From c36ba552d93efb8c7f115abd5ca2e2534286e877 Mon Sep 17 00:00:00 2001
From: Ryan Carroll <ryan.carroll@graylog.com>
Date: Fri, 27 Mar 2026 14:58:55 -0500
Subject: [PATCH] Move pluggable actions to end of event definition menu

Move `{moreActions}` (plugin-injected actions) to render after the
Replay Search item so that enterprise-injected actions like Sigma
Replay Search appear at the bottom of the menu, matching the position
of the built-in Replay Search for aggregation event definitions.

Also capitalizes "Replay search" to "Replay Search" for consistency
with other menu items.

Fixes Graylog2/graylog-plugin-enterprise#13184

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .../event-definitions/EventDefinitionActions.tsx              | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/graylog2-web-interface/src/components/event-definitions/event-definitions/EventDefinitionActions.tsx b/graylog2-web-interface/src/components/event-definitions/event-definitions/EventDefinitionActions.tsx
index 8525f84df062..439bed246b2f 100644
--- a/graylog2-web-interface/src/components/event-definitions/event-definitions/EventDefinitionActions.tsx
+++ b/graylog2-web-interface/src/components/event-definitions/event-definitions/EventDefinitionActions.tsx
@@ -283,7 +283,6 @@ const EventDefinitionActions = ({ eventDefinition }: Props) => {
               {isEnabled ? 'Disable' : 'Enable'}
             </MenuItem>
           </IfPermitted>
-          {moreActions}
           {showActions() && (
             <IfPermitted permissions={`eventdefinitions:delete:${eventDefinition.id}`}>
               <MenuItem divider />
@@ -310,10 +309,11 @@ const EventDefinitionActions = ({ eventDefinition }: Props) => {
                 <MenuItem divider />
               </IfPermitted>
               <LinkContainer to={Routes.ALERTS.DEFINITIONS.replay_search(eventDefinition.id)}>
-                <MenuItem>Replay search</MenuItem>
+                <MenuItem>Replay Search</MenuItem>
               </LinkContainer>
             </>
           )}
+          {moreActions}
         </MoreActions>
       </ButtonToolbar>
       {showDialog && (