Skip to content

[Security Solution] Hide KQL bar (all pages) and alerts filters (Detections) when Resolver is full screen#72788

Merged
andrew-goldstein merged 2 commits intoelastic:masterfrom
andrew-goldstein:hide-filters-when-resolver-is-full-screen
Jul 22, 2020
Merged

[Security Solution] Hide KQL bar (all pages) and alerts filters (Detections) when Resolver is full screen#72788
andrew-goldstein merged 2 commits intoelastic:masterfrom
andrew-goldstein:hide-filters-when-resolver-is-full-screen

Conversation

@andrew-goldstein
Copy link
Copy Markdown
Contributor

@andrew-goldstein andrew-goldstein commented Jul 22, 2020

Summary

Fixes an issue where the KQL bar (on all pages) and alerts filters (on the Detections page) should be hidden when Resolver is in full screen mode.

To reproduce:

  1. Navigate to the Detections page
  2. Enter agent.type : endpoint in the KQL bar to only show endpoint alerts
  3. Click the Full screen button in the detections table

Expected result

  • The KQL bar, inspect button, alerts filters (Open | In progress | Closed), and Showing n alerts, Select all n alerts, and Additional filters actions are visible in full screen mode
  1. Click the Analyze event button to show Resolver

Expected result

  • The KQL bar, inspect button, alerts filters (Open | In progress | Closed), Showing n alerts, Select all n alerts, and Additional filters actions are NOT visible in full screen mode when Resolver is open

Actual result

  • The KQL bar, inspect button, alerts filters (Open | In progress | Closed), Showing n alerts, Select all n alerts, and Additional filters actions are (incorrectly) visible in full screen mode, per the screenshot below:

filters-in-full-screen-mode

  1. Click the < Back to events button

Expected result

  • The KQL bar, inspect button, alerts filters (Open | In progress | Closed), Showing n alerts, Select all n alerts, and Additional filters actions become visible again
  1. Press the Esc (Escape) key to exit Full screen mode

Expected result

  • The KQL bar, inspect button, alerts filters (Open | In progress | Closed), Showing n alerts, Select all n alerts, and Additional filters actions are (still) visible

Screenshot (fixed)

The following screenshot of the fix was taken from the Detections page after following the reproduction steps above:

filters-in-full-screen-mode-fixed

@andrew-goldstein
## Summary
bbd7a47 
Fixes an issue where the KQL bar (on all pages) and alerts filters (on the `Detections` page) should be hidden when Resolver is in full screen mode.

**To reproduce:**

1) Navigate to the `Detections` page
2) Enter `agent.type : endpoint` in the KQL bar to only show endpoint alerts
3) Click the `Full screen` button in the detections table

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), and `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are visible in full screen mode

4) Click the `Analyze event` button to show Resolver

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are  **NOT** visible in full screen mode **when Resolver is open**

**Actual result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are (incorrectly) visible in full screen mode, per the screenshot below:

![filters-in-full-screen-mode](https://user-images.githubusercontent.com/4459398/88079205-9f565b80-cb3a-11ea-996a-fb71bf43c473.png)

5) Click the `< Back to events` button

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions become visible again

6) Press the `Esc` (Escape) key to exit Full screen mode

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are (still) visible

## Screenshot (fixed)

The following screenshot of the fix was taken from the `Detections` page after following the reproduction steps above:

![filters-in-full-screen-mode-fixed](https://user-images.githubusercontent.com/4459398/88125154-e882cb80-cb8b-11ea-9b45-718fd9ef0844.png)
@andrew-goldstein andrew-goldstein added Team:SIEM v8.0.0 release_note:skip Skip the PR/issue when compiling release notes v7.10.0 v7.9.0 labels Jul 22, 2020
@andrew-goldstein andrew-goldstein requested review from a team as code owners July 22, 2020 02:05
@andrew-goldstein andrew-goldstein self-assigned this Jul 22, 2020
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jul 22, 2020

