[SECURITY SOLUTION] Investigate EQL signal in timeline #79049

XavierM · 2020-10-01T02:31:44Z

Summary

Selection of timeline in the rule creation is done through templateTimelineId and not timelineId anymore
This will allow pre-packaged rule to associate their rule with a template timeline
Allow investigating EQL signal in the timeline
Fix bug when re-arranging columns in alert table

Checklist

Unit or functional tests were updated or added to match the most common scenarios

…imeline

…te to timeline through signal.group.id

elasticmachine · 2020-10-01T02:31:47Z

Pinging @elastic/siem (Team:SIEM)

angorayc · 2020-10-01T11:48:37Z

x-pack/plugins/security_solution/server/lib/timeline/saved_object.ts

@@ -95,9 +99,27 @@ export interface Timeline {

 export const getTimeline = async (


Seems that we have getTimeline and getTimelineByTemplateTimelineId doing the same thing, I am thinking of having a follow up PR to do a clean up for that. So we can just keep getTimeline in our code, what do you think?

…imeline

...ins/security_solution/public/detections/components/alerts_table/alerts_utility_bar/index.tsx

x-pack/plugins/security_solution/public/timelines/components/timeline/styles.tsx

x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.ts

x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx

...plugins/security_solution/public/timelines/components/timeline/search_super_select/index.tsx

XavierM · 2020-10-02T20:46:19Z

This PR is taking care of https://github.com/elastic/security-team/issues/388

…imeline

XavierM · 2020-10-05T13:03:49Z

@elasticmachine merge upstream

XavierM · 2020-10-05T18:16:50Z

@andrew-goldstein found a problem with the pagination of the timeline, therefore we did pair to fix it in this PR.

…imeline

andrew-goldstein

The screenshot from the Detections view below shows an extra set of ellipsis:

In the screenshot above:

The selected page size is 10
There are a total of 15 results, which means the results should be shown across 2 pages
The first of two pages is selected

Under these conditions, I don't think it should show the ...

EDIT: looks good now 👍

x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.tsx

andrew-goldstein

Thanks for building this bridge from EQL detections to timeline @XavierM! 🌉 🙏
Desk tested locally with EQL and non-EQL detections, and with various combinations of states and page sizes
LGTM 🚀

kibanamachine · 2020-10-06T01:40:37Z

💛 Build succeeded, but was flaky

continuous-integration/kibana-ci/pull-request
Commit: 05e26e0
Flaky suites:
- xpack-securitySolutionCypress

Test Failures

Creates and activates a new EQL rule with a sequence.Detection rules, EQL Creates and activates a new EQL rule with a sequence

Link to Jenkins

Stack Trace

Failed Tests Reporter:
  - Test has failed 3 times on tracked branches: https://github.com/elastic/kibana/issues/79522

TypeError: Cannot read property 'apply' of undefined
    at listener (http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:173184:19)
    at arrayMap (http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:25373:23)
    at Function.map (http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:34314:14)
    at $Cypress.events.emitMap (http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:173188:16)
    at $Cypress.parent.<computed> [as emitMap] (http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:173131:33)
    at $Cypress.action (http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:166487:31)
    at fail (http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:169982:22)
    at http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:169811:14
    at tryCatcher (http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:10325:23)
    at Promise._settlePromiseFromHandler (http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:8260:31)
    at Promise._settlePromise (http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:8317:18)
    at Promise._settlePromise0 (http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:8362:10)
    at Promise._settlePromises (http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:8438:18)
    at _drainQueueStep (http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:5032:12)
    at _drainQueue (http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:5025:9)
    at Async.../../node_modules/bluebird/js/release/async.js.Async._drainQueues (http://elastic:changeme@localhost:6121/__cypress/runner/cypress_runner.js:5041:5)

Metrics [docs]

async chunks size

id	before	after	diff
`securitySolution`	10.3MB	10.3MB	+16.3KB

page load bundle size

id	before	after	diff
`securitySolution`	587.2KB	587.2KB	+59.0B

History

💚 Build #79934 succeeded b4acc20
💚 Build #79924 succeeded 62a133f
💛 Build #79896 was flaky 7243860
💚 Build #79887 succeeded 4f02d83
💔 Build #79873 failed 63d863c

