Alerts can be shared via a shareable URL

[nastasha-solomon]

Description

In 8.8, a new Share alert button is being added to the top right of the alert details flyout. When you click the button, you’re given a URL to that specific alert.

Clicking on the URL will always bring you to the Alerts page, which is filtered to only show the alert ID. The alert’s details flyout is also open on the page.

Related:

• [Security Solution][Timeline] - Store flyout information in the url kibana#148800
• [Security Solution][Investigations] - Add kibana.alert.url kibana#155069 - These contain some impt “gotchas” about the flyout and Alert table behavior.

Doc updates

• Add the following to the View detection alert details topic:
  • Refresh screenshot alert-details-flyout.png
  • Add line to the topic intro that explains how to share alerts (use the Share alert button) and how to read the new kibana.alert.url field in the alert document. Include a link to these docs when explain how to "get" the new kibana.alert.url field.
• Add the kibana.alert.url field to the alert schema docs.

Notes

• Business value/customer driver: Gives users a one-click way to share alerts.
• The Share alert button will be available wherever the alert details flyout can be viewed (e.g., cases, timeline). The option has not been added to the more actions menu in the Alerts table.
• If a user doesn’t have access to the index where the alert doc is stored, they’ll get an privs error when they click on the URL.
• We might need to add the kibana.alert.url field to the alert schema docs. This field only appears when users set the publicbaseURL field in the kibana.dev.yml config file. More details to come.