[Security Solution] - use old flyout for user and host details when open within timeline (to avoid cell action bug)

[PhilippeOberti]

Notes

The intend is to merge this PR if we cannot fix the issue during the BC period.

Summary

A but was introduced when we merged the PR that enabled the expandable flyout for alerts, hosts and users within timeline. The bug was raised here and here's the ticket for it.

At the time we decided to merge the code anyway as the bug was hidden behind a feature flag that was turned off by default. We'd like to turn on the feature flag, but the fix seems to be a big complex and involved.

This PR makes very small changes to revert the use of the expandable flyout for hosts and users within timeline, until we can fix the actual issue.

https://github.com/elastic/kibana/assets/17276605/98324a68-87a5-4639-a32a-a6e3d304908e

[elasticmachine]

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

[kibana-ci]

:green_heart: Build Succeeded

• Buildkite Build
• Commit: d9f1eecbd5e0f37aa5570783daa193ccb358e196

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	17.4MB	17.4MB	-114.0B

History

• :broken_heart: Build #206369 failed 6513aff88eaf347fb96c97c12e948b4f96f657c1

To update your PR or re-run it, just comment with: @elasticmachine merge upstream

[PhilippeOberti]

Thanks for tagging me!

To fix the bug: The SecurityCellActions prop meta.scopeId was created to fix this kind of bug. We need set this prop with the timeline id.

https://github.com/elastic/kibana/blob/abb84a6426d3599c961ce685d365da923f898eb6/x-pack/plugins/security_solution/public/actions/filter/cell_action/filter_in.ts#L67

@machadoum if my understanding is correct, our problem is the new host and user flyouts aren't using those SecuritySolution cellactions though, they're using the DefaultFieldRendererComponent which internally is using DefaultDraggable, I tried to down the rabbit hole of trying to understand that code but it's rough 😆

Am I mistaken here and is there a simple fix I could get in this week?

[PhilippeOberti]

@semd @machadoum here's the PR that fixes the issue. If this gets merged then we do not have to merge this current PR! 🤞

[PhilippeOberti]

@semd @machadoum here's the PR that fixes the issue. If this gets merged then we do not have to merge this current PR! 🤞

the PR and its backport are merged. Closing this one as it's not needed anymore 🕺