Refactoring network TLS to use useSearchStrategy

[angorayc]

Summary

Screen.Recording.2022-07-18.at.11.00.40.mov

1. Creating mock data (Please make sure you have auditbeat index pattern in the Kibana)

POST auditbeat-7.15.1-2022.07.14-000001-my-test/_doc
{
  "tls": {
    "server": {
      "hash": {
        "sha1": "my-sha-1"
      },
      "issuer": "sha1-issuer",
      "subject": "sha1-subject",
      "not_after": "2022-07-12T23:00:00.000Z"
    },
    "client": {
      "ja3": "test-ja3"
    }
  },
  "server": {
    "port": 9300,
    "bytes": 22256,
    "ip": "10.200.0.63",
    "packets": 8
  },
  "agent": {
    "name": "es00.siem.estc.dev",
    "id": "db0852dd-e5d8-4f59-b8f4-526f04b476c1",
    "type": "auditbeat",
    "ephemeral_id": "773281d6-6848-46f7-a568-15070f4fb5a2",
    "version": "8.2.0"
  },
  "process": {
    "args": [
      "/usr/share/elasticsearch/jdk/bin/java",
      "-Des.networkaddress.cache.ttl=60",
      "-Des.networkaddress.cache.negative.ttl=10",
      "-Djava.security.manager=allow",
      "-XX:+AlwaysPreTouch",
      "-Xss1m",
      "-Djava.awt.headless=true",
      "-Dfile.encoding=UTF-8",
      "-Djna.nosys=true",
      "-XX:-OmitStackTraceInFastThrow",
      "-Dio.netty.noUnsafe=true",
      "-Dio.netty.noKeySetOptimization=true",
      "-Dio.netty.recycler.maxCapacityPerThread=0",
      "-Dlog4j.shutdownHookEnabled=false",
      "-Dlog4j2.disable.jmx=true",
      "-Dlog4j2.formatMsgNoLookups=true",
      "-Djava.locale.providers=SPI,COMPAT",
      "--add-opens=java.base/java.io=ALL-UNNAMED",
      "-XX:+UseG1GC",
      "-Djava.io.tmpdir=/tmp/elasticsearch-5971547258905936186",
      "-XX:+HeapDumpOnOutOfMemoryError",
      "-XX:+ExitOnOutOfMemoryError",
      "-XX:HeapDumpPath=/var/lib/elasticsearch",
      "-XX:ErrorFile=/var/log/elasticsearch/hs_err_pid%p.log",
      "-Xlog:gc*,gc+age=trace,safepoint:file=/var/log/elasticsearch/gc.log:utctime,pid,tags:filecount=32,filesize=64m",
      "-Xms16084m",
      "-Xmx16084m",
      "-XX:MaxDirectMemorySize=8434745344",
      "-XX:InitiatingHeapOccupancyPercent=30",
      "-XX:G1ReservePercent=25",
      "-Des.distribution.type=deb",
      "--module-path",
      "/usr/share/elasticsearch/lib",
      "-m",
      "org.elasticsearch.server/org.elasticsearch.bootstrap.Elasticsearch"
    ],
    "created": "2022-07-17T07:53:59.262Z",
    "name": "java",
    "pid": 29808,
    "executable": "/usr/share/elasticsearch/jdk/bin/java"
  },
  "destination": {
    "port": 9300,
    "bytes": 22256,
    "ip": "10.200.0.63",
    "packets": 8
  },
  "source": {
    "port": 36384,
    "bytes": 1877,
    "ip": "10.200.0.193",
    "packets": 3
  },
  "network": {
    "community_id": "1:gMvXyOWipet+m59XlQG9D9RQuEM=",
    "bytes": 24133,
    "transport": "tcp",
    "type": "ipv4",
    "packets": 11,
    "direction": "unknown"
  },
  "cloud": {
    "availability_zone": "us-central1-c",
    "instance": {
      "name": "es00",
      "id": "4079610831420507356"
    },
    "provider": "gcp",
    "service": {
      "name": "GCE"
    },
    "machine": {
      "type": "n2-highmem-4"
    },
    "project": {
      "id": "elastic-siem"
    },
    "account": {
      "id": "elastic-siem"
    }
  },
  "@timestamp": "2022-07-18T09:41:23.101Z",
  "system": {
    "audit": {
      "socket": {
        "uid": 108,
        "egid": 114,
        "gid": 114,
        "euid": 108,
        "kernel_sock_address": "0xffff8c10ebad8900"
      }
    }
  },
  "ecs": {
    "version": "8.0.0"
  },
  "related": {
    "ip": [
      "10.200.0.63",
      "10.200.0.193"
    ],
    "user": [
      "elasticsearch"
    ]
  },
  "service": {
    "type": "system"
  },
  "host": {
    "hostname": "es00",
    "os": {
      "kernel": "4.19.0-18-cloud-amd64",
      "codename": "buster",
      "name": "Debian GNU/Linux",
      "type": "linux",
      "family": "debian",
      "version": "10 (buster)",
      "platform": "debian"
    },
    "containerized": false,
    "ip": [
      "10.200.0.63",
      "fe80::4001:aff:fec8:3f"
    ],
    "name": "es00.siem.estc.dev",
    "id": "60c7b7e7a41e1afa7c89b9cd1b412275",
    "mac": [
      "42:01:0a:c8:00:3f"
    ],
    "architecture": "x86_64"
  },
  "client": {
    "port": 36384,
    "bytes": 1877,
    "ip": "10.200.0.193",
    "packets": 3
  },
  "event": {
    "duration": 1221137,
    "kind": "event",
    "module": "system",
    "start": "2022-07-18T09:40:52.720Z",
    "action": "network_flow",
    "end": "2022-07-18T09:40:52.721Z",
    "category": [
      "network",
      "network_traffic"
    ],
    "type": [
      "info",
      "connection"
    ],
    "dataset": "socket"
  },
  "user": {
    "name": "elasticsearch",
    "id": "108"
  },
  "flow": {
    "final": true,
    "complete": false
  },
  "group": {
    "name": "elasticsearch",
    "id": "114"
  }
}

3. Make sure auditbeat-* is selected in data view
4. Navigating to Network TLS to check if the table is rendered

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

[angorayc]

@elasticmachine merge upstream

[angorayc]

@elasticmachine merge upstream

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 944eeb4
• Storybooks Preview

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	5.2MB	5.2MB	-741.0B

History

• 💔 Build #58133 failed 0c7aa95
• 💚 Build #56986 succeeded 6255b05

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[jamster10]

I know this is what was there before but find it a little odd. It's not related to your PR, but i think we should set this to 0. and change code elsewhere that would be problematic because of that.

In public/common/components/paginated_table/index.tsx we have
const pageCount = Math.ceil(totalCount / limit);
which is why I think we have a -1 as default as otherwise, if it were 0 this calculation would equal Infinity. But we could change the code here to be `totalCount ? totalCount / limit : 1, or some such equivolent.

Maybe there is another reason though

[YulNaumenko]

++ to the suggestion above. At least we need some explanation in the code why it is -1.

[angorayc]

Yeah, I think it's to differentiate the initial value and the fetched value and avoid the calculation error. I'll create an issue to review all the places that have this implementation.

[angorayc]

#136672