Create Entity Analytics dashboard #137688

machadoum · 2022-08-01T11:31:08Z

issue: https://github.com/elastic/security-team/issues/3062

Summary

I created the new Entity analytics dashboard page
- It is hidden behind the experimental feature flag entityAnalyticsDashboardEnabled but also requires riskyHostsEnabled, and/or riskyUsersEnabled
- It requires the platinum license
- For now it only contains user and host risk.

How to test it

Enable entityAnalyticsDashboardEnabled, riskyHostsEnabled, and riskyUsersEnabled flags
Go to the entity analytics page
Click on "enable host risk score" button and follow the steps
Click on "enable user risk score" button and follow the steps

Another possibility is to load data with es_archiver:

node ./scripts/es_archiver load ./x-pack/test/security_solution_cypress/es_archives/risky_users --config .//x-pack/test/security_solution_cypress/config.ts --es-url http://admin:??????@localhost:9220  --kibana-url http://admin:?????@localhost:5601/

node ./scripts/es_archiver load ./x-pack/test/security_solution_cypress/es_archives/risky_hosts --config .//x-pack/test/security_solution_cypress/config.ts --es-url http://admin:<PWD>@localhost:9220  --kibana-url http://admin:<PWD>@localhost:5601/

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
This was checked for cross-browser compatibility

machadoum · 2022-08-02T11:50:25Z

@elasticmachine merge upstream

machadoum · 2022-08-11T14:37:11Z

@elasticmachine merge upstream

jamster10 · 2022-08-15T20:09:54Z

NIT: this might be personal preference more than anything but using index.ts just for exporting, and renaming the other files to EntityAnalyticsUserRiskScores.tsx, EntityAnalyticsHostRiskScores.tsx, etc. This would reduce the amount of index.ts files to search through, and make it easier to find these components.

x-pack/plugins/security_solution/public/app/deep_links/index.ts

...ecurity_solution/public/overview/components/entity_analytics/user_risk_score/translations.ts

...ecurity_solution/public/overview/components/entity_analytics/host_risk_score/translations.ts

stephmilovic · 2022-08-15T20:56:56Z

your entity_analytics_dashboard.png screenshot says "Host risk classification" where it should say "User risk classification"

stephmilovic · 2022-08-15T21:00:44Z

...urity_solution/public/overview/components/entity_analytics/common/risk_score_donut_chart.tsx

+        {legendItems.length > 0 && <Legend legendItems={legendItems} />}
+      </StyledLegendItems>
+      <DonutContainer grow={false} className="eui-textCenter">
+        <DonutChart


machadoum · 2022-08-16T09:41:45Z

Off a fresh build the view does not show up without feature flag as expected, but adding the feature flag, but not having a license I am able to access the view- although it is blank. Im wondering what the behaviour should be for unlicensed users if they should get an error message or if they should not be able to access it all?

Thanks for catching it! Users should not be able to see the page if they don't have the required license. I updated the old menu to check for ml permissions. It should work now.

machadoum · 2022-08-16T09:46:53Z

Off a fresh build the view does not show up without feature flag as expected, but adding the feature flag, but not having a license I am able to access the view- although it is blank. Im wondering what the behaviour should be for unlicensed users if they should get an error message or if they should not be able to access it all?

Figured it out, I was missing the host risk and user risk feature flags. I updated the test description to include them, though perhaps the page should kick back or require at least one of them

Hey, thanks for testing this scenario! It is a valid concern but I think we shouldn't focus on it right now. We are planning on deleting the feature flags soon and this page will get an extra anomalies table too. It is still a work in progress.

jamster10

works like a dream 🔥

x-pack/plugins/security_solution/cypress/integration/dashboards/entity_analytics.spec.ts

MadameSheema

sec-eng-prod changes LGTM

x-pack/plugins/security_solution/public/common/hooks/use_enable_host_risk_from_url.test.ts

michaelolo24

Nice work! LGTM 🚀

michaelolo24 · 2022-08-24T16:59:17Z

I know It says it at the top of the description, but I'd change this section in the description

