[Security Solution] Fixes issues with the Raw events Top N view

[andrew-goldstein]

[Security Solution] Fixes issues with the Raw events Top N view

This PR fixes the following issues with the Raw events Top N view:

• Fixes an issue [Security Solution] Detection alerts are showing in raw events when click on show to modal under alerts page #121168 where the Sourcerer context included detection alerts in the Raw events view, per the before screenshot below:

Before

Above: Before - the Raw events view includes detection alerts

After

Above: After - The Raw events view does NOT include detection alerts

• Fixes an issue [Security Solution]Inspect Icon Index pattern issue for Raw Event #121381 where when inspecting Raw events, Sorry about that, something went wrong is displayed when the Sourcerer context does not match the current selection:

Before

Above: Before - When users Inspect the Raw events view, Sorry about that, something went wrong is displayed

After

Above: After - When users Inspect the raw events view, the expected Index pattern reflects the current Sourcerer selection

• Fixes an issue where the following filters in the Security > Alerts and Security > Rule > Details views:
  • kibana.alert.building_block_type: an "Additional filters" option on the alerts table
  • kibana.alert.rule.rule_id: filters alerts to a single rule on the Security > Rules > Details views
  • kibana.alert.rule.name: not a built-in view filter, but frequently applied via the Filter In and Filter Out actions
  • kibana.alert.rule.threat_mapping: an "Additional filters" option on the alerts table
  • kibana.alert.workflow_status: The open | acknowledged | closed status filter

were incorrectly applied to the Raw events view, per the screenshots below:

Before

Inspecting the Raw events query reveals the alert filters are applied as filter criteria, per the screenshot below:

Above: Before - The alert filters are applied to the Raw events view

After

After the fix, the alert filters are NOT applied to the raw events view, per the screenshot below:

Above: After - The alert filters are NOT applied to the Raw events view

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[kqualters-elastic]

nit: might make sense to use the consts from '@kbn/rule-data-utils' here and in the tests above just in case these are changed en masse again

[andrew-goldstein]

great suggestion @kqualters-elastic! implemented in eea414d

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: eea414d
• Storybooks Preview

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	2818	2817	-1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	4.6MB	4.6MB	+1.1KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
securitySolution	242.2KB	241.9KB	-231.0B

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @andrew-goldstein

[kibanamachine]

💔 Backport failed

Status	Branch	Result
✅	8.0
❌	7.17	Commit could not be cherrypicked due to conflicts
❌	7.16	Commit could not be cherrypicked due to conflicts

Successful backport PRs will be merged automatically after passing CI.

To backport manually run:
node scripts/backport --pr 121562

[brianseeders]

Apologies @andrew-goldstein I had to revert this, it's failing in main:
https://buildkite.com/elastic/kibana-hourly/builds/5718#82557138-9ddb-46e5-8145-718f371d26fd/462-465

[andrew-goldstein]

This PR passed CI (and was merged), but a (CI) race condition from #121135 deleted the following constants from @kbn/rule-data-utils after all the CI checks passed:

  ALERT_RULE_RISK_SCORE
  ALERT_RULE_RISK_SCORE_MAPPING
  ALERT_RULE_SEVERITY
  ALERT_RULE_SEVERITY_MAPPING

The (CI) race condition required this PR to be reverted. A new PR that doesn't depend on the constants deleted from @kbn/rule-data-utils will be opened.