Custom Highlighted Fields Implentation in Kibana Security #152871

RubixSolver99 · 2023-03-07T23:16:35Z

Summary

These changes allow for the ability to customize the "highlighted fields" that appear in the "Overview" tab of the event details pane for any given Kibana Security alert:

These highlighted fields can be customized using one of two methods: the UI Setting Method and the Rule Setting Method

UI Setting Method

Using this method allows for a "global" configuration that is applied to all alerts and will simply disregard any field that is not specified in the given index. This configuration can be accessed via:
Main Hamburger Menu -> Management -> Stack Management -> Kibana -> Advanced Settings -> Security Solution -> Custom Highlighted Fields

Rule Settings Method

Using this method allows for a configuration that is specific to a rule and is applied only to alerts that match the specifc rule being used. This method will also disregard any field that is not specified in the given index. This configuration can be accessed when creating a new rule or editing a pre-existing one.

If creating a new rule, the configuration can be found in:

Main Hamburger Menu -> Security -> Alerts -> Manage rules -> Create new rule -> About rule -> Advanced settings -> Custom highlighted fields

If editing a pre-existing rule, the configuration can be found in:

Main Hamburger Menu -> Security -> Alerts -> Manage rules -> [RULE NAME] -> Edit rule settings -> About -> Advanced settings -> Custom highlighted fields

This pull request resolves #131778.

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
This was checked for cross-browser compatibility

For maintainers

This was checked for breaking API changes and was labeled appropriately

cla-checker-service · 2023-03-07T23:16:41Z

💚 CLA has been signed

kibanamachine · 2023-03-07T23:16:49Z

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

CoenWarmer

AO Changes LGTM

elasticmachine · 2023-03-09T14:19:46Z

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine · 2023-03-09T14:19:46Z

Pinging @elastic/security-solution (Team: SecuritySolution)

xcrzx · 2023-03-09T14:21:22Z

buildkite test this

packages/kbn-rule-data-utils/src/technical_field_names.ts

xcrzx · 2023-03-13T12:37:01Z

Hey @RubixSolver99, thanks for posting this PR 🎉
I see that there are some failing tests. Do you need any help fixing them?

RubixSolver99 · 2023-03-14T18:02:12Z

Hey @RubixSolver99, thanks for posting this PR 🎉 I see that there are some failing tests. Do you need any help fixing them?

@xcrzx Definitely! Are all of these build errors from my commit?

xcrzx · 2023-03-15T13:07:03Z

@xcrzx Definitely! Are all of these build errors from my commit?

I haven't checked all the errors, but from what I saw, yes.

RubixSolver99 · 2023-03-17T13:39:56Z

@xcrzx Definitely! Are all of these build errors from my commit?

I haven't checked all the errors, but from what I saw, yes.

I will get to work! I'll be sure to let you know if there are any struggles.

RubixSolver99 · 2023-06-06T23:59:54Z

Hey @RubixSolver99 ! I'm an engineer on the Detection Engine team. I'm working with our designers to finalize designs for this feature to move one step closer to getting this in! If you're available, I'd love to set up a time to chat. Are you part of the Elastic Slack Community? If you're interested, you can join here and we can chat there as we try to move this across the line.

I apologize for the late response, I have joined the Slack and would love to talk more. Thank you for everything thus far!

maryam-saeidi · 2023-06-07T08:14:02Z

x-pack/plugins/observability/public/pages/slo_details/slo_details.test.tsx

@@ -8,6 +8,158 @@
 import React from 'react';
 import { screen } from '@testing-library/react';

+import { useKibana } from '../../utils/kibana_react';


These changes seemed to be duplicated by accident, would you please revert them?

yctercero · 2023-06-12T16:45:27Z

Hey @RubixSolver99 ! I'm an engineer on the Detection Engine team. I'm working with our designers to finalize designs for this feature to move one step closer to getting this in! If you're available, I'd love to set up a time to chat. Are you part of the Elastic Slack Community? If you're interested, you can join here and we can chat there as we try to move this across the line.

I apologize for the late response, I have joined the Slack and would love to talk more. Thank you for everything thus far!

@RubixSolver99 I've sent you a message over on Slack! We can set up a time to sync there.

* Added framework for custom highlighted fields * Added temporary json support Still looking to develop further for yml config file * Added Custom Highlighted Fields Created the ability to define customized highlighted fields * Fixed plural function name * Added docstring for config.ts file * Fixed naming convention in ui_settings * Added newline * Deleted not-needed json file * Added newline * Removed requires reload for ui_settings * UI update * Finished event details to display * Updated mock to include test fields * Fixed docstring on ln 208 * Fixed translation * Fixed metric mocks * Fixed metric mocks * Removed alerts conflict * Resolved es_results conflict * Resolved types conflict * Resolved utils conflict * Custom rule highlighted fields (#1) * Added framework for custom highlighted fields * Added temporary json support Still looking to develop further for yml config file * Added Custom Highlighted Fields Created the ability to define customized highlighted fields * Fixed plural function name * Added docstring for config.ts file * Fixed naming convention in ui_settings * Added newline * Deleted not-needed json file * Added newline * Removed requires reload for ui_settings * UI update * Finished event details to display * Updated mock to include test fields * Fixed docstring on ln 208 * Fixed translation * Fixed metric mocks * Fixed metric mocks * Removed alerts conflict * Resolved es_results conflict * Resolved types conflict * Resolved utils conflict * Removed usage in kbn-rule-data-utils * Custom Highlighted Fields Implementation (#2) * Added framework for custom highlighted fields * Added temporary json support Still looking to develop further for yml config file * Added Custom Highlighted Fields Created the ability to define customized highlighted fields * Fixed plural function name * Added docstring for config.ts file * Fixed naming convention in ui_settings * Added newline * Deleted not-needed json file * Added newline * Removed requires reload for ui_settings * UI update * Finished event details to display * Updated mock to include test fields * Fixed docstring on ln 208 * Fixed translation * Fixed metric mocks * Fixed metric mocks * Removed alerts conflict * Resolved es_results conflict * Resolved types conflict * Resolved utils conflict * Removed usage in kbn-rule-data-utils * Fixed build for helpers.test.ts * Fixed formatting * Fixed build for config.mock.ts * Fixed build es_results.ts * Fixed build schedule_notification_actions.tests.ts * Fixed build schedule_thtrottle_notification_actions.test.ts * Fixed build duplicate_rule.test.ts * Fixed build get_export_by_object_ids.test.ts * Fixed build validate.test.ts * Fixed build alerts.ts * Attempt to fixed build - Build API Docs * Attempt to fix build - Build API Docs * Attempt to fix build - Jest #1 * Attempt to fix build - Jest #7 * Attempt to fix build - Jest #13 * Attempted to fix remaining build errors * Attempt to resolve all build errors for custom highlighted fields implementation

