[SECURITY SOLUTIONS] Bugs overview page + investigate eql in timeline #81550

XavierM · 2020-10-23T00:55:00Z

Summary

Host/Network events query on Overview page were not taking into consideration of the sourcerer (meaning the change of indices)
Signals from the correlation rules (EQL) does not have all the time a signal.group.id when there is no sequences so we need a way to fallback of the basic query of the _id: idididididididid
Timeline custom indexes change depending on the page the timeline is opened [Security Solution] Timeline custom indexes change depending on the page the timeline is opened #81640

Checklist

Unit or functional tests were updated or added to match the most common scenarios

XavierM · 2020-10-26T13:37:10Z

@elasticmachine merge upstream

spong · 2020-10-26T20:32:21Z

x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx

+  ecsData.signal?.rule?.type?.length &&
+  ecsData.signal?.rule?.type[0] === 'eql' &&


nit: Could consolidate to the following using array item access with optional chaining if you'd like:

Suggested change

ecsData.signal?.rule?.type?.length &&

ecsData.signal?.rule?.type[0] === 'eql' &&

ecsData.signal?.rule?.type?.[0] === 'eql' &&

spong · 2020-10-26T20:33:05Z

x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx

      ]);
      const resultingTimeline: TimelineResult = getOr({}, 'data.getOneTimeline', responseTimeline);
-      const eventData: TimelineEventsDetailsItem[] = getOr([], 'data', eventDataResp);
+      const eventData: TimelineEventsDetailsItem[] = eventDataResp.data ?? [];


Thank you for cleaning up more getOr's! 🙇‍♂️

spong

Checked out, tested locally, and verified EQL Rules with sequences use signal.group.id and EQL Rules without sequences use _id when Investigating in Timeline. LGTM! Thanks @XavierM! 👍

rylnd

Tested "investigate in timeline" with both sequence alerts and non-sequence alerts. LGTM!

rylnd · 2020-10-26T20:43:02Z

x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx

-  ecsData.signal?.rule?.type?.length && ecsData.signal?.rule?.type[0] === 'eql';
+export const isEqlRuleWithGroupId = (ecsData: Ecs) =>
+  ecsData.signal?.rule?.type?.length &&
+  ecsData.signal?.rule?.type[0] === 'eql' &&


We've also got those rule type helpers that could be leveraged here!

…at initialization

andrew-goldstein

Thanks for these fixes @XavierM!
Desk tested locally for (only) the following issue:

Timeline custom indexes change depending on the page the timeline is opened [Security Solution] Timeline custom indexes change depending on the page the timeline is opened #81640
LGTM 🚀

kibanamachine · 2020-10-26T23:41:06Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 01f2bea

Metrics [docs]

async chunks size

id	before	after	diff
`securitySolution`	8.1MB	8.1MB	+2.2KB

page load bundle size

id	before	after	diff
`securitySolution`	263.1KB	263.1KB	-1.0B

History

💔 Build #83792 failed be54bde
💚 Build #83767 succeeded f8e2742
💚 Build #83647 succeeded f7c73fc
💚 Build #83500 succeeded 43c29de

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

…elastic#81550) * fix overview query to be connected to sourcerer * investigate eql in timeline * keep timeline indices * trusting what is coming from timeline saved object for index pattern at initialization * fix type + initialize old timeline to sourcerer Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

* master: (37 commits) [ILM] Migrate Warm phase to Form Lib (elastic#81323) [Security Solutions][Detection Engine] Fixes critical bug with error reporting that was doing a throw (elastic#81549) [Detection Rules] Add 7.10 rules (elastic#81676) [kbn/optimizer] ignore missing metrics when updating limits with --focus (elastic#81696) [SECURITY SOLUTIONS] Bugs overview page + investigate eql in timeline (elastic#81550) [Maps] fix unable to edit cluster vector styles styled by count when switching to super fine grid resolution (elastic#81525) Fixed migration issue for case specific actions, by extending email action migrator checks (elastic#81673) [CI] Preparation for APM tracking on CI (elastic#80399) [Home] Fixes Kibana app description order on home page and updates Canvas copy (elastic#80057) Make sure `to` is 'now' and not the same as `from` (elastic#81524) Nitpicking the 8.0 Breaking Change issue template (elastic#81678) [SECURITY_SOLUTION] Fix text on onboarding screen (elastic#81672) [data.search] Skip async search tests in build candidates and production builds (elastic#81547) Fix previousStartedAt by not changing when execution fails (elastic#81388) [Monitoring] Fix a couple of issues with the cpu usage alert (elastic#80737) Telemetry collection xpack to ts project references (elastic#81269) Elasticsearch: don't use url authentication for new client (elastic#81564) [App Search] Credentials: implement working flyout form (elastic#81541) Properly encode links to edit user page (elastic#81562) [Alerting UI] Don't wait for health check before showing Create Alert flyout (elastic#80996) ...

…#81550) (#81708) * fix overview query to be connected to sourcerer * investigate eql in timeline * keep timeline indices * trusting what is coming from timeline saved object for index pattern at initialization * fix type + initialize old timeline to sourcerer Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

…#81550) (#81712) * fix overview query to be connected to sourcerer * investigate eql in timeline * keep timeline indices * trusting what is coming from timeline saved object for index pattern at initialization * fix type + initialize old timeline to sourcerer Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

XavierM added 3 commits October 22, 2020 10:43

fix overview query to be connected to sourcerer

fd42d0e

investigate eql in timeline

130c6a4

Merge branch 'master' of github.com:elastic/kibana into bugs_7_10

43c29de

XavierM requested review from a team as code owners October 23, 2020 00:55

XavierM self-assigned this Oct 23, 2020

kibanamachine and others added 2 commits October 26, 2020 09:37

Merge branch 'master' into bugs_7_10

f7c73fc

Merge branch 'master' of github.com:elastic/kibana into bugs_7_10

af7058b

patrykkopycinski approved these changes Oct 26, 2020

View reviewed changes

XavierM added 2 commits October 26, 2020 15:52

keep timeline indices

ecdf742

Merge branch 'master' of github.com:elastic/kibana into bugs_7_10

f8e2742

spong reviewed Oct 26, 2020

View reviewed changes

spong approved these changes Oct 26, 2020

View reviewed changes

rylnd approved these changes Oct 26, 2020

View reviewed changes

XavierM added 2 commits October 26, 2020 17:08

trusting what is coming from timeline saved object for index pattern …

55752b1

…at initialization

Merge branch 'master' of github.com:elastic/kibana into bugs_7_10

be54bde

andrew-goldstein approved these changes Oct 26, 2020

View reviewed changes

fix type + initialize old timeline to sourcerer

01f2bea

XavierM merged commit b304051 into elastic:master Oct 27, 2020

XavierM mentioned this pull request Oct 27, 2020

[7.x] [SECURITY SOLUTIONS] Bugs overview page + investigate eql in timeline (#81550) #81708

Merged

XavierM mentioned this pull request Oct 27, 2020

[7.10] [SECURITY SOLUTIONS] Bugs overview page + investigate eql in timeline (#81550) #81712

Merged

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Oct 27, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SECURITY SOLUTIONS] Bugs overview page + investigate eql in timeline #81550

[SECURITY SOLUTIONS] Bugs overview page + investigate eql in timeline #81550

XavierM commented Oct 23, 2020 •

edited

Loading

XavierM commented Oct 26, 2020

spong Oct 26, 2020

spong Oct 26, 2020

spong left a comment

rylnd left a comment

rylnd Oct 26, 2020

andrew-goldstein left a comment

kibanamachine commented Oct 26, 2020

		ecsData.signal?.rule?.type?.length &&
		ecsData.signal?.rule?.type[0] === 'eql' &&

	ecsData.signal?.rule?.type?.length &&
	ecsData.signal?.rule?.type[0] === 'eql' &&
	ecsData.signal?.rule?.type?.[0] === 'eql' &&

[SECURITY SOLUTIONS] Bugs overview page + investigate eql in timeline #81550

[SECURITY SOLUTIONS] Bugs overview page + investigate eql in timeline #81550

Conversation

XavierM commented Oct 23, 2020 • edited Loading

Summary

Checklist

XavierM commented Oct 26, 2020

spong Oct 26, 2020

Choose a reason for hiding this comment

spong Oct 26, 2020

Choose a reason for hiding this comment

spong left a comment

Choose a reason for hiding this comment

rylnd left a comment

Choose a reason for hiding this comment

rylnd Oct 26, 2020

Choose a reason for hiding this comment

andrew-goldstein left a comment

Choose a reason for hiding this comment

kibanamachine commented Oct 26, 2020

💚 Build Succeeded

Metrics [docs]

async chunks size

page load bundle size

History

XavierM commented Oct 23, 2020 •

edited

Loading