[Security Solution][Attacks/Alerts] Attacks page tour (#17464)

packages/kbn-optimizer/limits.yml

@@ -166,7 +166,7 @@ pageLoadAssetSize:
   searchQueryRules: 6689
   searchSynonyms: 6371
   security: 79627
-  securitySolution: 171101
+  securitySolution: 171457
   securitySolutionEss: 42592
   securitySolutionServerless: 57290
   serverless: 7412

src/platform/packages/shared/kbn-doc-links/src/get_doc_links.ts

@@ -461,6 +461,7 @@ export const getDocLinks = ({ kibanaBranch, buildFlavor }: GetDocLinkOptions): D
         ? `${KIBANA_APIS}group/endpoint-security-detections-api`
         : `${KIBANA_SERVERLESS_APIS}group/endpoint-security-detections-api`,
       configureAlertSuppression: `${ELASTIC_DOCS}solutions/security/detect-and-alert/alert-suppression#configure-alert-suppression`,
+      attacksPage: `${ELASTIC_DOCS}solutions/security/ai/attacks-page`,
     },
     server: {
       protocol: `${ELASTIC_DOCS}reference/kibana/configuration-reference/general-settings#server-protocol`,

src/platform/packages/shared/kbn-doc-links/src/types.ts

@@ -321,6 +321,7 @@ export interface DocLinks {
     readonly configureAlertSuppression: string;
     readonly ingestDataToSecurity: string;
     readonly automaticImport: string;
+    readonly attacksPage: string;
   };
   readonly server: {
     readonly protocol: string;

x-pack/solutions/security/plugins/security_solution/common/constants.ts

@@ -502,6 +502,8 @@ export const NEW_FEATURES_TOUR_STORAGE_KEYS = {
   RULE_MANAGEMENT_PAGE: 'securitySolution.rulesManagementPage.newFeaturesTour.v9.2',
   TIMELINES: 'securitySolution.security.timelineFlyoutHeader.saveTimelineTour',
   DEFAULT_LLM: `elasticAssistant.elasticLLM.costAwarenessTour.assistantHeader.v8.19.default`,
+  ATTACKS_PAGE: 'securitySolution.attacksPage.newFeaturesTour.v9.5',
+  ATTACKS_PAGE_CALLOUT: 'securitySolution.attacksPage.tourCalloutDismissed.v9.5',
 };
 
 export const RULE_DETAILS_EXECUTION_LOG_TABLE_SHOW_METRIC_COLUMNS_STORAGE_KEY =

x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts

@@ -296,6 +296,12 @@ export const allowedExperimentalValues = Object.freeze({
    * Enables the risk score history API endpoint for Entity Analytics.
    */
   riskScoreHistoryEnabled: false,
+
+  /**
+   * Enables the Attacks page tour (welcome callout + guided tour).
+   * Release: 9.5
+   */
+  attacksPageTourEnabled: false,
 });
 
 type ExperimentalConfigKeys = Array<keyof ExperimentalFeatures>;

x-pack/solutions/security/plugins/security_solution/public/common/lib/telemetry/events/attacks/index.ts

@@ -214,6 +214,36 @@ export const attacksTypeFilterChangedEvent: AttacksTelemetryEvent = {
   },
 };
 
+export const attacksTourCalloutActionEvent: AttacksTelemetryEvent = {
+  eventType: AttacksEventTypes.TourCalloutAction,
+  schema: {
+    action: {
+      type: 'keyword',
+      _meta: {
+        description: 'The action taken on the tour callout (view/start_tour/view_docs/dismiss)',
+        optional: false,
+      },
+    },
+  },
+};
+
+export const attacksTourStepActionEvent: AttacksTelemetryEvent = {
+  eventType: AttacksEventTypes.TourStepAction,
+  schema: {
+    action: {
+      type: 'keyword',
+      _meta: {
+        description: 'The action taken on a tour step (advance/dismiss/finish)',
+        optional: false,
+      },
+    },
+    step: {
+      type: 'integer',
+      _meta: { description: 'The tour step the action was taken on', optional: false },
+    },
+  },
+};
+
 export const attacksTelemetryEvents = [
   attacksTableSortChangedEvent,
   attacksViewOptionChangedEvent,
@@ -233,4 +263,6 @@ export const attacksTelemetryEvents = [
   attacksFeaturePromotionCalloutActionEvent,
   attacksWorkflowRunTriggeredEvent,
   attacksTypeFilterChangedEvent,
+  attacksTourCalloutActionEvent,
+  attacksTourStepActionEvent,
 ];

x-pack/solutions/security/plugins/security_solution/public/common/lib/telemetry/events/attacks/types.ts

@@ -26,6 +26,8 @@ export enum AttacksEventTypes {
   FeaturePromotionCalloutAction = 'Attacks Feature Promotion Callout Action',
   WorkflowRunTriggered = 'Attacks Workflow Run Triggered',
   TypeFilterChanged = 'Attacks Type Filter Changed',
+  TourCalloutAction = 'Attacks Tour Callout Action',
+  TourStepAction = 'Attacks Tour Step Action',
 }
 
 interface AttacksTableSortChangedParams {
@@ -104,6 +106,15 @@ interface AttacksTypeFilterChangedParams {
   types: string[];
 }
 
+interface AttacksTourCalloutActionParams {
+  action: 'view' | 'start_tour' | 'view_docs' | 'dismiss';
+}
+
+interface AttacksTourStepActionParams {
+  action: 'advance' | 'dismiss' | 'finish';
+  step: number;
+}
+
 export interface AttacksTelemetryEventsMap {
   [AttacksEventTypes.TableSortChanged]: AttacksTableSortChangedParams;
   [AttacksEventTypes.ViewOptionChanged]: AttacksViewOptionChangedParams;
@@ -123,6 +134,8 @@ export interface AttacksTelemetryEventsMap {
   [AttacksEventTypes.FeaturePromotionCalloutAction]: AttacksFeaturePromotionCalloutActionParams;
   [AttacksEventTypes.WorkflowRunTriggered]: AttacksActionBaseParams;
   [AttacksEventTypes.TypeFilterChanged]: AttacksTypeFilterChangedParams;
+  [AttacksEventTypes.TourCalloutAction]: AttacksTourCalloutActionParams;
+  [AttacksEventTypes.TourStepAction]: AttacksTourStepActionParams;
 }
 
 export interface AttacksTelemetryEvent {