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* fix template timeline for rule * fix moving column with linkfield by giving back the browserfield * leftover from investigate timeline with template from rule * add visualization for eql sequences in timeline + allow eql investigate to timeline through signal.group.id * bug fix of column in eventviewer * review I * review II * fix bug - Columns dynamically added to timeline indicate no data * fix pagination to work as attempted by elastic search * no tweak on pagination timeline * fix snapshot * reset activePage to 0 when changing indexNames * remove last page when we are not sure if it is really the last page * update activePage when resetting it by searchParameter * review bug on the last commit Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

* fix template timeline for rule * fix moving column with linkfield by giving back the browserfield * leftover from investigate timeline with template from rule * add visualization for eql sequences in timeline + allow eql investigate to timeline through signal.group.id * bug fix of column in eventviewer * review I * review II * fix bug - Columns dynamically added to timeline indicate no data * fix pagination to work as attempted by elastic search * no tweak on pagination timeline * fix snapshot * reset activePage to 0 when changing indexNames * remove last page when we are not sure if it is really the last page * update activePage when resetting it by searchParameter * review bug on the last commit Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

* master: (85 commits) Refactor attribute service (elastic#78414) [APM] Add default message to alerts. (elastic#78930) [Discover] Modify columns and sort when switching index pattern (elastic#74336) Document ts project references setup (elastic#78586) build all ts refs in single kbn:bootstrap (elastic#79438) [TSVB] Allow string fields on value count aggregation (elastic#79267) [SECURITY SOLUTION] Investigate EQL signal in timeline (elastic#79049) [Fleet] Add loading spinner to page headers (elastic#79568) [Security Solution][Resolver] Resolver query panel load more (elastic#79160) Add type row to monitor detail page. (elastic#79556) Remove license refresh from setup (elastic#79518) [docker] add reporting fonts (elastic#74806) [SECURITY_SOLUTION][ENDPOINT] Add info about trusted apps to the page subtitle + create flyout (elastic#79558) Trim Hash value before validating it (elastic#79545) Warn users when security is not configured (elastic#78545) update copy styling (elastic#79313) Update dependency @elastic/charts to v23.1.1 (elastic#78459) Introduce geo-threshold alerts (elastic#76285) elastic#76920 Show base breadcrumb when there is an error booting the app (elastic#79571) remove react-intl from kibana and keep it inside only i18n package (elastic#78956) ...

elasticmachine · 2021-09-23T14:24:21Z

Pinging @elastic/security-solution (Team: SecuritySolution)

XavierM added 6 commits September 29, 2020 15:12

fix template timeline for rule

bc4763e

Merge branch 'master' of github.com:elastic/kibana into investigate-t…

92dc07b

…imeline

Merge branch 'master' of github.com:elastic/kibana into investigate-t…

8e9151a

…imeline

fix moving column with linkfield by giving back the browserfield

95453eb

leftover from investigate timeline with template from rule

d39ee8b

add visualization for eql sequences in timeline + allow eql investiga…

70873f9

…te to timeline through signal.group.id

XavierM added release_note:enhancement Team:SIEM v8.0.0 v7.10.0 labels Oct 1, 2020

XavierM requested review from spong and andrew-goldstein October 1, 2020 02:31

XavierM requested review from a team as code owners October 1, 2020 02:31

XavierM self-assigned this Oct 1, 2020

angorayc reviewed Oct 1, 2020

View reviewed changes

This comment has been minimized.

Sign in to view

XavierM added 2 commits October 1, 2020 15:26

bug fix of column in eventviewer

a783093

Merge branch 'master' of github.com:elastic/kibana into investigate-t…

3f8a48b

…imeline

This comment has been minimized.

Sign in to view

spong reviewed Oct 1, 2020

View reviewed changes

...ins/security_solution/public/detections/components/alerts_table/alerts_utility_bar/index.tsx Outdated Show resolved Hide resolved

spong reviewed Oct 1, 2020

View reviewed changes

x-pack/plugins/security_solution/public/timelines/components/timeline/styles.tsx Outdated Show resolved Hide resolved

This comment has been minimized.

