Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refactoring network details to use useSearchStrategy #135995

Merged
merged 9 commits into from
Jul 21, 2022

Conversation

angorayc
Copy link
Contributor

@angorayc angorayc commented Jul 8, 2022

Summary

issue: #129054

Screen.Recording.2022-07-12.at.10.02.37.mov

Steps to verify:

  1. Index a sample data
POST filebeat-7.16.2-2022.07.11-000001-MyTest/_doc
{
  "agent": {
    "build_date": "2022-04-01 13:13:45 +0000 UTC",
    "name": "bastion00",
    "commit": "58327465d29b69f55dde92715cd06968311a15ab",
    "id": "7a25ee1d-0b43-435e-afcc-891ae418eb1d",
    "type": "filebeat",
    "ephemeral_id": "b33f49bc-326d-4588-a74d-b0637b268c05",
    "version": "8.2.0"
  },
  "log": {
    "file": {
      "path": "/var/log/traefik/access.log.json"
    },
    "offset": 2460703619
  },
  "traefik": {
    "access": {
      "OriginContentSize": 18,
      "entryPointName": "web",
      "ClientAddr": "139.177.197.217:47834",
      "RequestScheme": "http",
      "OriginStatus": 307,
      "RouterName": "redirector@file",
      "Overhead": 212185,
      "OriginDuration": 171531,
      "RequestCount": 407821598,
      "RetryAttempts": 0
    }
  },
  "destination": {
    "geo": {
      "continent_name": "Europe",
      "country_iso_code": "DE",
      "country_name": "Germany",
      "location": {
        "lon": 9.491,
        "lat": 51.2993
      }
    },
    "as": {
      "number": 44486,
      "organization": {
        "name": "SYNLINQ"
      }
    },
    "address": "45.85.219.239",
    "port": 4444,
    "ip": "45.85.219.239"
  },
  "source": {
    "geo": {
      "continent_name": "North America",
      "region_iso_code": "CA-ON",
      "city_name": "Toronto",
      "country_iso_code": "CA",
      "country_name": "Canada",
      "region_name": "Ontario",
      "location": {
        "lon": -79.3623,
        "lat": 43.6547
      }
    },
    "as": {
      "number": 63949,
      "organization": {
        "name": "Linode, LLC"
      }
    },
    "address": "139.177.197.217",
    "port": 47834,
    "ip": "139.177.197.217"
  },
  "message": """{"ClientAddr":"139.177.197.217:47834","ClientHost":"139.177.197.217","ClientPort":"47834","ClientUsername":"-","DownstreamContentSize":18,"DownstreamStatus":307,"Duration":383716,"OriginContentSize":18,"OriginDuration":171531,"OriginStatus":307,"Overhead":212185,"RequestAddr":"45.85.219.239:4444","RequestContentSize":0,"RequestCount":407821598,"RequestHost":"45.85.219.239","RequestMethod":"CONNECT","RequestPath":"","RequestPort":"4444","RequestProtocol":"HTTP/1.1","RequestScheme":"http","RetryAttempts":0,"RouterName":"redirector@file","StartLocal":"2022-07-11T15:58:20.660776429Z","StartUTC":"2022-07-11T15:58:20.660776429Z","entryPointName":"web","level":"info","msg":"","time":"2022-07-11T15:58:20Z"}""",
  "url": {
    "path": "",
    "domain": "45.85.219.239:4444"
  },
  "network": {
    "community_id": "1:WMjixKW/TOQZLDN+gfxg0TRBOvA=",
    "transport": "tcp"
  },
  "input": {
    "type": "log"
  },
  "@timestamp": "2022-07-12T15:58:20.660Z",
  "related": {
    "ip": [
      "139.177.197.217",
      "45.85.219.239"
    ]
  },
  "ecs": {
    "version": "8.0.0"
  },
  "host": {
    "name": "bastion00"
  },
  "http": {
    "request": {
      "method": "CONNECT",
      "body": {
        "bytes": 0
      }
    },
    "response": {
      "status_code": 307,
      "body": {
        "size": 18
      }
    },
    "version": "1.1"
  },
  "event": {
    "duration": 383716,
    "created": "2022-07-11T15:58:21.115Z",
    "module": "traefik",
    "start": "2022-07-11T15:58:20.660776429Z",
    "end": "2022-07-11T15:58:20.661Z",
    "dataset": "traefik.access"
  },
  "user": {
    "name": "-"
  }
}
}
  1. Navigate to network page, and make sure filebeat-* is selected
  2. Click an ip and check the content on details page is rendered.

Checklist

Delete any items that are not applicable to this PR.

@angorayc angorayc added release_note:skip Skip the PR/issue when compiling release notes backport:skip This commit does not require backporting Team:Threat Hunting Security Solution Threat Hunting Team Team:Threat Hunting:Explore v8.4.0 labels Jul 8, 2022
@angorayc
Copy link
Contributor Author

angorayc commented Jul 8, 2022

@elasticmachine merge upstream

@angorayc angorayc marked this pull request as ready for review July 11, 2022 13:47
@angorayc angorayc requested review from a team as code owners July 11, 2022 13:47
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

@angorayc
Copy link
Contributor Author

@elasticmachine merge upstream

@angorayc
Copy link
Contributor Author

@elasticmachine merge upstream

@angorayc
Copy link
Contributor Author

@elasticmachine merge upstream

@angorayc
Copy link
Contributor Author

@elasticmachine merge upstream

@kibana-ci
Copy link
Collaborator

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 5.2MB 5.2MB -821.0B

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@angorayc angorayc merged commit 2bda8aa into elastic:main Jul 21, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport:skip This commit does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team:Threat Hunting:Explore Team:Threat Hunting Security Solution Threat Hunting Team v8.4.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants