[Security Solution] Add more actions to alerts flyout #105767

angorayc · 2021-07-15T14:16:56Z

Summary

This PR is to implement take action button for alert flyout.

Add Investigate in timeline option in Take action button on alert flyout. - [Security Solution][Enhancement] Investigate timeline button should be available under Quick alert details fly out. #104581
Add actions for alert status
Add exception modal
Replace EuiCodeEditor with EuiCodeBlock, as EuiCodeEditor will be deprecated.

The action button should be available from case view and alerts table:

parkiino

i wonder if it makes more sense to move the TakeActionDropdown component outside of the host_isolation folder into a more top level folder since now there are new actions that aren't necessarily related to host isolation? Also is it possible to make each menu item look the same?

…ew-inspect

elasticmachine · 2021-08-02T15:48:31Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

…ew-inspect

...curity_solution/public/detections/components/alerts_table/timeline_actions/add_exception.tsx

semd

LGTM!

parkiino · 2021-08-03T20:31:54Z

.../security_solution/public/detections/components/host_isolation/use_host_isolation_action.tsx

+            {
+              name: isolateHostTitle,
+              onClick: isolateHostHandler,
+              disabled: loadingHostIsolationStatus || agentStatus === HostStatus.UNENROLLED,


I found a fix for why the Isolate host options always remain disabled after some digging. It looks like the loadingHostIsolationStatus is always true b/c of some code I wrote before that no longer works. If you could modify the use_isolation_status.tsx file with the below diff, the isolate host option should work again. Let me know if you want me to send you a patch file, otherwise i just copy and pasted the diff below!

index 6a40898d0a1..0631964660b 100644 --- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_host_isolation_status.tsx +++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_host_isolation_status.tsx @@ -37,6 +37,7 @@ export const useHostIsolationStatus = ({ const abortCtrl = new AbortController(); // isMounted tracks if a component is mounted before changing state let isMounted = true; + setLoading(true); let fleetAgentId: string; const fetchData = async () => { try { @@ -73,15 +74,10 @@ export const useHostIsolationStatus = ({ } }; - setLoading((prevState) => { - if (prevState) { - return prevState; - } - if (!isEmpty(agentId)) { - fetchData(); - } - return true; - }); + if (!isEmpty(agentId)) { + fetchData(); + } + return () => { // updates to show component is unmounted isMounted = false;

parkiino · 2021-08-03T20:33:41Z

x-pack/plugins/security_solution/public/detections/components/take_action_dropdown/index.tsx

+    const alertIds = useMemo(() => [actionsData.eventId], [actionsData.eventId]);
+    const isEvent = actionsData.eventKind === 'event';
+
+    const isEndpointAlert = useMemo((): boolean => {


there's actually a helper function written in public/common/utils/endpoint_alert_check.ts that you could use

cnasikas · 2021-08-04T12:01:03Z

x-pack/plugins/security_solution/public/detections/components/take_action_dropdown/index.tsx

+import { useExceptionActions } from '../alerts_table/timeline_actions/use_add_exception_actions';
+import { useAlertsActions } from '../alerts_table/timeline_actions/use_alerts_actions';
+import { useInvestigateInTimeline } from '../alerts_table/timeline_actions/use_investigate_in_timeline';
+/* Todo: Uncomment case action after getAddToCaseAction is split into action and modal


This is for another PR?

That was planed to be part of this PR, but there is still another dependency.

kibanamachine · 2021-08-04T14:40:09Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	2337	2348	+11

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	6.4MB	6.4MB	+18.9KB

History

💚 Build #142713 succeeded 9bd89e9
💚 Build #142584 succeeded e5d06d2
💔 Build #142418 failed 6793bde
💔 Build #142371 failed 9b6476e
💔 Build #142294 failed 0848f31

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cnasikas

Code LTGM! I tested cases actions. Everything is working as expected.

* add investigate in timeline action to flyout * close context menu on item clicked * add investigate in timeline * add investigat in timeline button * fix failing tests * add alerts status actions * update unit test * export alerts actions from hook * add disable props * add case action items * clean up * split alert status hook and hide add to case action * add useHoseIsolationAction hook * move out take action dropdown * refeactor hooks to only manage one thing * apply hooks to alerts table * clean up * fix unit tests * replace euiCodeBlock * take actions from case * fetch ecs in flyout footer * move fetch alert ecs to container * add AddExceptionModalWrapperData interface * fix cypress tests * update snapshot for json view * fix cypress test * update AddEndpointExceptionComponent * fix data retrieved from event details * fix host isolation action * use endpointAlertCheck Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com>

) * add investigate in timeline action to flyout * close context menu on item clicked * add investigate in timeline * add investigat in timeline button * fix failing tests * add alerts status actions * update unit test * export alerts actions from hook * add disable props * add case action items * clean up * split alert status hook and hide add to case action * add useHoseIsolationAction hook * move out take action dropdown * refeactor hooks to only manage one thing * apply hooks to alerts table * clean up * fix unit tests * replace euiCodeBlock * take actions from case * fetch ecs in flyout footer * move fetch alert ecs to container * add AddExceptionModalWrapperData interface * fix cypress tests * update snapshot for json view * fix cypress test * update AddEndpointExceptionComponent * fix data retrieved from event details * fix host isolation action * use endpointAlertCheck Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com> Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com>

