Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SIEM] Uses autonomous_system as new ECS field #43925

Merged
merged 3 commits into from
Aug 29, 2019

Conversation

stephmilovic
Copy link
Contributor

Summary

ECS has added an as.* field set (elastic/ecs#341, docs) and @andrewkroh has updated a bunch of Filebeat pipelines to use those fields (elastic/beats#13036).

This PR changes our references to autonomous_system.* change to as.* in the SIEM app. I don't see any data coming through for autonomous_system.* in the first place. After this change, we are getting that data now when it is there on Ip Overview
#43746

Screen Shot 2019-08-23 at 4 36 50 PM

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

For maintainers

@stephmilovic stephmilovic added Team:SIEM release_note:skip Skip the PR/issue when compiling release notes labels Aug 23, 2019
@elasticmachine
Copy link
Contributor

Pinging @elastic/siem

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

@FrankHassanabad
Copy link
Contributor

When the text field gets large, it will cause line breaks and visually looks a bit off, but no changes requested. We could in the future maybe truncate it and make the tooltip display the full name or another option might be to split apart the Autonomous System Number into its own separate field next the Autonomous System Name.
Screen Shot 2019-08-26 at 9 35 15 AM

@FrankHassanabad
Copy link
Contributor

The other thing I noticed when testing this is that when we "flip" between "source" and "destination through the drop-down it does not auto-refresh any of the data. Instead the user has to manually click refresh to get the data to update.

This looks to be true for the ASN information as well as for any data in that UI component such as the ML data.

Here is a screen shot before I clicked "refresh" showing the source as a draggable instead of destination after I clicked "destination".

Screen Shot 2019-08-26 at 9 43 39 AM

It fixes its self once I click "refresh" on the time range.
Screen Shot 2019-08-26 at 9 49 26 AM

Just FYI's in case this is a recent issue but it can always be solved in a different PR later.

Copy link
Contributor

@FrankHassanabad FrankHassanabad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

checked out, ran the tests and then tested this with source and destination.

This PR does what it advertises and cleans things up more so 👍

@stephmilovic
Copy link
Contributor Author

Thanks @FrankHassanabad for the review. Opened up a new issue for the IP Overview details not updating when flowTarget is changed: #44300

@stephmilovic
Copy link
Contributor Author

stephmilovic commented Aug 28, 2019

retest

@stephmilovic
Copy link
Contributor Author

jenkins retest

@spalger
Copy link
Contributor

spalger commented Aug 28, 2019

retest

@elasticmachine
Copy link
Contributor

💔 Build Failed

@stephmilovic
Copy link
Contributor Author

retest

1 similar comment
@stephmilovic
Copy link
Contributor Author

retest

@stephmilovic
Copy link
Contributor Author

Retest

@elasticmachine
Copy link
Contributor

💔 Build Failed

@stephmilovic
Copy link
Contributor Author

retest

@elasticmachine
Copy link
Contributor

💔 Build Failed

@elastic elastic deleted a comment from elasticmachine Aug 29, 2019
@elasticmachine
Copy link
Contributor

💚 Build Succeeded

@stephmilovic stephmilovic merged commit b727f6d into elastic:master Aug 29, 2019
@stephmilovic stephmilovic deleted the as-ecs branch August 29, 2019 22:11
stephmilovic added a commit to stephmilovic/kibana that referenced this pull request Aug 29, 2019
stephmilovic added a commit to stephmilovic/kibana that referenced this pull request Aug 29, 2019
@FrankHassanabad FrankHassanabad added v8.0.0 v7.5.0 v7.4.0 release_note:enhancement and removed release_note:skip Skip the PR/issue when compiling release notes labels Sep 16, 2019
@FrankHassanabad FrankHassanabad changed the title [SIEM] autonomous_system to use new as ECS field [SIEM] Uses autonomous_system as new ECS field Sep 16, 2019
@elasticmachine
Copy link
Contributor

💔 Build Failed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants