[Security Solution] Enable Value Reports in ESS

packages/kbn-optimizer/limits.yml

@@ -156,7 +156,7 @@ pageLoadAssetSize:
   searchQueryRules: 6689
   searchSynonyms: 6371
   security: 79627
-  securitySolution: 119378
+  securitySolution: 186285
   securitySolutionEss: 43319
   securitySolutionServerless: 62689
   serverless: 7852

src/platform/packages/private/kbn-reporting/common/constants.ts

@@ -13,6 +13,7 @@ import {
   DASHBOARD_APP_LOCATOR,
   LENS_APP_LOCATOR,
   VISUALIZE_APP_LOCATOR,
+  AI_VALUE_REPORT_LOCATOR,
 } from '@kbn/deeplinks-analytics';
 import type { LicenseType } from '@kbn/licensing-types';
 
@@ -74,6 +75,7 @@ export const REPORTING_REDIRECT_ALLOWED_LOCATOR_TYPES = [
   DASHBOARD_APP_LOCATOR,
   LENS_APP_LOCATOR,
   VISUALIZE_APP_LOCATOR,
+  AI_VALUE_REPORT_LOCATOR,
 ];
 
 // Redirection URL used to load app state for screenshotting

src/platform/packages/private/kbn-reporting/public/share/integrations/pdf/index.ts

@@ -16,7 +16,7 @@ export const reportingPDFExportShareIntegration = ({
   apiClient,
   startServices$,
 }: ExportModalShareOpts): RegisterShareIntegrationArgs<ExportShare> => {
-  const supportedObjectTypes = ['dashboard', 'visualization', 'lens'];
+  const supportedObjectTypes = ['dashboard', 'visualization', 'lens', 'ai_value_report'];
 
   return {
     id: 'pdfReports',

src/platform/packages/shared/deeplinks/analytics/constants.ts

@@ -32,3 +32,5 @@ export const DASHBOARD_SAVED_OBJECT_TYPE = 'dashboard';
 export const LENS_APP_LOCATOR = 'LENS_APP_LOCATOR';
 
 export const VISUALIZE_APP_LOCATOR = 'VISUALIZE_APP_LOCATOR';
+
+export const AI_VALUE_REPORT_LOCATOR = 'AI_VALUE_REPORT_LOCATOR';

src/platform/packages/shared/deeplinks/analytics/index.ts

@@ -17,6 +17,7 @@ export {
   LENS_APP_LOCATOR,
   DISCOVER_ESQL_LOCATOR,
   DASHBOARD_APP_LOCATOR,
+  AI_VALUE_REPORT_LOCATOR,
 } from './constants';
 
 export type { AppId, DeepLinkId } from './deep_links';

src/platform/plugins/private/kibana_usage_collection/server/collectors/management/schema.ts

@@ -42,6 +42,18 @@ export const stackManagementSchema: MakeSchemaFrom<UsageStats> = {
     type: 'keyword',
     _meta: { description: 'Non-default value of setting.' },
   },
+  'securitySolution:defaultValueReportMinutes': {
+    type: 'keyword',
+    _meta: { description: 'Non-default value of setting.' },
+  },
+  'securitySolution:defaultValueReportRate': {
+    type: 'keyword',
+    _meta: { description: 'Non-default value of setting.' },
+  },
+  'securitySolution:defaultValueReportTitle': {
+    type: 'keyword',
+    _meta: { description: 'Non-default value of setting.' },
+  },
   'xpackReporting:customPdfLogo': {
     type: 'keyword',
     _meta: { description: 'Default value of the setting was changed.' },

src/platform/plugins/private/kibana_usage_collection/server/collectors/management/types.ts

@@ -78,6 +78,9 @@ export interface UsageStats {
   'securitySolution:enableEsqlRiskScoring': boolean;
   'securitySolution:enableCloudConnector': boolean;
   'securitySolution:suppressionBehaviorOnAlertClosure': string;
+  'securitySolution:defaultValueReportMinutes': string;
+  'securitySolution:defaultValueReportRate': string;
+  'securitySolution:defaultValueReportTitle': string;
   'search:includeFrozen': boolean;
   'courier:maxConcurrentShardRequests': number;
   'courier:setRequestPreference': string;

src/platform/plugins/shared/telemetry/schema/oss_platform.json

@@ -10109,6 +10109,24 @@
             "description": "Non-default value of setting."
           }
         },
+        "securitySolution:defaultValueReportMinutes": {
+          "type": "keyword",
+          "_meta": {
+            "description": "Non-default value of setting."
+          }
+        },
+        "securitySolution:defaultValueReportRate": {
+          "type": "keyword",
+          "_meta": {
+            "description": "Non-default value of setting."
+          }
+        },
+        "securitySolution:defaultValueReportTitle": {
+          "type": "keyword",
+          "_meta": {
+            "description": "Non-default value of setting."
+          }
+        },
         "xpackReporting:customPdfLogo": {
           "type": "keyword",
           "_meta": {

x-pack/solutions/security/plugins/elastic_assistant/server/lib/prompt/prompts.ts

@@ -333,7 +333,7 @@ export const starterPromptPrompt4 =
   'Can you provide examples of questions I can ask about Elastic Security, such as investigating alerts, running ES|QL queries, incident response, or threat intelligence?';
 
 export const costSavingsInsightPart1 = `You are given Elasticsearch Lens aggregation results showing cost savings over time:`;
-export const costSavingsInsightPart2 = `Generate a concise bulleted summary in mdx markdown. Follow the style and tone of the example below, highlighting key trends, averages, peaks, and projections:
+export const costSavingsInsightPart2 = `Generate a concise bulleted summary in mdx markdown, no more than 500 characters. Follow the style and tone of the example below, highlighting key trends, averages, peaks, and projections:
 
 \`\`\`
 - Between July 18 and August 18, daily cost savings **averaged around $135K**

x-pack/solutions/security/plugins/security_solution/common/locators/ai_value_report/locator.test.ts

@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { AI_VALUE_REPORT_LOCATOR } from '@kbn/deeplinks-analytics';
+import { AIValueReportLocatorDefinition, parseLocationState } from './locator';
+import { AI_VALUE_PATH, APP_UI_ID } from '../../constants';
+
+describe('AIValueReportLocatorDefinition', () => {
+  const locator = new AIValueReportLocatorDefinition();
+
+  const validParams = {
+    timeRange: {
+      from: '2024-01-01T00:00:00Z',
+      to: '2024-01-02T00:00:00Z',
+    },
+    insight: 'Some valuable insight!',
+    reportDataHash: 'abc123',
+  };
+
+  test('id should match constant', () => {
+    expect(locator.id).toBe(AI_VALUE_REPORT_LOCATOR);
+  });
+
+  test('getLocation returns correct location object', async () => {
+    const result = await locator.getLocation(validParams);
+
+    expect(result).toEqual({
+      app: APP_UI_ID,
+      path: AI_VALUE_PATH,
+      state: validParams,
+    });
+  });
+});
+
+describe('parseLocationState', () => {
+  const validState = {
+    timeRange: {
+      from: '2024-01-01T00:00:00Z',
+      to: '2024-01-01T00:00:00Z',
+    },
+    insight: 'Some valuable insight!',
+    reportDataHash: 'hash123',
+  };
+
+  it('returns parsed state when valid', () => {
+    const result = parseLocationState(validState);
+    expect(result).toEqual(validState);
+  });
+
+  it('strips unknown fields but preserves valid ones', () => {
+    const stateWithExtras = {
+      ...validState,
+      extraField: 'foo',
+      anotherOne: 42,
+    };
+
+    const result = parseLocationState(stateWithExtras);
+
+    expect(result).toEqual(stateWithExtras);
+  });
+
+  it('returns undefined for invalid state (missing fields)', () => {
+    const invalid = {
+      insight: 'missing timeRange and hash',
+    };
+
+    const result = parseLocationState(invalid);
+    expect(result).toBeUndefined();
+  });
+});

x-pack/solutions/security/plugins/security_solution/common/locators/ai_value_report/locator.ts

