Skip to content

[SIEM][Detection Engine] Fixes tags to accept characters such as AND, OR, (, ), ", *#74003

Merged
FrankHassanabad merged 5 commits intoelastic:masterfrom
FrankHassanabad:fix-non-escaped-tags
Aug 1, 2020
Merged

[SIEM][Detection Engine] Fixes tags to accept characters such as AND, OR, (, ), ", *#74003
FrankHassanabad merged 5 commits intoelastic:masterfrom
FrankHassanabad:fix-non-escaped-tags

Conversation

@FrankHassanabad
Copy link
Copy Markdown
Contributor

@FrankHassanabad FrankHassanabad commented Jul 31, 2020 •
edited
Loading

Summary

If you create a rule with tags that have an AND, OR, (, ), etc... then you would blow up with an error when you try to filter based off of that like the screen shot below:
Screen Shot 2020-07-31 at 1 55 31 PM

Now you don't blow up:
Screen Shot 2020-07-31 at 2 37 11 PM

This fixes it by adding double quotes around the filters and also red/green/TDD unit tests where I first exercised the error conditions then fixed them.

Checklist

@FrankHassanabad
Fixes parsing to accept filters and tags to have characters such as A…
5427dc6 
…ND, (, by adding the double quotes around the KQL
@FrankHassanabad FrankHassanabad requested review from a team as code owners July 31, 2020 20:38
@FrankHassanabad FrankHassanabad self-assigned this Jul 31, 2020
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jul 31, 2020

Pinging @elastic/siem (Team:SIEM)

@FrankHassanabad FrankHassanabad added release_note:fix bug Fixes for quality problems that affect the customer experience labels Jul 31, 2020
@FrankHassanabad FrankHassanabad changed the title [SIEM][Detection Engine] Fixes tags and rule searching to accept tags with AND, OR, ( [SIEM][Detection Engine] Fixes tags and rule searching to accept tags with AND, OR, (, " Jul 31, 2020
@FrankHassanabad FrankHassanabad changed the title [SIEM][Detection Engine] Fixes tags and rule searching to accept tags with AND, OR, (, " [SIEM][Detection Engine] Fixes tags to accept characters such as AND, OR, (, ", * Jul 31, 2020
@FrankHassanabad FrankHassanabad changed the title [SIEM][Detection Engine] Fixes tags to accept characters such as AND, OR, (, ", * [SIEM][Detection Engine] Fixes tags to accept characters such as AND, OR, (, ), ", * Jul 31, 2020
dhurley14
dhurley14 approved these changes Jul 31, 2020
View reviewed changes
Copy link
Copy Markdown
Contributor

@dhurley14 dhurley14 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested filtering on all rules page with the tags in the below screenshot. LGTM!

Screen Shot 2020-07-31 at 5 39 37 PM

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jul 31, 2020

💚 Build Succeeded

Build metrics

async chunks size

id value diff baseline
securitySolution 7.3MB +25.0B 7.3MB

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@FrankHassanabad FrankHassanabad merged commit be47dc4 into elastic:master Aug 1, 2020
@FrankHassanabad FrankHassanabad deleted the fix-non-escaped-tags branch August 1, 2020 00:20
@FrankHassanabad FrankHassanabad mentioned this pull request Aug 1, 2020
Merged
FrankHassanabad added a commit to FrankHassanabad/kibana that referenced this pull request Aug 1, 2020
@FrankHassanabad
[SIEM][Detection Engine] Fixes tags to accept characters such as AND,…
dd43e62 
… OR, (, ), ", * (elastic#74003)

## Summary

If you create a rule with tags that have an AND, OR, (, ), etc... then you would blow up with an error when you try to filter based off of that like the screen shot below:
<img width="703" alt="Screen Shot 2020-07-31 at 1 55 31 PM" src="https://user-images.githubusercontent.com/1151048/89075547-b3206f80-d33b-11ea-9e7a-30d4a49ac1de.png">

Now you don't blow up:
<img width="1708" alt="Screen Shot 2020-07-31 at 2 37 11 PM" src="https://user-images.githubusercontent.com/1151048/89075553-b582c980-d33b-11ea-807a-7d6a1d1921e8.png">

This fixes it by adding double quotes around the filters and also red/green/TDD unit tests where I first exercised the error conditions then fixed them.   

### Checklist

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios
@FrankHassanabad FrankHassanabad mentioned this pull request Aug 1, 2020
Merged
FrankHassanabad added a commit to FrankHassanabad/kibana that referenced this pull request Aug 1, 2020
@FrankHassanabad
[SIEM][Detection Engine] Fixes tags to accept characters such as AND,…
2ff7bd1 
… OR, (, ), ", * (elastic#74003)

## Summary

If you create a rule with tags that have an AND, OR, (, ), etc... then you would blow up with an error when you try to filter based off of that like the screen shot below:
<img width="703" alt="Screen Shot 2020-07-31 at 1 55 31 PM" src="https://user-images.githubusercontent.com/1151048/89075547-b3206f80-d33b-11ea-9e7a-30d4a49ac1de.png">

Now you don't blow up:
<img width="1708" alt="Screen Shot 2020-07-31 at 2 37 11 PM" src="https://user-images.githubusercontent.com/1151048/89075553-b582c980-d33b-11ea-807a-7d6a1d1921e8.png">

This fixes it by adding double quotes around the filters and also red/green/TDD unit tests where I first exercised the error conditions then fixed them.   

### Checklist

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios
FrankHassanabad added a commit that referenced this pull request Aug 1, 2020
@FrankHassanabad
[SIEM][Detection Engine] Fixes tags to accept characters such as AND,…
ec583ce 
… OR, (, ), ", * (#74003) (#74033)

## Summary

If you create a rule with tags that have an AND, OR, (, ), etc... then you would blow up with an error when you try to filter based off of that like the screen shot below:
<img width="703" alt="Screen Shot 2020-07-31 at 1 55 31 PM" src="https://user-images.githubusercontent.com/1151048/89075547-b3206f80-d33b-11ea-9e7a-30d4a49ac1de.png">

Now you don't blow up:
<img width="1708" alt="Screen Shot 2020-07-31 at 2 37 11 PM" src="https://user-images.githubusercontent.com/1151048/89075553-b582c980-d33b-11ea-807a-7d6a1d1921e8.png">

This fixes it by adding double quotes around the filters and also red/green/TDD unit tests where I first exercised the error conditions then fixed them.   

### Checklist

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios
FrankHassanabad added a commit that referenced this pull request Aug 1, 2020
@FrankHassanabad
[SIEM][Detection Engine] Fixes tags to accept characters such as AND,…
6e3675a 
… OR, (, ), ", * (#74003) (#74032)

## Summary

If you create a rule with tags that have an AND, OR, (, ), etc... then you would blow up with an error when you try to filter based off of that like the screen shot below:
<img width="703" alt="Screen Shot 2020-07-31 at 1 55 31 PM" src="https://user-images.githubusercontent.com/1151048/89075547-b3206f80-d33b-11ea-9e7a-30d4a49ac1de.png">

Now you don't blow up:
<img width="1708" alt="Screen Shot 2020-07-31 at 2 37 11 PM" src="https://user-images.githubusercontent.com/1151048/89075553-b582c980-d33b-11ea-807a-7d6a1d1921e8.png">

This fixes it by adding double quotes around the filters and also red/green/TDD unit tests where I first exercised the error conditions then fixed them.   

### Checklist

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios
gmmorris added a commit to gmmorris/kibana that referenced this pull request Aug 2, 2020
@gmmorris
Merge branch 'master' into task-manager/fix-flaky-test
dffcdf9 
* master: (39 commits)
  [Canvas][tech-debt] Rename __examples__ to __stories__ (elastic#73853)
  [Canvas] Storybook Redux Addon (elastic#73227)
  Use "Apply_filter_trigger" in "explore underlying data" action (elastic#71445)
  [maps] convert top nav config to TS (elastic#73851)
  [maps] fix fit to bounds for ES document layers with joins (elastic#73985)
  [Canvas][tech-debt] Refactor Toolbar (completes Kill Recompose.pure) (elastic#73309)
  [CI] In-progress Slack notifications (elastic#74012)
  [SIEM][Detection Engine] Fixes tags to accept characters such as AND, OR, (, ), ", * (elastic#74003)
  [SECURITY_SOLUTION][ENDPOINT] Fix host list Configuration Status cell link loosing list page/size state (elastic#73989)
  Tweak injected metadata (elastic#73990)
  Closes elastic#73998 by using `canAccessML` in the ML capabilities API to (elastic#73999)
  [SIEM] Fixes toaster errors when siemDefault index is an empty or empty spaces (elastic#73991)
  [Security Solution] Fix timeline pin event callback (elastic#73981)
  [Security Solution] Fix unexpected redirect (elastic#73969)
  [Metrics UI] Fix Metrics Explorer TSVB link to use workaround pattern (elastic#73986)
  [APM] docs: Update machine learning integration (elastic#73597)
  [Ingest Manager] Fix limited concurrency helper (elastic#73976)
  [build/sysv] fix missing env variable rename (elastic#73977)
  Fix a typo. (elastic#73948)
  [Ingest Manager] Revert fleet config concurrency rollout to rate limit (elastic#73940)
  ...
@bm11100 bm11100 mentioned this pull request Aug 3, 2020
Merged
@MindyRS MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Sep 23, 2021

Pinging @elastic/security-solution (Team: SecuritySolution)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dhurley14 dhurley14 dhurley14 approved these changes

Assignees

@FrankHassanabad FrankHassanabad

Labels

bug Fixes for quality problems that affect the customer experience release_note:fix Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM v7.9.0 v7.10.0 v8.0.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@FrankHassanabad @elasticmachine @kibanamachine @dhurley14 @MindyRS