[Cloud Security] do not filter out vulnerabilities without the score field

[maxcold]

Summary

as a part of an effort to remove the vulnerability documents filter in https://github.com/elastic/security-team/issues/7146 this PR removes the filter for missing vulnerabiltiy.score.* fields.

Here is how the CNVM features look like when documents without these fields are present

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

[JordanSh]

👑

[JordanSh]

Suggested change

	render: (cvss: { score: number; version: string }) => {
	render: (cvss: Vulnerability["score"]) => {

[maxcold]

@JordanSh thanks for the suggestion! the Vulnerability["score"] is not the type we can use here, but I changed the code to use the correct type (as we are passing formatted data to the table)

[JordanSh]

I'm approving but was this agreed by product? if not, worth consulting. they might prefer some unknown/undefined tag or something. same for the vuln table itself.

[maxcold]

Thanks for highlighting this! I'm bringing it up in this comment https://github.com/elastic/security-team/issues/7146#issuecomment-1682475106 and think we need to specifically work on the UX of missing fields. Without this change, the behavior is different between dashboards and data grid (in the dashboard the empty green badge is being displayed as CVSScoreBadge doesn't handle this case itself, while in the data grid, we already have guards for a missing score in grid cells), so the question is if it's ok to move forward with the simplest solution. @nick-alayil do you see any problem with displaying empty cells consistently when the score is missing on the vulnerability document

[nick-alayil]

@nick-alayil do you see any problem with displaying empty cells consistently when the score is missing on the vulnerability document

This is totally acceptable at the moment since our primary goal is to ensure that all identified CVEs are presented to the end user, accompanied by the resource ID. We can focus on enhancing the UX for the default values in the future.

[JordanSh]

same comments

[JordanSh]

Suggested change

	<EuiLink onClick={() => onCellClick({ 'vulnerability.score.base': cvss.score! })}>
	<EuiLink onClick={() => onCellClick({ 'vulnerability.score.base': cvss.score })}>

i might be missing something but this shouldn't be needed if you already verified it exist

[maxcold]

for some reason, TS is not picking up the early return in case cvss.score is missing and I couldn't figure out why quickly. Do you have an idea why it might be?

[JordanSh]

I tried locally and i loled. looks like a typescript bug. consulted with the master @orouz and those two solutions work:

render: (cvss: PatchableVulnerabilityStat['cvss']) => {
            if (!cvss.score || !cvss.version) {
              return null;
            }
            const score = cvss.score;
            // const query = { 'vulnerability.score.base': cvss.score };

            return (
              <EuiLink onClick={() => onCellClick({ 'vulnerability.score.base': score})}>
              // <EuiLink onClick={() => onCellClick(query)}>
                <CVSScoreBadge version={cvss.version} score={cvss.score} />
              </EuiLink>
            );
          },

you can either declare a new constant for score, or the entire query object on a new constant. either way the inferring seems bugged inside the onClick function.

[maxcold]

thanks for finding a way to avoid the use of cvss.score!! definitely seems like a TS bug

[maxcold]

@elasticmachine merge upstream

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 9cddd39

Failed CI Steps

• FTR Configs #53

Test Failures

• [job] [logs] FTR Configs #53 / aiops change point detection shows multiple results when split field is selected

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
cloudSecurityPosture	264.0KB	264.1KB	+74.0B

History

• 💔 Build #151941 failed 80f95f0
• 💛 Build #151824 was flaky b3b9632
• 💛 Build #151319 was flaky 229d03d
• 💚 Build #150579 succeeded 31dbc9e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream