[SIEM] clipboard-copy when selecting a draggable field in Timeline #59472
Labels
Comments
|
Pinging @elastic/siem (Team:SIEM) |
|
Thanks @mbarretta for raising this. There are indeed some inconsistencies and limitations in the copy-to-clipboard capabilities in SIEM that we need to address. As a workaround, there are some cases where it does indeed work correctly using right-clicking. For example in the various SIEM widgets found in the Hosts and Network views in 7.6.0:
In addition, the SIEM Timeline, Hosts Events table, Hosts External Alerts table, and Network External Alerts tables all have explicit copy-to-clipboard functions in their expanded views as shown here:
Thanks again! |
mbarretta
changed the title
|
@MikePaquette thank you for the response and pointing out the areas where clipboard-copy is implemented. I was working from the timeline, where there are fewer options outside of expanding the full record. I updated the title to call out Timeline specifically. As an aside, is the Timeline going to gain some type of integration with the rest of the Kibana search/filter bar so that the search/filter set there can be "reused" in other apps without having to rebuild the search? |
|
Thanks @mbarretta
If I understand your question correctly, this feature exists now. For example if you save your query in the Timeline KQL bar (I just saved RUNDLL32)...
You can use the same saved query across Kibana, say in Discover... Likewise, you can use a query you saved in Discover when using timeline, or when creating a SIEM signal detection rule. |
andrew-goldstein
added a commit
to andrew-goldstein/kibana
that referenced
this issue
Apr 16, 2020
 A new context menu with the following items has been added to all draggables: - Filter for value - Filter out value - Show top _field name_ - Copy to Clipboard as shown in the following animated gif:  The _Filter for value_ context menu action adds the draggable to the global filter bar, which is applicable to all pages in the SIEM app, per the following animated gif:  The _Filter out value_ context menu action adds the draggable to the global filter bar as a _negated_ (`NOT`) filter, per the following animated gif:  The _Show top field_ context menu action displays an interactive Top 10 histogram, per the following animated gif:  - The contents of the histogram are filtered by the global KQL bar / filters and current date range - Brushing over the bars in the histogram updates the global date range / picker - Select _Events_ or _Signals_ - The _Show top field_ action is also available in the Fields Browser, per the following animated gif:  The _Copy to clipboard_ context menu action copies the draggable field and value to the clipboard in KQL format (e.g. `process.name: "nice"`). Per the following animated gifs, it's now possible to copy _any_ draggable to the clipboard, and paste it in KQL format, which addresses [this feature request from a user](elastic#59472):   You may now pivot from chart legends by dragging and dropping them to a timeline, or by selecting the Filter for / out context menu action, per the following animated gif:  Desk tested in: - Chrome `81.0.4044.92` - Firefox `75.0` - Safari `13.1`
andrew-goldstein
added a commit
that referenced
this issue
Apr 17, 2020
…eld, Copy to Clipboard, Draggable chart legends (#61207) ## [SIEM] Threat hunting enhancements: Filter for/out value, Show top field, Copy to Clipboard, Draggable chart legends Enhancements to the threat hunting experience  ### New draggable context menu A new context menu with the following items has been added to all draggables: - Filter for value - Filter out value - Show top _field name_ - Copy to Clipboard as shown in the following animated gif:  ### Filter for value The _Filter for value_ context menu action adds the draggable to the global filter bar, which is applicable to all pages in the SIEM app, per the following animated gif:  ### Filter out value The _Filter out value_ context menu action adds the draggable to the global filter bar as a _negated_ (`NOT`) filter, per the following animated gif:  ### Show top _field_ The _Show top field_ context menu action displays an interactive Top 10 histogram, per the following animated gif:  - The contents of the histogram are filtered by the global KQL bar / filters and current date range - Brushing over the bars in the histogram updates the global date range / picker - Select _Events_ or _Signals_ - The _Show top field_ action is also available in the Fields Browser, per the following animated gif:  ### Copy to Clipboard The _Copy to clipboard_ context menu action copies the draggable field and value to the clipboard in KQL format (e.g. `process.name: "nice"`). Per the following animated gifs, it's now possible to copy _any_ draggable to the clipboard, and paste it in KQL format, which addresses [this feature request from a user](#59472):   ### Draggable chart legends You may now pivot from chart legends by dragging and dropping them to a timeline, or by selecting the Filter for / out context menu action, per the following animated gif:  #### Desk testing Desk tested in: - Chrome `81.0.4044.92` - Firefox `75.0` - Safari `13.1`
andrew-goldstein
added a commit
that referenced
this issue
Apr 17, 2020
…eld, Copy to Clipboard, Draggable chart legends (#61207) (#63816) ## [SIEM] Threat hunting enhancements: Filter for/out value, Show top field, Copy to Clipboard, Draggable chart legends Enhancements to the threat hunting experience  ### New draggable context menu A new context menu with the following items has been added to all draggables: - Filter for value - Filter out value - Show top _field name_ - Copy to Clipboard as shown in the following animated gif:  ### Filter for value The _Filter for value_ context menu action adds the draggable to the global filter bar, which is applicable to all pages in the SIEM app, per the following animated gif:  ### Filter out value The _Filter out value_ context menu action adds the draggable to the global filter bar as a _negated_ (`NOT`) filter, per the following animated gif:  ### Show top _field_ The _Show top field_ context menu action displays an interactive Top 10 histogram, per the following animated gif:  - The contents of the histogram are filtered by the global KQL bar / filters and current date range - Brushing over the bars in the histogram updates the global date range / picker - Select _Events_ or _Signals_ - The _Show top field_ action is also available in the Fields Browser, per the following animated gif:  ### Copy to Clipboard The _Copy to clipboard_ context menu action copies the draggable field and value to the clipboard in KQL format (e.g. `process.name: "nice"`). Per the following animated gifs, it's now possible to copy _any_ draggable to the clipboard, and paste it in KQL format, which addresses [this feature request from a user](#59472):   ### Draggable chart legends You may now pivot from chart legends by dragging and dropping them to a timeline, or by selecting the Filter for / out context menu action, per the following animated gif:  #### Desk testing Desk tested in: - Chrome `81.0.4044.92` - Firefox `75.0` - Safari `13.1`
This was
linked to
pull requests
Apr 18, 2020
|
Thanks again for your feedback @mbarretta! This merged pull request adds the Copy to ClipboardThe Copy to Clipboard context menu action copies the draggable field and value to the clipboard in KQL format (e.g. Per the following animated gifs, it's now possible to copy any draggable to the clipboard, and paste it in KQL format:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the feature:
The value of a draggable field should automatically be copied to your clipboard when you click on it.
Describe a specific use case for the feature:
Currently, draggable fields have no easy way to copy their values:
The only way to get the text value of a draggable field is to drag it to the Timeline query builder, edit the resulting filter, and copy it there. This makes it hard to use those values in other Kibana apps or in external applications.
One example use would be finding the md5sum of some process in Timeline, then wanting to filter for that value in a dashboard.
The text was updated successfully, but these errors were encountered: