[Cloud Security] changed findings group by name to group by id

[alexreal1314]

Summary

This PR fixes group by logic in the findings table to be based on resource.id instead of resource.name.

Screenshots

Closes

• https://github.com/elastic/security-team/issues/9782

Definition of done

• When grouping findings by Resource, the findings are grouped by resource.id
• The group title should still contain resource.name for better UX in combination with the id
• The label in the grouping properties should be Resource ID, not just Resource

Checklist

• Unit or functional tests were updated or added to match the most common scenarios
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines

[elasticmachine]

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

[opauloh]

LGTM overall, could you also update the Cloud Security Posture dashboard resources URL to redirect to Group by resource.id page as well?

Screen.Recording.2025-01-14.at.9.21.31.PM.mov

[albertoblaz]

nice one!

[albertoblaz]

Would be great to implement @opauloh's suggestion but I'll approve the PR now

[alexreal1314]

@albertoblaz fixed @opauloh comment.

[JordanSh]

note that an empty array in bucket.resourceName?.buckets can count as true, which will lead into undefined bucket.resourceName.buckets[0]?.key that will be presented in bold.

instead, i suggest to directly check that we have a bucket.resourceName.buckets[0]?.key to decide if we want to render it or just bucket.key_as_string.

i also suggest to add named constants for those values so it will be easier to understand what exactly are we rendering.

Suggested change

	const getGroupPanelTitle = () => {
	if (bucket.resourceName?.buckets) {
	return (
	<>
	<strong>{bucket.resourceName.buckets[0]?.key}</strong> - {bucket.key_as_string}
	</>
	);
	}
	return <strong>{bucket.key_as_string}</strong>;
	};
	const getGroupPanelTitle = () => {
	const resourceName = bucket.resourceName?.buckets[0]?.key;
	const resourceId = bucket.key_as_string || 'Some default value like "Missing ID"';
	return resourceName ? (
	<>
	<strong>{resourceName}</strong> - {resourceId}
	</>
	) : (
	<strong>{resourceId}</strong>
	);
	};

[alexreal1314]

@JordanSh fixed, although i didnt use resourceName variable as it is not always resourceId.

[JordanSh]

can you elaborate? what else can it be?

[alexreal1314]

@JordanSh account id for example. any category from the group by menu.

[JordanSh]

can you provide some context around this change? wouldn't resource.id should be used in FINDINGS_GROUPING_OPTIONS.RESOURCE_ID?
just an observation as im not too familiar with this code

[maxcold]

I believe this is required to get more data for the group, as we use resource.name in the group title, we need to aggregate by it

[opauloh]

yes to what @maxcold said, this aggregation retrieves additional data used on this grouping visualization (.ie resources view will retrieve resources name so it can display the resource name under the resource id, cloud account view will retrieve the cloud provider and so on)

[maxcold]

I believe this is required to get more data for the group, as we use resource.name in the group title, we need to aggregate by it

[opauloh]

LGTM! Great work

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: cd4c937

Failed CI Steps

• FTR Configs #5

Test Failures

• [job] [logs] FTR Configs #5 / Alerting improving alert severity should correctly set severity_improving and previous_action_group data in alert document

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
cloudSecurityPosture	521.4KB	521.5KB	+136.0B

History

• 💚 Build #267423 succeeded 7b31986
• 💚 Build #267249 succeeded 88ee317
• 💔 Build #266477 failed 6603503
• 💔 Build #266305 failed fc9b764

[alexreal1314]

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation