[SecuritySolution] Turn prevalence count into a button #133791

janmonschke · 2022-06-07T15:33:18Z

Summary

After some feedback with design and product, we decided to remove the Investigate in timeline column and make the prevalence count a button that achieves the same thing. Now the interaction ties in better with other parts of the Kibana UI where we show counts to start a timeline investigation and it uses less space in the alert flyout.

Before	After

Checklist

Unit or functional tests were updated or added to match the most common scenarios

- Ties in with other parts of the UI where we show counts that are actionable and start a timeline investigation - Uses less space in the flyout

janmonschke · 2022-06-07T15:48:48Z

...olution/public/common/components/event_details/table/investigate_in_timeline_button.test.tsx

@@ -113,22 +96,4 @@ describe('AddToTimelineCellRenderer', () => {
      expect(screen.queryByLabelText(ACTION_INVESTIGATE_IN_TIMELINE)).not.toBeInTheDocument();
    });
  });
-
-  describe('When the field is the host status field', () => {


This test is not required anymore since no prevalence data is returned for this field and the button therefore is not rendered.

janmonschke · 2022-06-07T15:49:36Z

...ity_solution/public/common/components/event_details/table/investigate_in_timeline_button.tsx

@@ -0,0 +1,88 @@
+/*


I renamed this file, so tracking changes in this file is a bit cumbersome. I annotated the changes for y'all's convenience.

janmonschke · 2022-06-07T15:50:01Z

...ity_solution/public/common/components/event_details/table/investigate_in_timeline_button.tsx

+  React.PropsWithChildren<AlertSummaryRow['description']>
+>(({ data, eventId, fieldFromBrowserField, linkValue, timelineId, values, children }) => {


Added children to type and extracted it from props

janmonschke · 2022-06-07T15:51:02Z

...ity_solution/public/common/components/event_details/table/investigate_in_timeline_button.tsx

+    }
+  }, [dispatch, clearTimeline, actionCellConfig]);
+
+  const showButton = values != null && !isEmpty(actionCellConfig?.dataProvider);


Removed const fieldHasActionsEnabled = hasHoverOrRowActions(data.field); since the logic is not required anymore.

janmonschke · 2022-06-07T15:51:20Z

...ity_solution/public/common/components/event_details/table/investigate_in_timeline_button.tsx

+      <EuiButtonEmpty
+        aria-label={ACTION_INVESTIGATE_IN_TIMELINE}
+        onClick={configureAndOpenTimeline}
+        flush="right"
+        size="xs"
+      >
+        {children}
+      </EuiButtonEmpty>


Uses a different button than it did before

…-ref HEAD~1..HEAD --fix'

kibana-ci · 2022-06-07T17:25:50Z

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	5.1MB	5.1MB	+19.0B

History

💔 Build #49640 failed a398eb4

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @janmonschke

michaelolo24

Looks good, thanks for doing. LGTM!

kqualters-elastic

desk tested locally, works as expected lgtm 👍

* feat: turn prevalence count into a button - Ties in with other parts of the UI where we show counts that are actionable and start a timeline investigation - Uses less space in the flyout * fix: remove unused variable * [CI] Auto-commit changed files from 'node scripts/precommit_hook.js --ref HEAD~1..HEAD --fix' Co-authored-by: kibanamachine <[email protected]> (cherry picked from commit dd95fa2)

kibanamachine · 2022-06-08T20:19:13Z

💚 All backports created successfully

Status	Branch	Result
✅	8.3

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…3957) * feat: turn prevalence count into a button - Ties in with other parts of the UI where we show counts that are actionable and start a timeline investigation - Uses less space in the flyout * fix: remove unused variable * [CI] Auto-commit changed files from 'node scripts/precommit_hook.js --ref HEAD~1..HEAD --fix' Co-authored-by: kibanamachine <[email protected]> (cherry picked from commit dd95fa2) Co-authored-by: Jan Monschke <[email protected]>

ghost · 2022-06-14T12:53:11Z

@janmonschke tested pr on local kibana and targeted issue is now fixed . prevalence count into a button and got added in investigation✔️

10.0.6.219.-.Remote.Desktop.Connection.2022-06-14.18-21-40.mp4

stephmilovic · 2022-09-20T14:49:29Z

...ity_solution/public/common/components/event_details/table/investigate_in_timeline_button.tsx

+          selectedDataViewId: 'security-solution-default',
+          selectedPatterns: ['.alerts-security.alerts-default'],


The data view ids are space sensitive. You should just get them off of redux, sourcerer.defaultDataView.id and sourcerer.signalIndexName

Above, call

import { sourcererSelectors } from '../../store'; const getDataViewsSelector = useMemo( () => sourcererSelectors.getSourcererDataViewsSelector(), [] ); const { defaultDataView, signalIndexName, } = useDeepEqualSelector((state) => getDataViewsSelector(state));

and then here we would call

selectedDataViewId: defaultDataView.id, selectedPatterns: [signalIndexName],

feat: turn prevalence count into a button

a398eb4

- Ties in with other parts of the UI where we show counts that are actionable and start a timeline investigation - Uses less space in the flyout

janmonschke added release_note:skip Skip the PR/issue when compiling release notes auto-backport Deprecated - use backport:version if exact versions are needed Team:Threat Hunting:Investigations Security Solution Investigations Team v8.3.0 v8.3.1 labels Jun 7, 2022

janmonschke self-assigned this Jun 7, 2022

janmonschke requested a review from a team as a code owner June 7, 2022 15:33

janmonschke commented Jun 7, 2022

View reviewed changes

janmonschke and others added 2 commits June 7, 2022 18:14

fix: remove unused variable

7161e83

[CI] Auto-commit changed files from 'node scripts/precommit_hook.js -…

dc3dde1

…-ref HEAD~1..HEAD --fix'

janmonschke mentioned this pull request Jun 7, 2022

[Security Solution]Investigation in timeline present for Ransomware.Feature Alert prevalence #133723

Closed

michaelolo24 approved these changes Jun 8, 2022

View reviewed changes

kqualters-elastic approved these changes Jun 8, 2022

View reviewed changes

kqualters-elastic merged commit dd95fa2 into elastic:main Jun 8, 2022

kibanamachine mentioned this pull request Jun 8, 2022

[8.3] [SecuritySolution] Turn prevalence count into a button (#133791) #133957

Merged

This was referenced Jun 13, 2022

[DOCS] Prevalence count links to Timeline elastic/security-docs#2068

Closed

[DOCS] Add the "investigate in timeline" button to the alert prevalence section elastic/security-docs#2065

Closed

LeeDr removed the v8.3.1 label Jun 29, 2022

stephmilovic reviewed Sep 20, 2022

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SecuritySolution] Turn prevalence count into a button #133791

[SecuritySolution] Turn prevalence count into a button #133791

janmonschke commented Jun 7, 2022

janmonschke Jun 7, 2022

janmonschke Jun 7, 2022 •

edited

Loading

michaelolo24 Jun 8, 2022

janmonschke Jun 7, 2022

janmonschke Jun 7, 2022

janmonschke Jun 7, 2022

kibana-ci commented Jun 7, 2022

michaelolo24 left a comment

kqualters-elastic left a comment

kibanamachine commented Jun 8, 2022

ghost commented Jun 14, 2022

stephmilovic Sep 20, 2022

		React.PropsWithChildren<AlertSummaryRow['description']>
		>(({ data, eventId, fieldFromBrowserField, linkValue, timelineId, values, children }) => {

		selectedDataViewId: 'security-solution-default',
		selectedPatterns: ['.alerts-security.alerts-default'],

[SecuritySolution] Turn prevalence count into a button #133791

[SecuritySolution] Turn prevalence count into a button #133791

Conversation

janmonschke commented Jun 7, 2022

Summary

Checklist

janmonschke Jun 7, 2022

Choose a reason for hiding this comment

janmonschke Jun 7, 2022 • edited Loading

Choose a reason for hiding this comment

michaelolo24 Jun 8, 2022

Choose a reason for hiding this comment

janmonschke Jun 7, 2022

Choose a reason for hiding this comment

janmonschke Jun 7, 2022

Choose a reason for hiding this comment

janmonschke Jun 7, 2022

Choose a reason for hiding this comment

kibana-ci commented Jun 7, 2022

💚 Build Succeeded

Metrics [docs]

Async chunks

History

michaelolo24 left a comment

Choose a reason for hiding this comment

kqualters-elastic left a comment

Choose a reason for hiding this comment

kibanamachine commented Jun 8, 2022

💚 All backports created successfully

Questions ?

ghost commented Jun 14, 2022

stephmilovic Sep 20, 2022

Choose a reason for hiding this comment

janmonschke Jun 7, 2022 •

edited

Loading