[SigEvents] Redesign the Nightshift significant event flyout by achyutjhunjhunwala · Pull Request #299456 · elastic/kibana

achyutjhunjhunwala · 2026-10-21T10:02:19Z

Summary

closes https://github.com/elastic/nightshift-program/issues/1940

Match the redesigned significant event flyout while keeping the existing investigation, chat, and status actions.

Add Overview and Timeline tabs with severity, confidence, and status badges.
Show a linked investigation card and the five earliest detections in Overview.
Consolidate investigation, chat, and mark-inactive actions into one Actions menu.
Persist running investigations and terminal outcomes; show failed runs as Failed.
Wait for server-recorded completion so read errors and stale follow-up results cannot stop polling early.

How to test

Open Nightshift → Detections → Events and open a significant event. Check the header badges and Overview sections.
Open Timeline. Confirm detections run earliest first and the significant event appears last. Click a detection twice to open and close its child flyout. Click the event title to return to Overview.
Open an event with an investigation. Click its investigation card and confirm the investigation opens. Check that events without an investigation omit the card.
From Actions, run an investigation. Confirm the flyout and table show In progress immediately, retain that state after a reload, and show Completed when the run succeeds. Run a follow-up and confirm the previous result does not immediately complete the new round.
Cause an investigation to fail. Confirm its card shows Failed. Start a follow-up and confirm the card returns to In progress.
Simulate a temporary 5xx when reading a running investigation. Confirm it does not mark the event investigation Completed or stop event polling early.
Check chat actions and Mark inactive. With read-only access or a paused engine, verify the available actions and disabled-state explanations.
Expand an event with more than five detections. Open another event and confirm it starts on Overview with the first five detections visible.

Demo

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

infra-vault-gh-plugin-prod · 2026-10-21T14:02:34Z

+  const cutoff = Date.now() - 65 * 60 * 1000;
+  return events.some(({ investigations }) =>
+    investigations?.some(
+      ({ completed_at: completedAt, started_at: startedAt }) =>
+        completedAt == null && Date.parse(startedAt) > cutoff


Severity: P3 (Low)

Reconcile timed-out investigations before permanently stopping their polling. The managed investigation workflow has a 60-minute timeout and explicitly does not execute its failure fallback on timeout or cancellation, so those runs emit neither terminal attachment. With the new persisted running entry, this cutoff leaves them permanently “In progress,” including after reload, rather than recording a terminal state.

_{Generated by Libra. React with 👍 or 👎 to give feedback on this comment.}

Thanks, this is the existing workflow timeout/cancellation lifecycle gap. As the managed workflow documents, those terminal paths do not run its failure fallback.

We documented the Significant Events impact, source links, terminal-handling requirements, and suggested regression coverage here:
https://github.com/elastic/nightshift-program/issues/1820#issuecomment-6319878416

This requires engine-backed terminal reconciliation, coordinated with retry/recovery, and is being tracked as separate lifecycle work. The related event-reader work is linked here:
https://github.com/elastic/nightshift-program/issues/1838#issuecomment-6319878431

The 65-minute cutoff only bounds polling; it does not record a terminal outcome.

infra-vault-gh-plugin-prod · 2026-10-21T14:02:34Z

+        eventSearchClient: eventClient,
+        eventId: params.path.id,
+        investigation: {
+          workflow_execution_id: executionId,
+          started_at: new Date().toISOString(),
+        },


Severity: P2 (Medium)

Keep queued follow-ups distinguishable from the run already executing. start() returns the same conversation ID for a follow-up, and the investigation workflow queues runs on that ID. If a user queues a follow-up while the first run is active, the first run's completion replaces this newly written running entry because attachInvestigationToEvent matches only workflow_execution_id. The event then appears completed and stops polling throughout the queued follow-up, since its later started event is not attached. Track the run/generation or otherwise preserve pending rounds when processing terminal callbacks.

_{Generated by Libra. React with 👍 or 👎 to give feedback on this comment.}

Thanks, this identifies the existing conversation/run identity gap in the shared investigation lifecycle. Follow-ups share a conversation ID, while terminal callbacks do not distinguish individual runs.

We reproduced the attachment-ordering cases and documented the findings, source links, proposed fix direction, and regression coverage here:
https://github.com/elastic/nightshift-program/issues/1838#issuecomment-6319878431

We are tracking run-aware queued-follow-up handling as separate lifecycle work under that issue, coordinated with terminal reconciliation in:
https://github.com/elastic/nightshift-program/issues/1820#issuecomment-6319878416

infra-vault-gh-plugin-prod · 2026-10-22T09:44:03Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: be79cf1
Build duration: 44 mins

Failed CI Steps

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`nightshift`	614.8KB	602.6KB	-12.2KB
`significantEventsApp`	140.2KB	140.2KB	-59.0B
total			-12.3KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`kbnUiSharedDeps-srcJs`	5.4MB	5.4MB	+4.0B
`shared-packages`	5.2MB	5.2MB	+140.0B
total			+144.0B

Unknown metric groups

shared chunks total size

id	before	after	diff
`all`	7.5MB	7.5MB	+1.0B

total optimizer output size

id	before	after	diff
`all`	67.1MB	67.1MB	-12.1KB

warm start memory

id	before	after	diff
`post forced gc heap baseline`	-	720956068	+720956068
`post forced gc heap delta`	-	-1827528	-1827528
`post forced gc heap delta standard deviation`	-	2042941	+2042941
`post forced gc heap target`	-	719128540	+719128540
`tail heap delta`	-	-8399756	-8399756
total			+1431900265

workflow yaml validation

id	before	after	diff
`case_response.yaml (27 steps, 66 vars)/e2e/collectAllVariables`	0	1	+1
`case_response.yaml (27 steps, 66 vars)/e2e/performComputation`	12	13	+1
`case_response.yaml (27 steps, 66 vars)/e2e/total`	16	17	+1
`case_response.yaml (27 steps, 66 vars)/validateVariables (66 vars)`	1	2	+1
`infosec_demo.yaml (150 steps, 270 vars)/e2e/performComputation`	48	53	+5
`infosec_demo.yaml (150 steps, 270 vars)/e2e/total`	113	137	+24
`infosec_demo.yaml (150 steps, 270 vars)/e2e/validateIfConditions`	5	6	+1
`infosec_demo.yaml (150 steps, 270 vars)/e2e/validateLiquidTemplate`	5	6	+1
`infosec_demo.yaml (150 steps, 270 vars)/e2e/validateVariables`	38	51	+13
`infosec_demo.yaml (150 steps, 270 vars)/validateIfConditions`	4	6	+2
`infosec_demo.yaml (150 steps, 270 vars)/validateVariables (270 vars)`	36	48	+12
total			+62

Test Failures

[job] [logs] Scout Lane #71 - serverless-observability_complete / alerting_v2 / local-serverless-observability_complete - Alerts page - read/write privileges - editor sees the mutating episode actions menu
[job] [logs] Scout Lane #71 - serverless-observability_complete / alerting_v2 / local-serverless-observability_complete - ComposeDiscoverFlyout — create and edit flows - edit flow (sad path): a rule with no resolvable time field triggers validation and blocks Next
[job] [logs] Scout Lane #7 - stateful-classic / default / local-stateful-classic - Document flyout v2 — alerts page entry - assignees: assigning the current user shows the avatar in the flyout header

History

💛 Build #526266 was flaky ee16346
💛 Build #526166 was flaky a6fb62f

cc @achyutjhunjhunwala

crespocarlos · 2026-10-22T09:26:09Z

  const latestInvestigationInProgress =
-    availableInvestigation != null &&
-    availableInvestigation.completed_at == null &&
-    investigationStatus !== 'complete';
+    availableInvestigation != null && availableInvestigation.completed_at == null;


What happens if an investigation goes stale? Checking the hasInvestigationsToPoll function. Will latestInvestigationInProgress be in progress forever?

