[TIP] Investigate in timeline #140496

PhilippeOberti · 2022-09-12T12:33:51Z

Summary

This PR adds the Investigate in Timeline functionality to the Indicators table.

Behavior

When the user clicks on the Investigate in Timeline button in the actions column of the Indicators table or the flyout footer, the timeline view is presented with multiple entries already populated:

the indicator field and value pair, from the row selected (for example threat.indicator.file.hash.sha256: 'abc' )
the event source field and value pair, retrieved using the mapping (for example file.hash.sha256: 'abc')
If a saved timeline was open, or the unsaved default timeline already had some values, a new unsaved timeline is created with the above pairs.

As the investigate in timeline feature is a lot more complex than the more basic add to timeline (see some of the discussions here), and since there isn't anything available from the Security Solution or the Timeline plugin to make it work out of the box (like there was for the Add to Timeline feature), the current state of this PR presents 2 approaches:

commit #1: the Threat intelligence plugin is using actions duplicated from the Security Solution plugin
commit #2: most of the logic lives in the Security Solution plugin and mimics the existing alerts-table useInvestigateInTimeline hook, modifying it a bit, as we do not have ECS data.
the last commit cleans up a bit solution Change of links to styles and js #2 and adds unit and e2e tests

Notes:

I'm abandoning option links to styles and js #1 as option Change of links to styles and js #2 was approved by the Threat Hunting Investigation team.
This PR also changes the the url mapping to RawIndicatorFieldId.UrlFull instead of RawIndicatorFieldId.UrlOriginal (see here)
it seems that the threatIntelligence bundle has grown and surpassed the limit set in the knb-optimizer package. I ran the following command to update it node scripts/build_kibana_platform_plugins --update-limits

Screen.Recording.2022-09-12.at.2.18.55.PM.mov

https://github.com/elastic/security-team/issues/4558

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)

- add investigate in timeline component using basic redux actions duplicated from Security Solution plugin - investigates in timeline adds threat indicator as well as source entries using mapping

- remove first option as well as actions, selectors and types - add new investigate in timeline hook in Security Solution plugin and pass via context to TI plugin - replace UrlOriginal by UrlFull in the threat.indicator.name mapping

# Conflicts: # x-pack/plugins/threat_intelligence/public/modules/timeline/components/add_to_timeline/add_to_timeline.tsx # x-pack/plugins/threat_intelligence/public/modules/timeline/components/add_to_timeline/styles.ts

- split InvestigateInTimeline into 2 components (one for Button display the other for ButtonIcon) - extract most of the logic into useInvestigateInTimeline hook - add unit and e2e tests - remove threat.enrichments entries in the map

ran command: node scripts/build_kibana_platform_plugins --update-limits

PhilippeOberti · 2022-09-15T12:56:01Z

@elasticmachine merge upstream

PhilippeOberti · 2022-09-15T14:39:51Z

@elasticmachine merge upstream

jbudz

limits.yml

PhilippeOberti · 2022-09-15T18:02:14Z

@elasticmachine merge upstream

lgestc · 2022-09-19T07:36:17Z

x-pack/plugins/security_solution/public/threat_intelligence/routes.tsx

  const securitySolutionContext: SecuritySolutionPluginContext = {
    getFiltersGlobalComponent: () => FiltersGlobal,
    getPageWrapper: () => SecuritySolutionPageWrapper,
    licenseService,
    sourcererDataView: sourcererDataView as unknown as SourcererDataView,
+    getSecuritySolutionStore: securitySolutionStore,
+    getUseInvestigateInTimeline: useInvestigateInTimeline,


lgestc · 2022-09-19T07:38:47Z

LGTM!

maxcold · 2022-09-19T08:17:33Z

@elasticmachine merge upstream

maxcold

Overall code looks good and the feature works as expect, good job! There are some small comments and suggestions

maxcold · 2022-09-19T08:33:11Z

x-pack/plugins/security_solution/public/threat_intelligence/translations.ts

+export const ACTION_INVESTIGATE_IN_TIMELINE = i18n.translate(
+  'xpack.securitySolution.threatIntelligence.investigateInTimelineTitle',
+  {
+    defaultMessage: 'Investigate in timeline',


I remember talking with UX writer they mentioned that they always use Timeline capitalized and it's the only feature that behaves this way, let's change to Investigate in Timeline

Though I don't see where this defaultMeassage appears, I'd expect it to show up as a tooltip on the action icon, but it's not there. Btw about tooltips, I see that our expand icon has a tooltip "View Details", but Investigate in Timeline icon doesn't have a tooltip. I think we should add it, but it can be in a separate PR if it's not a one-lines somewhere

good point. I've added the tooltip here as well as in every other places in the plugin I could find

maxcold · 2022-09-19T08:49:32Z

x-pack/plugins/security_solution/public/threat_intelligence/use_investigate_in_timeline.ts

