-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Security Solution] Investigation guide - insights in markdown (#145240)
## Summary
This pr adds a new parsing plugin to the EuiMarkdownEditor used in
security solution that enables users to create run time queries that can
be parameterized from alert data, or hard coded literal values. A count
of the matching events is displayed in a button that when clicked will
open the same event set in timeline. Markdown is expected to be in the
following format:
`!{insight{"description":"2 top level OR providers, 1 nested
AND","label":"test insight", "providers": [[{ "field": "event.id",
"value": "kibana.alert.original_event.id", "type": "parameter" }], [{
"field": "event.category", "value": "network", "type": "literal" },
{"field": "process.pid", "value": "process.pid", "type":
"parameter"}]]}}`
The 2d array is used to allow nested queries, the top level arrays are
OR'ed together, and the inner array AND'ed together:
<img width="438" alt="image"
src="https://user-images.githubusercontent.com/56408403/201940553-96ab3d39-48fa-404f-ab2e-8946b532567b.png">
Following a prefix of !insight, the configuration object takes optional
description and label strings, along with a 2 dimensional array called
"providers". This value corresponds to what are called data providers in
the timeline view,
and are arrays of filters with 3 fields, "field" which is the field name
for that part of the query clause, "value" which is the value to be
used, and "type" which is either "parameter" or "literal". Filters of
type parameter expect value to be the name of a field present in an
alert document, and will use the value in the underlying document if
found. If the field is not present for some reason, a wildcard is used.
If the markdown is rendered in a context not tied to a specific alert,
parameter fields are treated as a timeline template field.
<img width="632" alt="image"
src="https://user-images.githubusercontent.com/56408403/201940922-7114a75f-0430-4397-8384-59f4e960ec9c.png">
### Checklist
Delete any items that are not applicable to this PR.
- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- Loading branch information
1 parent
58e6d94
commit 072c70d
Showing
18 changed files
with
599 additions
and
40 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
146 changes: 146 additions & 0 deletions
146
...gins/security_solution/public/common/components/markdown_editor/plugins/insight/index.tsx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,146 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| import type { Plugin } from 'unified'; | ||
| import React, { useContext, useMemo } from 'react'; | ||
| import type { RemarkTokenizer } from '@elastic/eui'; | ||
| import { EuiLoadingSpinner, EuiIcon } from '@elastic/eui'; | ||
| import { i18n } from '@kbn/i18n'; | ||
| import { useAppToasts } from '../../../../hooks/use_app_toasts'; | ||
| import { useInsightQuery } from './use_insight_query'; | ||
| import { useInsightDataProviders } from './use_insight_data_providers'; | ||
| import { BasicAlertDataContext } from '../../../event_details/investigation_guide_view'; | ||
| import { InvestigateInTimelineButton } from '../../../event_details/table/investigate_in_timeline_button'; | ||
| import type { AbsoluteTimeRange } from '../../../../store/inputs/model'; | ||
|
|
||
| interface InsightComponentProps { | ||
| label?: string; | ||
| description?: string; | ||
| providers?: string; | ||
| } | ||
|
|
||
| export const parser: Plugin = function () { | ||
| const Parser = this.Parser; | ||
| const tokenizers = Parser.prototype.inlineTokenizers; | ||
| const methods = Parser.prototype.inlineMethods; | ||
| const insightPrefix = '!{insight'; | ||
|
|
||
| const tokenizeInsight: RemarkTokenizer = function (eat, value, silent) { | ||
| if (value.startsWith(insightPrefix) === false) { | ||
| return false; | ||
| } | ||
|
|
||
| const nextChar = value[insightPrefix.length]; | ||
| if (nextChar !== '{' && nextChar !== '}') return false; | ||
| if (silent) { | ||
| return true; | ||
| } | ||
|
|
||
| // is there a configuration? | ||
| const hasConfiguration = nextChar === '{'; | ||
|
|
||
| let configuration: InsightComponentProps = {}; | ||
| if (hasConfiguration) { | ||
| let configurationString = ''; | ||
| let openObjects = 0; | ||
|
|
||
| for (let i = insightPrefix.length; i < value.length; i++) { | ||
| const char = value[i]; | ||
| if (char === '{') { | ||
| openObjects++; | ||
| configurationString += char; | ||
| } else if (char === '}') { | ||
| openObjects--; | ||
| if (openObjects === -1) { | ||
| break; | ||
| } | ||
| configurationString += char; | ||
| } else { | ||
| configurationString += char; | ||
| } | ||
| } | ||
|
|
||
| try { | ||
| configuration = JSON.parse(configurationString); | ||
| return eat(value)({ | ||
| type: 'insight', | ||
| ...configuration, | ||
| providers: JSON.stringify(configuration.providers), | ||
| }); | ||
| } catch (err) { | ||
| const now = eat.now(); | ||
| this.file.fail( | ||
| i18n.translate('xpack.securitySolution.markdownEditor.plugins.insightConfigError', { | ||
| values: { err }, | ||
| defaultMessage: 'Unable to parse insight JSON configuration: {err}', | ||
| }), | ||
| { | ||
| line: now.line, | ||
| column: now.column + insightPrefix.length, | ||
| } | ||
| ); | ||
| } | ||
| } | ||
| return false; | ||
| }; | ||
| tokenizeInsight.locator = (value: string, fromIndex: number) => { | ||
| return value.indexOf(insightPrefix, fromIndex); | ||
| }; | ||
| tokenizers.insight = tokenizeInsight; | ||
| methods.splice(methods.indexOf('text'), 0, 'insight'); | ||
| }; | ||
|
|
||
| // receives the configuration from the parser and renders | ||
| const InsightComponent = ({ label, description, providers }: InsightComponentProps) => { | ||
| const { addError } = useAppToasts(); | ||
| let parsedProviders = []; | ||
| try { | ||
| if (providers !== undefined) { | ||
| parsedProviders = JSON.parse(providers); | ||
| } | ||
| } catch (err) { | ||
| addError(err, { | ||
| title: i18n.translate('xpack.securitySolution.markdownEditor.plugins.insightProviderError', { | ||
| defaultMessage: 'Unable to parse insight provider configuration', | ||
| }), | ||
| }); | ||
| } | ||
| const { data: alertData } = useContext(BasicAlertDataContext); | ||
| const dataProviders = useInsightDataProviders({ | ||
| providers: parsedProviders, | ||
| alertData, | ||
| }); | ||
| const { totalCount, isQueryLoading, oldestTimestamp, hasError } = useInsightQuery({ | ||
| dataProviders, | ||
| }); | ||
| const timerange: AbsoluteTimeRange = useMemo(() => { | ||
| return { | ||
| kind: 'absolute', | ||
| from: oldestTimestamp ?? '', | ||
| to: new Date().toISOString(), | ||
| }; | ||
| }, [oldestTimestamp]); | ||
| if (isQueryLoading) { | ||
| return <EuiLoadingSpinner size="l" />; | ||
| } else { | ||
| return ( | ||
| <InvestigateInTimelineButton | ||
| asEmptyButton={false} | ||
| isDisabled={hasError} | ||
| dataProviders={dataProviders} | ||
| timeRange={timerange} | ||
| keepDataView={true} | ||
| data-test-subj="insight-investigate-in-timeline-button" | ||
| > | ||
| <EuiIcon type="timeline" /> | ||
| {` ${label} (${totalCount}) - ${description}`} | ||
| </InvestigateInTimelineButton> | ||
| ); | ||
| } | ||
| }; | ||
|
|
||
| export { InsightComponent as renderer }; |
Oops, something went wrong.