that the files accordion shows up to be safe?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

added in 0085312

Copy link
Copy Markdown
Contributor

@michaelolo24 michaelolo24 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some nits, but most changes I think will need to come in a UX pass

@christineweng christineweng enabled auto-merge (squash) May 29, 2026 19:05
@kibanamachine
Copy link
Copy Markdown
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #115 / Cloud Security Posture - Group 5 (KSPM + Flyouts) Security Alerts Page - Graph visualization expanded flyout - filter by node
  • [job] [logs] FTR Configs #202 / Licensing plugin public client changes in license types "before all" hook: setup for "are reflected in the start contract"
  • [job] [logs] Scout Lane #5 - stateful-classic / default / local-stateful-classic - Entity analytics management page - Privileges - should show privileges callout and disable switch for user without risk engine privileges
  • [job] [logs] Scout Lane #5 - stateful-classic / default / local-stateful-classic - Entity analytics management page - Risk Score tab - should discard changes when clicking discard button
  • [job] [logs] Scout Lane #5 - stateful-classic / default / local-stateful-classic - Entity analytics management page - Risk Score tab - should show save bar when toggling closed alerts switch
  • [job] [logs] Scout Lane #5 - stateful-classic / default / local-stateful-classic - Entity analytics management page - Risk Score tab - should show save bar when toggling retain checkbox

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
cases 2073 2074 +1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
cases 2.4MB 2.4MB -1.8KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
cases 205.0KB 205.0KB +21.0B

History

cc @christineweng

@christineweng christineweng merged commit f32a9c1 into elastic:main May 29, 2026
31 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:skip This PR does not require backporting release_note:enhancement Team:Cases Security Solution Cases team v9.5.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants