Hosts Risk Step 1 - Hosts Page - Risky Hosts KPI #119734

machadoum · 2021-11-25T14:14:09Z

issue: #119024
figma

To enable the feature flag, please add the following line to kibana.dev.yml
xpack.securitySolution.enableExperimental: ['riskyHostsEnabled']

What is included:

Create Risky Hosts KPI panel
Show EuiCallOut message when Host risk transform isn't enabled

Module enabled state

Module disabled state

Feature flag disabled state

What is not included:

Create host risk score calculation info. "How is host risk calculated"
Filter in/out by host risk score
Add Host risk classification column to "All Hosts" table (filter and sorting not included)

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)

machadoum · 2021-12-01T09:15:18Z

...plugins/security_solution/common/search_strategy/security_solution/hosts/risk_score/index.ts

  risk: string;
+  risk_stats: {


@ecezalp I am updating the HostsRiskScore interface to match the new version of the transform.

I am a bit unsure about the implications - what would happen if someone installed the host risk score module during 7.16 (or 8.0) and then upgraded to 8.1? Do we have a mechanism to tell them that the also need to update the host risk score package? How would they know? Would they get a broken UI (all 0s on the Host Risk Score card, or a javascript error?)

Maybe we don't care at this stage about breaking changes because the feature is experimental, but I think it's still something we should clear with product, what happens if users have an older version of the host risk score package installed. What issue would the users encounter, and how would they know how to fix it?

@ajosh0504 @SourinPaul Could you help us with this question? ⬆️

elasticmachine · 2021-12-01T09:19:28Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

x-pack/plugins/security_solution/public/hosts/components/kpi_hosts/risky_hosts/index.tsx

This reverts commit c29886c. Revert "Host Risk Filtering POC" This reverts commit c1540e54f6ec3d892035bb7aeecb40e5da219ac1.

machadoum · 2021-12-06T16:44:37Z

@elasticmachine merge upstream

monina-n

Design approval 12/6

we might need a follow up pr to update the copy/action of the enable callout

charlie-pichette

👍🏼

kibana-ci · 2021-12-06T18:30:38Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	2800	2807	+7

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	4.6MB	4.6MB	+5.9KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	243.7KB	243.9KB	+233.0B

History

💔 Build #11367 failed d531c48
💛 Build #11211 was flaky 59611a8
💚 Build #10912 succeeded 5d07eda41ce30ec5ebb958b6445045b2daaa0f7e
💔 Build #10901 failed 2fb432b07e0f1a40fd828d5adb9aac736c23909f
💔 Build #10678 failed 9d57dc9563ee26701e9abe8c265870c9b4b60b07

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @machadoum

kibanamachine · 2021-12-06T18:31:09Z

💔 Backport failed

The backport operation could not be completed due to the following error:
There are no branches to backport to. Aborting.

The backport PRs will be merged automatically after passing CI.

To backport manually run:
node scripts/backport --pr 119734

* Add Host risk classification column to All hosts table * Add cypress test to risk column on all hosts table * Fix unit test * Add unit test * Add tooltip to host risk column Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

* Fix HostsRiskScore interface to match new transform version This reverts commit c29886c. Revert "Host Risk Filtering POC" This reverts commit c1540e54f6ec3d892035bb7aeecb40e5da219ac1. * Move hosts risk API client to hosts folder structure * Add Risky Hosts KPI to Hosts page * Fix type issues and add unit tests * Add cypress test * Fix unit test * Fix cypress tests * Add 'EuiCallOut' message when Host risk index doesn't exist * Fix singular hosts internationalization * Fix conflict with main * Update risky_hosts es_archives mappings Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

…120487) * Add Host risk classification column to All hosts table * Add cypress test to risk column on all hosts table * Fix unit test * Add unit test * Add tooltip to host risk column Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

machadoum force-pushed the siem-explore-issue-119024 branch 5 times, most recently from cdc2f0c to 70f3d7b Compare December 1, 2021 09:01

machadoum changed the title ~~Hosts Risk Step 1 - Host Page~~ Hosts Risk Step 1 - Host Page - Risky Hosts KPI Dec 1, 2021

machadoum changed the title ~~Hosts Risk Step 1 - Host Page - Risky Hosts KPI~~ Hosts Risk Step 1 - Hosts Page - Risky Hosts KPI Dec 1, 2021

machadoum force-pushed the siem-explore-issue-119024 branch from 70f3d7b to 60f8f68 Compare December 1, 2021 09:13

