[Security Solution][Detection Alerts] Changes in-progress status to acknowledged #107972

dplumlee · 2021-08-09T20:41:10Z

Summary

Related to the RAC updates (#107923)

Updates alert status options to include acknowledged instead of in-progress

Screenshots

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios

For maintainers

This was checked for breaking API changes and was labeled appropriately

elasticmachine · 2021-08-16T21:27:03Z

Pinging @elastic/security-detections-response (Team:Detections and Resp)

dhurley14

For the text changes proposed here, It would be great to see an integration test added to this file where we update an alert to have an 'acknowledged' status:

https://github.com/elastic/kibana/blob/f243b0540d954a53b1b0371feb22c1cfd5593de9/x-pack/test/detection_engine_api_integration/basic/tests/update_rac_alerts.ts

rylnd

I checked this out and observed behavior with existing alerts. We're broadening the validations here so we should be safe in terms of legacy data, and most logic appears to treat in-progress and acknowledged identically. At a high level this seems like an opportunity to apply some "transform on read" functionality to alerts, but totally understand if that's not feasible right now.

Like other reviewers I'd love to see an integration test that asserts something about the new status value; it's also a little concerning that none of the existing integration tests do so 😬 .

michaelolo24 · 2021-08-17T22:34:13Z

x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx

@@ -193,7 +194,8 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
          title = i18n.OPENED_ALERT_FAILED_TOAST;
          break;
        case 'in-progress':


Can you create a separate issue to remove the in-progress references later on?

issue here #109030

michaelolo24 · 2021-08-17T22:35:34Z

x-pack/plugins/security_solution/server/lib/detection_engine/migrations/create_migration.ts

                    ctx._source.threat.enrichments.add(enrichment);
                  }
                  ctx._source.threat.remove("indicator");
                }
+
+                // migrate status
+                if(ctx._source.signal?.status == "in-progress") {


michaelolo24 · 2021-08-17T22:36:10Z

x-pack/plugins/timelines/common/constants.ts

+
+/**
+ * @deprecated
+ * TODO: Remove after `acknowledged` migration


This can go with the issue above. Just don't want us to lose track of this and have a build up of dead code

dplumlee · 2021-08-18T00:49:08Z

@elasticmachine merge upstream

XavierM · 2021-08-18T03:24:32Z

x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx

@@ -337,7 +337,9 @@ describe('EventsViewer', () => {
          <EventsViewer
            {...eventsViewerDefaultProps}
            graphEventId={undefined}
-            headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
+            headerFilterGroup={


why are we updating?

the headerFilterGroup should not be used anymore

the AlertsTableFilterGroup component updated, but we should probably delete/modify most of these since we don't use it this way in the app anymore

@XavierM we still have the property there though, no? I don't think we need this many tests anymore but it might be worthwhile to keep some around in case we use it with the component somewhere down the line.

XavierM · 2021-08-18T03:25:33Z

...ns/security_solution/public/detections/components/alerts_table/alerts_filter_group/index.tsx

-      </StatusFilterButton>
-    </StatusFilterGroup>
+    <EuiButtonGroup
+      legend="filter status"


maybe we need translations here

XavierM · 2021-08-18T03:25:58Z

...ns/security_solution/public/detections/components/alerts_table/alerts_filter_group/index.tsx

+      options={options}
+      idSelected={status}
+      data-test-subj="alerts-table-filter-group"
+      onChange={(id) => onFilterGroupChanged(id as Status)}


nit -> use useCallback

XavierM · 2021-08-18T03:26:27Z

...ins/security_solution/public/detections/components/alerts_table/alerts_utility_bar/index.tsx

        <EuiFlexItem>
          <Link
-            aria-label="markSelectedAlertsInProgress"
+            aria-label="markSelectedAlertsAcknowledged"
            onClick={() => {


use. useCallback

XavierM · 2021-08-18T03:29:41Z

x-pack/plugins/timelines/public/hooks/use_status_bulk_action_items.tsx

-          onClick={() => onClickUpdate(FILTER_IN_PROGRESS)}
+          key="acknowledge"
+          data-test-subj="acknowledged-alert-status"
+          onClick={() => onClickUpdate(FILTER_ACKNOWLEDGED)}


nit - use useCallback

XavierM

Code looks good

michaelolo24

Really nice job with this and thanks for making all the changes. 🔥 🔥 🔥 Great job!

kibanamachine · 2021-08-18T06:12:13Z

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	6.5MB	6.5MB	-1.5KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	211.7KB	211.7KB	+18.0B
`timelines`	318.3KB	318.3KB	+63.0B
total			+81.0B

Unknown metric groups

API count

id	before	after	diff
`timelines`	959	960	+1

API count missing comments

id	before	after	diff
`timelines`	839	840	+1

History

💔 Build #146452 failed a9bdacb
💔 Build #146366 failed 51a4d0a
💚 Build #146207 succeeded 0f41e65
💚 Build #146021 succeeded 24c0738
💔 Build #145947 failed 370ac1d

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @dplumlee

…cknowledged (elastic#107972)

kibanamachine · 2021-08-18T06:15:36Z

💚 Backport successful

Status	Branch	Result
✅	7.x

This backport PR will be merged automatically after passing CI.