stephmilovic

I'm so confused why you are deleting so many files? Did you have a bad commit or something? 8019 files changed, most of those being deleted. Please don't delete 8,000+ files

yctercero · 2023-08-05T22:53:17Z

I'm so confused why you are deleting so many files? Did you have a bad commit or something? 8019 files changed, most of those being deleted. Please don't delete 8,000+ files

Hey @stephmilovic ! @RubixSolver99 was trying to update with main after falling pretty far behind. We're working to clean this up and may suggest opening up a new PR.

thomheymann · 2023-08-07T08:33:42Z

Getting The diff you're trying to view is too large. We only load the first 3000 changed files error so am unable to review.

Can you please put this PR back into draft mode and clean it up?

yctercero · 2023-08-07T13:18:43Z

Opened new PR for this - #163235

kibanamachine added the 💝community label Mar 7, 2023

RubixSolver99 requested review from a team as code owners March 7, 2023 23:22

RubixSolver99 requested a review from xcrzx March 7, 2023 23:22

CoenWarmer approved these changes Mar 9, 2023

View reviewed changes

xcrzx added release_note:enhancement Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. 8.8 candidate labels Mar 9, 2023

ymao1 requested changes Mar 9, 2023

View reviewed changes

packages/kbn-rule-data-utils/src/technical_field_names.ts Show resolved Hide resolved

peluja1012 added the ci:cloud-deploy Create or update a Cloud deployment label Mar 9, 2023

RubixSolver99 requested review from a team as code owners March 17, 2023 19:06

maryam-saeidi requested changes Jun 7, 2023

View reviewed changes

gergoabraham removed their request for review June 13, 2023 09:10

RubixSolver99 closed this Jul 20, 2023

RubixSolver99 reopened this Jul 31, 2023

RubixSolver99 requested review from a team as code owners July 31, 2023 20:51

RubixSolver99 requested a review from a team July 31, 2023 20:52

RubixSolver99 requested review from a team as code owners July 31, 2023 20:52

stephmilovic requested changes Aug 3, 2023

View reviewed changes

yctercero mentioned this pull request Aug 6, 2023

[Detection Engine][Rules] - Adds custom highlighted fields option #163235

Merged

8 tasks

yctercero closed this Aug 7, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Custom Highlighted Fields Implentation in Kibana Security #152871

Custom Highlighted Fields Implentation in Kibana Security #152871

RubixSolver99 commented Mar 7, 2023

cla-checker-service bot commented Mar 7, 2023 •

edited

Loading

kibanamachine commented Mar 7, 2023

CoenWarmer left a comment

elasticmachine commented Mar 9, 2023

elasticmachine commented Mar 9, 2023

xcrzx commented Mar 9, 2023

xcrzx commented Mar 13, 2023

RubixSolver99 commented Mar 14, 2023 •

edited

Loading

xcrzx commented Mar 15, 2023

RubixSolver99 commented Mar 17, 2023

RubixSolver99 commented Jun 6, 2023

maryam-saeidi Jun 7, 2023

yctercero commented Jun 12, 2023

stephmilovic left a comment

yctercero commented Aug 5, 2023

thomheymann commented Aug 7, 2023

yctercero commented Aug 7, 2023

Custom Highlighted Fields Implentation in Kibana Security #152871

Custom Highlighted Fields Implentation in Kibana Security #152871

Conversation

RubixSolver99 commented Mar 7, 2023

Summary

UI Setting Method

Rule Settings Method

If creating a new rule, the configuration can be found in:

If editing a pre-existing rule, the configuration can be found in:

Checklist

For maintainers

cla-checker-service bot commented Mar 7, 2023 • edited Loading

kibanamachine commented Mar 7, 2023

CoenWarmer left a comment

Choose a reason for hiding this comment

elasticmachine commented Mar 9, 2023

elasticmachine commented Mar 9, 2023

xcrzx commented Mar 9, 2023

xcrzx commented Mar 13, 2023

RubixSolver99 commented Mar 14, 2023 • edited Loading

xcrzx commented Mar 15, 2023

RubixSolver99 commented Mar 17, 2023

RubixSolver99 commented Jun 6, 2023

maryam-saeidi Jun 7, 2023

Choose a reason for hiding this comment

yctercero commented Jun 12, 2023

stephmilovic left a comment

Choose a reason for hiding this comment

yctercero commented Aug 5, 2023

thomheymann commented Aug 7, 2023

yctercero commented Aug 7, 2023

cla-checker-service bot commented Mar 7, 2023 •

edited

Loading

RubixSolver99 commented Mar 14, 2023 •

edited

Loading