How to test it
Enable entityAnalyticsDashboardEnabled flag

to

How to test it
Enable entityAnalyticsDashboardEnabled, riskyHostsEnabled, and riskyUsersEnabled flags

Took me a sec to figure out why I was seeing an empty box on the page 😂

YulNaumenko

LGTM! Nice work

kibana-ci · 2022-08-25T08:39:34Z

💚 Build Succeeded

Buildkite Build
Commit: 2b296b4

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	2998	3013	+15

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	5.4MB	5.4MB	+13.9KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	255.4KB	256.0KB	+566.0B

Unknown metric groups

miscellaneous assets size

id	before	after	diff
`securitySolution`	4.0MB	4.1MB	+97.5KB

History

💚 Build #66974 succeeded 3e94c5d
💔 Build #66965 failed de336dd
💛 Build #65343 was flaky 7348fa4
💔 Build #65321 failed 97d120084fdf4f9fd3ad25f23db00d938ca7c7c4
💚 Build #65054 succeeded 06018de
💚 Build #64758 succeeded e042239

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @machadoum

* Create Entity analytics page * Add Hosts risk dashboard to Entity analytics page * Add entity analytics to the old menu * Add entity analytics dashboard header * Add User risk dashboard to Entity analytics * Add entityAnalyticsDashoardEnabled feature flag * Move useEnableHostRiskFromUrl to a shared folder * Upgrade Entity analytics license to platinum * Add ml permission check for entity analytics dashboard old menu Co-authored-by: Kibana Machine <[email protected]>

machadoum force-pushed the analytics-dashboard branch from 8bb0cbd to cc68676 Compare August 1, 2022 11:47

machadoum self-assigned this Aug 1, 2022

machadoum added the ci:deploy-cloud label Aug 1, 2022

machadoum added 11 commits August 9, 2022 15:49

wip - create new page

07fdd39

Add Hosts risk dashboard to Entity analytics

9514aaa

Add entiry analytics to old menu

12b8b10

Add entity analytics dashboard header

78b2539

Add User risk dashboard to Entity analytics

3f55204

Improve entity analytics navigation links

4846381

Add entityAnalyticsDashoardEnabled feature flag

70bebf8

Fix type

a14a85f

Add user and host risk dashboard empty state

8b51e93

Improve entity analytics dashboard code reusability

0e333ed

Add unit tests

db0a20b

machadoum force-pushed the analytics-dashboard branch from 4516db4 to db0a20b Compare August 9, 2022 13:58

machadoum added 7 commits August 10, 2022 12:39

Move useEnableHostRiskFromUrl to a shared folder

cc5d18c

Improve entity analytics page when host/user flags are disabled

42b6c75

Add cypress tests

96f24ba

Small tooltip fix

1a1e1c6

Delete comments

eda3742

Fix small cypress issue

94bd983

Fix typo

c8a80df

machadoum force-pushed the analytics-dashboard branch from 7fd5eb7 to c8a80df Compare August 10, 2022 14:38

machadoum added 2 commits August 11, 2022 10:07

Fix unit tests

cfa77e0

Upgrade Entity analytics license to platinum

2542c03

machadoum force-pushed the analytics-dashboard branch from 68283ab to 2542c03 Compare August 11, 2022 12:20

machadoum removed the ci:deploy-cloud label Aug 11, 2022

machadoum changed the title ~~Analytics dashboard~~ Create Entity Analytics dashboard Aug 11, 2022

stephmilovic reviewed Aug 15, 2022

View reviewed changes

x-pack/plugins/security_solution/public/app/deep_links/index.ts Outdated Show resolved Hide resolved

stephmilovic reviewed Aug 15, 2022

View reviewed changes

...ecurity_solution/public/overview/components/entity_analytics/user_risk_score/translations.ts Outdated Show resolved Hide resolved