+  const { filterManager: activeFilterManager } = useDeepEqualSelector((state) =>
+    getManageTimeline(state, TimelineId.active ?? '')
+  );
+  const filterManager = useMemo(


out of curiosity what this filterManager does and what is the logic behind filterManagerBackup?

maxcold · 2022-09-19T08:56:33Z

...reat_intelligence/public/modules/indicators/components/indicators_table/actions_row_cell.tsx

-      onOpen={setExpanded}
-      isOpen={Boolean(expanded && expanded._id === indicator._id)}
-    />
+    <div css={styles.rowActionsDiv}>


can EUI flex components be used here, eg EuiFlexGroup?

yup done, good cleanup I could delete the styles.ts file entirely

maxcold · 2022-09-19T09:01:19Z

...odules/timeline/components/investigate_in_timeline_button/investigate_in_timeline_button.tsx

+
+  return (
+    <EuiButton onClick={onClick} fill {...props}>
+      Investigate in Timeline


I think it should be translated

yup thanks, I went through the plugin and added a few more as well

maxcold · 2022-09-19T09:03:47Z

...eline/components/investigate_in_timeline_button_icon/investigate_in_timeline_button_icon.tsx

+  }
+
+  return (
+    <div css={styles.inlineFlex}>


same question about using flex components from EUI https://elastic.github.io/eui/#/layout/flex

yup, style.ts deleted!

maxcold · 2022-09-19T09:13:47Z

x-pack/plugins/threat_intelligence/public/modules/timeline/hooks/use_investigate_in_timeline.ts

+
+  const { key, value } = getIndicatorFieldAndValue(indicator, RawIndicatorFieldId.Name);
+
+  if (!value || value === EMPTY_VALUE || !key) {


we repeat this peace of logic in many places, I think we should at least move it to a utility function, ideally think about a model of our Indicator and about methods of this model. The best illustration of why it's bad to repeat business logic even if it's super simple is in indicator_value_actions.tsx where we have !key || value === EMPTY_VALUE || !key which is incorrect

yeah I extracted it, looks much better to me that way, thanks!

- add EuiTooltip for all EuiButtonIcon - add missing translations - replace css with EuiFlexGroup where possible - extract fieldValueValid logic

maxcold · 2022-09-19T16:19:04Z

x-pack/plugins/threat_intelligence/public/modules/indicators/lib/field_value.ts

+ * @returns true if correct, false if not
+ */
+export const fieldAndValueValid = (field: string | null, value: string | null): boolean =>
+  value != null && value !== '' && value !== EMPTY_VALUE && field != null && field !== '';


any partucular reason to do value != null && value !== '' instead of !value. Also not sure why non-strict comparison with null. I'd vote for a simpler version

ok I was confused for a sec... !value will not work with empty strings, but !!value will. It's cleaned up now! :)

kibana-ci · 2022-09-19T18:22:39Z

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

[job] [logs] Security Solution Tests #2 / Alerts detection rules table auto-refresh should disable auto refresh when any rule selected and enable it after rules unselected
[job] [logs] Security Solution Tests #1 / Cases Creates a new case with timeline and opens the timeline

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	3076	3077	+1
`threatIntelligence`	167	198	+31
total			+32

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`threatIntelligence`	3	4	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	6.4MB	6.4MB	+1.2KB
`threatIntelligence`	70.8KB	72.6KB	+1.9KB
total			+3.1KB

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`threatIntelligence`	2	3	+1

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	261.2KB	261.2KB	+42.0B
`threatIntelligence`	13.4KB	28.6KB	+15.2KB
total			+15.3KB

Unknown metric groups

API count

id	before	after	diff
`threatIntelligence`	17	20	+3

History

💛 Build #73374 was flaky eb5538a
💔 Build #73357 failed ab8e9e957c01299f070d03ee6488ac734ddcc51d
💚 Build #73210 succeeded ec85eba
💛 Build #72894 was flaky b12e48b
💔 Build #72745 failed 032866c
💔 Build #72676 failed e78ee30

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

elasticmachine · 2022-09-28T11:36:43Z

Pinging @elastic/security-solution (Team: SecuritySolution)

PhilippeOberti added 5 commits September 12, 2022 09:33

[TIP] Investigate in timeline

6da1cb1

- add investigate in timeline component using basic redux actions duplicated from Security Solution plugin - investigates in timeline adds threat indicator as well as source entries using mapping

Merge branch 'main' into investigate-in-timeline

ea4868b

Merge branch 'main' into investigate-in-timeline

f0f6548

# Conflicts: # x-pack/plugins/threat_intelligence/public/modules/timeline/components/add_to_timeline/add_to_timeline.tsx # x-pack/plugins/threat_intelligence/public/modules/timeline/components/add_to_timeline/styles.ts

