[SECURITY SOLUTIONS] Meta to move cases everywhere

[XavierM]

To get cases everywhere from other plugins than security solutions, we will need to do these steps:

UI

• Move Cases components from security solutions to the plugin case, we will follow the same architecture than the alert team. We had a meeting with the alert teams and @YulNaumenko advice us to follow this PR #103884
• Create case public folder #92416 PR: [SECURITY SOLUTIONS] [Case everywhere] Move Insert Timeline functionality to Cases #94697

We will have to move these components and the associated ones to Case plugin, we will keep the routing of cases inside of the security solutions.

• Create case page PR: [SECURITY SOLUTIONS] [Case everywhere] Move Insert Timeline functionality to Cases #94697
  • [SECURITY SOLUTIONS] [Case everywhere] Move Create case page #94131
• Configure case page
  • [SECURITY SOLUTIONS] [Case everywhere] Move Configure case page #94129
• Case details page
  • [SECURITY SOLUTIONS] [Case everywhere] Move Case Details page #94127
    We will have to be cautious here about (hard dependency from security solution plugin):
    • show alerts in timeline
    • show detail of an alert
    • we are using useQueryAlerts a dependency from detections team
• All cases page
  • [SECURITY SOLUTIONS][Case Everywhere] Move All Case page #92423
• Move Insert Timeline into Cases [SECURITY SOLUTIONS] [Case everywhere] Move Insert Timeline functionality to Cases #94697 PR: [Security Solution][Cases] Re-enable timeline functionality #96496
• Remaining Cases removal work [SECURITY SOLUTIONS] [Case everywhere] Remaining cases removal work #96074
• Integrate Security Cases UI Components into New Observability Cases Page https://github.com/elastic/security-team/issues/853

Privileges

• [RAC] RBAC around rules/alerts in Observability/Security Solutions #97124 :RBAC around rules/alerts in Observability/Security Solutions

---

Initial approach : Move Case privileges from security solution privileges to a customize sub-feature privileges. it will work the same way that it works for short URLs in Discover

@legrego was kind enough to share a lot of knowledge about sub feature

• https://www.elastic.co/guide/en/kibana/7.x/development-security.html#example-3-discover
• https://github.com/elastic/kibana/blob/7.x/x-pack/plugins/features/common/sub_feature.ts
• https://github.com/elastic/kibana/blob/7.x/x-pack/plugins/features/server/oss_features.ts#L48-L103

---

RBAC

• [Cases] RBAC #95804 : Create our own RBAC, we need to do that because we do not want to create multiple saved object type of case for security and observability etc. We are going to follow the consumer model from the RBAC of the alerting team. ([Cases] RBAC #95804)

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[tylersmalley]

it sounds like you're looking to create a plugin with the purpose of sharing a set of React components. If that is the case, I would instead suggest creating a package. Currently, the developer experience is a bit lacking to what the plugin dev is, happy to discuss further. But with the Bazel migration, this will quickly surpass it in the coming months. #92758

[XavierM]

it sounds like you're looking to create a plugin with the purpose of sharing a set of React components. If that is the case, I would instead suggest creating a package. Currently, the developer experience is a bit lacking to what the plugin dev is, happy to discuss further. But with the Bazel migration, this will quickly surpass it in the coming months. #92758

@tylersmalley @stephmilovic @michaelolo24 @kobelb and I met last week to talk about the diff between packages and plugin and we all realized that keeping our UI inside of the plugin of Cases is the way to go

[asnehalb]

Moved 'Export Cases' use case to https://github.com/elastic/security-team/issues/1085