@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { z } from '@kbn/zod';
+import type { LocatorDefinition, LocatorPublic } from '@kbn/share-plugin/public';
+import { AI_VALUE_REPORT_LOCATOR } from '@kbn/deeplinks-analytics';
+import { AI_VALUE_PATH, APP_UI_ID } from '../../constants';
+
+const AIValueReportParamsSchema = z.object({
+  timeRange: z.object({
+    to: z.string().nonempty(),
+    from: z.string().nonempty(),
+  }),
+  insight: z.string().nonempty(),
+  reportDataHash: z.string().nonempty(),
+});
+
+export type AIValueReportParams = z.infer<typeof AIValueReportParamsSchema>;
+
+export type ForwardedAIValueReportState = AIValueReportParams;
+
+export type AIValueReportLocator = LocatorPublic<AIValueReportParams>;
+
+export class AIValueReportLocatorDefinition implements LocatorDefinition<AIValueReportParams> {
+  public readonly id = AI_VALUE_REPORT_LOCATOR;
+
+  public readonly getLocation = async (params: AIValueReportParams) => {
+    return {
+      app: APP_UI_ID,
+      path: AI_VALUE_PATH,
+      state: params,
+    };
+  };
+}
+
+export const parseLocationState = (state: unknown): ForwardedAIValueReportState | undefined => {
+  const result = AIValueReportParamsSchema.passthrough().safeParse(state);
+  if (result.error) {
+    // This will cause the page to fallback to rendering normally
+    return undefined;
+  }
+
+  return result.data;
+};

x-pack/solutions/security/plugins/security_solution/kibana.jsonc

@@ -63,6 +63,7 @@
       "productDocBase",
       "telemetry",
       "elasticAssistantSharedState",
+      "share"
     ],
     "optionalPlugins": [
       "encryptedSavedObjects",

x-pack/solutions/security/plugins/security_solution/moon.yml

@@ -261,6 +261,7 @@ dependsOn:
   - '@kbn/response-ops-rule-form'
   - '@kbn/core-lifecycle-browser-mocks'
   - '@kbn/connector-schemas'
+  - '@kbn/deeplinks-analytics'
   - '@kbn/tour-queue'
 tags:
   - plugin

x-pack/solutions/security/plugins/security_solution/public/common/components/navigation/security_side_nav/categories.ts

@@ -47,5 +47,9 @@ export const getNavCategories = (
       type: LinkCategoryType.separator,
       linkIds: [SecurityPageName.siemReadiness],
     },
+    {
+      type: LinkCategoryType.separator,
+      linkIds: [SecurityPageName.aiValue],
+    },
   ];
 };

x-pack/solutions/security/plugins/security_solution/public/common/components/search_bar/index.test.tsx

@@ -363,6 +363,10 @@ describe('SearchBarComponent', () => {
             timerange: mockGlobalState.inputs.timeline.timerange,
             linkTo: mockGlobalState.inputs.timeline.linkTo,
           },
+          valueReport: {
+            timerange: mockGlobalState.inputs.valueReport.timerange,
+            linkTo: mockGlobalState.inputs.valueReport.linkTo,
+          },
         },
       ]);
     });

x-pack/solutions/security/plugins/security_solution/public/common/hooks/search_bar/use_init_timerange_url_params.test.tsx

@@ -11,7 +11,6 @@ import * as redux from 'react-redux';
 import * as experimentalFeatures from '../use_experimental_features';
 import * as globalQueryString from '../../utils/global_query_string';
 import { TestProviders } from '../../mock';
-import { useKibana } from '../../lib/kibana';
 
 jest.mock('react-redux', () => ({
   ...jest.requireActual('react-redux'),
@@ -27,12 +26,6 @@ describe('useInitTimerangeFromUrlParam', () => {
     jest.clearAllMocks();
     (redux.useDispatch as jest.Mock).mockReturnValue(dispatch);
     (experimentalFeatures.useIsExperimentalFeatureEnabled as jest.Mock).mockReturnValue(false);
-    (useKibana as jest.Mock).mockReturnValue({
-      services: {
-        serverless: {},
-      },
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    } as any);
   });
 
   it('should call useInitializeUrlParam with correct params', () => {
@@ -45,20 +38,7 @@ describe('useInitTimerangeFromUrlParam', () => {
     );
   });
 