Sign in to view

andrew-goldstein reviewed Oct 2, 2020

View reviewed changes

x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.ts Outdated Show resolved Hide resolved

andrew-goldstein reviewed Oct 2, 2020

View reviewed changes

x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx Outdated Show resolved Hide resolved

andrew-goldstein reviewed Oct 2, 2020

View reviewed changes

...plugins/security_solution/public/timelines/components/timeline/search_super_select/index.tsx Outdated Show resolved Hide resolved

review I

c007f32

XavierM added 3 commits October 2, 2020 22:15

review II

de3448d

fix bug - Columns dynamically added to timeline indicate no data

96859b3

Merge branch 'master' of github.com:elastic/kibana into investigate-t…

673ee0b

…imeline

XavierM requested a review from andrew-goldstein October 3, 2020 02:20

kibanamachine and others added 2 commits October 5, 2020 09:03

Merge branch 'master' into investigate-timeline

7b3b6cc

fix pagination to work as attempted by elastic search

4bbf9f2

Merge branch 'master' of github.com:elastic/kibana into investigate-t…

fe82acc

…imeline

XavierM force-pushed the investigate-timeline branch from 172a093 to fe82acc Compare October 5, 2020 18:25

andrew-goldstein reviewed Oct 5, 2020

View reviewed changes

XavierM added 5 commits October 5, 2020 16:10

no tweak on pagination timeline

63d863c

fix snapshot

4f02d83

reset activePage to 0 when changing indexNames

7243860

remove last page when we are not sure if it is really the last page

62a133f

update activePage when resetting it by searchParameter

b4acc20

andrew-goldstein reviewed Oct 5, 2020

View reviewed changes

x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.tsx Outdated Show resolved Hide resolved

review bug on the last commit

05e26e0

andrew-goldstein approved these changes Oct 6, 2020

View reviewed changes

XavierM merged commit cf45fef into elastic:master Oct 6, 2020

XavierM mentioned this pull request Oct 6, 2020

[7.x] [SECURITY SOLUTION] Investigate EQL signal in timeline (#79049) #79606

Merged

angorayc mentioned this pull request Oct 21, 2020

Unable to associate prepackaged rules to prepacked timelines #74161

Closed

spong mentioned this pull request Jul 22, 2021

Hiding building block rules in "Security/Overview" #99841

Closed

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SECURITY SOLUTION] Investigate EQL signal in timeline #79049

[SECURITY SOLUTION] Investigate EQL signal in timeline #79049

XavierM commented Oct 1, 2020 •

edited

Loading

elasticmachine commented Oct 1, 2020

angorayc Oct 1, 2020

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

XavierM commented Oct 2, 2020

XavierM commented Oct 5, 2020

XavierM commented Oct 5, 2020

andrew-goldstein left a comment •

edited

Loading

andrew-goldstein left a comment

kibanamachine commented Oct 6, 2020

Stack Trace

elasticmachine commented Sep 23, 2021

		@@ -95,9 +99,27 @@ export interface Timeline {

		export const getTimeline = async (

[SECURITY SOLUTION] Investigate EQL signal in timeline #79049

[SECURITY SOLUTION] Investigate EQL signal in timeline #79049

Conversation

XavierM commented Oct 1, 2020 • edited Loading

Summary

Checklist

elasticmachine commented Oct 1, 2020

angorayc Oct 1, 2020

Choose a reason for hiding this comment

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

XavierM commented Oct 2, 2020

XavierM commented Oct 5, 2020

XavierM commented Oct 5, 2020

andrew-goldstein left a comment • edited Loading

Choose a reason for hiding this comment

andrew-goldstein left a comment

Choose a reason for hiding this comment

kibanamachine commented Oct 6, 2020

💛 Build succeeded, but was flaky

Test Failures

Stack Trace

Metrics [docs]

async chunks size

page load bundle size

History

elasticmachine commented Sep 23, 2021

XavierM commented Oct 1, 2020 •

edited

Loading

andrew-goldstein left a comment •

edited

Loading