Yes, without a terminal attachment it remains in progress; the 65-minute cutoff only stops polling. This is the existing timeout/cancellation reconciliation gap, documented here and being tackled as separate lifecycle work: https://github.com/elastic/nightshift-program/issues/1820#issuecomment-6319878416

crespocarlos · 2026-10-22T10:02:56Z

+        <FlyoutTemplate.Footer>
+          <FlyoutTemplate.Footer.PrimaryActionMenu
+            label={ACTIONS_LABEL}
+            panels={actionMenuPanels}


Does this handle empty state?

Yes. When no actions are available, we pass panels=[]. FlyoutTemplate.Footer ignores the empty menu and hides the footer when no other actions remain. This exact case is covered by the existing test, which I reran successfully:

kibana/src/platform/packages/shared/shared-ux/flyout/template/src/footer.test.tsx

Lines 194 to 206 in be79cf1

it('omits the footer when a menu with empty panels is the only action', () => {

renderTemplate(

<FlyoutTemplate onClose={noop} session="never" data-test-subj="emptyMenu">

<FlyoutTemplate.Body>

<span>content</span>

</FlyoutTemplate.Body>

<FlyoutTemplate.Footer>

<FlyoutTemplate.Footer.PrimaryActionMenu label="Take action" panels={[]} />

</FlyoutTemplate.Footer>

</FlyoutTemplate>

);

expect(screen.queryByTestId('emptyMenuFooter')).not.toBeInTheDocument();

…#299456) ## Summary closes elastic/nightshift-program#1940 Match the [redesigned significant event flyout ](https://symmetrical-adventure-2y9no3w.pages.github.io/main/#/alerts)while keeping the existing investigation, chat, and status actions. - Add Overview and Timeline tabs with severity, confidence, and status badges. - Show a linked investigation card and the five earliest detections in Overview. - Consolidate investigation, chat, and mark-inactive actions into one Actions menu. - Persist running investigations and terminal outcomes; show failed runs as Failed. - Wait for server-recorded completion so read errors and stale follow-up results cannot stop polling early. ## How to test 1. Open Nightshift → Detections → Events and open a significant event. Check the header badges and Overview sections. 2. Open Timeline. Confirm detections run earliest first and the significant event appears last. Click a detection twice to open and close its child flyout. Click the event title to return to Overview. 3. Open an event with an investigation. Click its investigation card and confirm the investigation opens. Check that events without an investigation omit the card. 4. From Actions, run an investigation. Confirm the flyout and table show In progress immediately, retain that state after a reload, and show Completed when the run succeeds. Run a follow-up and confirm the previous result does not immediately complete the new round. 5. Cause an investigation to fail. Confirm its card shows Failed. Start a follow-up and confirm the card returns to In progress. 6. Simulate a temporary 5xx when reading a running investigation. Confirm it does not mark the event investigation Completed or stop event polling early. 7. Check chat actions and Mark inactive. With read-only access or a paused engine, verify the available actions and disabled-state explanations. 8. Expand an event with more than five detections. Open another event and confirm it starts on Overview with the first five detections visible. ## Demo <img width="1702" height="1318" alt="Oct-21-2026 15-45-54" src="https://github.com/user-attachments/assets/1b97540b-275d-44e0-8a3f-073ad59ec429" /> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

achyutjhunjhunwala self-assigned this Oct 21, 2026

achyutjhunjhunwala added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:nightshift-sre-agent Feature: Nightshift Context Engine Nightshift Context Engine is the memory layer every other engine draws on labels Oct 21, 2026

achyutjhunjhunwala and others added 2 commits October 21, 2026 15:17

[Nightshift] Redesign the significant event flyout

c5008a2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

[Nightshift] Keep investigation outcomes authoritative

a6fb62f

achyutjhunjhunwala force-pushed the nightshift/detection-event-flyout branch from 2bc31a3 to a6fb62f Compare October 21, 2026 13:21

achyutjhunjhunwala marked this pull request as ready for review October 21, 2026 13:56

achyutjhunjhunwala requested a review from a team as a code owner October 21, 2026 13:56

infra-vault-gh-plugin-prod Bot reviewed Oct 21, 2026

View reviewed changes

botelastic Bot added the Team:One Workflow Team label for One Workflow (Workflow automation) label Oct 21, 2026

achyutjhunjhunwala added 2 commits October 21, 2026 16:59

[Nightshift] Show the latest investigation state in the event card

ee16346

[Nightshift] Poll deep-linked events while investigations run

be79cf1

crespocarlos reviewed Oct 22, 2026

View reviewed changes

achyutjhunjhunwala enabled auto-merge October 22, 2026 10:24

crespocarlos approved these changes Oct 22, 2026

View reviewed changes

achyutjhunjhunwala added this pull request to the merge queue Oct 22, 2026

Merged via the queue into elastic:main with commit e34b930 Oct 22, 2026
24 checks passed

achyutjhunjhunwala deleted the nightshift/detection-event-flyout branch October 22, 2026 11:05

kibanamachine added the v9.6.0 label Oct 22, 2026

kibanamachine mentioned this pull request Oct 29, 2026

[Significant events] Cut the event flyout Actions-menu test cost #301793

Open

Navigation Menu

Repository navigation

[SigEvents] Redesign the Nightshift significant event flyout - #299456

[SigEvents] Redesign the Nightshift significant event flyout#299456
achyutjhunjhunwala merged 4 commits into
elastic:mainfrom
achyutjhunjhunwala:nightshift/detection-event-flyout

achyutjhunjhunwala commented Oct 21, 2026 •

edited

Loading

Uh oh!

Uh oh!

infra-vault-gh-plugin-prod Bot Oct 21, 2026

Uh oh!

achyutjhunjhunwala Oct 22, 2026

Uh oh!

infra-vault-gh-plugin-prod Bot Oct 21, 2026

Uh oh!

achyutjhunjhunwala Oct 22, 2026

Uh oh!

infra-vault-gh-plugin-prod Bot commented Oct 22, 2026

shared chunks total size

total optimizer output size

warm start memory

workflow yaml validation

Uh oh!

crespocarlos Oct 22, 2026

Uh oh!

achyutjhunjhunwala Oct 22, 2026

Uh oh!

crespocarlos Oct 22, 2026

Uh oh!

achyutjhunjhunwala Oct 22, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	it('omits the footer when a menu with empty panels is the only action', () => {
	renderTemplate(
	<FlyoutTemplate onClose={noop} session="never" data-test-subj="emptyMenu">
	<FlyoutTemplate.Body>
	<span>content</span>
	</FlyoutTemplate.Body>
	<FlyoutTemplate.Footer>
	<FlyoutTemplate.Footer.PrimaryActionMenu label="Take action" panels={[]} />
	</FlyoutTemplate.Footer>
	</FlyoutTemplate>
	);

	expect(screen.queryByTestId('emptyMenuFooter')).not.toBeInTheDocument();

Conversation

achyutjhunjhunwala commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How to test

Demo

Uh oh!

Uh oh!

infra-vault-gh-plugin-prod Bot Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

achyutjhunjhunwala Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

infra-vault-gh-plugin-prod Bot Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

achyutjhunjhunwala Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

infra-vault-gh-plugin-prod Bot commented Oct 22, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Async chunks

Page load bundle

shared chunks total size

total optimizer output size

warm start memory

workflow yaml validation

Test Failures

History

Uh oh!

crespocarlos Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

achyutjhunjhunwala Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

crespocarlos Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

achyutjhunjhunwala Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

achyutjhunjhunwala commented Oct 21, 2026 •

edited

Loading