-  it('should call dispatch 2 times on init url params when not serverless', () => {
-    (useKibana as jest.Mock).mockReturnValue({
-      services: {},
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    } as any);
-    renderHook(() => useInitTimerangeFromUrlParam(), {
-      wrapper: TestProviders,
-    });
-    const callback = (globalQueryString.useInitializeUrlParam as jest.Mock).mock.calls[0][1];
-    callback({ valueReport: { timerange: { kind: 'absolute' } } });
-    expect(dispatch).toHaveBeenCalledTimes(2);
-  });
-
-  it('should call dispatch 3 times on init url params when serverless and valueReport exists', () => {
+  it('should call dispatch 3 times on init url params when valueReport exists', () => {
     renderHook(() => useInitTimerangeFromUrlParam(), {
       wrapper: TestProviders,
     });
@@ -67,7 +47,7 @@ describe('useInitTimerangeFromUrlParam', () => {
     expect(dispatch).toHaveBeenCalledTimes(3);
   });
 
-  it('should call dispatch 6 times on init url params when serverless, valueReport exists, and isSocTrendsEnabled=true', () => {
+  it('should call dispatch 6 times on init url params when valueReport exists, and isSocTrendsEnabled=true', () => {
     (experimentalFeatures.useIsExperimentalFeatureEnabled as jest.Mock).mockReturnValue(true);
     renderHook(() => useInitTimerangeFromUrlParam(), {
       wrapper: TestProviders,

x-pack/solutions/security/plugins/security_solution/public/common/hooks/search_bar/use_init_timerange_url_params.ts

@@ -9,7 +9,6 @@ import { useCallback } from 'react';
 import { get, isEmpty } from 'lodash/fp';
 import { useDispatch } from 'react-redux';
 import type { Dispatch } from 'redux';
-import { useKibana } from '../../lib/kibana';
 import { useIsExperimentalFeatureEnabled } from '../use_experimental_features';
 import type { TimeRangeKinds } from '../../store/inputs/constants';
 import type {
@@ -28,18 +27,11 @@ import { InputsModelId } from '../../store/inputs/constants';
 export const useInitTimerangeFromUrlParam = () => {
   const dispatch = useDispatch();
   const isSocTrendsEnabled = useIsExperimentalFeatureEnabled('socTrendsEnabled');
-  const { serverless } = useKibana().services;
-  // only on serverless
-  const isValueReportEnabled = !!serverless;
+
   const onInitialize = useCallback(
     (initialState: UrlInputsModel | null) =>
-      initializeTimerangeFromUrlParam(
-        initialState,
-        dispatch,
-        isSocTrendsEnabled,
-        isValueReportEnabled
-      ),
-    [dispatch, isSocTrendsEnabled, isValueReportEnabled]
+      initializeTimerangeFromUrlParam(initialState, dispatch, isSocTrendsEnabled),
+    [dispatch, isSocTrendsEnabled]
   );
 
   useInitializeUrlParam(URL_PARAM_KEY.timerange, onInitialize);
@@ -48,8 +40,7 @@ export const useInitTimerangeFromUrlParam = () => {
 const initializeTimerangeFromUrlParam = (
   initialState: UrlInputsModel | null,
   dispatch: Dispatch,
-  isSocTrendsEnabled: boolean,
-  isValueReportEnabled: boolean
+  isSocTrendsEnabled: boolean
 ) => {
   if (initialState != null) {
     const globalLinkTo: LinkTo = { linkTo: get('global.linkTo', initialState) };
@@ -188,7 +179,7 @@ const initializeTimerangeFromUrlParam = (
         );
       }
     }
-    if (valueReportType && isValueReportEnabled) {
+    if (valueReportType) {
       if (valueReportType === 'absolute') {
         const absoluteRange = normalizeTimeRange<AbsoluteTimeRange>(
           get('valueReport.timerange', initialState)