[Security Solution][Exceptions] - Make esTypes and subType available to index patterns by yctercero · Pull Request #72336 · elastic/kibana

yctercero · 2020-07-17T19:58:03Z

Summary

This PR updates the following:

useFetchIndexPatterns now returns indexPatterns whose fields include esTypes and subType
- Why?? The exceptions builder needs these two fields to determine what fields are of ES type nested and parent paths
exceptions add and edit modals now use the rule.index field to pass into useFetchindexPatterns
- Before we were using the signals index and alerts index for endpoint, needs to be rule's index patterns
- if no index patterns exist on the rule (if rule created via API, it's not required), then uses DEFAULT_INDEX_PATTERN
updates the autocomplete validation to use IField.esTypes to check type instead of IField.type

We were noticing that when selecting is in list in the builder, the IFieldType.type does not match the ES type assigned to the large value list on creation and so the lists were not populating in the select dropdown. This should fix that issue.

Checklist

Unit or functional tests were updated or added to match the most common scenarios

…ll checking signals index for closing alerts functionality

elasticmachine · 2020-07-20T04:01:32Z

Pinging @elastic/siem (Team:SIEM)

...k/plugins/security_solution/public/common/components/autocomplete/field_value_lists.test.tsx

FrankHassanabad · 2020-07-20T14:29:31Z

x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.ts

+    switch (type) {
+      case 'date':
+        const moment = dateMath.parse(params);
+        return Boolean(moment && moment.isValid());


nit, can you just do: return moment && moment.isValid() ? Won't that work as well without introducing the capital boolean boxing here?

I tried removing it and the test yelled at me saying expected boolean not string. Leaving for now.

FrankHassanabad · 2020-07-20T14:32:51Z

x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.ts

+        return Boolean(moment && moment.isValid());
+      case 'ip':
+        try {
+          return Boolean(new Ipv4Address(params));


This new object seems weird to me...Does this mean we only support ipv4 and not ipv6?

If this is only validating ipv4 but allowing ipv6 I am fine with it. If we begin hindering users or disallowing ipv6 though we are going to start to have issue relatively quickly.

I did a bit of research and there isn't really great consensus on a good regex for ipv6. I didn't find a similar util like the one above for ipv4 in our code so I removed the validation here. I don't want to block users from adding exceptions. This can be something we can circle back on.

FrankHassanabad · 2020-07-20T14:35:17Z

x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.tsx

-        exceptionToEdit !== null &&
-        exceptionListTypeToEdit !== null && (
+        exceptionToEdit != null &&
+        exceptionListTypeToEdit != null && (


👍 , using the != null is great here!

FrankHassanabad

👍 Thanks adding the subType to the index patterns.

peluja1012 · 2020-07-20T15:00:00Z

.../plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx

  EuiCallOut,
  EuiText,
 } from '@elastic/eui';
-import { alertsIndexPattern } from '../../../../../common/endpoint/constants';


Thanks for removing this!

peluja1012 · 2020-07-20T15:10:47Z

x-pack/plugins/security_solution/server/lib/index_fields/types.ts

  type: string;
  searchable: boolean;
  aggregatable: boolean;
+  esTypes?: string[];


Why is esTypes optional. I think getFieldsForWildcard() always returns it. https://github.com/elastic/kibana/blob/master/x-pack/plugins/security_solution/server/lib/index_fields/elasticsearch_adapter.ts#L42

peluja1012

Thanks for improving the field validation in the builder! LGTM, only comment is about esTypes being an optional type, but we can leave as is if it makes sense.

kibanamachine · 2020-07-20T23:04:27Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 7d5744f

Build metrics

@kbn/optimizer bundle module count

id	value	diff	baseline
securitySolution	1065	-1	1066

async chunks size

id	value	diff	baseline
securitySolution	7.3MB	+191.0B	7.3MB

History

💚 Build #63112 succeeded f667704
💚 Build #62841 succeeded 548ead4
💔 Build #62816 failed 2861cfa
💔 Build #62746 failed 42de990

