[Security Solution] The Global search bar is not accessible if user is working with Console responder

[muskangulati-qasource]

Description: The Global search bar is not accessible if user is working with Console responder

Build Details:

VERSION: 8.4.0 BC1
BUILD: 54999
COMMIT: 58f7eaf0f8dc3c43cbfcd393e587f155e97b3d0d
ARTIFACT PAGE: https://staging.elastic.co/8.4.0-91109cf0/summary-8.4.0.html

Browser Details: All

Preconditions:

1. Kibana user should be logged in

Steps to Reproduce:

1. Navigate to the Endpoints tab under the Manage section from the left-hand side navigation bar
2. Click on the hostname
3. Click on the 'Take Action' button
4. Click on 'Launch responder' option
5. Click on the Global Search bar and observe the drop down closes immediately.

Impacted Test case: N/A

Actual Result: The Global search bar is not accessible if user is working with Console responder

Expected Result: The Global search bar should be accessible if user is working with Console responder

Screen Recording:

https://user-images.githubusercontent.com/60252716/181742048-263f5587-f058-4c4a-b70a-7935e3861218.mp4

Logs: N/A

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt)

[manishgupta-qasource]

Reviewed & assigned to @kevinlog

[kevinlog]

@paul-tavares I assume this has to do with the z-index on the Responder since it's an overlay.

It looks like it works correctly with the timeline view.

Can you take a look?

[paul-tavares]

Hey @kevinlog , @muskangulati-qasource , This is actually not an issue with Responder, but rather an issue (maybe) with the global toolbar. The problem happens anytime you have a "modal" type of UI shown on the page - example: a flyout with a background mask. I found this issue when on the following pages as well:

• Rules > Import (uses flyout with mask background)
• Artifact create/edit flyouts (those are also displayed with a flyout with mask background)

The problem is that when these types of flyouts (and Responder page overlay is also a flyout type), they have "focus lock" enabled. What that does is it ensure that the user's mouse focus remains inside of the area that enabled it - in this case the Responder window.

I'm not sure we can fix this.

[kevinlog]

thanks for the analysis @paul-tavares

I'm going to lower the impact on this since I don't think it will be a common use case to use the global search back when using the responder.

I'll keep this open for now and discuss it with whoever owns the global search bar. I'll close it if there's another issue opened or we decide that it won't be addressed/working as expected.

[muskangulati-qasource]

Sure @kevinlog,

@paul-tavares, Thank you for the update!!

We will keep track of the ticket and will add the same behavior to the test case as well.

Thank you!

[sukhwindersingh-qasource]

Hi @kevinlog,

We have validated this ticket on the latest 8.10.0-SNAPSHOT build and found the issue is NOT FIXED. 🔴

Please find below the testing details

Build Details:

VERSION: 8.10.0 BUILD: 65561 COMMIT: 4dadcbb91136a3e7d39e4b419aa12e21a37e4918

Screen Recording

https://github.com/elastic/kibana/assets/108654988/3bac0385-2c33-48f9-b542-d2b40ffd39b8

We have updated the label to the latest 8.10.0 release version .

Thanks!

[kevinlog]

Given @paul-tavares comment here: https://github.com/elastic/kibana/issues/137568#issuecomment-1209612264

I think it's OK to close this as "won't fix" since this is also a problem with a couple other views. We can revisit if it becomes a larger issue

[sukhwindersingh-qasource]

Bug Conversion

• No Test case is required since it is marked as won't fix.

Thanks!