Your window into the Elastic Stack
Find a file
Justin Kambic 6b556d593f
[Incident Management] Investigation guide frontend (#217106)
## Summary 🌹

Resolves #213024.

The frontend changes for
[#216377](https://github.com/elastic/kibana/pull/216377).

Depends on #216377 and https://github.com/elastic/kibana/pull/216292.

## Testing these changes 🌸

This adds frontend integration with the API changes we previously merged
in #216377. There is a new editor in the Rule Create/Edit Detail view,
below the pre-existing field for naming the rule.

To test that this feature is working you should:

- This is easiest to test if you have actual data that will trigger an
alert in your cluster. If you need some fake data, you can use the nifty
`data-forge` utility with a command like:
```shell
node x-pack/scripts/data_forge.js --events-per-cycle 200 --lookback now-1h --ephemeral-project-ids 10 --dataset fake_stack --install-kibana-assets --kibana-url http://localhost:5601 --event-template bad
```
- Create a rule with an investigation guide specified. This is easy.
Write some Markdown text into the editor and save the rule. My favorite
rule for testing the feature is Custom Threshold, because it's easy to
configure an alert that will fire. But this works for any rule.
<img width="1260" alt="image"
src="https://github.com/user-attachments/assets/bf9bf866-2439-456a-a700-1a93ae2e5dac"
/>

- After you create your rule, it should fire at some point, ideally.
Using the Observability -> Alerts view, drill into the Alert Details
page. There, you should find a spiffy new tab called _Investigation
Guide_. Confirm the contents on that tab are your markdown, properly
rendered.

<img width="1000" alt="image"
src="https://github.com/user-attachments/assets/bff19e48-da44-4886-bcf7-a296559c0aca"
/>

- Repeat step 1-2 as many times as you like with different rule types,
if you desire.
- Edit your rule, using the edit page or flyout.

<img width="606" alt="image"
src="https://github.com/user-attachments/assets/1a6149fe-016a-4b8c-9846-24cb2931aed3"
/>

- When you save the rule you should be able to refresh the alert details
page and see the modified Investigation Guide reflected in the tab.

