[9.2] [Security Solution] [Bug] The schedule can not be created if any LLM model is selected as the default (#239049) (#239112) (#239164)

# Backport

This will backport the following commits from `main` to `9.2`:
- [[Security Solution] [Bug] The schedule can not be created if any LLM
model is selected as the default (#239049)
(#239112)](#239112)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Ievgen
Sorokopud","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-10-15T14:24:48Z","message":"[Security
Solution] [Bug] The schedule can not be created if any LLM model is
selected as the default (#239049) (#239112)\n\n## Summary\n\nBUG:
https://github.com/elastic/kibana/issues/239049\n\nThese changes fix the
issue where user cannot create a new attack\ndiscovery schedule when the
default LLM has been selected.\n\nThe issue happens because internally
the connector selector implicitly\nsets the default connector without
notifying parent controls. Also, the\nnature of the form that we use for
the create and edit schedules flows\nis that we need to initialize it
with the correct value or update it\nonce the form ha been mounted and
rendered.\n\nAs a fix for the upcoming release, we would allow parent
components to\nenforce user to select connector while creating the
attack discovery\nschedule - even when the default LLM exists.\n\n###
Recording of the
fix\n\n\nhttps://github.com/user-attachments/assets/f05d4959-e218-4c99-81a6-02b657bcb39d","sha":"168f852cd6b3c5ed09178bdea466a6befa54422e","branchLabelMapping":{"^v9.3.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:
SecuritySolution","Team:Security Generative
AI","backport:version","v9.2.0","v9.3.0"],"title":"[Security Solution]
[Bug] The schedule can not be created if any LLM model is selected as
the default
(#239049)","number":239112,"url":"https://github.com/elastic/kibana/pull/239112","mergeCommit":{"message":"[Security
Solution] [Bug] The schedule can not be created if any LLM model is
selected as the default (#239049) (#239112)\n\n## Summary\n\nBUG:
https://github.com/elastic/kibana/issues/239049\n\nThese changes fix the
issue where user cannot create a new attack\ndiscovery schedule when the
default LLM has been selected.\n\nThe issue happens because internally
the connector selector implicitly\nsets the default connector without
notifying parent controls. Also, the\nnature of the form that we use for
the create and edit schedules flows\nis that we need to initialize it
with the correct value or update it\nonce the form ha been mounted and
rendered.\n\nAs a fix for the upcoming release, we would allow parent
components to\nenforce user to select connector while creating the
attack discovery\nschedule - even when the default LLM exists.\n\n###
Recording of the
fix\n\n\nhttps://github.com/user-attachments/assets/f05d4959-e218-4c99-81a6-02b657bcb39d","sha":"168f852cd6b3c5ed09178bdea466a6befa54422e"}},"sourceBranch":"main","suggestedTargetBranches":["9.2"],"targetPullRequestStates":[{"branch":"9.2","label":"v9.2.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.3.0","branchLabelMappingKey":"^v9.3.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/239112","number":239112,"mergeCommit":{"message":"[Security
Solution] [Bug] The schedule can not be created if any LLM model is
selected as the default (#239049) (#239112)\n\n## Summary\n\nBUG:
https://github.com/elastic/kibana/issues/239049\n\nThese changes fix the
issue where user cannot create a new attack\ndiscovery schedule when the
default LLM has been selected.\n\nThe issue happens because internally
the connector selector implicitly\nsets the default connector without
notifying parent controls. Also, the\nnature of the form that we use for
the create and edit schedules flows\nis that we need to initialize it
with the correct value or update it\nonce the form ha been mounted and
rendered.\n\nAs a fix for the upcoming release, we would allow parent
components to\nenforce user to select connector while creating the
attack discovery\nschedule - even when the default LLM exists.\n\n###
Recording of the
fix\n\n\nhttps://github.com/user-attachments/assets/f05d4959-e218-4c99-81a6-02b657bcb39d","sha":"168f852cd6b3c5ed09178bdea466a6befa54422e"}}]}]
BACKPORT-->

Co-authored-by: Ievgen Sorokopud <[email protected]>

Author: kibanamachine

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/connectorland/connector_selector/index.tsx

@@ -42,6 +42,12 @@ interface Props {
   displayFancy?: (label: string, aIConnector?: AIConnector) => React.ReactNode;
   setIsOpen?: (isOpen: boolean) => void;
   stats?: AttackDiscoveryStats | null;
+
+  /**
+   * Allows parent components to control whether the default connector should be
+   * automatically selected or the explicit user selection action required.
+   */
+  explicitConnectorSelection?: boolean;
 }
 
 export type AIConnector = ActionConnector & {
@@ -59,6 +65,7 @@ export const ConnectorSelector: React.FC<Props> = React.memo(
     onConnectorSelectionChange,
     setIsOpen,
     stats = null,
+    explicitConnectorSelection,
   }) => {
     const {
       actionTypeRegistry,
@@ -129,7 +136,9 @@ export const ConnectorSelector: React.FC<Props> = React.memo(
     );
 
     // Use effective value (optimistic or actual) or fall back to default
-    const selectedOrDefaultConnectorId = effectiveSelectedConnectorId ?? defaultAIConnectorId;
+    const selectedOrDefaultConnectorId =
+      effectiveSelectedConnectorId ??
+      (explicitConnectorSelection ? undefined : defaultAIConnectorId);
     const selectedOrDefaultConnector = aiConnectors?.find(
       (connector) => connector.id === selectedOrDefaultConnectorId
     );

x-pack/platform/packages/shared/kbn-elastic-assistant/impl/connectorland/connector_selector_inline/connector_selector_inline.tsx

@@ -27,6 +27,12 @@ interface Props {
   onConnectorIdSelected?: (connectorId: string) => void;
   onConnectorSelected?: (conversation: Conversation, apiConfig?: ApiConfig) => void;
   stats?: AttackDiscoveryStats | null;
+
+  /**
+   * Allows parent components to control whether the default connector should be
+   * automatically selected or the explicit user selection action required.
+   */
+  explicitConnectorSelection?: boolean;
 }
 
 const inputContainerClassName = css`
@@ -77,6 +83,7 @@ export const ConnectorSelectorInline: React.FC<Props> = React.memo(
     onConnectorIdSelected,
     onConnectorSelected,
     stats = null,
+    explicitConnectorSelection,
   }) => {
     const { euiTheme } = useEuiTheme();
     const [isOpen, setIsOpen] = useState<boolean>(false);
@@ -159,6 +166,7 @@ export const ConnectorSelectorInline: React.FC<Props> = React.memo(
             setIsOpen={setIsOpen}
             onConnectorSelectionChange={onChange}
             stats={stats}
+            explicitConnectorSelection={explicitConnectorSelection}
           />
         </EuiFlexItem>
       </EuiFlexGroup>

x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/form_fields/connector_selector_field/index.tsx

@@ -37,6 +37,7 @@ export const ConnectorSelectorField: React.FC<Props> = React.memo(
           onConnectorSelected={noop}
           onConnectorIdSelected={onConnectorIdSelected}
           selectedConnectorId={connectorId}
+          explicitConnectorSelection={true}
         />
       </EuiFormRow>
     );