[8.19] [Security Solution] Fix hover actions when data view manager is enabled (#225561) (#225933)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Security Solution] Fix hover actions when data view manager is
enabled (#225561)](#225561)

<!--- Backport version: 10.0.1 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT
[{"author":{"name":"christineweng","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-06-27T17:56:28Z","message":"[Security
Solution] Fix hover actions when data view manager is enabled
(#225561)\n\n## Summary\n\nFollow up of
#224812, fixing hover\nactions in
other places: kpi charts in alerts page and event table in\nexplore
pages.\n\nEnable
`newDataViewPickerEnabled`\n\n\n![image](https://github.com/user-attachments/assets/0402aa29-cf09-4813-8e39-ac1af898d969)","sha":"00ca52da3a9a95bf5938d7d76413a35d1e65190f","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Threat
Hunting:Investigations","backport:version","v9.1.0","v8.19.0","v9.2.0"],"title":"[Security
Solution] Fix hover actions when data view manager is
enabled","number":225561,"url":"https://github.com/elastic/kibana/pull/225561","mergeCommit":{"message":"[Security
Solution] Fix hover actions when data view manager is enabled
(#225561)\n\n## Summary\n\nFollow up of
#224812, fixing hover\nactions in
other places: kpi charts in alerts page and event table in\nexplore
pages.\n\nEnable
`newDataViewPickerEnabled`\n\n\n![image](https://github.com/user-attachments/assets/0402aa29-cf09-4813-8e39-ac1af898d969)","sha":"00ca52da3a9a95bf5938d7d76413a35d1e65190f"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/225694","number":225694,"state":"MERGED","mergeCommit":{"sha":"47e270c08bbf9ce20121d8cf25a6d2417701d235","message":"[9.1]
[Security Solution] Fix hover actions when data view manager is enabled
(#225561) (#225694)\n\n# Backport\n\nThis will backport the following
commits from `main` to `9.1`:\n- [[Security Solution] Fix hover actions
when data view manager is\nenabled
(#225561)](https://github.com/elastic/kibana/pull/225561)\n\n\n\n###
Questions ?\nPlease refer to the [Backport
tool\ndocumentation](https://github.com/sorenlouv/backport)\n\n\n\nCo-authored-by:
christineweng
<[email protected]>"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/225561","number":225561,"mergeCommit":{"message":"[Security
Solution] Fix hover actions when data view manager is enabled
(#225561)\n\n## Summary\n\nFollow up of
#224812, fixing hover\nactions in
other places: kpi charts in alerts page and event table in\nexplore
pages.\n\nEnable
`newDataViewPickerEnabled`\n\n\n![image](https://github.com/user-attachments/assets/0402aa29-cf09-4813-8e39-ac1af898d969)","sha":"00ca52da3a9a95bf5938d7d76413a35d1e65190f"}}]}]
BACKPORT-->

Author: christineweng

x-pack/solutions/security/plugins/security_solution/public/common/components/cell_actions/index.test.tsx

@@ -11,6 +11,16 @@ import { SecurityCellActionsTrigger } from '../../../app/actions/constants';
 import { CellActionsMode, SecurityCellActions } from '.';
 import { CellActions } from '@kbn/cell-actions';
 
+jest.mock('../../../data_view_manager/hooks/use_data_view', () => ({
+  useDataView: jest.fn(() => ({
+    dataView: { id: 'security-default-dataview-id', fields: { getByName: jest.fn() } },
+  })),
+}));
+
+jest.mock('../../hooks/use_experimental_features', () => ({
+  useIsExperimentalFeatureEnabled: jest.fn(() => false),
+}));
+
 const MockCellActions = CellActions as jest.Mocked<typeof CellActions>;
 jest.mock('@kbn/cell-actions', () => ({
   ...jest.requireActual('@kbn/cell-actions'),

x-pack/solutions/security/plugins/security_solution/public/common/components/cell_actions/index.tsx

@@ -19,6 +19,8 @@ import { SecurityCellActionsTrigger, SecurityCellActionType } from '../../../app
 import { SourcererScopeName } from '../../../sourcerer/store/model';
 import { useGetFieldSpec } from '../../hooks/use_get_field_spec';
 import { useDataViewId } from '../../hooks/use_data_view_id';
+import { useIsExperimentalFeatureEnabled } from '../../hooks/use_experimental_features';
+import { useDataView } from '../../../data_view_manager/hooks/use_data_view';
 
 // bridge exports for convenience
 export * from '@kbn/cell-actions';
@@ -64,8 +66,13 @@ export const SecurityCellActions: React.FC<SecurityCellActionsProps> = ({
   children,
   ...props
 }) => {
-  const getFieldSpec = useGetFieldSpec(sourcererScopeId);
-  const dataViewId = useDataViewId(sourcererScopeId);
+  const oldGetFieldSpec = useGetFieldSpec(sourcererScopeId);
+  const oldDataViewId = useDataViewId(sourcererScopeId);
+
+  const newDataViewPickerEnabled = useIsExperimentalFeatureEnabled('newDataViewPickerEnabled');
+  const { dataView: experimentalDataView } = useDataView(sourcererScopeId);
+  const dataViewId = newDataViewPickerEnabled ? experimentalDataView?.id : oldDataViewId;
+
   // Make a dependency key to prevent unnecessary re-renders when data object is defined inline
   // It is necessary because the data object is an array or an object and useMemo would always re-render
   const dependencyKey = JSON.stringify(data);
@@ -74,12 +81,14 @@ export const SecurityCellActions: React.FC<SecurityCellActionsProps> = ({
     () =>
       (Array.isArray(data) ? data : [data])
         .map(({ field, value }) => ({
-          field: getFieldSpec(field),
+          field: newDataViewPickerEnabled
+            ? experimentalDataView?.fields?.getByName(field)?.toSpec()
+            : oldGetFieldSpec(field),
           value,
         }))
         .filter((item): item is CellActionsData => !!item.field),
     // eslint-disable-next-line react-hooks/exhaustive-deps -- Use the dependencyKey to prevent unnecessary re-renders
-    [dependencyKey, getFieldSpec]
+    [dependencyKey, oldGetFieldSpec, newDataViewPickerEnabled, experimentalDataView?.fields]
   );
 
   const metadataWithDataView = useMemo(() => ({ ...metadata, dataViewId }), [dataViewId, metadata]);

x-pack/solutions/security/plugins/security_solution/public/common/components/events_viewer/index.tsx

@@ -36,6 +36,7 @@ import type { EuiTheme } from '@kbn/kibana-react-plugin/common';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import type { RunTimeMappings } from '@kbn/timelines-plugin/common/search_strategy';
 import { useDataViewSpec } from '../../../data_view_manager/hooks/use_data_view_spec';
+import { useDataView } from '../../../data_view_manager/hooks/use_data_view';
 import { InspectButton } from '../inspect';
 import type {
   ControlColumnProps,
@@ -156,9 +157,12 @@ const StatefulEventsViewerComponent: React.FC<EventsViewerProps & PropsFromRedux
     sourcererDataView: oldSourcererDataView,
     loading: oldIsLoadingIndexPattern,
   } = useSourcererDataView(sourcererScope);
+  const oldGetFieldSpec = useGetFieldSpec(sourcererScope);
 
   const newDataViewPickerEnabled = useIsExperimentalFeatureEnabled('newDataViewPickerEnabled');
   const { dataViewSpec, status } = useDataViewSpec(sourcererScope);
+  const { dataView: experimentalDataView } = useDataView(sourcererScope);
+
   const experimentalSelectedPatterns = useSelectedPatterns(sourcererScope);
   const experimentalBrowserFields = useBrowserFields(sourcererScope);
   const selectedPatterns = newDataViewPickerEnabled
@@ -172,7 +176,13 @@ const StatefulEventsViewerComponent: React.FC<EventsViewerProps & PropsFromRedux
   const selectedDataViewId = newDataViewPickerEnabled ? dataViewSpec.id : oldDataViewId;
   const browserFields = newDataViewPickerEnabled ? experimentalBrowserFields : oldBrowserFields;
 
-  const getFieldSpec = useGetFieldSpec(sourcererScope);
+  const experimentalGetFieldSpec = useCallback(
+    (fieldName: string) => {
+      return experimentalDataView?.fields?.getByName(fieldName)?.toSpec();
+    },
+    [experimentalDataView?.fields]
+  );
+  const getFieldSpec = newDataViewPickerEnabled ? experimentalGetFieldSpec : oldGetFieldSpec;
 
   const editorActionsRef = useRef<FieldEditorActions>(null);
   useEffect(() => {

x-pack/solutions/security/plugins/security_solution/public/detections/hooks/trigger_actions_alert_table/use_cell_actions.tsx

@@ -30,7 +30,7 @@ export const useCellActionsOptions = (
   >
 ) => {
   const newDataViewPickerEnabled = useIsExperimentalFeatureEnabled('newDataViewPickerEnabled');
-  const experimentalDataView = useDataView(SourcererScopeName.detections);
+  const { dataView: experimentalDataView } = useDataView(SourcererScopeName.detections);
 
   const {
     columns = [],
@@ -39,9 +39,9 @@ export const useCellActionsOptions = (
     pageSize = 0,
     dataGridRef,
   } = context ?? {};
-  const getFieldSpec = useGetFieldSpec(SourcererScopeName.detections);
+  const oldGetFieldSpec = useGetFieldSpec(SourcererScopeName.detections);
   const oldDataViewId = useDataViewId(SourcererScopeName.detections);
-  const dataViewId = newDataViewPickerEnabled ? experimentalDataView?.dataView?.id : oldDataViewId;
+  const dataViewId = newDataViewPickerEnabled ? experimentalDataView?.id : oldDataViewId;
 
   const cellActionsMetadata = useMemo(
     () => ({ scopeId: tableId, dataViewId }),
@@ -52,15 +52,15 @@ export const useCellActionsOptions = (
       columns.map(
         (column) =>
           (newDataViewPickerEnabled
-            ? experimentalDataView.dataView?.fields?.getByName(column.id)?.toSpec()
-            : getFieldSpec(column.id)) ?? {
+            ? experimentalDataView?.fields?.getByName(column.id)?.toSpec()
+            : oldGetFieldSpec(column.id)) ?? {
             name: '',
             type: '', // When type is an empty string all cell actions are incompatible
             aggregatable: false,
             searchable: false,
           }
       ),
-    [columns, experimentalDataView.dataView?.fields, getFieldSpec, newDataViewPickerEnabled]
+    [columns, experimentalDataView?.fields, oldGetFieldSpec, newDataViewPickerEnabled]
   );
 
   /**