diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/alert_summary_view.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/alert_summary_view.tsx
index e229c0c6fae49..9cc0b43f52123 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/alert_summary_view.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/alert_summary_view.tsx
@@ -37,6 +37,7 @@ import { SummaryView } from './summary_view';
import { AlertSummaryRow, getSummaryColumns, SummaryRow } from './helpers';
import { useRuleAsync } from '../../../detections/containers/detection_engine/rules/use_rule_async';
import { LineClamp } from '../line_clamp';
+import { endpointAlertCheck } from '../../utils/endpoint_alert_check';
const StyledEuiDescriptionList = styled(EuiDescriptionList)`
padding: 24px 4px 4px;
@@ -53,7 +54,7 @@ const fields = [
{ id: 'signal.rule.severity', label: ALERTS_HEADERS_SEVERITY },
{ id: 'signal.rule.risk_score', label: ALERTS_HEADERS_RISK_SCORE },
{ id: 'host.name' },
- { id: 'host.status' },
+ { id: 'agent.status' },
{ id: 'user.name' },
{ id: SOURCE_IP_FIELD_NAME, fieldType: IP_FIELD_TYPE },
{ id: DESTINATION_IP_FIELD_NAME, fieldType: IP_FIELD_TYPE },
@@ -178,6 +179,10 @@ const AlertSummaryViewComponent: React.FC<{
timelineId,
]);
+ const isEndpointAlert = useMemo(() => {
+ return endpointAlertCheck({ data });
+ }, [data]);
+
const agentId = useMemo(() => {
const findAgentId = find({ category: 'agent', field: 'agent.id' }, data)?.values;
return findAgentId ? findAgentId[0] : '';
@@ -188,7 +193,7 @@ const AlertSummaryViewComponent: React.FC<{
description: {
contextId: timelineId,
eventId,
- fieldName: 'host.status',
+ fieldName: 'agent.status',
value: agentId,
linkValue: undefined,
},
@@ -209,7 +214,7 @@ const AlertSummaryViewComponent: React.FC<{
{maybeRule?.note && (
diff --git a/x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.test.ts b/x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.test.ts
new file mode 100644
index 0000000000000..b085fe67d3814
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.test.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import _ from 'lodash';
+import { mockDetailItemData } from '../mock';
+import { endpointAlertCheck } from './endpoint_alert_check';
+
+describe('utils', () => {
+ describe('endpointAlertCheck', () => {
+ it('should return false if detections data does not come from endpoint rule', () => {
+ expect(endpointAlertCheck({ data: mockDetailItemData })).toBeFalsy();
+ });
+ it('should return true if detections data comes from an endpoint rule', () => {
+ _.remove(mockDetailItemData, function (o) {
+ return o.field === 'agent.type';
+ });
+ const mockEndpointDetailItemData = _.concat(mockDetailItemData, {
+ field: 'agent.type',
+ originalValue: 'endpoint',
+ values: ['endpoint'],
+ isObjectArray: false,
+ });
+
+ expect(endpointAlertCheck({ data: mockEndpointDetailItemData })).toBeTruthy();
+ });
+ });
+});
diff --git a/x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.ts b/x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.ts
new file mode 100644
index 0000000000000..e399cec0f3bbe
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { find } from 'lodash/fp';
+import { TimelineEventsDetailsItem } from '../../../common/search_strategy';
+
+export const endpointAlertCheck = ({ data }: { data: TimelineEventsDetailsItem[] | null }) => {
+ const findEndpointAlert = find({ field: 'agent.type' }, data)?.values;
+ return findEndpointAlert ? findEndpointAlert[0] === 'endpoint' : false;
+};
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
index 76341055f28ef..395538610f567 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
@@ -32,6 +32,7 @@ import {
} from '../../../../detections/components/host_isolation/translations';
import { ALERT_DETAILS } from './translations';
import { useIsolationPrivileges } from '../../../../common/hooks/endpoint/use_isolate_privileges';
+import { endpointAlertCheck } from '../../../../common/utils/endpoint_alert_check';
const StyledEuiFlyoutBody = styled(EuiFlyoutBody)`
.euiFlyoutBody__overflow {
@@ -92,8 +93,7 @@ const EventDetailsPanelComponent: React.FC = ({
const isAlert = some({ category: 'signal', field: 'signal.rule.id' }, detailsData);
const isEndpointAlert = useMemo(() => {
- const findEndpointAlert = find({ category: 'agent', field: 'agent.type' }, detailsData)?.values;
- return findEndpointAlert ? findEndpointAlert[0] === 'endpoint' : false;
+ return endpointAlertCheck({ data: detailsData });
}, [detailsData]);
const agentId = useMemo(() => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/constants.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/constants.tsx
index 761d82b482af2..aeb40bed26c8e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/constants.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/constants.tsx
@@ -16,4 +16,4 @@ export const REFERENCE_URL_FIELD_NAME = 'reference.url';
export const EVENT_URL_FIELD_NAME = 'event.url';
export const SIGNAL_RULE_NAME_FIELD_NAME = 'signal.rule.name';
export const SIGNAL_STATUS_FIELD_NAME = 'signal.status';
-export const HOST_STATUS_FIELD_NAME = 'host.status';
+export const AGENT_STATUS_FIELD_NAME = 'agent.status';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx
index efb51916e3765..3d5d410abb87e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx
@@ -32,7 +32,7 @@ import {
REFERENCE_URL_FIELD_NAME,
EVENT_URL_FIELD_NAME,
SIGNAL_STATUS_FIELD_NAME,
- HOST_STATUS_FIELD_NAME,
+ AGENT_STATUS_FIELD_NAME,
GEO_FIELD_TYPE,
} from './constants';
import { RenderRuleName, renderEventModule, renderUrl } from './formatted_field_helpers';
@@ -120,7 +120,7 @@ const FormattedFieldValueComponent: React.FC<{
return (
);
- } else if (fieldName === HOST_STATUS_FIELD_NAME) {
+ } else if (fieldName === AGENT_STATUS_FIELD_NAME) {
return (