Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[GS] Add Security Solution deep links to navigational search #86167

Closed
joshdover opened this issue Dec 16, 2020 · 5 comments · Fixed by #89772
Closed

[GS] Add Security Solution deep links to navigational search #86167

joshdover opened this issue Dec 16, 2020 · 5 comments · Fixed by #89772
Labels
enhancement New value added to drive a business result Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM

Comments

@joshdover
Copy link
Contributor

joshdover commented Dec 16, 2020

Meta issue: #72680

In #83380 we added support for applications to include a searchDeepLinks property on their core.application.register call which feeds into the navigational search feature.

Security Solution apps should add this property to add deep links for their key locations to search. In most cases, this should be adding an array with the name of the location and a URL path to the route in your app. See the documentation for this API for more info. Some things to consider:

  • The title for each link should be localized
  • The path for each link should be relative to your application's appRoute. Base path does not need to be included.
  • If there are locations that are only conditionally available (for example, due to licensing or feature controls), you can utilize the appUpdater$ API. See the example in the Stack Management app.

New links to add

Detections

  • Detected signals (same entry point as Detections app)
  • External Alerts
  • Manage signal detection rules

Hosts

  • All hosts (same entry point as Hosts app)
  • Authentications
  • Uncommon processes
  • Anomalies
  • Events
  • External alerts

Network

  • Flows (same entry point as Network app)
  • DNS
  • HTTP
  • TLS
  • Anomalies
  • External alerts

Timelines

  • Timeline (same entry point as Timeline app)
  • Templates
@joshdover joshdover added enhancement New value added to drive a business result Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM labels Dec 16, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/siem (Team:SIEM)

@joshdover
Copy link
Contributor Author

@spong Any update here on when this may be scheduled?

@spong
Copy link
Member

spong commented Jan 27, 2021

I spoke with @oatkiller and he mentioned @kqualters-elastic is looking at some of this for 7.12 (exposing security entities), but the rest might bleed over to 7.13.

@kqualters-elastic
Copy link
Contributor

Most of these locations should now be searchable in Kibana when license level is appropriate. The tabs on the manage detections page are missing however, as those tabs are not their own route like in other places in SIEM, the active tab is instead tracked in application state.
image
Shouldn't be much effort to add search entries here https://github.com/elastic/kibana/blob/master/x-pack/plugins/security_solution/public/app/search/index.ts#L20 if those tabs are ever linked to the url.

@spong
Copy link
Member

spong commented Mar 1, 2021

Thanks @kqualters-elastic! For future reference, here's the issue I created for adding deep links into those views within Detections: #92345

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New value added to drive a business result Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants