[Security Solution][Detections] Adds more granular validation for nested fields #92041

dplumlee · 2021-02-19T16:45:04Z

Summary

Adds more low level validation for nested fields such that one invalid field in the nested entries array won't make the entire nested entry invalid. This was causing a problem where our Ext prepopulated fields in Endpoint exceptions would sometimes be empty and invalidate the entire nested entry, even if the other fields were correct.

Example

With this code_signature field coming back from the alert, the exceptions modal would prepopulate as shown in the screenshot below

exists: false
status: "noSignature"
subject_name: ""
trusted: false

This would cause the modal to be valid and be able to be added to the exceptions list successfully, but in reality a concatenated version was being added without the entire Process.Ext field, even though the trusted field was valid.

With this fix, the signer field will still be removed but the remaining valid fields will be passed to the final exceptions request.

Checklist

Delete any items that are not applicable to this PR.

Unit or functional tests were updated or added to match the most common scenarios

For maintainers

This was checked for breaking API changes and was labeled appropriately

x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.ts

x-pack/plugins/lists/common/shared_exports.ts

dplumlee · 2021-02-19T17:02:01Z

x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx

@@ -401,7 +421,7 @@ export const getCodeSignatureValue = (
    return codeSignature.map((signature) => {
      return {
        subjectName: signature.subject_name ?? '',
-        trusted: signature.trusted ?? '',
+        trusted: signature.trusted.toString() ?? '',


Fixes another bug where we were passing in a boolean type when the builder expected a string so it was marking it as invalid

elasticmachine · 2021-02-19T17:02:37Z

Pinging @elastic/security-detections-response (Team:Detections and Resp)

dhurley14 · 2021-02-19T20:49:40Z

x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx

+            if (validatedNestedEntry != null) {
+              return true;
+            }
+            return false;


nit: could just replace with return validatedNestedEntry != null

dhurley14

LGTM!

kibanamachine · 2021-02-20T00:16:12Z

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	7.7MB	7.7MB	+743.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`lists`	143.0KB	143.2KB	+217.0B

History

💚 Build #108161 succeeded 57e0237
💚 Build #108073 succeeded 62d0152

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @dplumlee

…ted fields (elastic#92041)

kibanamachine · 2021-02-20T00:18:52Z

💚 Backport successful

✅ 7.12 / #92107
✅ 7.x / #92108

Successful backport PRs will be merged automatically after passing CI.

…ted fields (#92041) (#92108) Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>

…ted fields (#92041) (#92107) Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>

…ndition-for-hiding-recommded-allocation * 'master' of github.com:elastic/kibana: (117 commits) [coverage] ingest data in parallel (elastic#92074) [Lens] Drag and drop performance improvements (elastic#91641) A few more environment uiFilters fixes (elastic#92044) Enabling Uptime and Dashboard a11y test (elastic#91017) [Security Solution][Detections] Adds more granular validation for nested fields (elastic#92041) [Security Solution] [Detections] add overflow-wrap for description (elastic#91945) [Security Solution] [Detections] do not truncate filename in value list table in modal (elastic#91952) Skip flaky apm test elastic#91673 (elastic#92065) [docker] Default server.name to hostname (elastic#90799) Use documentation link service for snapshot restore (elastic#91596) [Security Solution] Clearing up all jest errors and warnings (elastic#91740) Add `@kbn/analytics` to UI Shared Deps (elastic#91810) [7.12][Telemetry] Add missing fields for security telemetry (elastic#91920) [Security Solution] Adds cypress-pipe (elastic#91550) [ML] Fix event rate chart annotation position (elastic#91899) [APM] Break down error table api removing the sparklines (elastic#89138) docs: update dependencies table bug (elastic#91964) [Time to Visualize] Stay in Edit Mode After Dashboard Quicksave (elastic#91729) Unskip Search Sessions Management UI test (elastic#90110) [Fleet] Handle long text in agent details page (elastic#91776) ... # Conflicts: # x-pack/plugins/index_lifecycle_management/__jest__/client_integration/edit_policy/edit_policy.helpers.tsx # x-pack/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.tsx

…bana into task-manager/docs-monitoring * 'task-manager/docs-monitoring' of github.com:gmmorris/kibana: (29 commits) Update docs/developer/plugin-list.asciidoc Update docs/api/task-manager/health.asciidoc Update docs/api/task-manager/health.asciidoc [Lens] Load indexpatterns list from indexPattern Service (elastic#91984) [coverage] ingest data in parallel (elastic#92074) [Lens] Drag and drop performance improvements (elastic#91641) A few more environment uiFilters fixes (elastic#92044) Enabling Uptime and Dashboard a11y test (elastic#91017) [Security Solution][Detections] Adds more granular validation for nested fields (elastic#92041) [Security Solution] [Detections] add overflow-wrap for description (elastic#91945) [Security Solution] [Detections] do not truncate filename in value list table in modal (elastic#91952) Skip flaky apm test elastic#91673 (elastic#92065) [docker] Default server.name to hostname (elastic#90799) Use documentation link service for snapshot restore (elastic#91596) [Security Solution] Clearing up all jest errors and warnings (elastic#91740) Add `@kbn/analytics` to UI Shared Deps (elastic#91810) [7.12][Telemetry] Add missing fields for security telemetry (elastic#91920) [Security Solution] Adds cypress-pipe (elastic#91550) [ML] Fix event rate chart annotation position (elastic#91899) [APM] Break down error table api removing the sparklines (elastic#89138) ...

* master: (36 commits) [Uptime] Thumbnail full screen view steps navigation fix (elastic#91895) Implement ScopedHistory.block (elastic#91099) [Lens] Fix overlowing content on a chart for charts and table (elastic#92006) handle source column differences in embeddable as well (elastic#91987) [Vega] [Map] disable map rotation using right right click / touch rotation gesture (elastic#91996) [Lens] Load indexpatterns list from indexPattern Service (elastic#91984) [coverage] ingest data in parallel (elastic#92074) [Lens] Drag and drop performance improvements (elastic#91641) A few more environment uiFilters fixes (elastic#92044) Enabling Uptime and Dashboard a11y test (elastic#91017) [Security Solution][Detections] Adds more granular validation for nested fields (elastic#92041) [Security Solution] [Detections] add overflow-wrap for description (elastic#91945) [Security Solution] [Detections] do not truncate filename in value list table in modal (elastic#91952) Skip flaky apm test elastic#91673 (elastic#92065) [docker] Default server.name to hostname (elastic#90799) Use documentation link service for snapshot restore (elastic#91596) [Security Solution] Clearing up all jest errors and warnings (elastic#91740) Add `@kbn/analytics` to UI Shared Deps (elastic#91810) [7.12][Telemetry] Add missing fields for security telemetry (elastic#91920) [Security Solution] Adds cypress-pipe (elastic#91550) ...

adds more granual validation for nested fields

62d0152

dplumlee added bug Fixes for quality problems that affect the customer experience release_note:fix v8.0.0 v7.12.0 Team:Detections and Resp Security Detection Response Team Feature:Rule Exceptions Security Solution Rule Exceptions feature labels Feb 19, 2021

dplumlee self-assigned this Feb 19, 2021

dplumlee commented Feb 19, 2021

View reviewed changes

x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.ts Outdated Show resolved Hide resolved

dplumlee commented Feb 19, 2021

View reviewed changes

x-pack/plugins/lists/common/shared_exports.ts Outdated Show resolved Hide resolved

dplumlee commented Feb 19, 2021

View reviewed changes

dplumlee marked this pull request as ready for review February 19, 2021 17:02

dplumlee requested review from a team as code owners February 19, 2021 17:02

changes schema name

57e0237

dhurley14 reviewed Feb 19, 2021

View reviewed changes

dhurley14 approved these changes Feb 19, 2021

View reviewed changes

simpler return type

932d97e

dplumlee enabled auto-merge (squash) February 19, 2021 22:00

dplumlee added auto-backport Deprecated - use backport:version if exact versions are needed v7.13.0 labels Feb 19, 2021

dplumlee merged commit 087449c into elastic:master Feb 20, 2021

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 20, 2021

[Security Solution][Detections] Adds more granular validation for nes…

6ff8d3b

…ted fields (elastic#92041)

This was referenced Feb 20, 2021

[7.12] [Security Solution][Detections] Adds more granular validation for nested fields (#92041) #92107

Merged

[7.x] [Security Solution][Detections] Adds more granular validation for nested fields (#92041) #92108

Merged

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 20, 2021

[Security Solution][Detections] Adds more granular validation for nes…

87428eb

…ted fields (elastic#92041)

dplumlee deleted the nested-field-validation-fix branch February 20, 2021 01:05

kibanamachine added a commit that referenced this pull request Feb 20, 2021

[Security Solution][Detections] Adds more granular validation for nes…

9e13ac7

…ted fields (#92041) (#92108) Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>

kibanamachine added a commit that referenced this pull request Feb 20, 2021

[Security Solution][Detections] Adds more granular validation for nes…

83a59bc

…ted fields (#92041) (#92107) Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Detections] Adds more granular validation for nested fields #92041

[Security Solution][Detections] Adds more granular validation for nested fields #92041

dplumlee commented Feb 19, 2021 •

edited

Loading

dplumlee Feb 19, 2021

elasticmachine commented Feb 19, 2021

dhurley14 Feb 19, 2021

dhurley14 left a comment

kibanamachine commented Feb 20, 2021

kibanamachine commented Feb 20, 2021

[Security Solution][Detections] Adds more granular validation for nested fields #92041

[Security Solution][Detections] Adds more granular validation for nested fields #92041

Conversation

dplumlee commented Feb 19, 2021 • edited Loading

Summary

Example

Checklist

For maintainers

dplumlee Feb 19, 2021

Choose a reason for hiding this comment

elasticmachine commented Feb 19, 2021

dhurley14 Feb 19, 2021

Choose a reason for hiding this comment

dhurley14 left a comment

Choose a reason for hiding this comment

kibanamachine commented Feb 20, 2021

💚 Build Succeeded

Metrics [docs]

Async chunks

Page load bundle

History

kibanamachine commented Feb 20, 2021

💚 Backport successful

dplumlee commented Feb 19, 2021 •

edited

Loading