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

…to index patterns (elastic#72336) ## Summary This PR updates the following: - `useFetchIndexPatterns` now returns `indexPatterns` whose fields include `esTypes` and `subType` - Why?? The exceptions builder needs these two fields to determine what fields are of ES type `nested` and parent paths - exceptions add and edit modals now use the `rule.index` field to pass into `useFetchindexPatterns` - Before we were using the signals index and alerts index for endpoint, needs to be rule's index patterns - if no index patterns exist on the rule (if rule created via API, it's not required), then uses `DEFAULT_INDEX_PATTERN` - updates the autocomplete validation to use `IField.esTypes` to check type instead of `IField.type`

…to index patterns (#72336) (#72554) ## Summary This PR updates the following: - `useFetchIndexPatterns` now returns `indexPatterns` whose fields include `esTypes` and `subType` - Why?? The exceptions builder needs these two fields to determine what fields are of ES type `nested` and parent paths - exceptions add and edit modals now use the `rule.index` field to pass into `useFetchindexPatterns` - Before we were using the signals index and alerts index for endpoint, needs to be rule's index patterns - if no index patterns exist on the rule (if rule created via API, it's not required), then uses `DEFAULT_INDEX_PATTERN` - updates the autocomplete validation to use `IField.esTypes` to check type instead of `IField.type`

…to index patterns (#72336) (#72555) ## Summary This PR updates the following: - `useFetchIndexPatterns` now returns `indexPatterns` whose fields include `esTypes` and `subType` - Why?? The exceptions builder needs these two fields to determine what fields are of ES type `nested` and parent paths - exceptions add and edit modals now use the `rule.index` field to pass into `useFetchindexPatterns` - Before we were using the signals index and alerts index for endpoint, needs to be rule's index patterns - if no index patterns exist on the rule (if rule created via API, it's not required), then uses `DEFAULT_INDEX_PATTERN` - updates the autocomplete validation to use `IField.esTypes` to check type instead of `IField.type`

* master: (28 commits) allow some env settings for ingest manager (elastic#72544) Add inspector for VEGA (elastic#70941) chore(NA): fix grunt task for test:coverage (elastic#72539) Archive e2e test results in ES (elastic#72575) preserve 401 errors from new es client (elastic#71248) [SIEM][Detections] Updates text for severity and risk_score overrides (elastic#72244) fixing error occurences tooltip (elastic#72425) use KibanaClient interface instead of Client for new client interface (elastic#72388) [APM] Handle ML errors (elastic#72316) [Discover] Improve histogram tests (elastic#72235) [ftr/webdriver] retry on all errors, use Rx so that timers are canceled (elastic#72540) [pre-req] Move .storybook to storybook; standardize files (elastic#72384) [Security_Solution][Resolver][Bug]: Restore breadcrumb background (elastic#72538) [ML] Fix annotation detector linking & delayed_data(0) (elastic#72468) [Security Solution][Exceptions] - Make esTypes and subType available to index patterns (elastic#72336) [SIEM] Uses faster wait from testing-library and removes duplicate older wait idiom (elastic#72509) Fix long combo box items breaking out of flex item width (elastic#72512) [pipeline/commitStatus] update commit status in baseline-capture job (elastic#72366) [Security Solution][Resolver] Update the resolver element ref on scroll events if the position of the element has changed within the page (elastic#72461) [Maps] auto-fit to data bounds (elastic#72129) ...

…feature-privileges * alerting/consumer-based-rbac: (30 commits) removed uneeded tests expclude security wrapper in SO client passed to ActionsClient allow some env settings for ingest manager (elastic#72544) Add inspector for VEGA (elastic#70941) chore(NA): fix grunt task for test:coverage (elastic#72539) Archive e2e test results in ES (elastic#72575) preserve 401 errors from new es client (elastic#71248) [SIEM][Detections] Updates text for severity and risk_score overrides (elastic#72244) fixing error occurences tooltip (elastic#72425) use KibanaClient interface instead of Client for new client interface (elastic#72388) [APM] Handle ML errors (elastic#72316) [Discover] Improve histogram tests (elastic#72235) [ftr/webdriver] retry on all errors, use Rx so that timers are canceled (elastic#72540) [pre-req] Move .storybook to storybook; standardize files (elastic#72384) [Security_Solution][Resolver][Bug]: Restore breadcrumb background (elastic#72538) [ML] Fix annotation detector linking & delayed_data(0) (elastic#72468) [Security Solution][Exceptions] - Make esTypes and subType available to index patterns (elastic#72336) [SIEM] Uses faster wait from testing-library and removes duplicate older wait idiom (elastic#72509) Fix long combo box items breaking out of flex item width (elastic#72512) [pipeline/commitStatus] update commit status in baseline-capture job (elastic#72366) ...

