[Security Solution][Exceptions] Rule exceptions TTL - Expiration #145180

dplumlee · 2022-11-14T20:41:07Z

Summary

Overview

Adds rule exception expiration component and related fields to Exceptions feature. Allows a user to set/edit an exception to run until a specific datetime is reached. It also updates certain orthogonal features/api's such as exporting exceptions to utilize the new expiration functionality.

Exceptions List Export

Users are able to select if they want to include expired exceptions when exporting their exception lists via a confirm modal on the lists and list details pages

Screenshots

Exceptions List

Exporting Exceptions

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)

For maintainers

This was checked for breaking API changes and was labeled appropriately

…-ref HEAD~1..HEAD --fix'

…tions-ttl-expire

dplumlee · 2023-01-31T04:01:11Z

@elasticmachine merge upstream

dplumlee · 2023-01-31T18:29:17Z

@elasticmachine merge upstream

dplumlee · 2023-02-02T22:07:57Z

@elasticmachine merge upstream

WafaaNasr

@dplumlee it is minor, just some UI points, I just noticed.

Can we adjust the alignment of the items align-items: center; } so they can on the same line

I am not sure why we have many spaces here, if we can reduce them that will be great

packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/index.tsx

packages/kbn-securitysolution-io-ts-list-types/src/common/expire_time/index.ts

kqualters-elastic

threat hunting changes lgtm 👍

dhurley14

LGTM just some small changes and ++ to what @WafaaNasr has commented on. Otherwise this looks great!

packages/kbn-securitysolution-io-ts-list-types/src/common/expire_time/index.ts

dhurley14 · 2023-02-06T22:25:38Z

...ity_solution/public/detection_engine/rule_exceptions/components/exception_item_card/meta.tsx

+    const isExpired = useMemo(
+      () => (item.expire_time ? new Date(item.expire_time) <= new Date() : false),
+      [item]
+    );


can we import this function from your changes here?

packages/kbn-securitysolution-exception-list-components/src/exception_item_card/meta/index.tsx

marshallmain

Add rule execution tests to verify that exceptions with an expiration date affect the created alerts as expected. I.e. unexpired exceptions are applied and expired exceptions are not applied at rule execution time. This can be done with rule preview instead of real executions to make the tests faster.

x-pack/plugins/lists/server/services/exception_lists/build_exception_filter.test.ts

kibana-ci · 2023-02-07T21:08:13Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 565d753

Failed CI Steps

Security Solution Tests #3

Test Failures

[job] [logs] Security Solution Tests #3 / Inspect Network stats and tables "after each" hook for "inspects the Top DNS Domains Table"
[job] [logs] Security Solution Tests #3 / Inspect Network stats and tables inspects the Top DNS Domains Table

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`lists`	251	253	+2
`securitySolution`	3711	3716	+5
total			+7

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/securitysolution-io-ts-list-types`	498	503	+5
`@kbn/securitysolution-list-utils`	155	159	+4
total			+9

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`lists`	152.1KB	152.3KB	+231.0B
`securitySolution`	13.8MB	13.8MB	+30.7KB
total			+31.0KB

Saved Objects .kibana field count

Every field in each saved object type adds overhead to Elasticsearch. Kibana needs to keep the total field count below Elasticsearch's default limit of 1000 fields. Only specify field mappings for the fields you wish to search on or query. See https://www.elastic.co/guide/en/kibana/master/saved-objects-service.html#_mappings

id	before	after	diff
`exception-list`	41	42	+1
`exception-list-agnostic`	41	42	+1
total			+2

Unknown metric groups

API count

id	before	after	diff
`@kbn/securitysolution-io-ts-list-types`	511	516	+5
`@kbn/securitysolution-list-utils`	202	206	+4
`lists`	206	208	+2
total			+11

