[Security Solution][Endpoint] Update list api summary endpoint to use filter #123476

ashokaditya · 2022-01-20T15:42:35Z

Summary

Updates the summary endpoint of list API to allow kql filters in requests.

policy detail card:

integration host isolation exception card total

Checklist

Delete any items that are not applicable to this PR.

Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios

…ilters cards fixes elastic/security-team/issues/2513

fixes elastic/security-team/issues/2513

…facts fixes elastic/issues/121507

elasticmachine · 2022-01-24T15:22:19Z

Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt)

fixes elastic/security-team/issues/2513 ref elastic/kibana/pull/123476

pzl · 2022-01-24T17:50:56Z

x-pack/plugins/lists/server/services/exception_lists/get_exception_list_summary.ts

+        // Do not add up the items by OS if host isolation exception
+        // As each host exception entry applies to all OSs


thanks for commenting the "why" here 👍

ashokaditya · 2022-01-24T18:41:49Z

doc PR elastic/security-docs/pull/1439

…_filter

missing merge updates

dasansol92

This is looking so good! Thanks for adding this filter parameter.
I think we are missing the changes on the Trusted Apps card and on the Host isolation Exceptions card. In those places we can use the new summary api instead of the list one.

dasansol92 · 2022-01-25T14:07:04Z

x-pack/plugins/lists/server/services/exception_lists/get_exception_list_summary.test.ts

+        page: 1,
+        per_page: 0,
+        saved_objects: [],
+        total: 7,


Not relevant but I think this total number should be 6 according the counters above

@dasansol92 so this was because the API was returning +1 as total. I went looking for why that was and @paul-tavares helped me figure that out. We made the changes in bdc0c97 to fix that. Also updated the test mock to have the correct total.

x-pack/plugins/lists/server/services/exception_lists/get_exception_list_summary.ts

...ration/endpoint_package_custom_extension/components/fleet_integration_event_filters_card.tsx

review changes

x-pack/plugins/lists/server/services/exception_lists/get_exception_list_summary.ts

…_filter

ashokaditya · 2022-01-25T18:17:31Z

@elasticmachine merge upstream

…_filter

yctercero

Just did a code review, didn't pull down to check but code LGTM.

++ what Frank suggested about integration tests. Could you add an integration test that uses this new filter in https://github.com/elastic/kibana/blob/main/x-pack/test/lists_api_integration/security_and_spaces/tests/summary_exception_lists.ts ?

review suggestions

paul-tavares

Thanks for all the tests 👍

LGTM. Make sure you get 👍 's from Detections team and/or security solution platform team

yctercero

Thanks for the tests!

ashokaditya · 2022-01-26T18:02:56Z

@elasticmachine merge upstream

…_filter

kibana-ci · 2022-01-26T19:58:54Z

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`lists`	140.6KB	140.6KB	+10.0B
`securitySolution`	4.6MB	4.6MB	+30.0B
total			+40.0B

History

💔 Build #19785 failed bdc0c97
💚 Build #19484 succeeded e24628d
💔 Build #19464 failed 140ef7f
💔 Build #19403 failed a08472e
💛 Build #19333 was flaky 3d043fc

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @ashokaditya

dasansol92 · 2022-01-27T09:10:47Z

@ashokaditya I was checking this and I think my comment was missed

I think we are missing the changes on the Trusted Apps card and on the Host isolation Exceptions card. In those places we can use the new summary api instead of the list one.

Did you created a separated issue for it?

ashokaditya · 2022-01-27T09:13:12Z

I think we are missing the changes on the Trusted Apps card and on the Host isolation Exceptions card. In those places we can use the new summary API instead of the list one.

Oops my bad! I'll update those two in a new PR now. Thanks for looking into this and following up.

ref elastic/pull/123476

ref elastic#123476 (review)

* Update exception list summary api doc fixes elastic/security-team/issues/2513 ref elastic/kibana/pull/123476 * Update api-summary-exception-container.asciidoc * Update docs/detections/api/exceptions/api-summary-exception-container.asciidoc Co-authored-by: Janeen Mikell-Straughn <[email protected]> Co-authored-by: Janeen Mikell-Straughn <[email protected]>

…ation Exception cards to use exception list summary API (#123900) * don't use deprecated class ref /pull/123476 * update TA card to use summary api with filter ref #123476 (review) * update fleet hie card to use summary api ref #123476 (review) * update param types review changes Co-authored-by: Kibana Machine <[email protected]>

…ation Exception cards to use exception list summary API (elastic#123900) * don't use deprecated class ref elastic/pull/123476 * update TA card to use summary api with filter ref elastic#123476 (review) * update fleet hie card to use summary api ref elastic#123476 (review) * update param types review changes Co-authored-by: Kibana Machine <[email protected]>

ashokaditya self-assigned this Jan 20, 2022

ashokaditya added v8.1.0 release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution labels Jan 20, 2022

ashokaditya force-pushed the task/update_list_api_summary_endpoint_to_use_filter branch 3 times, most recently from 5c0458e to b9df82b Compare January 24, 2022 08:41

ashokaditya added 2 commits January 24, 2022 11:45

update summary endpoint to use filters and use that for fleet event f…

7ee4e6e

…ilters cards fixes elastic/security-team/issues/2513

update tests

c3980cc

fixes elastic/security-team/issues/2513

ashokaditya force-pushed the task/update_list_api_summary_endpoint_to_use_filter branch 2 times, most recently from c4b4519 to d806b35 Compare January 24, 2022 12:44

ashokaditya mentioned this pull request Jan 24, 2022

[Security Solution] [Bug] The total count of Host Isolations Exceptions under the advanced tab is incorrect #121507

Closed

update host isolation card to show total as the actual number of arti…

35d1ef9

…facts fixes elastic/issues/121507

ashokaditya force-pushed the task/update_list_api_summary_endpoint_to_use_filter branch from d806b35 to 35d1ef9 Compare January 24, 2022 15:22

ashokaditya marked this pull request as ready for review January 24, 2022 15:22

ashokaditya requested review from a team as code owners January 24, 2022 15:22

ashokaditya requested review from pzl and dasansol92 January 24, 2022 15:22

ashokaditya added a commit to ashokaditya/security-docs that referenced this pull request Jan 24, 2022

Update exception list summary api doc

f99b927

fixes elastic/security-team/issues/2513 ref elastic/kibana/pull/123476

pzl approved these changes Jan 24, 2022

View reviewed changes

ashokaditya mentioned this pull request Jan 24, 2022

Update exception list summary api doc elastic/security-docs#1439

Merged

ashokaditya added 2 commits January 25, 2022 08:59

Merge branch 'main' into task/update_list_api_summary_endpoint_to_use…

e56e24e

…_filter

fix types

3d043fc

missing merge updates

dasansol92 reviewed Jan 25, 2022

View reviewed changes

ashokaditya added 2 commits January 25, 2022 15:29

use named constant for isolation exception list

4f5be8b

review changes

Update fleet_integration_event_filters_card.tsx

a08472e

review changes

paul-tavares reviewed Jan 25, 2022

View reviewed changes

x-pack/plugins/lists/server/services/exception_lists/get_exception_list_summary.ts Outdated Show resolved Hide resolved

Merge branch 'main' into task/update_list_api_summary_endpoint_to_use…

140ef7f

…_filter

Merge branch 'main' into task/update_list_api_summary_endpoint_to_use…

e24628d

…_filter

yctercero approved these changes Jan 26, 2022

View reviewed changes

fix the total on summary api

bdc0c97

review suggestions

ashokaditya requested a review from a team as a code owner January 26, 2022 15:41

ashokaditya requested review from yctercero, FrankHassanabad, paul-tavares and dasansol92 January 26, 2022 15:41

paul-tavares approved these changes Jan 26, 2022

View reviewed changes

FrankHassanabad approved these changes Jan 26, 2022

View reviewed changes

yctercero approved these changes Jan 26, 2022

View reviewed changes

Merge branch 'main' into task/update_list_api_summary_endpoint_to_use…

7e2cdb8

…_filter

ashokaditya enabled auto-merge (squash) January 26, 2022 18:03

ashokaditya merged commit 1855702 into elastic:main Jan 26, 2022

kibanamachine added the backport:skip This commit does not require backporting label Jan 26, 2022

ashokaditya deleted the task/update_list_api_summary_endpoint_to_use_filter branch January 27, 2022 09:13

ashokaditya added a commit to ashokaditya/kibana that referenced this pull request Jan 27, 2022

don't use deprecated class

2002b04

ref elastic/pull/123476

ashokaditya added a commit to ashokaditya/kibana that referenced this pull request Jan 27, 2022

update TA card to use summary api with filter

653ffba

ref elastic#123476 (review)

ashokaditya mentioned this pull request Jan 27, 2022

[Security Solution][Endpoint] Update Fleet TA and HIE cards to use exception list summary API #123900

Merged

1 task

ashokaditya added a commit to ashokaditya/kibana that referenced this pull request Jan 27, 2022

update fleet hie card to use summary api

af83384

ref elastic#123476 (review)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Endpoint] Update list api summary endpoint to use filter #123476

[Security Solution][Endpoint] Update list api summary endpoint to use filter #123476

ashokaditya commented Jan 20, 2022 •

edited

Loading

elasticmachine commented Jan 24, 2022

pzl Jan 24, 2022

ashokaditya Jan 25, 2022

ashokaditya commented Jan 24, 2022

dasansol92 left a comment

dasansol92 Jan 25, 2022

ashokaditya Jan 26, 2022

ashokaditya commented Jan 25, 2022

yctercero left a comment

paul-tavares left a comment

yctercero left a comment

ashokaditya commented Jan 26, 2022

kibana-ci commented Jan 26, 2022

dasansol92 commented Jan 27, 2022

ashokaditya commented Jan 27, 2022

		// Do not add up the items by OS if host isolation exception
		// As each host exception entry applies to all OSs

[Security Solution][Endpoint] Update list api summary endpoint to use filter #123476

[Security Solution][Endpoint] Update list api summary endpoint to use filter #123476

Conversation

ashokaditya commented Jan 20, 2022 • edited Loading

Summary

Checklist

elasticmachine commented Jan 24, 2022

pzl Jan 24, 2022

Choose a reason for hiding this comment

ashokaditya Jan 25, 2022

Choose a reason for hiding this comment

ashokaditya commented Jan 24, 2022

dasansol92 left a comment

Choose a reason for hiding this comment

dasansol92 Jan 25, 2022

Choose a reason for hiding this comment

ashokaditya Jan 26, 2022

Choose a reason for hiding this comment

ashokaditya commented Jan 25, 2022

yctercero left a comment

Choose a reason for hiding this comment

paul-tavares left a comment

Choose a reason for hiding this comment

yctercero left a comment

Choose a reason for hiding this comment

ashokaditya commented Jan 26, 2022

kibana-ci commented Jan 26, 2022

💚 Build Succeeded

Metrics [docs]

Async chunks

History

dasansol92 commented Jan 27, 2022

ashokaditya commented Jan 27, 2022

ashokaditya commented Jan 20, 2022 •

edited

Loading