elasticmachine · 2021-09-23T14:29:42Z

Pinging @elastic/security-solution (Team: SecuritySolution)

yctercero added 9 commits July 17, 2020 12:12

making estypes and subtype available in indexPatterns

952a105

updating graphql types

4448734

Merge branch 'master' of github.com:yctercero/kibana into index_es_types

c56a96d

update source graphql type to match expected

f059d70

cleanup

42de990

tests

ebcb6d3

cleanup

2861cfa

updated tests, reverted changes to modals, to make sure they were sti…

760ed31

…ll checking signals index for closing alerts functionality

Merge branch 'master' of github.com:yctercero/kibana into index_es_types

548ead4

yctercero self-assigned this Jul 20, 2020

yctercero added release_note:enhancement Team:SIEM v7.10.0 v7.9.0 v8.0.0 labels Jul 20, 2020

yctercero marked this pull request as ready for review July 20, 2020 04:01

yctercero requested review from a team as code owners July 20, 2020 04:01

FrankHassanabad reviewed Jul 20, 2020

View reviewed changes

...k/plugins/security_solution/public/common/components/autocomplete/field_value_lists.test.tsx Outdated Show resolved Hide resolved

FrankHassanabad reviewed Jul 20, 2020

View reviewed changes

...k/plugins/security_solution/public/common/components/autocomplete/field_value_lists.test.tsx Outdated Show resolved Hide resolved

FrankHassanabad reviewed Jul 20, 2020

View reviewed changes

FrankHassanabad approved these changes Jul 20, 2020

View reviewed changes

madirey approved these changes Jul 20, 2020

View reviewed changes

peluja1012 reviewed Jul 20, 2020

View reviewed changes

peluja1012 approved these changes Jul 20, 2020

View reviewed changes

Merge branch 'master' of github.com:yctercero/kibana into index_es_types

1e57353

yctercero added 2 commits July 20, 2020 16:10

applying feedback

f667704

Merge branch 'master' of github.com:yctercero/kibana into index_es_types

7d5744f

yctercero merged commit 21977a7 into elastic:master Jul 20, 2020

This was referenced Jul 20, 2020

[7.x] [Security Solution][Exceptions] - Make esTypes and subType available to index patterns (#72336) #72554

Merged

[7.9] [Security Solution][Exceptions] - Make esTypes and subType available to index patterns (#72336) #72555

Merged

yctercero deleted the index_es_types branch October 14, 2020 12:01

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

Conversation

yctercero commented Jul 17, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

elasticmachine commented Jul 20, 2020

Uh oh!

Uh oh!

Uh oh!

FrankHassanabad Jul 20, 2020

Choose a reason for hiding this comment

Uh oh!

yctercero Jul 20, 2020

Choose a reason for hiding this comment

Uh oh!

FrankHassanabad Jul 20, 2020

Choose a reason for hiding this comment

Uh oh!

yctercero Jul 20, 2020

Choose a reason for hiding this comment

Uh oh!

FrankHassanabad Jul 20, 2020

Choose a reason for hiding this comment

Uh oh!

FrankHassanabad left a comment

Choose a reason for hiding this comment

Uh oh!

peluja1012 Jul 20, 2020

Choose a reason for hiding this comment

Uh oh!

peluja1012 Jul 20, 2020

Choose a reason for hiding this comment

Uh oh!

peluja1012 left a comment

Choose a reason for hiding this comment

Uh oh!

kibanamachine commented Jul 20, 2020

💚 Build Succeeded

Build metrics

@kbn/optimizer bundle module count

async chunks size

History

Uh oh!

elasticmachine commented Sep 23, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

yctercero commented Jul 17, 2020 •

edited

Loading