stephmilovic reviewed Aug 15, 2022

View reviewed changes

...ecurity_solution/public/overview/components/entity_analytics/host_risk_score/translations.ts Outdated Show resolved Hide resolved

stephmilovic reviewed Aug 15, 2022

View reviewed changes

Fix broken link to user risk tab

17c37e8

machadoum added 2 commits August 16, 2022 13:03

Fix typos

9d87041

Add ml permission check for entity analytics dashboard old menu

7348fa4

machadoum force-pushed the analytics-dashboard branch from 97d1200 to 7348fa4 Compare August 16, 2022 11:03

jamster10 approved these changes Aug 16, 2022

View reviewed changes

machadoum added 2 commits August 24, 2022 10:19

Merge remote-tracking branch 'elastic/main' into analytics-dashboard

de336dd

Fix merge issues

3e94c5d

MadameSheema reviewed Aug 24, 2022

View reviewed changes

x-pack/plugins/security_solution/cypress/integration/dashboards/entity_analytics.spec.ts Outdated Show resolved Hide resolved

MadameSheema reviewed Aug 24, 2022

View reviewed changes

x-pack/plugins/security_solution/cypress/integration/dashboards/entity_analytics.spec.ts Outdated Show resolved Hide resolved

MadameSheema reviewed Aug 24, 2022

View reviewed changes

x-pack/plugins/security_solution/cypress/integration/dashboards/entity_analytics.spec.ts Outdated Show resolved Hide resolved

MadameSheema approved these changes Aug 24, 2022

View reviewed changes

michaelolo24 reviewed Aug 24, 2022

View reviewed changes

x-pack/plugins/security_solution/public/common/hooks/use_enable_host_risk_from_url.test.ts Outdated Show resolved Hide resolved

michaelolo24 approved these changes Aug 24, 2022

View reviewed changes

YulNaumenko approved these changes Aug 24, 2022

View reviewed changes

Code review improvements

2b296b4

machadoum enabled auto-merge (squash) August 25, 2022 08:15

machadoum merged commit bbcadf1 into elastic:main Aug 25, 2022

kibanamachine added the backport:skip This commit does not require backporting label Aug 25, 2022

jmikell821 mentioned this pull request Sep 28, 2022

[DOCS] Add Entity analytics dashboard elastic/security-docs#2517

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create Entity Analytics dashboard #137688

Create Entity Analytics dashboard #137688

machadoum commented Aug 1, 2022 •

edited

Loading

machadoum commented Aug 2, 2022

machadoum commented Aug 11, 2022

jamster10 commented Aug 15, 2022

stephmilovic commented Aug 15, 2022

stephmilovic Aug 15, 2022

machadoum commented Aug 16, 2022

machadoum commented Aug 16, 2022

jamster10 left a comment

MadameSheema left a comment

michaelolo24 left a comment

michaelolo24 commented Aug 24, 2022

YulNaumenko left a comment

kibana-ci commented Aug 25, 2022

miscellaneous assets size

Create Entity Analytics dashboard #137688

Create Entity Analytics dashboard #137688

Conversation

machadoum commented Aug 1, 2022 • edited Loading

Summary

How to test it

Checklist

machadoum commented Aug 2, 2022

machadoum commented Aug 11, 2022

jamster10 commented Aug 15, 2022

stephmilovic commented Aug 15, 2022

stephmilovic Aug 15, 2022

Choose a reason for hiding this comment

machadoum commented Aug 16, 2022

machadoum commented Aug 16, 2022

jamster10 left a comment

Choose a reason for hiding this comment

MadameSheema left a comment

Choose a reason for hiding this comment

michaelolo24 left a comment

Choose a reason for hiding this comment

michaelolo24 commented Aug 24, 2022

YulNaumenko left a comment

Choose a reason for hiding this comment

kibana-ci commented Aug 25, 2022

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

Page load bundle

miscellaneous assets size

History

machadoum commented Aug 1, 2022 •

edited

Loading