---------

Co-authored-by: Panagiota Mitsopoulou <giota85@gmail.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-05-29 11:49:20 -04:00
.buildkite [ci] trigger artifact builds for 9.0 also (#221791) 2025-05-28 16:13:47 +02:00
.devcontainer Upgrade to Storybook 8 (#195148) 2025-03-14 15:41:03 -07:00
.github fix issue accessing repo owner name (#221751) 2025-05-28 15:39:36 +02:00
api_docs [api-docs] 2025-05-29 Daily api_docs build (#221876) 2025-05-29 09:25:17 +03:00
config [AI SOC] Grant fleet (v1) access to see integrations in Search AI Lake tier (#221189) 2025-05-24 13:48:44 +02:00
dev_docs Update ttfmp documentation to include the recent enhancements (#213416) 2025-05-28 17:11:37 +03:00
docs [Docs][9.0.x] Add known issue about AI Obs Assistant getting stuck when attempting to call the call the execute_connector function (#221834) 2025-05-28 20:44:28 +00:00
examples [Discover] Persist tabs in local storage and sync selected tab ID with URL (#217706) 2025-05-27 23:32:56 +03:00
kbn_pm Add conditional switching between EUI releases (#219818) 2025-05-28 15:41:19 +02:00
legacy_rfcs SKA: Relocate "platform" packages that remain on /packages (#208704) 2025-02-24 11:03:30 +00:00
licenses Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
oas_docs [Fleet] Add license gate around remote synced integrations (#221636) 2025-05-29 10:16:47 +02:00
packages [Fleet] Handle install status and errors when uninstalling remote integrations is enabled (#220990) 2025-05-28 11:24:00 -05:00
plugins
scripts [Inference] Instrument inference with OpenTelemetry (#218694) 2025-05-07 11:44:29 +02:00
src [Incident Management] Investigation guide frontend (#217106) 2025-05-29 11:49:20 -04:00
typings chore: remove react-syntax-highlighter leftovers (#213076) 2025-03-04 15:35:34 +01:00
x-pack [Incident Management] Investigation guide frontend (#217106) 2025-05-29 11:49:20 -04:00
.backportrc.json chore(NA): prepare replacement of 8.x branch with 8.19 (#218514) 2025-04-17 04:02:40 +01:00
.bazelignore Remove references to deleted .ci folder (#177168) 2024-02-20 19:54:21 +01:00
.bazeliskversion
.bazelrc
.bazelrc.common Transpile packages on demand, validate all TS projects (#146212) 2022-12-22 19:00:29 -06:00
.bazelversion chore(NA): revert bazel upgrade for v5.2.0 (#135096) 2022-06-24 03:57:21 +01:00
.browserslistrc Add Firefox ESR to browserlistrc (#184462) 2024-05-29 17:53:18 -05:00
.editorconfig
.eslintignore chore(fullstory): serve the snippet as an asset (#220368) 2025-05-07 23:06:24 +02:00
.eslintrc.js [ska][x-pack] relocate platform tests [4] (#219691) 2025-05-07 19:13:04 +02:00
.gitattributes
.gitignore Add windsurf to gitignore (#221801) 2025-05-28 12:29:33 -06:00
.i18nrc.json [Discover] Support Lens fetches across tabs (#218506) 2025-05-02 13:39:25 -03:00
.node-version Upgrade Node.js to 20.18.2 (#207431) 2025-01-22 12:00:14 -06:00
.npmrc [npmrc] Fix puppeteer_skip_download configuration (#177673) 2024-02-22 18:59:01 -07:00
.nvmrc Upgrade Node.js to 20.18.2 (#207431) 2025-01-22 12:00:14 -06:00
.prettierignore
.prettierrc
.puppeteerrc Add .puppeteerrc (#179847) 2024-04-03 09:14:39 -05:00
.stylelintignore
.stylelintrc Bump stylelint to ^14 (#136693) 2022-07-20 10:11:00 -05:00
.telemetryrc.json Sustainable Kibana Architecture: Move modules owned by @elastic/kibana-core (#201653) 2025-01-04 11:47:24 -07:00
.yarnrc
BUILD.bazel Transpile packages on demand, validate all TS projects (#146212) 2022-12-22 19:00:29 -06:00
catalog-info.yaml Configures PagerDuty Backstage Integration for kbn (#208440) 2025-01-27 23:29:11 +00:00
CODE_OF_CONDUCT.md
CONTRIBUTING.md Docs: fix broken links in CONTRIBUTING.md (#219158) 2025-04-24 17:25:00 -06:00
FAQ.md Fix small typos in the root md files (#134609) 2022-06-23 09:36:11 -05:00
fleet_packages.json [main] Sync bundled packages with Package Storage (#221619) 2025-05-27 18:08:49 +03:00
github_checks_reporter.json
kibana.d.ts Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
LICENSE.txt Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
NOTICE.txt [api-docs] 2025-01-01 Daily api_docs build (#205342) 2025-01-01 01:37:13 -06:00
package.json Add Ruby and PHP request conversion to the Search dev console (#221771) 2025-05-29 10:54:50 +01:00
preinstall_check.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
README.md
renovate.json [Renovate] Prevent immortal vega PRs (#221660) 2025-05-29 17:40:01 +02:00
RISK_MATRIX.mdx
run_fleet_setup_parallel.sh Sustainable Kibana Architecture: Move modules owned by @elastic/fleet (#202422) 2024-12-24 15:32:43 +01:00
SECURITY.md
sonar-project.properties [sonarqube] update memory, cpu (#190547) 2024-09-09 16:16:30 -05:00
STYLEGUIDE.mdx [styleguide] update path to scss theme (#140742) 2022-09-15 10:41:14 -04:00
tsconfig.base.json [onechat] Introduce plugin and tool registry (#220889) 2025-05-28 00:45:01 +03:00
tsconfig.browser.json
tsconfig.browser_bazel.json
tsconfig.json Transpile packages on demand, validate all TS projects (#146212) 2022-12-22 19:00:29 -06:00
TYPESCRIPT.md Fix small typos in the root md files (#134609) 2022-06-23 09:36:11 -05:00
updatecli-compose.yaml deps(updatecli): bump all policies (#195865) 2024-10-15 07:37:12 -05:00
versions.json chore(NA): update versions after v9.0.2 bump (#220254) 2025-05-07 03:23:40 +01:00
WORKSPACE.bazel Upgrade Node.js to 20.18.2 (#207431) 2025-01-22 12:00:14 -06:00
yarn.lock Add Ruby and PHP request conversion to the Search dev console (#221771) 2025-05-29 10:54:50 +01:00

Kibana

Kibana is your window into the Elastic Stack. Specifically, it's a browser-based analytics and search dashboard for Elasticsearch.

Getting Started

If you just want to try Kibana out, check out the Elastic Stack Getting Started Page to give it a whirl.

If you're interested in diving a bit deeper and getting a taste of Kibana's capabilities, head over to the Kibana Getting Started Page.

Using a Kibana Release

If you want to use a Kibana release in production, give it a test run, or just play around:

Building and Running Kibana, and/or Contributing Code

You might want to build Kibana locally to contribute some code, test out the latest features, or try out an open PR:

Documentation

Visit Elastic.co for the full Kibana documentation.

For information about building the documentation, see the README in elastic/docs.

Version Compatibility with Elasticsearch

Ideally, you should be running Elasticsearch and Kibana with matching version numbers. If your Elasticsearch has an older version number or a newer major number than Kibana, then Kibana will fail to run. If Elasticsearch has a newer minor or patch number than Kibana, then the Kibana Server will log a warning.

Note: The version numbers below are only examples, meant to illustrate the relationships between different types of version numbers.

Situation Example Kibana version Example ES version Outcome
Versions are the same. 7.15.1 7.15.1 💚 OK
ES patch number is newer. 7.15.0 7.15.1 ⚠️ Logged warning
ES minor number is newer. 7.14.2 7.15.0 ⚠️ Logged warning
ES major number is newer. 7.15.1 8.0.0 🚫 Fatal error
ES patch number is older. 7.15.1 7.15.0 ⚠️ Logged warning
ES minor number is older. 7.15.1 7.14.2 🚫 Fatal error
ES major number is older. 8.0.0 7.15.1 🚫 Fatal error

Questions? Problems? Suggestions?

  • If you've found a bug or want to request a feature, please create a GitHub Issue. Please check to make sure someone else hasn't already created an issue for the same topic.
  • Need help using Kibana? Ask away on our Kibana Discuss Forum and a fellow community member or Elastic engineer will be glad to help you out.