Pinging @elastic/siem (Team:SIEM)

andrew-goldstein
andrew-goldstein commented Jul 22, 2020
View reviewed changes
x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
/>

<EuiSpacer />
<WrapperPage noPadding={globalFullScreen}>
Copy link
Copy Markdown
Contributor Author

@andrew-goldstein andrew-goldstein Jul 22, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewer, consider applying Github's Hide whitespace changes PR review filter (in the ⚙️) before reviewing the change here (the diff will appear much smaller)

@andrew-goldstein
Copy link
Copy Markdown
Contributor Author

andrew-goldstein commented Jul 22, 2020

@elasticmachine merge upstream

@andrew-goldstein andrew-goldstein force-pushed the hide-filters-when-resolver-is-full-screen branch from 3910493 to 39c6f35 Compare July 22, 2020 04:27
andrew-goldstein
andrew-goldstein commented Jul 22, 2020
View reviewed changes
x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts
});

context('Events columns', () => {
context.skip('Events columns', () => {
Copy link
Copy Markdown
Contributor Author

@andrew-goldstein andrew-goldstein Jul 22, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@MadameSheema I skipped this D&D test because it failed on CI, and once locally. Would you be willing to debug it with me?

spong
spong approved these changes Jul 22, 2020
View reviewed changes
Copy link
Copy Markdown
Member

@spong spong left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thanks for taking the time to pair and go over these changes with me @andrew-goldstein. Appreciate all the tests to accompany as well! 🙂

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jul 22, 2020

💚 Build Succeeded

Build metrics

async chunks size

id value diff baseline
securitySolution 7.3MB +4.5KB 7.3MB

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@andrew-goldstein andrew-goldstein merged commit ad65b2c into elastic:master Jul 22, 2020
@andrew-goldstein andrew-goldstein deleted the hide-filters-when-resolver-is-full-screen branch July 22, 2020 06:12
@andrew-goldstein andrew-goldstein mentioned this pull request Jul 22, 2020
Merged
andrew-goldstein added a commit to andrew-goldstein/kibana that referenced this pull request Jul 22, 2020
@andrew-goldstein
[Security Solution] Hide KQL bar (all pages) and alerts filters (Dete…
e66df7a 
…ctions) when Resolver is full screen (elastic#72788)

## Summary

Fixes an issue where the KQL bar (on all pages) and alerts filters (on the `Detections` page) should be hidden when Resolver is in full screen mode.

**To reproduce:**

1) Navigate to the `Detections` page
2) Enter `agent.type : endpoint` in the KQL bar to only show endpoint alerts
3) Click the `Full screen` button in the detections table

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), and `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are visible in full screen mode

4) Click the `Analyze event` button to show Resolver

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are  **NOT** visible in full screen mode **when Resolver is open**

**Actual result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are (incorrectly) visible in full screen mode, per the screenshot below:

![filters-in-full-screen-mode](https://user-images.githubusercontent.com/4459398/88079205-9f565b80-cb3a-11ea-996a-fb71bf43c473.png)

5) Click the `< Back to events` button

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions become visible again

6) Press the `Esc` (Escape) key to exit Full screen mode

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are (still) visible

## Screenshot (fixed)

The following screenshot of the fix was taken from the `Detections` page after following the reproduction steps above:

![filters-in-full-screen-mode-fixed](https://user-images.githubusercontent.com/4459398/88125154-e882cb80-cb8b-11ea-9b45-718fd9ef0844.png)
@andrew-goldstein andrew-goldstein mentioned this pull request Jul 22, 2020
Merged
andrew-goldstein added a commit to andrew-goldstein/kibana that referenced this pull request Jul 22, 2020
@andrew-goldstein
[Security Solution] Hide KQL bar (all pages) and alerts filters (Dete…
ee4b05e 
…ctions) when Resolver is full screen (elastic#72788)

## Summary

Fixes an issue where the KQL bar (on all pages) and alerts filters (on the `Detections` page) should be hidden when Resolver is in full screen mode.

**To reproduce:**

1) Navigate to the `Detections` page
2) Enter `agent.type : endpoint` in the KQL bar to only show endpoint alerts
3) Click the `Full screen` button in the detections table

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), and `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are visible in full screen mode

4) Click the `Analyze event` button to show Resolver

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are  **NOT** visible in full screen mode **when Resolver is open**

**Actual result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are (incorrectly) visible in full screen mode, per the screenshot below:

![filters-in-full-screen-mode](https://user-images.githubusercontent.com/4459398/88079205-9f565b80-cb3a-11ea-996a-fb71bf43c473.png)

5) Click the `< Back to events` button

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions become visible again

6) Press the `Esc` (Escape) key to exit Full screen mode

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are (still) visible

## Screenshot (fixed)

The following screenshot of the fix was taken from the `Detections` page after following the reproduction steps above:

![filters-in-full-screen-mode-fixed](https://user-images.githubusercontent.com/4459398/88125154-e882cb80-cb8b-11ea-9b45-718fd9ef0844.png)
andrew-goldstein added a commit that referenced this pull request Jul 22, 2020
@andrew-goldstein
[Security Solution] Hide KQL bar (all pages) and alerts filters (Dete…
e06dd30 
…ctions) when Resolver is full screen (#72788) (#72795)

## Summary

Fixes an issue where the KQL bar (on all pages) and alerts filters (on the `Detections` page) should be hidden when Resolver is in full screen mode.

**To reproduce:**

1) Navigate to the `Detections` page
2) Enter `agent.type : endpoint` in the KQL bar to only show endpoint alerts
3) Click the `Full screen` button in the detections table

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), and `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are visible in full screen mode

4) Click the `Analyze event` button to show Resolver

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are  **NOT** visible in full screen mode **when Resolver is open**

**Actual result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are (incorrectly) visible in full screen mode, per the screenshot below:

![filters-in-full-screen-mode](https://user-images.githubusercontent.com/4459398/88079205-9f565b80-cb3a-11ea-996a-fb71bf43c473.png)

5) Click the `< Back to events` button

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions become visible again

6) Press the `Esc` (Escape) key to exit Full screen mode

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are (still) visible

## Screenshot (fixed)

The following screenshot of the fix was taken from the `Detections` page after following the reproduction steps above:

![filters-in-full-screen-mode-fixed](https://user-images.githubusercontent.com/4459398/88125154-e882cb80-cb8b-11ea-9b45-718fd9ef0844.png)
MadameSheema pushed a commit that referenced this pull request Jul 22, 2020
@andrew-goldstein
[7.9] [Security Solution] Hide KQL bar (all pages) and alerts filters…
5e0c492 
… (Detections) when Resolver is full screen (#72788) (#72796)

* [Security Solution] Hide KQL bar (all pages) and alerts filters (Detections) when Resolver is full screen (#72788)

## Summary

Fixes an issue where the KQL bar (on all pages) and alerts filters (on the `Detections` page) should be hidden when Resolver is in full screen mode.

**To reproduce:**

1) Navigate to the `Detections` page
2) Enter `agent.type : endpoint` in the KQL bar to only show endpoint alerts
3) Click the `Full screen` button in the detections table

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), and `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are visible in full screen mode

4) Click the `Analyze event` button to show Resolver

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are  **NOT** visible in full screen mode **when Resolver is open**

**Actual result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are (incorrectly) visible in full screen mode, per the screenshot below:

![filters-in-full-screen-mode](https://user-images.githubusercontent.com/4459398/88079205-9f565b80-cb3a-11ea-996a-fb71bf43c473.png)

5) Click the `< Back to events` button

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions become visible again

6) Press the `Esc` (Escape) key to exit Full screen mode

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are (still) visible

## Screenshot (fixed)

The following screenshot of the fix was taken from the `Detections` page after following the reproduction steps above:

