[ResponseOps][Cases] Set case alert attachment rule info to null #123094

jonathan-buttner · 2022-01-14T22:47:57Z

This PR is the first step for fixing the above issue where we didn't migrate the rule.id field from the case attachment saved object into the saved object reference field. This solution incurs a performance hit since the frontend will have to look up the rule name for each alert. I don't anticipate this being much of an issue because we likely don't have many alerts attached to cases right now.

I talked with Brandon and Sophie and we thought this was a less drastic fix than migrating the field to the references. We also were concerned that if we moved the rule.id then when a user exports a case, it will also export the rule, and we weren't sure that's what users would want.

Testing

To test I would attach an alert to the case, then grab the alertId and case ID information to use with a postman request like this:

{
    "alertId": [<add a valid alertId here>],
    "index": [".internal.alerts-security.alerts-default-000001"],
    "rule": { "id": null, "name": null },
    "type": "alert",
    "owner": "securitySolution"
}

You should see the rule's name show up for both alerts and clicking on it should take you to the rule's page.

elasticmachine · 2022-01-14T22:47:59Z

Pinging @elastic/response-ops (Team:ResponseOps)

elasticmachine · 2022-01-14T22:47:59Z

Pinging @elastic/response-ops-cases (Feature:Cases)

x-pack/plugins/cases/public/components/user_actions/comment/alert.tsx

x-pack/plugins/cases/public/components/user_actions/comment/alert.test.tsx

x-pack/plugins/cases/public/components/user_actions/comment/alert.tsx

cnasikas · 2022-01-17T11:16:57Z

@elasticmachine merge upstream

x-pack/plugins/cases/server/saved_object_types/migrations/comments.ts

…le-info

jonathan-buttner · 2022-01-18T21:15:33Z

x-pack/plugins/cases/server/saved_object_types/migrations/user_actions/types.ts

@@ -15,7 +15,7 @@ export interface UserActions {
  owner: string;
 }

-export interface UserActionUnmigratedConnectorDocument {
+export interface UserActionVersion800 {


I'm happy to name this something else, the reason I changed it is because it's being used for the new removeRuleInformation migration and a few other ones (it's not just a connectors thing anymore).

Maybe we can give a name that distinguishes the old mapping (new_value, old_value) from the new one (payload: { connector, ... })

jonathan-buttner · 2022-01-18T21:45:39Z

@elasticmachine merge upstream

kibana-ci · 2022-01-18T23:35:06Z

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`cases`	311.3KB	311.3KB	+18.0B

Unknown metric groups

ESLint disabled in files

id	before	after	diff
`cases`	18	19	+1

Total ESLint disabled count

id	before	after	diff
`cases`	89	90	+1

History

💔 Build #18195 failed 706295b
💚 Build #17762 succeeded 282ebfd
💚 Build #17655 succeeded a7ddb24

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cnasikas

Tested by importing a 7.16 case and is working as expected! 🚀

## Summary See this PR from here: #123094 Where `"rule": { "id": null, "name": null },` can be null. This just adds guards around it to prevent possible errors. Note, I tested it first and there aren't errors with this even if we don't merge but that is not a guarantee that later NodeJS wouldn't cause errors if the implementation details of [Map](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map) change. Note, I don't try to do any additional lookups if these are `null` as the release is coming very quickly and I do not want to overcomplicate telemetry and we don't have dashboards around the cases feature. Over time I would expect the telemetry to become more accurate again even if cases are `nulled` out. **Manual testing** Either create a true upgrade where all the id's changed by going to 7.16 and making a new space, then within that space outside of default creating cases and alerts and then do an upgrade to 8.0.0 ... or ... Downgrade a `case-comments` like so manually in dev tools: ```ts # Get all case-comments to choose an id GET .kibana/_search { "query": { "term": { "type": "cases-comments" } } } ``` ```ts # Downgrades a case comment of id "25554290-7a36-11ec-8d37-0d0e30a77b60" POST .kibana/_update/cases-comments:25554290-7a36-11ec-8d37-0d0e30a77b60 { "script" : { "source": """ ctx._source.migrationVersion['cases-comments'] = "7.16.3"; """, "lang": "painless" } } ``` Restart Kibana and you should query the same `case-comments` and see that the `"rule": { "id": null, "name": null },` are all null. Either way once you have a null rule go to `Advanced Settings -> cluster data` and ensure that you still get metrics flowing and that one is no longer counted but if you create a new one everything still works as expected: <img width="647" alt="Screen Shot 2022-01-24 at 11 48 39 AM" src="https://user-images.githubusercontent.com/1151048/150846789-d94ac212-6c45-44cc-a663-cd304bfda22e.png"> ### Checklist - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios We still don't have this for the existing telemetry and are running out of time for 8.0.0 to add them. We might re-write this part of telemetry as well so I am not adding tests just yet.

…123643) ## Summary See this PR from here: elastic#123094 Where `"rule": { "id": null, "name": null },` can be null. This just adds guards around it to prevent possible errors. Note, I tested it first and there aren't errors with this even if we don't merge but that is not a guarantee that later NodeJS wouldn't cause errors if the implementation details of [Map](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map) change. Note, I don't try to do any additional lookups if these are `null` as the release is coming very quickly and I do not want to overcomplicate telemetry and we don't have dashboards around the cases feature. Over time I would expect the telemetry to become more accurate again even if cases are `nulled` out. **Manual testing** Either create a true upgrade where all the id's changed by going to 7.16 and making a new space, then within that space outside of default creating cases and alerts and then do an upgrade to 8.0.0 ... or ... Downgrade a `case-comments` like so manually in dev tools: ```ts # Get all case-comments to choose an id GET .kibana/_search { "query": { "term": { "type": "cases-comments" } } } ``` ```ts # Downgrades a case comment of id "25554290-7a36-11ec-8d37-0d0e30a77b60" POST .kibana/_update/cases-comments:25554290-7a36-11ec-8d37-0d0e30a77b60 { "script" : { "source": """ ctx._source.migrationVersion['cases-comments'] = "7.16.3"; """, "lang": "painless" } } ``` Restart Kibana and you should query the same `case-comments` and see that the `"rule": { "id": null, "name": null },` are all null. Either way once you have a null rule go to `Advanced Settings -> cluster data` and ensure that you still get metrics flowing and that one is no longer counted but if you create a new one everything still works as expected: <img width="647" alt="Screen Shot 2022-01-24 at 11 48 39 AM" src="https://user-images.githubusercontent.com/1151048/150846789-d94ac212-6c45-44cc-a663-cd304bfda22e.png"> ### Checklist - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios We still don't have this for the existing telemetry and are running out of time for 8.0.0 to add them. We might re-write this part of telemetry as well so I am not adding tests just yet. (cherry picked from commit 607feec)

…#123747) ## Summary See this PR from here: #123094 Where `"rule": { "id": null, "name": null },` can be null. This just adds guards around it to prevent possible errors. Note, I tested it first and there aren't errors with this even if we don't merge but that is not a guarantee that later NodeJS wouldn't cause errors if the implementation details of [Map](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map) change. Note, I don't try to do any additional lookups if these are `null` as the release is coming very quickly and I do not want to overcomplicate telemetry and we don't have dashboards around the cases feature. Over time I would expect the telemetry to become more accurate again even if cases are `nulled` out. **Manual testing** Either create a true upgrade where all the id's changed by going to 7.16 and making a new space, then within that space outside of default creating cases and alerts and then do an upgrade to 8.0.0 ... or ... Downgrade a `case-comments` like so manually in dev tools: ```ts # Get all case-comments to choose an id GET .kibana/_search { "query": { "term": { "type": "cases-comments" } } } ``` ```ts # Downgrades a case comment of id "25554290-7a36-11ec-8d37-0d0e30a77b60" POST .kibana/_update/cases-comments:25554290-7a36-11ec-8d37-0d0e30a77b60 { "script" : { "source": """ ctx._source.migrationVersion['cases-comments'] = "7.16.3"; """, "lang": "painless" } } ``` Restart Kibana and you should query the same `case-comments` and see that the `"rule": { "id": null, "name": null },` are all null. Either way once you have a null rule go to `Advanced Settings -> cluster data` and ensure that you still get metrics flowing and that one is no longer counted but if you create a new one everything still works as expected: <img width="647" alt="Screen Shot 2022-01-24 at 11 48 39 AM" src="https://user-images.githubusercontent.com/1151048/150846789-d94ac212-6c45-44cc-a663-cd304bfda22e.png"> ### Checklist - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios We still don't have this for the existing telemetry and are running out of time for 8.0.0 to add them. We might re-write this part of telemetry as well so I am not adding tests just yet. (cherry picked from commit 607feec) Co-authored-by: Frank Hassanabad <[email protected]>

Setting rule info to null

6704826

jonathan-buttner added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) Feature:Cases Cases feature v8.1.0 labels Jan 14, 2022

jonathan-buttner requested review from academo, kobelb, peteharverson and cnasikas January 14, 2022 22:47

jonathan-buttner commented Jan 14, 2022

View reviewed changes

x-pack/plugins/cases/public/components/user_actions/comment/alert.tsx Show resolved Hide resolved

Renaming variables

a7ddb24

jonathan-buttner added backport:skip This commit does not require backporting and removed v8.0.0 labels Jan 14, 2022

jonathan-buttner mentioned this pull request Jan 14, 2022

[ResponseOps][Cases] Setting rule info to null for 8.0 #123096

Merged

academo reviewed Jan 17, 2022

View reviewed changes

x-pack/plugins/cases/public/components/user_actions/comment/alert.test.tsx Outdated Show resolved Hide resolved

academo reviewed Jan 17, 2022

View reviewed changes

x-pack/plugins/cases/public/components/user_actions/comment/alert.tsx Outdated Show resolved Hide resolved

Merge branch 'main' into cases-remove-rule-info

282ebfd

cnasikas added v8.0.0 and removed v8.0.0 labels Jan 17, 2022

cnasikas reviewed Jan 17, 2022

View reviewed changes

x-pack/plugins/cases/server/saved_object_types/migrations/comments.ts Show resolved Hide resolved

jonathan-buttner added 2 commits January 18, 2022 14:40

Merge branch 'main' of github.com:elastic/kibana into cases-remove-ru…

b0bcfd4

…le-info

Addressing PR feedback

706295b

jonathan-buttner commented Jan 18, 2022

View reviewed changes

Merge branch 'main' into cases-remove-rule-info

62f09ff

cnasikas approved these changes Jan 19, 2022

View reviewed changes

jonathan-buttner merged commit d1eb0df into elastic:main Jan 19, 2022

jonathan-buttner deleted the cases-remove-rule-info branch January 19, 2022 14:30

FrankHassanabad mentioned this pull request Jan 24, 2022

[Security Solutions] Adds type fixes for case cache in case it's null/undefined #123643

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ResponseOps][Cases] Set case alert attachment rule info to null #123094

[ResponseOps][Cases] Set case alert attachment rule info to null #123094

jonathan-buttner commented Jan 14, 2022 •

edited

Loading

elasticmachine commented Jan 14, 2022

elasticmachine commented Jan 14, 2022

cnasikas commented Jan 17, 2022

jonathan-buttner Jan 18, 2022 •

edited

Loading

cnasikas Jan 19, 2022 •

edited

Loading

jonathan-buttner commented Jan 18, 2022

kibana-ci commented Jan 18, 2022

ESLint disabled in files

Total ESLint disabled count

cnasikas left a comment

[ResponseOps][Cases] Set case alert attachment rule info to null #123094

[ResponseOps][Cases] Set case alert attachment rule info to null #123094

Conversation

jonathan-buttner commented Jan 14, 2022 • edited Loading

Testing

elasticmachine commented Jan 14, 2022

elasticmachine commented Jan 14, 2022

cnasikas commented Jan 17, 2022

jonathan-buttner Jan 18, 2022 • edited Loading

Choose a reason for hiding this comment

cnasikas Jan 19, 2022 • edited Loading

Choose a reason for hiding this comment

jonathan-buttner commented Jan 18, 2022

kibana-ci commented Jan 18, 2022

💚 Build Succeeded

Metrics [docs]

Async chunks

ESLint disabled in files

Total ESLint disabled count

History

cnasikas left a comment

Choose a reason for hiding this comment

jonathan-buttner commented Jan 14, 2022 •

edited

Loading

jonathan-buttner Jan 18, 2022 •

edited

Loading

cnasikas Jan 19, 2022 •

edited

Loading