-
Notifications
You must be signed in to change notification settings - Fork 8.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[SIEM] Add scripts for on boarding prepackage timeline #67496
[SIEM] Add scripts for on boarding prepackage timeline #67496
Conversation
Pinging @elastic/siem (Team:SIEM) |
@elasticmachine merge upstream |
@elasticmachine merge upstream |
@elasticmachine merge upstream |
merge conflict between base and head |
@elasticmachine merge upstream |
Have some more things to add, close it for now. |
x-pack/plugins/security_solution/server/lib/timeline/routes/export_timelines_route.ts
Outdated
Show resolved
Hide resolved
This comment has been minimized.
This comment has been minimized.
.../plugins/security_solution/server/lib/detection_engine/rules/prepackaged_timelines/README.md
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I first tested to make sure that we did not break custom rules installation/updates/deletions, and everything is working as I expected/remembered ;)
Then I tested our flow for template timelines and everything is also working as expected.
My only suggestion will be to update our custom template timeline, to not be the way they are, or it will be really difficult to test them out in our BC. Even if we fake them just to use a template field.
I will approve after we discuss that.
…ules/prepackaged_timelines/README.md Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com>
…na into prepackage-timeline-script
@elasticmachine merge upstream |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good to go, Let's make sure to get a meeting with the detection team to get good timeline templates for our 7.9 release
💛 Build succeeded, but was flaky
Test FailuresKibana Pipeline / kibana-xpack-agent / Chrome X-Pack UI Functional Tests.x-pack/test/functional/apps/lens/smokescreen·ts.lens app lens smokescreen tests should allow creation of lens visualizationsStandard Out
Stack Trace
Build metrics@kbn/optimizer bundle module count
History
To update your PR or re-run it, just comment with: |
* add prepackaged timelines * generate ndjson * expose end api points * fix types * fix types * fix unit test * install prepackage timelines * plumbing for prepackaged timelines * read ndjson by line * fix unit test * update templates * fix types * fix types * fix integration test * update script * name it back * add timeline status into rule status api * fix update messages * fix unit tests * fix integration test * rename types * update prepackaged timelines * update prepackaged timelines script * update scripts * fix update for elastic template * move timeline utils * export timelines scripts * update module path * fix intefration test * add delete all timelines script * readme * add get_timeline_by_templatetimeline_id * add getTimelineByIdRoute * rename file * add unit test * fix types * fix types * update readme * fix error id * fix unit test * update path * update i18n * update readme * load prepacked timelines by default * add unit tests * Update x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_timelines/README.md Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com> * review * update prepacked timelines Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com> # Conflicts: # x-pack/plugins/translations/translations/ja-JP.json # x-pack/plugins/translations/translations/zh-CN.json
…#71698) * [SIEM] Add scripts for on boarding prepackage timeline (#67496) * add prepackaged timelines * generate ndjson * expose end api points * fix types * fix types * fix unit test * install prepackage timelines * plumbing for prepackaged timelines * read ndjson by line * fix unit test * update templates * fix types * fix types * fix integration test * update script * name it back * add timeline status into rule status api * fix update messages * fix unit tests * fix integration test * rename types * update prepackaged timelines * update prepackaged timelines script * update scripts * fix update for elastic template * move timeline utils * export timelines scripts * update module path * fix intefration test * add delete all timelines script * readme * add get_timeline_by_templatetimeline_id * add getTimelineByIdRoute * rename file * add unit test * fix types * fix types * update readme * fix error id * fix unit test * update path * update i18n * update readme * load prepacked timelines by default * add unit tests * Update x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_timelines/README.md Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com> * review * update prepacked timelines Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com> # Conflicts: # x-pack/plugins/translations/translations/ja-JP.json # x-pack/plugins/translations/translations/zh-CN.json * rollback change
Pinging @elastic/security-solution (Team: SecuritySolution) |
Summary
This PR is to create scripts for on boarding prepackaged timelines.
#66291
How to on board a new prepackage timelines:
Have the env params set up
Create a new timelines template into
x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_timelines
2.a : Create a new template from UI and export it.
Create new timeline template
x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_timelines
. (For potential update requirement in the future, we put one timeline in each file to keep nice and clear).json
Fields to hightlight for on boarding a new prepackaged timeline
in this readme and update your template2.b : Create a new template from scratch
Please note that below template is just an example, please replace all your fields with whatever makes sense. Do check
Fields to hightlight for on boarding a new prepackaged timeline
to make sure the template can be created as expected.Note that the json has to be minified.
Fields to hightlight for on boarding a new prepackaged timeline:
savedObjectId: null
version: null
templateTimelineId: Specify an unique uuid e.g.:
2c7e0663-5a91-0004-aa15-26bf756d2c40
templateTimelineVersion: just start from
1
timelineType:
template
status:
immutable
cd x-pack/plugins/security_solution/server/lib/detection_engine/scripts
sh ./timelines/run regen_prepackage_timelines_index.sh
(this will update
x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_timelines/index.ndjson
)http://localhost:5601/app/security#/detections/rules
and click onInstall Elastic prebuild rules
or run
How to update an existing prepackage timeline:
cd x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_timelines
Open the json file you wish to update, and remember to bump the
templateTimelineVersion
Go to
cd x-pack/plugins/security_solution/server/lib/detection_engine/scripts
, runsh ./timelines/regen_prepackage_timelines_index.sh
Go to
http://localhost:5601/app/security#/detections/rules
and click onInstall Elastic prebuild rules
or run
How to install prepackaged timelines:
cd x-pack/plugins/siem/server/lib/detection_engine/scripts
sh ./timelines/add_prepackaged_timelines.sh
sh ./timelines/find_timeline_by_filter.sh immutable template elastic
Get timeline by id:
Get timeline by templateTimelineId:
Get all custom timelines:
Delete all timelines:
Delete timeline by timeline id:
Checklist
Delete any items that are not applicable to this PR.
Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n supportThis was checked for keyboard-only and screenreader accessibilityThis renders correctly on smaller devices using a responsive layout. (You can test this in your browserThis was checked for cross-browser compatibility, including a check against IE11For maintainers