machadoum requested a review from stephmilovic December 1, 2021 09:13

machadoum assigned angorayc Dec 1, 2021

machadoum commented Dec 1, 2021

View reviewed changes

machadoum assigned machadoum and unassigned angorayc Dec 1, 2021

machadoum requested a review from angorayc December 1, 2021 09:15

machadoum marked this pull request as ready for review December 1, 2021 09:17

machadoum requested review from a team as code owners December 1, 2021 09:17

machadoum added v8.0.0 auto-backport Deprecated - use backport:version if exact versions are needed Team:Threat Hunting:Explore v8.1.0 Team:Threat Hunting Security Solution Threat Hunting Team and removed v8.0.0 labels Dec 1, 2021

machadoum added release_note:enhancement release_note:feature Makes this part of the condensed release notes and removed release_note:enhancement labels Dec 1, 2021

machadoum force-pushed the siem-explore-issue-119024 branch 2 times, most recently from bb9c9a1 to 450ea37 Compare December 2, 2021 10:18

angorayc reviewed Dec 2, 2021

View reviewed changes

x-pack/plugins/security_solution/public/hosts/components/kpi_hosts/risky_hosts/index.tsx Outdated Show resolved Hide resolved

machadoum force-pushed the siem-explore-issue-119024 branch 2 times, most recently from 9436ec1 to 5d07eda Compare December 3, 2021 10:59

angorayc approved these changes Dec 3, 2021

View reviewed changes

machadoum added 10 commits December 6, 2021 10:11

Fix HostsRiskScore interface to match new transform version

0443efe

This reverts commit c29886c. Revert "Host Risk Filtering POC" This reverts commit c1540e54f6ec3d892035bb7aeecb40e5da219ac1.

Move hosts risk API client to hosts folder structure

988f0df

Add Risky Hosts KPI to Hosts page

25a717d

Fix type issues and add unit tests

35367f8

Add cypress test

e5b66d4

Fix unit test

4ba9698

Fix cypress tests

f6494f7

Add 'EuiCallOut' message when Host risk index doesn't exist

24f4709

Fix singular hosts internationalization

c130256

Fix conflict with main

59611a8

machadoum force-pushed the siem-explore-issue-119024 branch from 5d07eda to 59611a8 Compare December 6, 2021 09:19

Update risky_hosts es_archives mappings

d531c48

Merge branch 'main' into siem-explore-issue-119024

5d9e112

monina-n approved these changes Dec 6, 2021

View reviewed changes

monina-n reviewed Dec 6, 2021

View reviewed changes

charlie-pichette approved these changes Dec 6, 2021

View reviewed changes

machadoum enabled auto-merge (squash) December 6, 2021 16:47

machadoum merged commit f2ef652 into elastic:main Dec 6, 2021

kibanamachine added the backport:skip This commit does not require backporting label Dec 6, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Hosts Risk Step 1 - Hosts Page - Risky Hosts KPI #119734

Hosts Risk Step 1 - Hosts Page - Risky Hosts KPI #119734

machadoum commented Nov 25, 2021 •

edited

Loading

machadoum Dec 1, 2021

ecezalp Dec 6, 2021 •

edited

Loading

machadoum Dec 6, 2021 •

edited

Loading

elasticmachine commented Dec 1, 2021

machadoum commented Dec 6, 2021

monina-n left a comment

charlie-pichette left a comment

kibana-ci commented Dec 6, 2021

kibanamachine commented Dec 6, 2021

Hosts Risk Step 1 - Hosts Page - Risky Hosts KPI #119734

Hosts Risk Step 1 - Hosts Page - Risky Hosts KPI #119734

Conversation

machadoum commented Nov 25, 2021 • edited Loading

What is included:

Module enabled state

Module disabled state

Feature flag disabled state

What is not included:

Checklist

machadoum Dec 1, 2021

Choose a reason for hiding this comment

ecezalp Dec 6, 2021 • edited Loading

Choose a reason for hiding this comment

machadoum Dec 6, 2021 • edited Loading

Choose a reason for hiding this comment

elasticmachine commented Dec 1, 2021

machadoum commented Dec 6, 2021

monina-n left a comment

Choose a reason for hiding this comment

charlie-pichette left a comment

Choose a reason for hiding this comment

kibana-ci commented Dec 6, 2021

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

Page load bundle

History

kibanamachine commented Dec 6, 2021

💔 Backport failed

machadoum commented Nov 25, 2021 •

edited

Loading

ecezalp Dec 6, 2021 •

edited

Loading

machadoum Dec 6, 2021 •

edited

Loading