Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Improve Toast message when bulk updating Index Patterns configured with data views #139802

Closed
jpdjere opened this issue Aug 31, 2022 · 3 comments · Fixed by #147345
Closed

[Security Solution] Improve Toast message when bulk updating Index Patterns configured with data views #139802

jpdjere opened this issue Aug 31, 2022 · 3 comments · Fixed by #147345
Assignees
@jpdjere
Labels
8.7 candidate enhancement New value added to drive a business result Feature:Rule Management Security Solution Detection Rule Management area Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.7.0

Comments

@jpdjere
Copy link
Contributor

jpdjere commented Aug 31, 2022 •
edited by banderror
Loading

Depends on: #145093
Related to: #139897
Follow-up: #146283

Summary

Current behavior

When attempting to update/bulk update rules configured with a data view by adding an Index Pattern (and the "Apply changes to rules with data view" checkbox is NOT checked), the Success Toast message still says "You've successfully updated X rules".

bulk_edit_success_toast

This might be confusing UX because nothing has been actually changed (i.e. the rules are still configured with Data Views).

The full message of successful toast includes the following text: "If you did not select to apply changes to rules using Kibana data views, those rules were not updated and will continue using data views." However, since the toast itself gets hidden pretty quickly and is green, some users may think that rules were updated somehow.

We currently cannot distinguish from the API response if the data view has been overwritten in order to let the user know in the toast message.

Proposal

Introduce a new skipped property in the API response that would contain rules that were intentionally skipped by the endpoint. It could be useful in this and other cases related to data views, and any other cases where we don't want to return an error in general.

attributes:
  results:
    created: []
    deleted: []
    updated: []
    skipped: [{ id: "...", ... }]
  summary:
    failed: 0
    succeeded: 0
    skipped: 1
    total: 1
rules_count: 1
success: true

This technical proposal is described in more detail in #145093.
@botelastic botelastic bot added the needs-team Issues missing a team label label Aug 31, 2022
@jpdjere jpdjere added triage_needed enhancement New value added to drive a business result Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team and removed needs-team Issues missing a team label labels Aug 31, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@banderror banderror mentioned this issue Sep 6, 2022
Closed
@banderror banderror added Feature:Rule Management Security Solution Detection Rule Management area and removed triage_needed labels Sep 6, 2022
@banderror banderror removed their assignment Sep 6, 2022
@maximpn maximpn self-assigned this Oct 8, 2022
@banderror banderror changed the title [Security Solution][Detections] Improve Toast message when bulk updating Index Patterns configured with data views [Security Solution] Improve Toast message when bulk updating Index Patterns configured with data views Oct 21, 2022
@banderror banderror assigned jpdjere and unassigned maximpn Oct 31, 2022
@jpdjere jpdjere mentioned this issue Nov 2, 2022
Closed
9 tasks
@jpdjere jpdjere mentioned this issue Nov 18, 2022
Merged
@banderror banderror mentioned this issue Nov 22, 2022
Closed
@jpdjere jpdjere mentioned this issue Dec 12, 2022
Merged
9 tasks
@banderror
Copy link
Contributor

Will be closed by #147345 where this enhancement was done specifically for bulk updating index patterns of rules with data views. A more generic enhancement is opened as a separate ticket and added to the backlog: #146283.

@banderror banderror linked a pull request Dec 19, 2022 that will close this issue
[Security Solution] Add skipped rules to Bulk Edit rules API response #147345
Merged
9 tasks
jpdjere added a commit that referenced this issue Dec 20, 2022
@jpdjere @XavierM
[Security Solution] Add skipped rules to Bulk Edit rules API response (…
aaac011 
…#147345)

**Addresses:** #145093
**Related to:** #139802

## Summary

- Extends Bulk Edit API to return a new `skipped` property for rules
whose updating was skipped. See
[#145093](#145093) for details
on when a rule is skipped.
- In `x-pack/plugins/alerting/server/rules_client/methods/bulk_edit.ts`,
refactored the methods `bulkEdit` and `bulkEditOcc` to smaller methods,
following an immutable approach.
- Updated all related tests and expanded coverage. (unit, integration
and e2e)
- Update success toast message so that the user is informed if rules
were skipped.


https://user-images.githubusercontent.com/5354282/199806913-eb70e7a6-0435-486a-96f1-dd0e8abaffe2.mp4

### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
  - elastic/security-docs#2684
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)



### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

Co-authored-by: Xavier Mouligneau <xavier.mouligneau@elastic.co>
banderror pushed a commit to elastic/security-docs that referenced this issue Jan 4, 2023
@jpdjere
Document the new skipped response parameter of the _bulk_action endpo…
d4ddb81 
…int (#2731)

Relates to: #2684

Feature tickets:  elastic/kibana#145093 elastic/kibana#139802

Implemented in PR: elastic/kibana#144461
@joepeeples joepeeples mentioned this issue Jan 18, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jpdjere jpdjere

Labels
8.7 candidate enhancement New value added to drive a business result Feature:Rule Management Security Solution Detection Rule Management area Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.7.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Security Solution] Add skipped rules to Bulk Edit rules API response jpdjere/kibana
4 participants
@maximpn @jpdjere @banderror @elasticmachine