[Attack discovery] Enable the Attack discovery and Attack discovery schedules public API feature flag by default

[andrew-goldstein]

[Attack discovery] Enable the Attack discovery and Attack discovery schedules public API feature flag by default

This PR enables the feature flag for the Attack discovery and Attack discovery schedules public APIs by default.

• The securitySolution.attackDiscoveryPublicApiEnabled, feature flag now defaults to true; it may be overridden in config/kibana.yml:

feature_flags.overrides:
  securitySolution.attackDiscoveryPublicApiEnabled: true

In addition to the above:

• The compressed={true} style is applied to the EuiSuperDatePicker in the Attack discovery settings and Create new schedule flyout
• The GET /api/attack_discovery/generations route now includes a default for the size parameter

Desk testing

1. Remove any references to the securitySolution.attackDiscoveryPublicApiEnabled in the feature_flags.overrides in section of your local config/kibana.dev.yml or config/kibana.yml.

Expected result

• The feature flag is NOT present in config/kibana.dev.yml or config/kibana.yml

2. Navigate to Security > Attack discovery

3. Open the browser's dev tools, and click the Network tab

4. Filter the network tab by _generate

5. In the header of the Attack discovery page, click the Run button

Expected result

• A POST request is made to the public API route: /api/attack_discovery/_generate

6. In the header of the Attack discovery page, click the Settings button

Expected results

• The Attack discovery settings flyout appears
• The Custom query KQL bar and date picker appear to have the same height, as illustrated by the following screenshot:

7. Click Cancel to close the Attack discovery settings flyout

8. In the header of the Attack discovery page, click the Schedule button

9. Click the Create new schedule button

Expected results

• The Create new schedule flyout appears
• The Custom query KQL bar and date picker appear to have the same height

10. Navigate to the Dev Tools > Console page

11. Execute the following query:

GET kbn:/api/attack_discovery/generations

Expected result

• The API returns previous generation results
• The API does NOT return an error

12. Disable the securitySolution.attackDiscoveryPublicApiEnabled feature flag in your local config/kibana.dev.yml or config/kibana.yml, like the following example:

feature_flags.overrides:
  securitySolution.attackDiscoveryPublicApiEnabled: false

13. After Kibana server finishes restarting, do a full page refresh of your browser

14. Navigate to Security > Attack discovery

15. Once again, in the header of the Attack discovery page, click the Run button

Expected result

• In the browsers dev tools, the network tab is still filtered by _generate
• A POST request is NOT made to the public API route: /api/attack_discovery/_generate

16. In the browsers dev tools, filter the network tab by /internal/elastic_assistant/attack_discovery

Expected result

• A POST request was made to /internal/elastic_assistant/attack_discovery

17. Once again, Navigate to the Dev Tools > Console page

18. Execute the following query:

GET kbn:/api/attack_discovery/generations

Expected result

• The API returns results an error indicating the public API is disabled

{
  "message": "Attack discovery public API is disabled",
  "status_code": 403
}

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[andrew-goldstein]

before:

after:

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 1ae6b90

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	11.1MB	11.1MB	+14.0B

cc @andrew-goldstein