kibana
kibana copied to clipboard
elastic
[Security Solution][UX] Streamlining the Timeline Components in Security Solution UI
Summary
This issue describes some UX issues faced by users with respect to timelines. Opinions are needed by below teams to take an action to mitigate those issues.
- @elastic/security-threat-hunting-investigations
- @elastic/security-threat-hunting-explore
- @elastic/security-onboarding-and-lifecycle-mgt
Current Situation regarding Timeline
Currently timelines occur in Security Solution in below 2 ways:
| Universal Bottom Bar | Expanded Timeline Flyout |
|---|---|
 |
 |
Today, this Bottom Bar and Timeline Flyout appears on almost all screens of Security Solution except below ones:
- Security / Dashboards
- Security / Explore
- Security / Manage
- Security / Manage / Endpoints
- Security / Manage / Policies
- Security / Manage / Trusted applications
- Security / Manage / Event Filters
- Security / Manage / Host isolation exceptions
UX Issues
Since, timeline is not available on the above screens, it presents us with some user Experience issues ( mentioned in #119593 ) when user leaves the security solution UI. When user leave the Security solution plugin, we ask user to either save/discard the timeline.
But timeline components are not available on these screens and there is no way for user to either save or discard the timeline before they leave the Security Solution UI.
Suggested Proposal 1
We can add Timeline components (BottomBar and Flyout) on every screen, so that timeline can be truly universal across the screen. I have created this issue so that we can discuss, what stops us from going in that direction.
We can also discuss other possible solutions to this issue.
Adding @kevinlog ( For Security Solution Administration ), @elastic/security-threat-hunting-investigations & @elastic/security-threat-hunting-explore teams to weigh in on this issue.
Suggested Proposal 2
Currently, Save or Discard timeline screen is divided into 2 parts.
- Actual timeline flyout that you see in the background in the screenshot.
-
Save Timelinepopup.
Currently, they are part of one component only. We can separate out these 2 and show only the popup only on the screens where timeline is not available. Only issue I see with that is that user will not be able to see what they are saving.
@logeekal
I'm apprehensive to add the Timeline bar to the bottom of the pages above since I think it would interfere with some of our functionality. Most notably, we use a bottom bar with save options on our Policy configuration page. Screenshot below.
I like the Suggested Proposal 2, but understand that it can be confusing to be asked to save when you can't see the timeline in the bottom on the manage pages.
Is there a 3rd option where we can prompt the user to save when entering any of the Manage pages within Security? Specifically what you listed above:
- Security / Manage
- Security / Manage / Endpoints
- Security / Manage / Policies
- Security / Manage / Trusted applications
- Security / Manage / Event Filters
- Security / Manage / Host isolation exceptions
Today, the Manage section is primarily concerned with configuring and monitoring Endpoints which are different workflows than investigations done in the timeline. So maybe prompting the user to save when entering Manage is OK?
cc @caitlinbetz @merilmathew let me know your thoughts on the above
Thanks for calling this out @logeekal. I like @kevinlog 's idea of prompting a save when the user navigates into the Manage section. @paulewing - curious about your thoughts on this?
@kevinlog I agree with the option that you proposed. But as @caitlinbetz said, I would also let @paulewing weigh in on it. Thank you very much for both of your inputs.
Thank you all for your inputs. As final resolution, timeline bottom bar has been enabled on below pages.
- Security / Dashboards
- Security / Explore
- Security / Cases / ....
When user navigates to any other pages within security solution where timeline bottom bar is not visible, use will be reminded that they have an unsaved timeline.
Justification for enabling timeline bottom bar on above pages is to prevent users from getting too many timeline save reminders if they navigate within Security Solution plugin.