Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[8.x] [Cloud Security] Added graph visualization in alert's flyo…
…ut (#196034) (#197837) # Backport This will backport the following commits from `main` to `8.x`: - [[Cloud Security] Added graph visualization in alert's flyout (#196034)](#196034) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Kfir Peled","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-10-25T14:30:15Z","message":"[Cloud Security] Added graph visualization in alert's flyout (#196034)\n\n## Summary\r\n\r\nEnables a new experimental feature. To visualize an alert/event by a\r\ngraph.\r\n\r\nWhen the alert/event does not contain the relevant data the graph\r\npreview will not be visible (confirmed by @tinnytintin10)\r\n\r\nTo enable the feature through kibana's config:\r\n\r\n```yaml\r\nxpack.securitySolution.enableExperimental: ['graphVisualizationInFlyoutEnabled']\r\n```\r\n\r\n<details>\r\n<summary>Event's graph visualization: 🎥 </summary>\r\n\r\n\r\nhttps://github.com/user-attachments/assets/4cee2032-173e-4b44-b371-a8e187763764\r\n\r\n</details>\r\n\r\n\r\n<details>\r\n<summary>Alert's graph visualization: 🎥 </summary>\r\n\r\n\r\nhttps://github.com/user-attachments/assets/4fb942d0-6704-4c79-862c-956821ce59b6\r\n\r\n</details>\r\n\r\n<details>\r\n<summary>Alert in rule preview: 🎥 </summary>\r\n\r\n\r\nhttps://github.com/user-attachments/assets/4f8d086e-1ee4-414f-8efa-4715c1d5e1f6\r\n\r\n</details>\r\n\r\n**List of TODO's**\r\n- Add FTR test to host's flyout\r\n- Add FTR test to alerts preview\r\n- Enhance graph_preview_container UT to cover all edge cases\r\n- Enhance visualization_section UT to cover all edge cases\r\n\r\n**List of open issues (will be tracked in a different ticket):**\r\n\r\n- Graph preview search on the past 60 days, which can lead to an empty\r\ngraph\r\n- API should return 404 when the feature is not enabled\r\n- ~Empty state message~ Not showing the graph preview instead.\r\n\r\n**How to test:**\r\n\r\nFirst, enable the feature, add to `config/kibana.dev.yml`:\r\n\r\n```yaml\r\nxpack.securitySolution.enableExperimental: ['graphVisualizationInFlyoutEnabled']\r\n```\r\n\r\nSecond, load mocked data\r\n\r\n```bash\r\nnode scripts/es_archiver load x-pack/test/cloud_security_posture_functional/es_archives/logs_gcp_audit \\ \r\n --es-url http://elastic:changeme@localhost:9200 \\\r\n --kibana-url http://elastic:changeme@localhost:5601\r\n\r\nnode scripts/es_archiver load x-pack/test/cloud_security_posture_functional/es_archives/security_alerts \\\r\n --es-url http://elastic:changeme@localhost:9200 \\\r\n --kibana-url http://elastic:changeme@localhost:5601\r\n```\r\n\r\n1. Go to the alerts page\r\n2. Change the query time range to show alerts from the 13th of October\r\n2024\r\n3. Open the alerts flyout\r\n4. Scroll to see the graph visualization : D\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] Any text added follows [EUI's writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\r\nsentence case text and includes [i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n- [x]\r\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\r\nwas added for features that require explanation or tutorials\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n- [x] [Flaky Test\r\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was\r\nused on any tests changed\r\n- [x] Any UI touched in this PR is usable by keyboard only (learn more\r\nabout [keyboard accessibility](https://webaim.org/techniques/keyboard/))\r\n- [ ] Any UI touched in this PR does not create any new axe failures\r\n(run axe in browser:\r\n[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),\r\n[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))\r\n- [ ] This renders correctly on smaller devices using a responsive\r\nlayout. (You can test this [in your\r\nbrowser](https://www.browserstack.com/guide/responsive-testing-on-local-server))\r\n- [ ] This was checked for [cross-browser\r\ncompatibility](https://www.elastic.co/support/matrix#matrix_browsers)\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine <[email protected]>","sha":"b4a80d8d506dd474b4dfb599fc123cb612a5d79b","branchLabelMapping":{"^v9.0.0$":"main","^v8.17.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","backport:prev-minor"],"title":"[Cloud Security] Added graph visualization in alert's flyout","number":196034,"url":"https://github.com/elastic/kibana/pull/196034","mergeCommit":{"message":"[Cloud Security] Added graph visualization in alert's flyout (#196034)\n\n## Summary\r\n\r\nEnables a new experimental feature. To visualize an alert/event by a\r\ngraph.\r\n\r\nWhen the alert/event does not contain the relevant data the graph\r\npreview will not be visible (confirmed by @tinnytintin10)\r\n\r\nTo enable the feature through kibana's config:\r\n\r\n```yaml\r\nxpack.securitySolution.enableExperimental: ['graphVisualizationInFlyoutEnabled']\r\n```\r\n\r\n<details>\r\n<summary>Event's graph visualization: 🎥 </summary>\r\n\r\n\r\nhttps://github.com/user-attachments/assets/4cee2032-173e-4b44-b371-a8e187763764\r\n\r\n</details>\r\n\r\n\r\n<details>\r\n<summary>Alert's graph visualization: 🎥 </summary>\r\n\r\n\r\nhttps://github.com/user-attachments/assets/4fb942d0-6704-4c79-862c-956821ce59b6\r\n\r\n</details>\r\n\r\n<details>\r\n<summary>Alert in rule preview: 🎥 </summary>\r\n\r\n\r\nhttps://github.com/user-attachments/assets/4f8d086e-1ee4-414f-8efa-4715c1d5e1f6\r\n\r\n</details>\r\n\r\n**List of TODO's**\r\n- Add FTR test to host's flyout\r\n- Add FTR test to alerts preview\r\n- Enhance graph_preview_container UT to cover all edge cases\r\n- Enhance visualization_section UT to cover all edge cases\r\n\r\n**List of open issues (will be tracked in a different ticket):**\r\n\r\n- Graph preview search on the past 60 days, which can lead to an empty\r\ngraph\r\n- API should return 404 when the feature is not enabled\r\n- ~Empty state message~ Not showing the graph preview instead.\r\n\r\n**How to test:**\r\n\r\nFirst, enable the feature, add to `config/kibana.dev.yml`:\r\n\r\n```yaml\r\nxpack.securitySolution.enableExperimental: ['graphVisualizationInFlyoutEnabled']\r\n```\r\n\r\nSecond, load mocked data\r\n\r\n```bash\r\nnode scripts/es_archiver load x-pack/test/cloud_security_posture_functional/es_archives/logs_gcp_audit \\ \r\n --es-url http://elastic:changeme@localhost:9200 \\\r\n --kibana-url http://elastic:changeme@localhost:5601\r\n\r\nnode scripts/es_archiver load x-pack/test/cloud_security_posture_functional/es_archives/security_alerts \\\r\n --es-url http://elastic:changeme@localhost:9200 \\\r\n --kibana-url http://elastic:changeme@localhost:5601\r\n```\r\n\r\n1. Go to the alerts page\r\n2. Change the query time range to show alerts from the 13th of October\r\n2024\r\n3. Open the alerts flyout\r\n4. Scroll to see the graph visualization : D\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] Any text added follows [EUI's writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\r\nsentence case text and includes [i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n- [x]\r\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\r\nwas added for features that require explanation or tutorials\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n- [x] [Flaky Test\r\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was\r\nused on any tests changed\r\n- [x] Any UI touched in this PR is usable by keyboard only (learn more\r\nabout [keyboard accessibility](https://webaim.org/techniques/keyboard/))\r\n- [ ] Any UI touched in this PR does not create any new axe failures\r\n(run axe in browser:\r\n[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),\r\n[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))\r\n- [ ] This renders correctly on smaller devices using a responsive\r\nlayout. (You can test this [in your\r\nbrowser](https://www.browserstack.com/guide/responsive-testing-on-local-server))\r\n- [ ] This was checked for [cross-browser\r\ncompatibility](https://www.elastic.co/support/matrix#matrix_browsers)\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine <[email protected]>","sha":"b4a80d8d506dd474b4dfb599fc123cb612a5d79b"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/196034","number":196034,"mergeCommit":{"message":"[Cloud Security] Added graph visualization in alert's flyout (#196034)\n\n## Summary\r\n\r\nEnables a new experimental feature. To visualize an alert/event by a\r\ngraph.\r\n\r\nWhen the alert/event does not contain the relevant data the graph\r\npreview will not be visible (confirmed by @tinnytintin10)\r\n\r\nTo enable the feature through kibana's config:\r\n\r\n```yaml\r\nxpack.securitySolution.enableExperimental: ['graphVisualizationInFlyoutEnabled']\r\n```\r\n\r\n<details>\r\n<summary>Event's graph visualization: 🎥 </summary>\r\n\r\n\r\nhttps://github.com/user-attachments/assets/4cee2032-173e-4b44-b371-a8e187763764\r\n\r\n</details>\r\n\r\n\r\n<details>\r\n<summary>Alert's graph visualization: 🎥 </summary>\r\n\r\n\r\nhttps://github.com/user-attachments/assets/4fb942d0-6704-4c79-862c-956821ce59b6\r\n\r\n</details>\r\n\r\n<details>\r\n<summary>Alert in rule preview: 🎥 </summary>\r\n\r\n\r\nhttps://github.com/user-attachments/assets/4f8d086e-1ee4-414f-8efa-4715c1d5e1f6\r\n\r\n</details>\r\n\r\n**List of TODO's**\r\n- Add FTR test to host's flyout\r\n- Add FTR test to alerts preview\r\n- Enhance graph_preview_container UT to cover all edge cases\r\n- Enhance visualization_section UT to cover all edge cases\r\n\r\n**List of open issues (will be tracked in a different ticket):**\r\n\r\n- Graph preview search on the past 60 days, which can lead to an empty\r\ngraph\r\n- API should return 404 when the feature is not enabled\r\n- ~Empty state message~ Not showing the graph preview instead.\r\n\r\n**How to test:**\r\n\r\nFirst, enable the feature, add to `config/kibana.dev.yml`:\r\n\r\n```yaml\r\nxpack.securitySolution.enableExperimental: ['graphVisualizationInFlyoutEnabled']\r\n```\r\n\r\nSecond, load mocked data\r\n\r\n```bash\r\nnode scripts/es_archiver load x-pack/test/cloud_security_posture_functional/es_archives/logs_gcp_audit \\ \r\n --es-url http://elastic:changeme@localhost:9200 \\\r\n --kibana-url http://elastic:changeme@localhost:5601\r\n\r\nnode scripts/es_archiver load x-pack/test/cloud_security_posture_functional/es_archives/security_alerts \\\r\n --es-url http://elastic:changeme@localhost:9200 \\\r\n --kibana-url http://elastic:changeme@localhost:5601\r\n```\r\n\r\n1. Go to the alerts page\r\n2. Change the query time range to show alerts from the 13th of October\r\n2024\r\n3. Open the alerts flyout\r\n4. Scroll to see the graph visualization : D\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] Any text added follows [EUI's writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\r\nsentence case text and includes [i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n- [x]\r\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\r\nwas added for features that require explanation or tutorials\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n- [x] [Flaky Test\r\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was\r\nused on any tests changed\r\n- [x] Any UI touched in this PR is usable by keyboard only (learn more\r\nabout [keyboard accessibility](https://webaim.org/techniques/keyboard/))\r\n- [ ] Any UI touched in this PR does not create any new axe failures\r\n(run axe in browser:\r\n[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),\r\n[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))\r\n- [ ] This renders correctly on smaller devices using a responsive\r\nlayout. (You can test this [in your\r\nbrowser](https://www.browserstack.com/guide/responsive-testing-on-local-server))\r\n- [ ] This was checked for [cross-browser\r\ncompatibility](https://www.elastic.co/support/matrix#matrix_browsers)\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine <[email protected]>","sha":"b4a80d8d506dd474b4dfb599fc123cb612a5d79b"}}]}] BACKPORT--> Co-authored-by: Kfir Peled <[email protected]>
- Loading branch information