[Security Solution] Add Host/User flyout in One Discover. #199279

logeekal · 2024-11-07T10:03:56Z

Summary

Handles #191998

Follow up work:

This PR add below entity flyouts for below entities in One Discover:

host.name
user.name
source.ip
destination.ip

In this PR we re-use the security solution code by making use of below model based on discover-shared plugin.

flowchart TD
  discoverShared["Discover Shared"]
  securitySolution["Security Solution"]
  discover["Discover"]


  securitySolution -- "registers Features" --> discoverShared
  discover -- "consume Features" --> discoverShared

How to Test

Note

This PR adds security-root-profile in One discover which is currently in experimental mode. All changes below can only be tested when profile is activated. Profile can activated by adding below lines in config/kibana.dev.yml

 discover.experimental.enabledProfiles:
    - security-root-profile

As mentioned above, adding above experimental flag in kibana.dev.yml.
Spin up Security Serverless project and add some alert Data.
Navigate to Discover and add columns host.name and user.name in table. Now host and user flyouts should be available on clicking host.name, user.name, source.ip & destination.ip.
Flyout should work without any error.
Below things are not working and will be tackled in followup PR :
- Security Hover actions
- Actions such as Add to Timeline or Add to Case

Checklist

Delete any items that are not applicable to this PR.

Unit or functional tests were updated or added to match the most common scenarios

incremental change incremental save entity flyout working [CI] Auto-commit changed files from 'node scripts/notice' [CI] Auto-commit changed files from 'node scripts/lint_ts_projects --fix' fix: quick checks Merge discover getRenderAppWrapper fix: incremental change fix: merge mistakes fix: types and tests fix: undo unnecessary changes tests: cell renderer fix: small quirks fix: types fix: getCellRenderers fix: test comment fix: formatting

logeekal · 2024-11-08T17:26:50Z

/ci

logeekal · 2024-11-11T11:04:40Z

/ci

logeekal · 2024-11-11T13:06:53Z

/ci

logeekal · 2024-11-11T13:11:16Z

packages/kbn-unified-data-table/src/types.ts

-  string,
-  (props: DataGridCellValueElementProps) => ReactElement
->;
+export type CustomCellRenderer = Record<string, FunctionComponent<DataGridCellValueElementProps>>;


@elastic/kibana-data-discovery

Changed this to FunctionComponent because previous type does not accept memoized components. FunctionComponent is more inclusive.

Please let me know if you would keep this a function instead.

I don't really see an issue with this, although we do already memoize cell renderers here, so it's likely not necessary to memoize again:

kibana/packages/kbn-unified-data-table/src/utils/get_render_cell_value.tsx

Line 166 in 7538565

: memo(UnifiedDataTableRenderCellValue);

If we make this change, it might even make sense to go all the way and just accept ComponentType, but not really a strong opinion.

elasticmachine · 2024-11-11T15:17:07Z

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

...scover/public/context_awareness/profile_providers/security/security_root_profile/profile.tsx

jloleysens

kibana.jsonc LGTM

...scover/public/context_awareness/profile_providers/security/security_root_profile/profile.tsx

src/plugins/discover_shared/public/services/discover_features/types.ts

x-pack/plugins/security_solution/public/one_discover/app_wrapper/index.tsx

semd

LGTM! Thanks Jatin for doing this and taking the time to discuss and address each comment.
Great work! 💯

davismcphee

@logeekal It looks like discoverShared might have been partially removed from Discover and now there are some related type errors. Other than that this LGTM from the Data Discovery side and will be good to go once fixed.

davismcphee

Thanks for fixing the types, and this now LGTM on the Data Discovery side 👍 Congrats on merging the first Security extension point implementations @logeekal!

logeekal · 2024-11-29T10:49:24Z

Thanks for fixing the types, and this now LGTM on the Data Discovery side 👍 Congrats on merging the first Security extension point implementations @logeekal

Thanks. Finally :D . But this is also experimental 🤣

elasticmachine · 2024-11-29T12:49:56Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 5c42105

Failed CI Steps

Jest Tests #18

Test Failures

[job] [logs] Jest Tests #18 / useActionStatus should post cancel and invoke callback on cancel upgrade - plural
[job] [logs] Jest Tests #18 / useActionStatus should report error on cancel upgrade failure

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`discover`	981	983	+2
`securitySolution`	6277	6283	+6
total			+8

