From 82e4aea2b5c4da6786ff1a242e2fd7b9d5af7ed6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20S=C3=A1nchez?= <sanchez.saez.alex01@gmail.com>
Date: Wed, 28 Oct 2026 08:07:08 -0600
Subject: [PATCH] fix[frontend](alerts): fixed related evets auto navigation
 and windows user-auditor-logs

---
 .../alerts/components/alert-drawer.tsx        | 21 ++++++++++++-------
 .../alerts/hooks/use-alert-thread-events.ts   |  2 +-
 .../helpers/user-auditor-display.ts           |  4 ++--
 3 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/frontend/src/features/alerts/components/alert-drawer.tsx b/frontend/src/features/alerts/components/alert-drawer.tsx
index eada2e6bf..a456d4a71 100644
--- a/frontend/src/features/alerts/components/alert-drawer.tsx
+++ b/frontend/src/features/alerts/components/alert-drawer.tsx
@@ -1,5 +1,5 @@
-import { useMemo,useEffect, useState } from 'react'
-import { Flame, X } from 'lucide-react'
+import { useMemo, useState } from 'react'
+import { Flame, X, Loader2 } from 'lucide-react'
 import { useTranslation } from 'react-i18next'
 import { cn } from '@/shared/lib/utils'
 import { Button } from '@/shared/components/ui/button'
@@ -63,7 +63,6 @@ export function AlertDrawer({
   useSocAiFocus(useMemo(() => alertFocus(a), [a]))
   const [tab, setTab] = useState<Tab>('summary')
   const { loading: loadingRelated, viewRelatedLogs } = useRelatedLogs()
-  const thread = useAlertThreadEvents(a, tab === 'events')
   // `notes` stores only the analyst's own free text; any AI assessment block is
   // kept separate so the SOC AI note is preserved when the analyst saves.
   const [notes, setNotes] = useState(userNotePart(a.notes))
@@ -75,10 +74,8 @@ export function AlertDrawer({
   const stmLabel = t(`alerts.status.${statusKey(a)}`)
   const tags = a.tags ?? []
 
+  const thread = useAlertThreadEvents(a, true)
 
-  useEffect(()=>{
-    viewRelatedLogs(a)
-  },[a])
 
   return (
     <div
@@ -157,11 +154,19 @@ export function AlertDrawer({
               onClick={() => setTab(id)}
               className={cn(
                 'relative px-3 py-2.5 text-xs capitalize transition-colors',
-                tab === id ? 'text-foreground' : 'text-muted-foreground hover:text-foreground'
+                tab === id ? 'text-foreground' : 'text-muted-foreground hover:text-foreground',
+                id === 'events' && thread.loading ? 'pointer-events-none cursor-not-allowed opacity-50':''
               )}
             >
               {id === 'events'
-                ? `${t('alerts.drawer.tabs.events')}${thread.events.length ? ` (${thread.events.length})` : ''}`
+                ? thread.loading? (
+                    <div className="flex gap-1 justify-center items-center">
+                     <small>{t('alerts.drawer.tabs.events')}</small>
+                      <Loader2 className="mr-2 h-3 w-3 animate-spin" />
+                    </div>
+
+
+                ) : `${t('alerts.drawer.tabs.events')}${thread.events.length ? ` (${thread.events.length})` : ''}`
                 : t(`alerts.drawer.tabs.${id}`)}
               {tab === id && <span className="absolute inset-x-2 -bottom-px h-0.5 rounded-full bg-primary" />}
             </button>
diff --git a/frontend/src/features/alerts/hooks/use-alert-thread-events.ts b/frontend/src/features/alerts/hooks/use-alert-thread-events.ts
index 7377f0420..7d8947d7d 100644
--- a/frontend/src/features/alerts/hooks/use-alert-thread-events.ts
+++ b/frontend/src/features/alerts/hooks/use-alert-thread-events.ts
@@ -48,7 +48,7 @@ export function useAlertThreadEvents(alert: Alert, enabled: boolean): AlertThrea
     return () => {
       cancelled = true
     }
-  }, [alert.id, echoes, enabled])
+  }, [alert.id,  enabled])
 
   const events = useMemo(() => {
     const seen = new Set<string>()
diff --git a/frontend/src/features/user-auditor/helpers/user-auditor-display.ts b/frontend/src/features/user-auditor/helpers/user-auditor-display.ts
index 21946ec07..c7e0d4daf 100644
--- a/frontend/src/features/user-auditor/helpers/user-auditor-display.ts
+++ b/frontend/src/features/user-auditor/helpers/user-auditor-display.ts
@@ -76,8 +76,8 @@ export function logExplorerHref(user: ADUser): string {
     if (user.hostname) p['origin.host'] = user.hostname
   } else {
     p.dataType = 'wineventlog'
-    p.eventCode = '4720,4726,4624'
-    if (user.sid) p.eventDataTargetSid = user.sid
+    p['log.eventCode'] = '4720,4726,4624'
+    if (user.sid) p['log.eventDataTargetSid'] = user.sid
   }
   return `/log-explorer?${new URLSearchParams(p).toString()}`
 }