Skip to content

[SIEM][Detection Engine] Removes technical debt and minor bug fixes#50111

Merged
FrankHassanabad merged 6 commits intoelastic:masterfrom
FrankHassanabad:update-detection-engine
Nov 11, 2019
Merged

[SIEM][Detection Engine] Removes technical debt and minor bug fixes#50111
FrankHassanabad merged 6 commits intoelastic:masterfrom
FrankHassanabad:update-detection-engine

Conversation

@FrankHassanabad
Copy link
Copy Markdown
Contributor

@FrankHassanabad FrankHassanabad commented Nov 8, 2019 •
edited
Loading

Summary

  • Removes technical debt of name being in the params now that the regular alerting has name as a first class citizen.
  • Only creates new signals on an update if it sees that saved objects return 404
  • Changes the conversion script of saved searches to rules to be every 5 minutes for tests.
  • Changes the logger levels to be mostly quiet by using debug instead of info.
  • Small fixes for when we return false for errors on 0 found signals when that is not an error.
  • Added a delete all api keys for more cleanups when developing

For testing things on the backend this is the kibana.dev.yml settings I use for this PR which enables the siem debug but filters out the others and enables additional request information for testing:

logging.verbose: true
logging.events:
  {
    log: ['siem', 'info', 'warning', 'error', 'fatal'],
    request: ['info', 'warning', 'error', 'fatal'],
    error: '*',
    ops: __no-ops__,
  }

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

- [ ] This was checked for cross-browser compatibility, including a check against IE11

- [ ] Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support

- [ ] Documentation was added for features that require explanation or tutorials

- [ ] This was checked for keyboard-only and screenreader accessibility

For maintainers

- [ ] This was checked for breaking API changes and was labeled appropriately

- [ ] This includes a feature addition or change that requires a release note and was labeled appropriately

@FrankHassanabad FrankHassanabad added the release_note:skip Skip the PR/issue when compiling release notes label Nov 8, 2019
@FrankHassanabad FrankHassanabad self-assigned this Nov 8, 2019
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Nov 8, 2019

💚 Build Succeeded

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Nov 8, 2019

💚 Build Succeeded

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Nov 9, 2019

Pinging @elastic/siem (Team:SIEM)

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Nov 11, 2019

💔 Build Failed

@FrankHassanabad
Copy link
Copy Markdown
Contributor Author

FrankHassanabad commented Nov 11, 2019

retest this

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Nov 11, 2019

💔 Build Failed

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Nov 11, 2019

💚 Build Succeeded

dhurley14
dhurley14 approved these changes Nov 11, 2019
View reviewed changes
Copy link
Copy Markdown
Contributor

@dhurley14 dhurley14 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for updating the logic for zero results and the logging! LGTM!

@FrankHassanabad FrankHassanabad merged commit ab5f411 into elastic:master Nov 11, 2019
@FrankHassanabad FrankHassanabad deleted the update-detection-engine branch November 11, 2019 18:02
@FrankHassanabad FrankHassanabad mentioned this pull request Nov 11, 2019
Merged
FrankHassanabad added a commit to FrankHassanabad/kibana that referenced this pull request Nov 11, 2019
@FrankHassanabad
[SIEM][Detection Engine] Removes technical debt and minor bug fixes (e…
e7b68e3 
…lastic#50111)

## Summary

* Removes technical debt of name being in the params now that the regular alerting has name as a first class citizen.
* Only creates new signals on an update if it sees that saved objects return 404
* Changes the conversion script of saved searches to rules to be every 5 minutes for tests.
* Changes the logger levels to be mostly quiet by using debug instead of info.
* Small fixes for when we return false for errors on 0 found signals when that is not an error. 
* Added a delete all api keys for more cleanups when developing 

For testing things on the backend this is the `kibana.dev.yml` settings I use for this PR which enables the siem debug but filters out the others and enables additional request information for testing:

```yml
logging.verbose: true
logging.events:
  {
    log: ['siem', 'info', 'warning', 'error', 'fatal'],
    request: ['info', 'warning', 'error', 'fatal'],
    error: '*',
    ops: __no-ops__,
  }
```

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

~~- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~~

~~- [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~~

~~- [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~~

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios

~~- [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~~

### For maintainers

~~- [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~

~~- [ ] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~
FrankHassanabad added a commit that referenced this pull request Nov 11, 2019
@FrankHassanabad
[SIEM][Detection Engine] Removes technical debt and minor bug fixes (#…
bf37b9d 
…50111) (#50183)

## Summary

* Removes technical debt of name being in the params now that the regular alerting has name as a first class citizen.
* Only creates new signals on an update if it sees that saved objects return 404
* Changes the conversion script of saved searches to rules to be every 5 minutes for tests.
* Changes the logger levels to be mostly quiet by using debug instead of info.
* Small fixes for when we return false for errors on 0 found signals when that is not an error. 
* Added a delete all api keys for more cleanups when developing 

For testing things on the backend this is the `kibana.dev.yml` settings I use for this PR which enables the siem debug but filters out the others and enables additional request information for testing:

```yml
logging.verbose: true
logging.events:
  {
    log: ['siem', 'info', 'warning', 'error', 'fatal'],
    request: ['info', 'warning', 'error', 'fatal'],
    error: '*',
    ops: __no-ops__,
  }
```

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

~~- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~~

~~- [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~~

~~- [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~~

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios

~~- [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~~

### For maintainers

~~- [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~

~~- [ ] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~
jloleysens added a commit to jloleysens/kibana that referenced this pull request Nov 12, 2019
@jloleysens
Merge remote-tracking branch 'upstream/master' into test-1
37d4836 
* upstream/master:
  [ML] Make navigation in tests more stable (elastic#50132)
  Migrate authorization subsystem to the new platform.  (elastic#46145)
  Bugfix: Interpreter conversion of string to number should throw on NaN elastic#27788 (elastic#50063)
  Update dependency @elastic/charts to v14 (elastic#49947)
  [ML] Adding cloud specific ML node warning (elastic#50139)
  Fixing bugs in the Shareable Runtime (elastic#49965)
  Revert router base name for Uptime plugin to use hash in default path. (elastic#50095)
  Ability to have telemetry always opted in (elastic#49798)
  Add "Get Help" and "Kibana Feedback" links to the help popover (elastic#49797)
  Removes references to Elasticsearch mapping types (elastic#47610)
  [skip-ci] Replace coordinate map in Kibana getting started docs with Maps (elastic#50167)
  [ML] Indicate missing required privileges for import in File Data Viz (elastic#50147)
  [SIEM][Detection Engine] Removes technical debt and minor bug fixes (elastic#50111)
jloleysens added a commit to jloleysens/kibana that referenced this pull request Nov 12, 2019
@jloleysens
Merge remote-tracking branch 'upstream/master' into test-3
7b512ad 
* upstream/master:
  Move table-list-view to kibana-react (elastic#50046)
  [ML] Stats bar for data frame analytics (elastic#49464)
  [ML] Make navigation in tests more stable (elastic#50132)
  Migrate authorization subsystem to the new platform.  (elastic#46145)
  Bugfix: Interpreter conversion of string to number should throw on NaN elastic#27788 (elastic#50063)
  Update dependency @elastic/charts to v14 (elastic#49947)
  [ML] Adding cloud specific ML node warning (elastic#50139)
  Fixing bugs in the Shareable Runtime (elastic#49965)
  Revert router base name for Uptime plugin to use hash in default path. (elastic#50095)
  Ability to have telemetry always opted in (elastic#49798)
  Add "Get Help" and "Kibana Feedback" links to the help popover (elastic#49797)
  Removes references to Elasticsearch mapping types (elastic#47610)
  [skip-ci] Replace coordinate map in Kibana getting started docs with Maps (elastic#50167)
  [ML] Indicate missing required privileges for import in File Data Viz (elastic#50147)
  [SIEM][Detection Engine] Removes technical debt and minor bug fixes (elastic#50111)
jloleysens added a commit to jloleysens/kibana that referenced this pull request Nov 12, 2019
@jloleysens
Merge remote-tracking branch 'upstream/master' into np-migration/ua […
faa2676 
…skip ci]

* upstream/master:
  Move table-list-view to kibana-react (elastic#50046)
  [ML] Stats bar for data frame analytics (elastic#49464)
  [ML] Make navigation in tests more stable (elastic#50132)
  Migrate authorization subsystem to the new platform.  (elastic#46145)
  Bugfix: Interpreter conversion of string to number should throw on NaN elastic#27788 (elastic#50063)
  Update dependency @elastic/charts to v14 (elastic#49947)
  [ML] Adding cloud specific ML node warning (elastic#50139)
  Fixing bugs in the Shareable Runtime (elastic#49965)
  Revert router base name for Uptime plugin to use hash in default path. (elastic#50095)
  Ability to have telemetry always opted in (elastic#49798)
  Add "Get Help" and "Kibana Feedback" links to the help popover (elastic#49797)
  Removes references to Elasticsearch mapping types (elastic#47610)
  [skip-ci] Replace coordinate map in Kibana getting started docs with Maps (elastic#50167)
  [ML] Indicate missing required privileges for import in File Data Viz (elastic#50147)
  [SIEM][Detection Engine] Removes technical debt and minor bug fixes (elastic#50111)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dhurley14 dhurley14 dhurley14 approved these changes

Assignees

@FrankHassanabad FrankHassanabad

Labels

release_note:skip Skip the PR/issue when compiling release notes Team:SIEM v7.6.0 v8.0.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@FrankHassanabad @elasticmachine @dhurley14