ESLint disabled in files

id	before	after	diff
`@kbn/securitysolution-io-ts-list-types`	14	15	+1

Total ESLint disabled count

id	before	after	diff
`@kbn/securitysolution-io-ts-list-types`	14	15	+1

History

💔 Build #106227 failed 8105531
💛 Build #105976 was flaky c883c2c
💚 Build #105807 succeeded 740be6e
💚 Build #105306 succeeded b96d875caf0a738391e77a15f75c271d5cb6378b
💚 Build #104341 succeeded 103c6b1f25c153079b52413edcc5e757471b849e
💔 Build #104053 failed f9bec2df41464bfe46cf658fd93ec26e579e5600

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @dplumlee

* main: (187 commits) [APM] Removing the icon for tech preview and fixing some of the alert badges (elastic#150528) [Cloud Posture][Bug]added fix for resource tab + small css fix on CSPM onboarding (elastic#149997) Making maxTransactionGroupsExceeded false by default (elastic#150458) [Fleet] refactor install registry and upload to extract common logic (elastic#150444) [ftr tests] split x-pack functional_with_es_ssl config (elastic#150416) [APM] switch get environment function to use terms_enum api (elastic#150175) [Unified search] Fixes ally issues (elastic#150411) [Synthetics] Fix overview status query (elastic#150285) [api-docs] 2023-02-08 Daily api_docs build (elastic#150518) [canvas] Run tests against @kbn/handlebars compileAST function (elastic#150439) [RAM] Bring flapping status and settings in o11y (elastic#150483) [data view mgmt] fix field refresh when index pattern is changed. (elastic#150403) [RAM] Allow alert table to show new alert status on apm (elastic#150500) [Synthetics] errors - adjust empty state content (elastic#150455) Uncomment tests (elastic#150481) [TIP] fix broken cypress tests after change made in cases plugin (elastic#150479) [enterprise search]: disallow removing last index from engine (elastic#150464) [Security Solution][Exceptions] Rule exceptions TTL - Expiration (elastic#145180) Adds link to Jan 2023 contributors newsletter. (elastic#150259) [Security Solution][Alerts] Fix bug when suppression has both created and updated alerts (elastic#150236) ...

dplumlee added Team:Detections and Resp Security Detection Response Team release_note:feature Makes this part of the condensed release notes Team:Detection Alerts Security Detection Alerts Area Team v8.7.0 labels Nov 14, 2022

dplumlee self-assigned this Nov 14, 2022

dplumlee force-pushed the exceptions-ttl-expire branch from f45ba09 to 6aa07f7 Compare November 16, 2022 04:48

dplumlee force-pushed the exceptions-ttl-expire branch 3 times, most recently from f2eddb2 to 7c778d2 Compare December 15, 2022 05:02

dplumlee added 12 commits January 4, 2023 15:34

inital poc

b44af38

fixes types and adds error state

089a826

fix types

a4dcd29

fixes types again

36e79bf

adds expires label to exception list

9587252

adds exception list expire ui

b2ef7e7

adds error states

1c4b9d1

fixes types

672dba2

updates css

a3f9d09

fixes test mock

35aa3da

updates tests

fd9656a

adds export modals

43d0e4f

dplumlee force-pushed the exceptions-ttl-expire branch from 4b27d54 to 43d0e4f Compare January 4, 2023 22:36

kibanamachine and others added 7 commits January 4, 2023 22:41

[CI] Auto-commit changed files from 'node scripts/precommit_hook.js -…

906f50c

…-ref HEAD~1..HEAD --fix'

updates modal tests

753dd4e

Merge remote-tracking branch 'davis/exceptions-ttl-expire' into excep…

5354daf

…tions-ttl-expire

fix types

823625d

fix types

ec62825

adds todo comment for future export options

6f606f3

updates functional tests

dc2f8fc

dplumlee marked this pull request as ready for review January 5, 2023 17:55

fix tests

58d2c89

Merge remote-tracking branch 'upstream/main' into exceptions-ttl-expire

740be6e

dplumlee force-pushed the exceptions-ttl-expire branch from b96d875 to 740be6e Compare February 6, 2023 17:32

