[Security Solution]data viewOnly .alerts-security.alerts-default index should show under add filter alert page

[ghost]

Describe the bug:
Only .alerts-security.alerts-default index should show under add filter data view

Kibana/Elasticsearch Stack version

Version: 8.12 BC3
Commit: 2a8afed8572a4c709aa1c64216748197eeb9b18f
Build: 69985

Browser and Browser OS Version:
Firefox for windows OS
Version: 121.0

Elastic Endpoint Version:
N/A

Original install method:
None

Functional Area:
Add Filter on Alert Page

Initial Setup:

• None

precondition

• Alert should be present on 8.12 kibana instance.

Steps to reproduce

• Go to Alert Table
• Click on Add filter under the query bar
• Click on data view and check the list of the index not match with alert page index set
• On Alert page only one index is expected to show however under data view all index are showing

Additional Result

• Issue is also occuring on 8.11.0

Current Result

• All present index are showing under the add filter data view list

Expected behavior:

• Only .alerts-security.alerts-default index should show under add filter data view

Screen-Cast:

add.filter.mp4

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[semd]

This inconsistency happens because the global filters are linked with a data view, using the dataview id. The data view saved object is retrieved to render the index pattern in the component, assuming the entire index pattern is used.

In Security, we have the sourcerer which allows selecting a subset of the index patterns present in the data view. However, the global filters do not support that.

To fix this inconsistency we would have to either adapt the global filters to work with explicit index patterns (not likely since data views exist to abstract this information), or drop the sourcerer implementation in favor of raw data views in Security.

[yctercero]

cc @paulewing we're currently focused on sourcerer performance wins. A longer term discussions needs to be had around migrating to core components and endpoints.

[yctercero]

@paulewing revisiting this ticket - we may need more insight into the enhancements needed for sourcerer. There are a number of asks that require thinking through what we want the user experience to be.

[pborgonovi]

@yctercero I tried to reproduce this behavior but I don't see the option to filter by Data View and I also see by the evidences that it was under Technical Preview.
Has this feature been released?

[yctercero]

@pborgonovi sourcerer has been out for a while. If we can't reproduce, let's close out.

[pborgonovi]

Closing this bug since it's not reproducible.