…cknowledged (#107972) (#109042) Co-authored-by: Davis Plumlee <[email protected]>

dplumlee added release_note:enhancement v8.0.0 Team:Detections and Resp Security Detection Response Team Feature:Detection Alerts Security Solution Detection Alerts Feature Theme: rac label obsolete Feature:RAC label obsolete v7.15.0 labels Aug 9, 2021

dplumlee self-assigned this Aug 9, 2021

peluja1012 mentioned this pull request Aug 10, 2021

[Security Solution][RAC] - Table Filter Updates #107923

Closed

4 tasks

michaelolo24 mentioned this pull request Aug 11, 2021

[Security Solution][RAC] - 7.15 Checklist #108071

Closed

48 tasks

dplumlee force-pushed the in-progress-acknowledged-switch branch 2 times, most recently from 5d05168 to 370ac1d Compare August 16, 2021 21:26

dplumlee requested a review from rylnd August 16, 2021 21:26

dplumlee marked this pull request as ready for review August 16, 2021 21:27

dplumlee requested review from a team as code owners August 16, 2021 21:27

mgiota mentioned this pull request Aug 17, 2021

[RAC] 7.15 Observability Checklist #107933

Closed

52 tasks

dplumlee mentioned this pull request Aug 17, 2021

[RAC] Workflow status button group on Security is showing different than on Observability #108893

Closed

dhurley14 reviewed Aug 17, 2021

View reviewed changes

rylnd approved these changes Aug 17, 2021

View reviewed changes

dplumlee force-pushed the in-progress-acknowledged-switch branch from da035ee to 51a4d0a Compare August 17, 2021 20:33

michaelolo24 reviewed Aug 17, 2021

View reviewed changes

dplumlee mentioned this pull request Aug 18, 2021

[Security Solution][RAC] Remove in-progress type guards once migration is complete #109030

Closed

dplumlee added the auto-backport Deprecated - use backport:version if exact versions are needed label Aug 18, 2021

XavierM reviewed Aug 18, 2021

View reviewed changes

XavierM approved these changes Aug 18, 2021

View reviewed changes

michaelolo24 approved these changes Aug 18, 2021

View reviewed changes

dplumlee added 12 commits August 17, 2021 23:54

updates front end names

fb186d1

fixes translation issue

d97be19

updates types

0b05733

fixes merge

9116dd8

adds migration script

21148d7

adds type guards for backwards compatability

e79419d

fixes cypress tests

47379f8

fixing design bug

4f463b6

updates tests

0c77834

adds integration tests

8daf78f

fixes merge conflicts

5c76556

skips cypress

ecd286c

dplumlee force-pushed the in-progress-acknowledged-switch branch from a9bdacb to ecd286c Compare August 18, 2021 03:54

dplumlee mentioned this pull request Aug 18, 2021

[Security Solution] Reenable skipped cypress tests #109038

Closed

dplumlee enabled auto-merge (squash) August 18, 2021 04:03

dplumlee merged commit fc1a2bb into elastic:master Aug 18, 2021

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Aug 18, 2021

[Security Solution][Detection Alerts] Changes in-progress status to a…

9b2049b

…cknowledged (elastic#107972)

kibanamachine mentioned this pull request Aug 18, 2021

[7.x] [Security Solution][Detection Alerts] Changes in-progress status to acknowledged (#107972) #109042

Merged

kibanamachine added a commit that referenced this pull request Aug 18, 2021

[Security Solution][Detection Alerts] Changes in-progress status to a…

205de2a

…cknowledged (#107972) (#109042) Co-authored-by: Davis Plumlee <[email protected]>

dplumlee deleted the in-progress-acknowledged-switch branch August 18, 2021 18:22

dplumlee mentioned this pull request Aug 19, 2021

[Security Solution][RAC] Adds OR bool for acknowledged status filter #109348

Merged

3 tasks

peluja1012 mentioned this pull request Dec 23, 2022

[BUG] "Set alert status" API doc mentions "in-progress" status instead of "acknowledged" elastic/security-docs#2798

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Detection Alerts] Changes in-progress status to acknowledged #107972

[Security Solution][Detection Alerts] Changes in-progress status to acknowledged #107972

dplumlee commented Aug 9, 2021 •

edited

Loading

elasticmachine commented Aug 16, 2021

dhurley14 left a comment

rylnd left a comment

michaelolo24 Aug 17, 2021 •

edited

Loading

dplumlee Aug 18, 2021

michaelolo24 Aug 17, 2021

michaelolo24 Aug 17, 2021

dplumlee commented Aug 18, 2021

XavierM Aug 18, 2021

XavierM Aug 18, 2021

dplumlee Aug 18, 2021

dplumlee Aug 18, 2021

XavierM Aug 18, 2021

XavierM Aug 18, 2021

XavierM Aug 18, 2021

XavierM Aug 18, 2021

XavierM left a comment

michaelolo24 left a comment

kibanamachine commented Aug 18, 2021

API count

API count missing comments

kibanamachine commented Aug 18, 2021

[Security Solution][Detection Alerts] Changes in-progress status to acknowledged #107972

[Security Solution][Detection Alerts] Changes in-progress status to acknowledged #107972

Conversation

dplumlee commented Aug 9, 2021 • edited Loading

Summary

Screenshots

Checklist

For maintainers

elasticmachine commented Aug 16, 2021

dhurley14 left a comment

Choose a reason for hiding this comment

rylnd left a comment

Choose a reason for hiding this comment

michaelolo24 Aug 17, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dplumlee commented Aug 18, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

XavierM left a comment

Choose a reason for hiding this comment

michaelolo24 left a comment

Choose a reason for hiding this comment

kibanamachine commented Aug 18, 2021

💚 Build Succeeded

Metrics [docs]

Async chunks

Page load bundle

API count

API count missing comments

History

kibanamachine commented Aug 18, 2021

💚 Backport successful

dplumlee commented Aug 9, 2021 •

edited

Loading

michaelolo24 Aug 17, 2021 •

edited

Loading