From 755a5d1b9ec11ab5f3c4328351a54216fe9dae97 Mon Sep 17 00:00:00 2001
From: Tomasz Ciecierski <tomasz.ciecierski@elastic.co>
Date: Fri, 8 Dec 2023 16:54:48 +0100
Subject: [PATCH] [EDR Workflows] Fix failing attach to case functionality when
 isolating/releasing a host (#172912)

(cherry picked from commit a5528e3e7ded7ca3388cf552c60de4c30e521781)
---
 .../endpoint/services/actions/create/update_cases.ts   | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/security_solution/server/endpoint/services/actions/create/update_cases.ts b/x-pack/plugins/security_solution/server/endpoint/services/actions/create/update_cases.ts
index 7dd7cd75a6304..7032a0d7b4725 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/actions/create/update_cases.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/actions/create/update_cases.ts
@@ -9,6 +9,7 @@ import type { GetRelatedCasesByAlertResponse } from '@kbn/cases-plugin/common';
 import { AttachmentType } from '@kbn/cases-plugin/common';
 import type { CasesClient } from '@kbn/cases-plugin/server';
 import type { BulkCreateArgs } from '@kbn/cases-plugin/server/client/attachments/types';
+import { i18n } from '@kbn/i18n';
 import { APP_ID } from '../../../../../common';
 import type {
   ImmutableObject,
@@ -56,7 +57,7 @@ export const updateCases = async ({
 
     const attachments = caseIDs.map(() => ({
       type: AttachmentType.actions,
-      comment: createActionPayload.comment || '',
+      comment: createActionPayload.comment || EMPTY_COMMENT,
       actions: {
         targets,
         type: createActionPayload.command,
@@ -74,3 +75,10 @@ export const updateCases = async ({
     );
   }
 };
+
+export const EMPTY_COMMENT = i18n.translate(
+  'xpack.securitySolution.endpoint.updateCases.emptyComment',
+  {
+    defaultMessage: 'No comment provided',
+  }
+);