[Security Solution]inspect index pattern not aligned with data view index pattern

[ghost]

Describe the bug
inspect index pattern not aligned with data view index pattern

Build Details

Version: 8.0.0-SNAPSHOT
commit:474d83d2bbc5dbe28ac4b4d2e9ddcecd434671fa
Build:48754

Pre-Conditions

• Few Alerts should be generated on Kibana
• file-beat should be installed on kibana with threat Intel module

Steps

• Login to Kibana
• Navigate to Overview page
• click on data view and change it to metrics-*
• click on save
• scroll down and came to threat Intel card and click on inspect icon
• observed that index pattern logs-ti_* of threat Intel card not getting aligned with data view index pattern metrics-*

• Now go to timeline and select default data view
• filter timeline result with any query let say process.name: *
• click on inspect icon on top right corner
• observed that index pattern -*elastic-cloud-logs-* not getting aligned with the data view index pattern

Expected Result

• Index pattern should be aligned
  OR
• If these index pattern are kind of built in index pattern there should be mention of these index in data view

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[manishgupta-qasource]

Reviewed & Assigned to @MadameSheema

[MadameSheema]

@karanbirsingh-qasource the behaviors you are describing here are expected.

• The threat intelligence card has its own index pattern, and that one does not change with the data view.
• The - at the beginning of the index pattern inform the user that specific index pattern is excluded. So it is a way to inform the user that index pattern is not going to be present.

@ecezalp @stephmilovic what do you want to do regarding the above issues? Thanks :)

[stephmilovic]

@monina-n needs design, some indicator of when cards are not associated with the Data View selector

[monina-n]

Here is the design discussion for this bug elastic/security-design-team#20

There's some additional context needed on the second scenario (timeline inspect) so whoever engineer is assigned to this, we can set up a meeting to talk more.

[stephmilovic]

Hi @karanbirsingh-qasource this is ready to be re-tested, thank you!

[MadameSheema]

@karanbirsingh-qasource please validate this on next 8.1.0BC3, thanks!!

[ghost]

Hi @MadameSheema

We have validated this issue on 8.1.0-BC3 Self Managed and found that expected changes are now present on the build.

Build Details:

Version: 8.1.0-BC3
Commit:0335dd6a26ef29ae9021d0fae9347dc88f3b7d6e
Build:50346

Screen-Shoot:

• Overview Page Threat Intel

• Timeline

• Timeline
• Timeline Inspect modal of timeline event

Hence we are closing this issue and adding "QAValidated" label to it.

c.c. @stephmilovic