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`discover`	100	161	+61
`discoverShared`	15	23	+8
`securitySolution`	119	123	+4
total			+73

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`discover`	811.3KB	812.2KB	+874.0B
`securitySolution`	13.4MB	14.6MB	⚠️ +1.2MB
total			⚠️ +1.2MB

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`discover`	24	29	+5
`discoverShared`	3	2	-1
`securitySolution`	33	34	+1
total			+5

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	86.6KB	87.8KB	+1.2KB

Unknown metric groups

API count

id	before	after	diff
`discover`	148	209	+61
`discoverShared`	16	26	+10
`securitySolution`	187	191	+4
total			+75

async chunk count

id	before	after	diff
`securitySolution`	101	102	+1

History

💔 Build #253101 failed cbbb094
💔 Build #253095 failed 7af2969
💔 Build #253062 failed 4ef1600
💚 Build #250861 succeeded 9198449
💔 Build #250816 failed c4bece2

kibanamachine · 2024-11-29T13:05:15Z

Starting backport for target branches: 8.17, 8.x

https://github.com/elastic/kibana/actions/runs/12085265704

kibanamachine · 2024-11-29T13:10:07Z

💔 All backports failed

Status	Branch	Result
❌	8.17	Backport failed because of merge conflicts
❌	8.x	Backport failed because of merge conflicts You might need to backport the following PRs to 8.x: - [Fleet] Change uninstall tokens space when changing agent policies spaces (#199536)

Manual backport

To create the backport manually run:

node scripts/backport --pr 199279

Questions ?

Please refer to the Backport tool documentation

…199818) ## Summary Fixes elastic/security-team#11112 Follow up to - #199279 Adds functional test for Security Profiles in One Discover. ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…9279) ## Summary Handles elastic#191998 Follow up work: - elastic/security-team#11112 - elastic#196667 This PR add below entity flyouts for below entities in One Discover: - host.name - user.name - source.ip - destination.ip In this PR we re-use the security solution code by making use of below model based on `discover-shared` plugin. ```mermaid flowchart TD discoverShared["Discover Shared"] securitySolution["Security Solution"] discover["Discover"] securitySolution -- "registers Features" --> discoverShared discover -- "consume Features" --> discoverShared ``` ## How to Test >[!Note] >This PR adds `security-root-profile` in One discover which is currently in `experimental mode`. All changes below can only be tested when profile is activated. Profile can activated by adding below lines in `config/kibana.dev.yml` > ```yaml > discover.experimental.enabledProfiles: > - security-root-profile > ``` > 1. As mentioned above, adding above experimental flag in `kibana.dev.yml`. 2. Spin up Security Serverless project and add some alert Data. 3. Navigate to Discover and add columns `host.name` and `user.name` in table. Now `host` and `user` flyouts should be available on clicking `host.name`, `user.name`, `source.ip` & `destination.ip`. 4. Flyout should work without any error. 5. Below things are not working and will be tackled in followup PR : - Security Hover actions - Actions such as `Add to Timeline` or `Add to Case` ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…lastic#199818) ## Summary Fixes elastic/security-team#11112 Follow up to - elastic#199279 Adds functional test for Security Profiles in One Discover. ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

logeekal force-pushed the feat/entity_flyout_discover_context_final branch from 2a300b9 to ac84386 Compare November 8, 2024 16:37

fix: user+host flyout

3a46b0e

logeekal changed the title ~~Feat/entity flyout discover context final~~ [Security Solution] Add Host/User flyout in One Discover. Nov 8, 2024

logeekal added backport:skip This commit does not require backporting Team:Threat Hunting:Investigations Security Solution Investigations Team release_note:skip Skip the PR/issue when compiling release notes labels Nov 8, 2024

logeekal and others added 3 commits November 8, 2024 18:31

remove unnecessary change

2580c51

[CI] Auto-commit changed files from 'node scripts/notice'

27ee1fc

discover shared lazy modules

fb53790

fix: types

8a385b6

logeekal commented Nov 11, 2024

View reviewed changes

fix: better lazy loading and feature access

0a7eaed

logeekal requested a review from semd November 11, 2024 15:14

logeekal marked this pull request as ready for review November 11, 2024 15:17

logeekal requested review from a team as code owners November 11, 2024 15:17

tonyghiani reviewed Nov 11, 2024

View reviewed changes

...scover/public/context_awareness/profile_providers/security/security_root_profile/profile.tsx Outdated Show resolved Hide resolved

logeekal added 3 commits November 12, 2024 10:22

fix: types

a57d5bf

createSecurityProfileProvider is not async

6a8a7d9

types: fix

d9cd681

jloleysens approved these changes Nov 12, 2024

View reviewed changes

fix: more types + some renames

f134206

michaelolo24 reviewed Nov 18, 2024

View reviewed changes

...scover/public/context_awareness/profile_providers/security/security_root_profile/profile.tsx Outdated Show resolved Hide resolved

michaelolo24 reviewed Nov 18, 2024

View reviewed changes

src/plugins/discover_shared/public/services/discover_features/types.ts Outdated Show resolved Hide resolved

michaelolo24 reviewed Nov 18, 2024

View reviewed changes

x-pack/plugins/security_solution/public/one_discover/app_wrapper/index.tsx Show resolved Hide resolved

logeekal added 4 commits November 21, 2024 11:23

Merge main → current branch

4ef1600

fix: CellActionsContext + isTimeline

4aaa456

fix: PR feedback

7af2969

fix: types

cbbb094

michaelolo24 approved these changes Nov 25, 2024

View reviewed changes

semd approved these changes Nov 26, 2024

View reviewed changes

davismcphee reviewed Nov 27, 2024

View reviewed changes

logeekal added 2 commits November 27, 2024 16:40

Merge branch 'main' into feat/entity_flyout_discover_context_final

652ba54

fix: types

6ae2a61

davismcphee approved these changes Nov 27, 2024

View reviewed changes

Merge branch 'main' into feat/entity_flyout_discover_context_final

5c42105

logeekal merged commit c80f91e into elastic:main Nov 29, 2024
8 checks passed

kibanamachine added the v9.0.0 label Nov 29, 2024

logeekal added backport:skip This commit does not require backporting and removed backport v8.17.0 labels Nov 29, 2024

This was referenced Dec 4, 2024

[ Security Solution ] One discover security context functional tests #199818

Merged

[Security Solution] Implement Host/User/IP Flyouts in One Discover #191998

Closed

PhilippeOberti mentioned this pull request Dec 17, 2024

[8.x] Sustainable Kibana Architecture: Move modules owned by @elastic/security-solution (#202851) #204518

Closed

jughosta added the Project:OneDiscover Enrich Discover with contextual awareness label Jan 24, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Add Host/User flyout in One Discover. #199279

[Security Solution] Add Host/User flyout in One Discover. #199279

logeekal commented Nov 7, 2024 •

edited by kibanamachine

Loading

logeekal commented Nov 8, 2024

logeekal commented Nov 11, 2024

logeekal commented Nov 11, 2024

logeekal Nov 11, 2024

davismcphee Nov 13, 2024

elasticmachine commented Nov 11, 2024

jloleysens left a comment •

edited

Loading

semd left a comment

davismcphee left a comment

davismcphee left a comment

logeekal commented Nov 29, 2024

elasticmachine commented Nov 29, 2024

API count

async chunk count

kibanamachine commented Nov 29, 2024

kibanamachine commented Nov 29, 2024

[Security Solution] Add Host/User flyout in One Discover. #199279

[Security Solution] Add Host/User flyout in One Discover. #199279

Conversation

logeekal commented Nov 7, 2024 • edited by kibanamachine Loading

Summary

How to Test

Checklist

logeekal commented Nov 8, 2024

logeekal commented Nov 11, 2024

logeekal commented Nov 11, 2024

logeekal Nov 11, 2024

Choose a reason for hiding this comment

davismcphee Nov 13, 2024

Choose a reason for hiding this comment

elasticmachine commented Nov 11, 2024

jloleysens left a comment • edited Loading

Choose a reason for hiding this comment

semd left a comment

Choose a reason for hiding this comment

davismcphee left a comment

Choose a reason for hiding this comment

davismcphee left a comment

Choose a reason for hiding this comment

logeekal commented Nov 29, 2024

elasticmachine commented Nov 29, 2024

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Public APIs missing exports

Page load bundle

API count

async chunk count

History

kibanamachine commented Nov 29, 2024

kibanamachine commented Nov 29, 2024

💔 All backports failed

Manual backport

Questions ?

logeekal commented Nov 7, 2024 •

edited by kibanamachine

Loading

jloleysens left a comment •

edited

Loading