All pull requests

Pull requests

• [Agent Builder] [AlertZero] Report changes to template fields a template opts in

  backport:versionrelease_note:skipTeam:agent-builderTeam: SecuritySolutionv9.6.0
  #297578·andrew-goldstein opened Oct 14, 2026Contributor·

  ·
  3

  

• [OAS] Add Impact and Action guidance for breaking changes

  backport:skiprelease_note:skipTeam:Core
  #297577·TinaHeiligers opened Oct 14, 2026Contributor·5 of 8 tasks·

  ·
  2

• [TRIAL - DO NOT MERGE] BC keeps Impact & Action guidance

  backport:skipblockedrelease_note:skip
  #297576·TinaHeiligers opened Oct 14, 2026Contributor·

  ·
  4

• [TRIAL - DO NOT MERGE] GA & TP BC comment Impact & Action

  backport:skipblockedrelease_note:skip
  #297575·TinaHeiligers opened Oct 14, 2026Contributor·

  ·
  3

• [Agent Builder] [AlertZero] Report the workflow run id on agent rounds and EIS calls

  backport:versionrelease_note:skipTeam:agent-builderTeam: SecuritySolutionv9.6.0
  #297574·andrew-goldstein opened Oct 14, 2026Contributor·

  ·
  2

  

• [Lens] Return specific error codes when a by-reference panel can't be converted to the API format

  backport:skiprelease_note:skip
  #297572·nickofthyme opened Oct 13, 2026Contributor·

  ·
  1

  2

• [Security Solution / Dashboards] Align embedded dashboard chrome with the recessed layout

  backport:skiprelease_note:skipv9.6.0
  #297571·ryankeairns opened Oct 13, 2026Contributor·6 tasks·

  ·
  6

• [AlertZero] Split Hunt Watch's single model into Efficient, Balanced and Frontier tiers

  #297568·PhilippeOberti opened Oct 13, 2026Contributor·

  ·
  1

• [CI] Treat steps with array-valued commands as command steps

  backport:skiprelease_note:skipTeam:Operations
  #297566·lhearachel opened Oct 13, 2026Contributor·

  ·
  3

• [AlertZero] Attribute Hunt and Threat Intel model calls in token usage

  backport:skiprelease_note:skipTeam:Security Generative AIv9.6.0
  #297563·patrykkopycinski opened Oct 13, 2026Contributor·

  ·
  1

• [AlertZero] Ensure the shared agent when a Worker is enabled; fail clearly when a new conversation's agent is unusable

  backport:skiprelease_note:fixTeam:Security Generative AIv9.6.0
  #297560·patrykkopycinski opened Oct 13, 2026Contributor·2 tasks done·

  ·
  3

• [Security Evals] FP/TP real-workflow eval: workflow harness, seeding, Playwright eval

  backport:skiprelease_note:skipTeam:Security Generative AIv9.6.0
  #297559·patrykkopycinski opened Oct 13, 2026Contributor·

  ·
  1

• [Entity Analytics] Add task to backfill alerts indices with entity ID

  backport:skiprelease_note:skip
  #297558·tcalopes opened Oct 13, 2026Contributor·10 tasks·

  ·
  1

  

• [Obs Navigation - Classic] Add alerting section for universal and classic alerts

  #297553·baileycash-elastic opened Oct 13, 2026Contributor·

  ·
  2

• [9.5] [Lens] Defer metric accessor updates until datasource initialization (#296545)

  backport
  #297547·walterra opened Oct 13, 2026Contributor·

  ·
  3

• [security-evals-matrix] Render matrix report through report adapters

  backport:skiprelease_note:skipTeam:Security Generative AIv8.20.0
  #297546·patrykkopycinski opened Oct 13, 2026Contributor·

  ·
  1

• [Agent Builder] Fall back to tool_choice auto when a model rejects forced tool_choice

  backport:skiprelease_note:fixTeam:AI Infra
  #297545·patrykkopycinski opened Oct 13, 2026Contributor·

  ·
  3

• feat(slack): return the Relay's conversationKey from slack2.sendMessage

  backport:skipconnectors-v2release_note:skipv9.6.0
  #297543·vigneshshanmugam opened Oct 13, 2026Member·

  ·
  3

• [kbn-evals] Evaluate models with different reasoning effort levels

  backport:skipevals:smoke-testskbn-evalsmodels:eis/anthropic-claude-5-sonnetrelease_note:skipTeam:nightshift-context-and-research
  #297542·arturoliduena opened Oct 13, 2026Contributor·

  ·
  12

• [Vega] Add dashboard library (by-reference) support

  #297541·nickpeihl opened Oct 13, 2026Contributor·

  ·
  1

• [ResponseOps][Connectors] Read connector specs from the connector type registry

  #297540·jcger opened Oct 13, 2026Contributor·3 of 9 tasks·

  ·
  1

• [Security Evals] FP/TP twin seeder: serverless support

  #297538·patrykkopycinski opened Oct 13, 2026Contributor·

  ·
  2

• [Security Evals] Add FP/TP real-workflow eval package: corpora, loader, cohort, evaluators

  backport:skiprelease_note:skipTeam:Security Generative AIv9.6.0
  #297534·patrykkopycinski opened Oct 13, 2026Contributor·

  ·
  1

• [Security Evals] FP/TP trajectory: tolerate unmapped tool columns, ignore harness tools

  backport:skiprelease_note:skipTeam:Security Generative AIv9.6.0
  #297533·patrykkopycinski opened Oct 13, 2026Contributor·

  ·
  1

• [Workflows][AlertZero] FP/TP analysis reads both Attack Discovery destinations

  backport:skiprelease_note:skipTeam: SecuritySolutionv9.6.0
  #297532·patrykkopycinski opened Oct 13, 2026Contributor·

  ·
  1