* add investigate in timeline action to flyout * close context menu on item clicked * add investigate in timeline * add investigat in timeline button * fix failing tests * add alerts status actions * update unit test * export alerts actions from hook * add disable props * add case action items * clean up * split alert status hook and hide add to case action * add useHoseIsolationAction hook * move out take action dropdown * refeactor hooks to only manage one thing * apply hooks to alerts table * clean up * fix unit tests * replace euiCodeBlock * take actions from case * fetch ecs in flyout footer * move fetch alert ecs to container * add AddExceptionModalWrapperData interface * fix cypress tests * update snapshot for json view * fix cypress test * update AddEndpointExceptionComponent * fix data retrieved from event details * fix host isolation action * use endpointAlertCheck Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com>

angorayc changed the title ~~[Security Solution] inspect alert in timeline from flyout~~ [Security Solution] Add more actions to alerts flyout Jul 20, 2021

parkiino reviewed Jul 20, 2021

View reviewed changes

angorayc force-pushed the flyout-overview-inspect branch from c580050 to 51bef34 Compare July 26, 2021 16:52

angorayc and others added 18 commits July 29, 2021 20:57

add investigate in timeline action to flyout

5493e61

close context menu on item clicked

40c9cc3

add investigate in timeline

7efb220

add investigat in timeline button

ab00883

fix failing tests

698d8bc

add alerts status actions

7a89b68

update unit test

c4a6f29

export alerts actions from hook

4be133e

add disable props

68c485f

add case action items

bec2c89

clean up

653c79c

split alert status hook and hide add to case action

4be7137

add useHoseIsolationAction hook

7161b66

move out take action dropdown

b34c3af

refeactor hooks to only manage one thing

484440a

apply hooks to alerts table

a26904b

Merge branch 'master' of github.com:elastic/kibana into flyout-overvi…

c684b43

…ew-inspect

Merge branch 'master' of github.com:elastic/kibana into flyout-overvi…

0aaece0

…ew-inspect

angorayc force-pushed the flyout-overview-inspect branch from 2a6c5a9 to 0aaece0 Compare July 30, 2021 11:08

angorayc added 7 commits July 30, 2021 12:41

clean up

b4a7473

fix unit tests

21a7690

replace euiCodeBlock

870fa0b

take actions from case

cee5390

fetch ecs in flyout footer

0a803f6

move fetch alert ecs to container

044900a

add AddExceptionModalWrapperData interface

0848f31

angorayc added the release_note:enhancement label Aug 2, 2021

angorayc added Team:Threat Hunting Security Solution Threat Hunting Team v7.15.0 v8.0.0 labels Aug 2, 2021

angorayc marked this pull request as ready for review August 2, 2021 15:48

angorayc requested a review from a team as a code owner August 2, 2021 15:48

angorayc added 2 commits August 2, 2021 17:00

fix cypress tests

e267e3d

Merge branch 'master' of github.com:elastic/kibana into flyout-overvi…

9b6476e

…ew-inspect

semd reviewed Aug 2, 2021

View reviewed changes

...curity_solution/public/detections/components/alerts_table/timeline_actions/add_exception.tsx Outdated Show resolved Hide resolved

angorayc added 3 commits August 2, 2021 19:24

update snapshot for json view

6793bde

fix cypress test

6270a49

update AddEndpointExceptionComponent

e5d06d2

semd approved these changes Aug 3, 2021

View reviewed changes

fix data retrieved from event details

9bd89e9

parkiino reviewed Aug 3, 2021

View reviewed changes

cnasikas reviewed Aug 4, 2021

View reviewed changes

angorayc added 2 commits August 4, 2021 13:12

fix host isolation action

001bb03

use endpointAlertCheck

102fc60

cnasikas approved these changes Aug 4, 2021

View reviewed changes

parkiino approved these changes Aug 4, 2021

View reviewed changes

angorayc merged commit 60f8da4 into elastic:master Aug 4, 2021

angorayc mentioned this pull request Aug 5, 2021

[7.x] [Security Solution] Add more actions to alerts flyout (#105767) #107722

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Add more actions to alerts flyout #105767

[Security Solution] Add more actions to alerts flyout #105767

angorayc commented Jul 15, 2021 •

edited

Loading

parkiino left a comment

elasticmachine commented Aug 2, 2021

semd left a comment

parkiino Aug 3, 2021

parkiino Aug 3, 2021

cnasikas Aug 4, 2021

angorayc Aug 4, 2021

kibanamachine commented Aug 4, 2021

cnasikas left a comment

[Security Solution] Add more actions to alerts flyout #105767

[Security Solution] Add more actions to alerts flyout #105767

Conversation

angorayc commented Jul 15, 2021 • edited Loading

Summary

parkiino left a comment

Choose a reason for hiding this comment

elasticmachine commented Aug 2, 2021

semd left a comment

Choose a reason for hiding this comment

parkiino Aug 3, 2021

Choose a reason for hiding this comment

parkiino Aug 3, 2021

Choose a reason for hiding this comment

cnasikas Aug 4, 2021

Choose a reason for hiding this comment

angorayc Aug 4, 2021

Choose a reason for hiding this comment

kibanamachine commented Aug 4, 2021

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

History

cnasikas left a comment

Choose a reason for hiding this comment

angorayc commented Jul 15, 2021 •

edited

Loading