[Security Solution] 'Unsupported operation exception' error is thrown and Alerts table become inoperable upon addition of field '_source'

[pborgonovi]

Describe the bug:
When adding field _source to Alerts table, 'Unsupported operation exception' error is thrown and user can no longer interact with it.

Kibana/Elasticsearch Stack version:
8.16

Server OS version:

Browser and Browser OS versions:

Elastic Endpoint version:

Original install method (e.g. download page, yum, from source, etc.):

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):
Alerts table

Pre-requisites:

1. Have rules installed
2. Have alerts generated by the rule

Steps to reproduce:

1. Launch Alerts page
2. In Alerts table, select 'Fields'
3. Add _source field as a column to the table

Current behavior:
'Unsupported operation exception' error is thrown and user can no longer interact with it.

Expected behavior:
User should be able to interact with Alerts table and undo the action

Screenshots (if relevant):

Screen.Recording.2024-10-29.at.3.08.30.PM.mov

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context (logs, chat logs, magical formulas, etc.):

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-detection-engine (Team:Detection Engine)

[yctercero]

@michaelolo24 would this be threat hunting investigations? We can ask @paulewing if we should disable allowing the user adding _source to the table.

[elasticmachine]

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[michaelolo24]

@yctercero I believe it's all related to this: #170167

While this error seems to happen immediately on query, the error from the related issue happens when trying to sort on an unmapped field which isn't allowed. Now we can stop _source from being an available option in the field browser and also prevent sorting on unmapped fields, but I think the easiest first step is to just separate the field browser rendering from the table rendering to allow users to revert their changes. Thoughts?

[PhilippeOberti]

We should also investigate adding a button somewhere on the page (or in the error pop up) to allow the user to remove the local storage keys that will clear what is causing the issue.

[PhilippeOberti]

Reassigning to @elastic/response-ops as it is related to #170167 fyi @kobelb