WafaaNasr reviewed Feb 6, 2023

View reviewed changes

packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/index.tsx Outdated Show resolved Hide resolved

WafaaNasr reviewed Feb 6, 2023

View reviewed changes

packages/kbn-securitysolution-io-ts-list-types/src/common/expire_time/index.ts Outdated Show resolved Hide resolved

kqualters-elastic approved these changes Feb 6, 2023

View reviewed changes

dhurley14 approved these changes Feb 6, 2023

View reviewed changes

marshallmain reviewed Feb 7, 2023

View reviewed changes

x-pack/plugins/lists/server/services/exception_lists/build_exception_filter.test.ts Outdated Show resolved Hide resolved

dplumlee added 3 commits February 7, 2023 03:05

adds integration test

5fd3e63

updates types

ce349e5

updates css

c883c2c

marshallmain approved these changes Feb 7, 2023

View reviewed changes

dplumlee added 2 commits February 7, 2023 13:58

Merge remote-tracking branch 'upstream/main' into exceptions-ttl-expire

8105531

fixes merge conflicts

565d753

dplumlee merged commit 92a1689 into elastic:main Feb 7, 2023

kibanamachine added the backport:skip This commit does not require backporting label Feb 7, 2023

dplumlee mentioned this pull request Feb 8, 2023

[Security Solution] Include/exclude expired exceptions option needs to be added to full rule export #150635

Open

dplumlee deleted the exceptions-ttl-expire branch February 9, 2023 17:46

dplumlee mentioned this pull request Feb 22, 2023

[Security Solution] Exceptions TTL Follow-up #151952

Merged

3 tasks

dplumlee mentioned this pull request Mar 2, 2023

[Security Solution][Exceptions] Adds Exception TTL Cypress tests #152626

Closed

4 tasks

dplumlee mentioned this pull request Mar 22, 2023

Adding exceptions list export route documentation elastic/security-docs#3061

Closed

peluja1012 mentioned this pull request Apr 14, 2023

[FR] temp exception for detection rules #78548

Closed

MadameSheema mentioned this pull request Jun 13, 2023

[Security Solution] Expiration Option for Security Detection Rule Exceptions #159215

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Exceptions] Rule exceptions TTL - Expiration #145180

[Security Solution][Exceptions] Rule exceptions TTL - Expiration #145180

dplumlee commented Nov 14, 2022 •

edited

Loading

dplumlee commented Jan 31, 2023

dplumlee commented Jan 31, 2023

dplumlee commented Feb 2, 2023

WafaaNasr left a comment

kqualters-elastic left a comment

dhurley14 left a comment •

edited

Loading

dhurley14 Feb 6, 2023

marshallmain left a comment

kibana-ci commented Feb 7, 2023

API count

ESLint disabled in files

Total ESLint disabled count

[Security Solution][Exceptions] Rule exceptions TTL - Expiration #145180

[Security Solution][Exceptions] Rule exceptions TTL - Expiration #145180

Conversation

dplumlee commented Nov 14, 2022 • edited Loading

Summary

Overview

Exceptions List Export

Screenshots

Exceptions List

Exporting Exceptions

Checklist

For maintainers

dplumlee commented Jan 31, 2023

dplumlee commented Jan 31, 2023

dplumlee commented Feb 2, 2023

WafaaNasr left a comment

Choose a reason for hiding this comment

kqualters-elastic left a comment

Choose a reason for hiding this comment

dhurley14 left a comment • edited Loading

Choose a reason for hiding this comment

dhurley14 Feb 6, 2023

Choose a reason for hiding this comment

marshallmain left a comment

Choose a reason for hiding this comment

kibana-ci commented Feb 7, 2023

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Saved Objects .kibana field count

API count

ESLint disabled in files

Total ESLint disabled count

History

dplumlee commented Nov 14, 2022 •

edited

Loading

dhurley14 left a comment •

edited

Loading