PhilippeOberti marked this pull request as ready for review September 14, 2022 15:42

PhilippeOberti requested a review from a team as a code owner September 14, 2022 15:42

PhilippeOberti added release_note:skip Skip the PR/issue when compiling release notes 8.5 candidate Team: Protections Experience labels Sep 14, 2022

PhilippeOberti added 4 commits September 15, 2022 09:53

[TIP] Fix data-provider file should be snake_case

894e240

Merge branch 'main' into investigate-in-timeline

5861e18

[TIP] Fix wrong namespace for translation id

938597d

[TIP] Bump kbn-optimizer limit for threatIntelligence

d621e20

ran command: node scripts/build_kibana_platform_plugins --update-limits

PhilippeOberti requested a review from a team as a code owner September 15, 2022 11:55

Merge branch 'main' into investigate-in-timeline

e78ee30

Merge branch 'main' into investigate-in-timeline

032866c

jbudz approved these changes Sep 15, 2022

View reviewed changes

Merge branch 'main' into investigate-in-timeline

b12e48b

lgestc reviewed Sep 19, 2022

View reviewed changes

lgestc approved these changes Sep 19, 2022

View reviewed changes

Merge branch 'main' into investigate-in-timeline

ec85eba

maxcold approved these changes Sep 19, 2022

View reviewed changes

PhilippeOberti added 2 commits September 19, 2022 05:43

Merge branch 'main' into investigate-in-timeline

5af030b

[TIP] Fix many small UI issues

eb5538a

- add EuiTooltip for all EuiButtonIcon - add missing translations - replace css with EuiFlexGroup where possible - extract fieldValueValid logic

PhilippeOberti force-pushed the investigate-in-timeline branch from ab8e9e9 to eb5538a Compare September 19, 2022 13:19

maxcold reviewed Sep 19, 2022

View reviewed changes

[TIP] Code clean

7d81350

PhilippeOberti merged commit 3099159 into elastic:main Sep 19, 2022

PhilippeOberti deleted the investigate-in-timeline branch September 19, 2022 18:28

kibanamachine added v8.5.0 backport:skip This commit does not require backporting labels Sep 19, 2022

PhilippeOberti mentioned this pull request Sep 22, 2022

[TIP] FilterIn FilterOut component cleanup #141525

Merged

1 task

maxcold mentioned this pull request Sep 27, 2022

[DOCS] Threat Intelligence - Indicators Page and Indicator Details elastic/security-docs#2497

Closed

2 tasks

maxcold added Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. release_note:feature Makes this part of the condensed release notes and removed release_note:skip Skip the PR/issue when compiling release notes labels Sep 28, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[TIP] Investigate in timeline #140496

[TIP] Investigate in timeline #140496

PhilippeOberti commented Sep 12, 2022 •

edited

Loading

PhilippeOberti commented Sep 15, 2022

PhilippeOberti commented Sep 15, 2022

jbudz left a comment

PhilippeOberti commented Sep 15, 2022

lgestc Sep 19, 2022

lgestc commented Sep 19, 2022

maxcold commented Sep 19, 2022

maxcold left a comment

maxcold Sep 19, 2022

maxcold Sep 19, 2022

PhilippeOberti Sep 19, 2022

maxcold Sep 19, 2022

maxcold Sep 19, 2022

PhilippeOberti Sep 19, 2022

maxcold Sep 19, 2022

PhilippeOberti Sep 19, 2022

maxcold Sep 19, 2022

PhilippeOberti Sep 19, 2022

maxcold Sep 19, 2022

PhilippeOberti Sep 19, 2022

maxcold Sep 19, 2022

PhilippeOberti Sep 19, 2022

kibana-ci commented Sep 19, 2022

API count

elasticmachine commented Sep 28, 2022


		const { key, value } = getIndicatorFieldAndValue(indicator, RawIndicatorFieldId.Name);

		if (!value \|\| value === EMPTY_VALUE \|\| !key) {

[TIP] Investigate in timeline #140496

[TIP] Investigate in timeline #140496

Conversation

PhilippeOberti commented Sep 12, 2022 • edited Loading

Summary

Behavior

Notes:

Checklist

PhilippeOberti commented Sep 15, 2022

PhilippeOberti commented Sep 15, 2022

jbudz left a comment

Choose a reason for hiding this comment

PhilippeOberti commented Sep 15, 2022

Choose a reason for hiding this comment

lgestc commented Sep 19, 2022

maxcold commented Sep 19, 2022

maxcold left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kibana-ci commented Sep 19, 2022

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Public APIs missing exports

Page load bundle

API count

History

elasticmachine commented Sep 28, 2022

PhilippeOberti commented Sep 12, 2022 •

edited

Loading