[Security Solution][Bug] The timeline automatically opens up when user navigated to network page by clicking IP address flyout title from timelines

[divyaaghi-qasource]

Describe the bug:
The timeline automatically opens up when user navigated to network page by clicking IP address flyout title from timelines

Kibana/Elasticsearch Stack version:

VERSION: 9.3.0

BUILD: 94822

COMMIT: c42e4abbd81ade41addc00964fc7a8d38a2c739d

Pre Conditions:
1.Kibana 9.3.0 or latest build should be available
2.Events should be present.
3.Timelines must be created

Steps to reproduce:

1.Navigate to Security>Investigation>Timelines
2.Click on the created timeline.
3.Now click on View Details icon of the events rendered.
4.Click on Expand Details icon on the flyout.
5.Under Insights tab, click on +More under Ip address.
6.Observe that the timeline automatically opens up when user navigated to network page by clicking IP address flyout title from timelines

Current behavior:
The timeline automatically opens up when user navigated to network page by clicking IP address flyout title from timelines

Expected behavior:
The network details page should show instead of opening same timeline on navigating to the Networks page.

Screen recording:

Timelines.-.Kibana.-.Google.Chrome.2025-12-29.15-59-45.mp4

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[divyaaghi-qasource]

Suggestion to address the issue:

Version: Copilot- GPT-4.1:

1. Files to investigate and modify:

• x-pack/plugins/security_solution/public/timelines/components/flyout/event_insights/index.tsx
  Responsible for rendering the Insights tab in the event details flyout.

• x-pack/plugins/security_solution/public/timelines/components/flyout/event_details/index.tsx
  The main event flyout component where logic for redirection and state updates may need modification.

• x-pack/plugins/security_solution/public/network/components/ip_details/index.tsx
  Handles logic for the Network tab and associated query creation.

2. Steps to fix:

1. Update the click event handler for the +More link:

   Locate the component rendering the +More link in event_insights/index.tsx. Ensure that the onClick event triggers the redirection to the Network tab and passes the proper query for the IP address.

2. Create and pass the necessary query:

   Ensure the click handler generates an appropriate query for the Network tab. If the source IP is clicked, a query for network-flows, indicators, or connections involving the IP should be created. This query can be passed via navigation context or state.

3. Handle navigation to the Network tab:

   Use navigateToApp from Kibana's application plugin to navigate to the Network tab. For example:

   const handleNavigation = (ip: string) => {
      navigateToApp('securitySolution', {
        path: `/network?ip=${ip}`,
      });
   };

   Augment the click handler for the +More action to trigger this navigation with the appropriate IP address.

4. Test thoroughly:

   • Verify if clicking the source IP in the flyout redirects the user to the Network tab.
   • Confirm that the query is correctly passed and executed in the Network tab.
   • Ensure no regressions in other flyout behaviors.

---

Sample Code Changes

Update: event_insights/index.tsx

import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
import React from 'react';

const Insights = ({ ipAddress }) => {
  const { services: { application } } = useKibana();

  const handleMoreClick = () => {
    application.navigateToApp('securitySolution', {
      path: `/network?ip=${ipAddress}`,
    });
  };

  return (
    <div>
      <span>Source IP:</span>
      <button onClick={handleMoreClick}>+More</button>
    </div>
  );
};

This addition ensures that clicking +More navigates to the Network tab.

Update: ip_details/index.tsx

In the Network tab, ensure proper handling of the IP query passed via the URL:

import { useLocation } from 'react-router-dom';

const NetworkTab = () => {
  const location = useLocation();
  const query = new URLSearchParams(location.search).get('ip');

  // Use the `query` to create and execute a network query for the provided IP
};

---

Testing Scenarios

1. Open a Timeline > Event Details > Insights tab.
2. Click +More for a source IP.
3. Ensure the Network tab opens with the correct query executed for the IP.
4. Validate the Network tab renders the expected details for the IP.

---

[divyaaghi-qasource]

@chetnarajput-qasource Kindly review!

[chetnarajput-qasource]

Reviewed and assigned to @vgomez-el