[8.14] Fix Alert exception flyout don't open for ESQL alerts (#1…

…84389) (#184530)

# Backport

This will backport the following commits from `main` to `8.14`:
- [ Fix Alert exception flyout don't open for ESQL alerts
(#184389)](#184389)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Khristinin
Nikita","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-05-30T16:22:52Z","message":"
Fix Alert exception flyout don't open for ESQL alerts (#184389)\n\nFix
Alert exception flyout not opening for ESQL and ML
alerts","sha":"be3503c711ebf8d79c10835cfb731592c9769354","branchLabelMapping":{"^v8.15.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:
SecuritySolution","backport:prev-minor","Team:Detection
Engine","v8.15.0"],"title":" Fix Alert exception flyout don't open for
ESQL
alerts","number":184389,"url":"https://github.com/elastic/kibana/pull/184389","mergeCommit":{"message":"
Fix Alert exception flyout don't open for ESQL alerts (#184389)\n\nFix
Alert exception flyout not opening for ESQL and ML
alerts","sha":"be3503c711ebf8d79c10835cfb731592c9769354"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v8.15.0","branchLabelMappingKey":"^v8.15.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/184389","number":184389,"mergeCommit":{"message":"
Fix Alert exception flyout don't open for ESQL alerts (#184389)\n\nFix
Alert exception flyout not opening for ESQL and ML
alerts","sha":"be3503c711ebf8d79c10835cfb731592c9769354"}}]}]
BACKPORT-->

Co-authored-by: Khristinin Nikita <[email protected]>
Co-authored-by: Yara Tercero <[email protected]>

packages/kbn-securitysolution-ecs/src/index.ts

@@ -109,7 +109,7 @@ export interface EcsSecurityExtension {
   };
   // I believe these parameters are all snake cased to correspond with how they are sent "over the wire" as request / response
   // Not representative of the parsed types that are camel cased.
-  'kibana.alert.rule.parameters'?: { index: string[]; data_view_id?: string };
+  'kibana.alert.rule.parameters'?: { index: string[]; data_view_id?: string; type?: string };
   'kibana.alert.workflow_status'?: 'open' | 'acknowledged' | 'in-progress' | 'closed';
   // eslint-disable-next-line @typescript-eslint/naming-convention
   Memory_protection?: MemoryProtection;

x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx

@@ -426,10 +426,15 @@ export const AddExceptionFlyoutWrapper: React.FC<AddExceptionFlyoutWrapperProps>
     return null;
   }, [maybeRule]);
 
+  const ruleType = enrichedAlert?.['kibana.alert.rule.parameters']?.type;
+  const isAlertWithoutIndex = ruleType === 'esql' || ruleType === 'machine_learning';
+  const isWaitingForIndexOrDataView =
+    !isAlertWithoutIndex && memoRuleIndices == null && memoDataViewId == null;
+
   const isLoading =
     (isLoadingAlertData && isSignalIndexLoading) ||
     enrichedAlert == null ||
-    (memoRuleIndices == null && memoDataViewId == null);
+    isWaitingForIndexOrDataView;
 
   if (isLoading || isRuleLoading) return null;