![filters-in-full-screen-mode-fixed](https://user-images.githubusercontent.com/4459398/88125154-e882cb80-cb8b-11ea-9b45-718fd9ef0844.png)

* - skipping cypress tests in `x-pack/plugins/security_solution/cypress/integration/timeline_data_providers.spec.ts`
gmmorris added a commit to gmmorris/kibana that referenced this pull request Jul 22, 2020
@gmmorris
Merge branch 'master' into task-manager/fix-flaky-buffer-test
1b2400c 
* master: (23 commits)
  Stabilize closing toast (elastic#72097)
  stabilize failing test (elastic#72086)
  Stabilize filter bar test (elastic#72032)
  Unskip vislib tests (elastic#71452)
  [ML] Fix layout of anomaly chart tooltip for long field values (elastic#72689)
  fix preAuth/preRouting mocks (elastic#72663)
  [Security Solution] Hide KQL bar (all pages) and alerts filters (Detections) when Resolver is full screen (elastic#72788)
  [Uptime] Rename Whitelist to Allowlist in parse_filter_map (elastic#71584)
  [Security Solution] Fixes exception modal not loading content (elastic#72770)
  [Security Solution][Exceptions] - Require non empty entries and non empty string values in exception list items (elastic#72748)
  [Detections] Add validation for Threshold value field (elastic#72611)
  [SIEM][Detection Engine][Lists] Adds version and immutability data structures (elastic#72730)
  [Security Solution][Detections] Validate file type of value lists (elastic#72746)
  [pre-req] New Component Layout proposal (elastic#72385)
  [ML] do not throw an error when agg is not supported by UI (elastic#72685)
  [Resolver] Origin process (elastic#72382)
  [Ingest Manager] Allow to force unenroll from the UI (elastic#72386)
  skip 6.8 branch when triggering baseline-capture builds (elastic#72706)
  [CI] In-progress PR comments (elastic#72211)
  Fix sorting of scripted string fields (elastic#72681)
  ...
gmmorris added a commit to gmmorris/kibana that referenced this pull request Jul 22, 2020
@gmmorris
Merge branch 'master' into alerting/management-feature-privileges
7c51753 
* master: (34 commits)
  Adds Role Based Access-Control to the Alerting & Action plugins based on Kibana Feature Controls (elastic#67157)
  [Monitoring] Revert direct shipping code (elastic#72505)
  Use server basepath  when creating reporting jobs (elastic#72722)
  Adding api test for transaction_groups /breakdown and /avg_duration_by_browser (elastic#72623)
  [Task Manager] Addresses flaky test introduced by buffered store (elastic#72815)
  [Observability] filter "hasData" api by processor event (elastic#72810)
  do  not pass title as part of tsvb request (elastic#72619)
  [Lens] Legend config (elastic#70619)
  Stabilize closing toast (elastic#72097)
  stabilize failing test (elastic#72086)
  Stabilize filter bar test (elastic#72032)
  Unskip vislib tests (elastic#71452)
  [ML] Fix layout of anomaly chart tooltip for long field values (elastic#72689)
  fix preAuth/preRouting mocks (elastic#72663)
  [Security Solution] Hide KQL bar (all pages) and alerts filters (Detections) when Resolver is full screen (elastic#72788)
  [Uptime] Rename Whitelist to Allowlist in parse_filter_map (elastic#71584)
  [Security Solution] Fixes exception modal not loading content (elastic#72770)
  [Security Solution][Exceptions] - Require non empty entries and non empty string values in exception list items (elastic#72748)
  [Detections] Add validation for Threshold value field (elastic#72611)
  [SIEM][Detection Engine][Lists] Adds version and immutability data structures (elastic#72730)
  ...
@MindyRS MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Sep 23, 2021

Pinging @elastic/security-solution (Team: SecuritySolution)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@spong spong spong approved these changes

Assignees

@andrew-goldstein andrew-goldstein

Labels

release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM v7.9.0 v7.10.0 v8.0.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@andrew-goldstein @elasticmachine @kibanamachine @spong @MindyRS