[Security Solution] Investigation guide - insights in markdown #145240
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…lastic/kibana into investigation-guide-insights
kqualters-elastic
added
release_note:feature
| timeRange: { | ||
| kind: 'absolute', | ||
| from: timeRange, | ||
| to: new Date().toISOString(), |
There was a problem hiding this comment.
Is it always to the current time? and should timerange be from instead?
There was a problem hiding this comment.
ya agree this was weirdly done by me, forgot to go back and change it. updated now so that timerange is passed as a prop or not at all. For the now, I think oldest timestamp -> now is as inclusive as we can be, since a value has to be supplied, not sure what else we could use.
| const { addError } = useAppToasts(); | ||
| let parsedProviders = []; | ||
| try { | ||
| if (providers !== undefined) { |
There was a problem hiding this comment.
providers can never be null?
There was a problem hiding this comment.
shouldn't be, but if they are, we just pass an empty array for data providers, and the button will render but show 0
kqualters-elastic
changed the title
| @@ -360,17 +360,20 @@ export const useTimelineEventsHandler = ({ | |||
| ...deStructureEqlOptions(prevEqlRequest), | |||
| }; | |||
|
|
|||
| const requestTimeRange = | |||
There was a problem hiding this comment.
nit:
const timerange = startDate && endDate ? { timerange: {....} } : {};
searchParamStuff = {
...timerange
}
| dataViewId, | ||
| fields: ['*'], | ||
| filterQuery: combinedQueries?.filterQuery, | ||
| id: 'timeline-1', |
There was a problem hiding this comment.
use TimelineId.active?
| @@ -0,0 +1,132 @@ | |||
| /* | |||
There was a problem hiding this comment.
Thanks for adding these tests!
| export { InsightComponent as renderer }; | ||
|
|
||
| const InsightEditorComponent = ({ | ||
| node, |
There was a problem hiding this comment.
These props aren't used
michaelolo24
approved these changes
Nov 15, 2022
💚 Build Succeeded
Metrics [docs]Module Count
Async chunks
Unknown metric groupsESLint disabled in files
ESLint disabled line counts
Total ESLint disabled count
History
To update your PR or re-run it, just comment with: |
2 tasks
kqualters-elastic
added a commit
that referenced
this pull request
Feb 7, 2023
…150363) ## Summary This pr expands upon the work done in #145240 to make use of the filters builder form from unified_search to serialize filters into a markdown compatible string, so that investigation guides, timeline notes or any other place where text is parsed as markdown can make use of standard kibana filters and view a count of the matching documents at a glance, and open the entire set in timeline as well. These are generally converted to timeline data providers to enable drag and drop query building, however this is not supported for filters of range type, so regular kibana filters are used in that case for now.        ### Checklist - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This pr adds a new parsing plugin to the EuiMarkdownEditor used in security solution that enables users to create run time queries that can be parameterized from alert data, or hard coded literal values. A count of the matching events is displayed in a button that when clicked will open the same event set in timeline. Markdown is expected to be in the following format:
!{insight{"description":"2 top level OR providers, 1 nested AND","label":"test insight", "providers": [[{ "field": "event.id", "value": "kibana.alert.original_event.id", "type": "parameter" }], [{ "field": "event.category", "value": "network", "type": "literal" }, {"field": "process.pid", "value": "process.pid", "type": "parameter"}]]}}The 2d array is used to allow nested queries, the top level arrays are OR'ed together, and the inner array AND'ed together:
Following a prefix of !insight, the configuration object takes optional description and label strings, along with a 2 dimensional array called "providers". This value corresponds to what are called data providers in the timeline view,
and are arrays of filters with 3 fields, "field" which is the field name for that part of the query clause, "value" which is the value to be used, and "type" which is either "parameter" or "literal". Filters of type parameter expect value to be the name of a field present in an alert document, and will use the value in the underlying document if found. If the field is not present for some reason, a wildcard is used. If the markdown is rendered in a context not tied to a specific alert, parameter fields are treated as a timeline template field.
Checklist
Delete any items that are not applicable to this PR.