[Security Solution][Case] Subcases bugs

[jonathan-buttner]

Case's List Page

Assignees: (@angorayc @jonathan-buttner)

• UI Remove status on collections ([Security Solution] Case ui enhancement #91863)

• A collection is clickable selectable for bulk actions if it has no sub cases and the status is still displayed on it
  ([Security Solution] Case ui enhancement #91863)

• Cannot change the status of a subcase ([Security Solution] Case ui enhancement #91863)

• API Allow deletion of collections (PR: [Security Solution][Case][Bug] Allowing deletion of collections #91926)

• API update find to remove empty collections except for when not querying for status (PR: [Security Solution][Case][Bug] Removing empty collections when filtering on status #92048)

Case Detail Page

• Remove status when viewing a collection (@cnasikas) ([Security Solution][Case] Fix subcases bugs on detections and case view #91836)
• When a user clicks on investigate in timeline cancel existing requests (@XavierM )
• Move fetchEcsAlertData up to avoid re-render (@XavierM )
• Show rule name for generated alerts (@XavierM) ([SECURITY SOLUTION] BUG Manual Alert in case #93726)
• Posting a comment to a sub case fails [request query.subCaseId]: definition for this key is missing (@cnasikas) ([Security Solution][Case] Fix subcases bugs on detections and case view #91836)
• Patching a comment to a sub case fails (@cnasikas) ([Security Solution][Case] Fix subcases bugs on detections and case view #91836)
• Attaching an alert to a sub case fails with an encoding error because the UI is expecting a CaseResponseRt and the backend is sending a CollectionWithSubCaseResponseRt (@cnasikas) ([Security Solution][Case] Fix subcases bugs on detections and case view #91836)
• User actions are empty when you post/patch a comment to a subcase (@cnasikas) ([Security Solution][Case] Fix subcases bugs on detections and case view #91836)
• Skip closing a collection with the push-to-close functionality and add a line in the description in the UI like "Does not support sub-cases at this time" (@jonathan-buttner ) (PR: [Security Solution][Case][Bug] Prevent closing collection when pushing #93095)
• Individual case cannot deleted. (@cnasikas) ([Security Solution][Case] Fix individual case deletion on case view #93218)
• Subcase cannot be deleted. (@cnasikas)
• Cannot change the status of a subcase. (@cnasikas)
• Fix divider (@cnasikas) ([Security Solution][Case] Fix individual case deletion on case view #93218)

Detections Page

Assignees: @cnasikas

• UI don't allow manually attaching alert to closed case ([Security Solution][Case] Fix subcases bugs on detections and case view #91836)
• UI don't allow manually attaching alert to a collection ([Security Solution][Case] Fix subcases bugs on detections and case view #91836)
  • Gray out collections but enable sub cases
• Make sure to show sub cases as an option when attaching a manual alert ([Security Solution][Case] Fix subcases bugs on detections and case view #91836)
• When manually attaching an alert to a case, the case is pushed before the alert is attached ([Security Solution][Case] Fix subcases bugs on detections and case view #91836)
• Infinity state loop when using the connector ([Security Solution][Case] Fix subcases bugs on detections and case view #91836)

Rule Detection

• Review case connector flow in rules with @monina-n (@XavierM )
• Show detection engine changes to @spong (@XavierM )

Misc

• API Add logs (@jonathan-buttner ) (PR: [Security Solution][Case][Bug] Improve case logging #91924)
• Investigate if we can remove update_at to avoid a saved object document version change each time a generated alert is attached to a sub case (the collection version changes) (@jonathan-buttner @XavierM )
• 7.12 migration places rule.id and rule.name on all comments, we should only add it to alert comments ([Security Solution][Case][Bug] Only add rule object for alert comments #92977)
• Connector Service Now new field needs migration ([Security Solution][Case] Migrate category & subcategory fields of ServiceNow ITSM connector #93092) (@cnasikas )

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[jonathan-buttner]

cc: @MadameSheema @IgorGuz2000 if QA source finds any issues can you double check to see if we have it here already

[jonathan-buttner]

I split out a few of the remaining items and put them in this issue: #94115 so I'm going to close this cc: @MadameSheema