Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution][Alert Flyout] Convert rule name to rule flyout and enable rule previews #191764

Merged
merged 4 commits into from
Sep 11, 2024
Merged

[Security Solution][Alert Flyout] Convert rule name to rule flyout and enable rule previews #191764

merged 4 commits into from
Sep 11, 2024
+1,054 −707

Conversation

christineweng
Copy link
Contributor

@christineweng christineweng commented Aug 29, 2024 •
edited
Loading

Summary

This PR converts rule name in alert table to be a flyout (consistent with host name and user name) and enables rule preview whenever rule name is present.

This PR also moved the rule details component into its own rule_details folder to be independent of the document_details flyout.

Dependency: #190560 to be merged first

New behavior:

  • Rule link in alert table opens rule flyout
  • Clicking the rule title goes to rule details page
  • Clicking rule name in alert flyout opens rule preview
Screen.Recording.2024-09-05.at.4.19.08.PM.mov

Checklist

@christineweng christineweng added release_note:enhancement backport:skip This commit does not require backporting Team:Threat Hunting Security Solution Threat Hunting Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Investigations Security Solution Investigations Team v8.16.0 labels Aug 29, 2024
@christineweng christineweng self-assigned this Aug 29, 2024
@christineweng christineweng force-pushed the rule-flyout branch 2 times, most recently from 74084c7 to 12b7c6c Compare September 5, 2024 21:21
@christineweng christineweng marked this pull request as ready for review September 5, 2024 21:26
@christineweng christineweng requested review from a team as code owners September 5, 2024 21:26
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

PhilippeOberti
PhilippeOberti requested changes Sep 9, 2024
View reviewed changes
Copy link
Contributor

@PhilippeOberti PhilippeOberti left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code looks great! At first I did not find any issues during desk testing, but pushing a little bit more in depth, I found that we have some inconsistencies between the alerts table on the Alerts page and the one on the Cases page.

We should show the rule flyout instead of navigating to the rule details page on the Activity tab of the Cases detail page

Screen.Recording.2024-09-09.at.9.06.15.AM.mov

We should show the rule flyout instead of navigating to the rule details page on the Alerts tab of the Cases detail page

Screen.Recording.2024-09-09.at.9.06.56.AM.mov

Also, unrelated but I found a but/inconsistent behavior when creating a new rule. We can still click on the link in the Alerts details flyout Table tab Preview rule link. Sometimes it just loads indefinitely, sometimes it errors out

Screen.Recording.2024-09-09.at.9.10.36.AM.mov

...gins/security_solution/public/flyout/document_details/left/components/prevalence_details.tsx Outdated Show resolved Hide resolved
...ecurity_solution/public/flyout/document_details/right/components/highlighted_fields_cell.tsx Outdated Show resolved Hide resolved
x-pack/plugins/security_solution/public/flyout/rule_details/hooks/use_rule_details.tsx Show resolved Hide resolved
x-pack/plugins/security_solution/public/flyout/rule_details/preview/footer.test.tsx Outdated Show resolved Hide resolved
x-pack/plugins/security_solution/public/flyout/shared/components/preview_link.tsx Show resolved Hide resolved
@kibana-ci
Copy link
Collaborator

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #21 / core route timeouts idle socket should timeout if payload sending has too long of an idle period

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 5734 5735 +1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 19.7MB 20.3MB ⚠️ +605.9KB

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @christineweng

This was referenced Sep 11, 2024
Open
Closed
PhilippeOberti
PhilippeOberti approved these changes Sep 11, 2024
View reviewed changes
Copy link
Contributor

@PhilippeOberti PhilippeOberti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for adding all the unit tests, the code looks great and everything works great!

@christineweng christineweng merged commit e01423d into elastic:main Sep 11, 2024
40 checks passed
@szaffarano szaffarano mentioned this pull request Sep 13, 2024
Merged
1 task
@christineweng christineweng mentioned this pull request Nov 4, 2024
Merged
1 task
christineweng added a commit that referenced this pull request Nov 6, 2024
@christineweng
[Security Solution] Update rule link in cases activities (#198836)
09dd66d 
## Summary

As a follow up to #191764, this PR
updates rule names in `Activity` tab in cases to open a rule flyout
instead of going to rule details page.

**Security solution changes**: replace rule page navigation with a
`openFlyout` call
**Cases plugin changes**: update the rules link component to accept
either `href` or `onClick`.


![image](https://github.com/user-attachments/assets/c5dca885-61b8-4481-adfa-f9e615a01265)


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Nov 6, 2024
@christineweng
[Security Solution] Update rule link in cases activities (elastic#198836
f75ce37 
)

## Summary

As a follow up to elastic#191764, this PR
updates rule names in `Activity` tab in cases to open a rule flyout
instead of going to rule details page.

**Security solution changes**: replace rule page navigation with a
`openFlyout` call
**Cases plugin changes**: update the rules link component to accept
either `href` or `onClick`.

![image](https://github.com/user-attachments/assets/c5dca885-61b8-4481-adfa-f9e615a01265)

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

(cherry picked from commit 09dd66d)
kibanamachine added a commit that referenced this pull request Nov 7, 2024
@kibanamachine @christineweng
[8.x] [Security Solution] Update rule link in cases activities (#198836…
6530bea 
…) (#199242)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution] Update rule link in cases activities
(#198836)](#198836)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT
[{"author":{"name":"christineweng","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-11-06T22:57:55Z","message":"[Security
Solution] Update rule link in cases activities (#198836)\n\n##
Summary\r\n\r\nAs a follow up to
#191764, this PR\r\nupdates rule
names in `Activity` tab in cases to open a rule flyout\r\ninstead of
going to rule details page.\r\n\r\n**Security solution changes**:
replace rule page navigation with a\r\n`openFlyout` call\r\n**Cases
plugin changes**: update the rules link component to accept\r\neither
`href` or
`onClick`.\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/c5dca885-61b8-4481-adfa-f9e615a01265)\r\n\r\n\r\n###
Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"09dd66d355fbb32fa0090e36945819a9509138c6","branchLabelMapping":{"^v9.0.0$":"main","^v8.17.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","backport","v9.0.0","Team:Threat
Hunting","v8.17.0"],"title":"[Security Solution] Update rule link in
cases
activities","number":198836,"url":"https://github.com/elastic/kibana/pull/198836","mergeCommit":{"message":"[Security
Solution] Update rule link in cases activities (#198836)\n\n##
Summary\r\n\r\nAs a follow up to
#191764, this PR\r\nupdates rule
names in `Activity` tab in cases to open a rule flyout\r\ninstead of
going to rule details page.\r\n\r\n**Security solution changes**:
replace rule page navigation with a\r\n`openFlyout` call\r\n**Cases
plugin changes**: update the rules link component to accept\r\neither
`href` or
`onClick`.\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/c5dca885-61b8-4481-adfa-f9e615a01265)\r\n\r\n\r\n###
Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"09dd66d355fbb32fa0090e36945819a9509138c6"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/198836","number":198836,"mergeCommit":{"message":"[Security
Solution] Update rule link in cases activities (#198836)\n\n##
Summary\r\n\r\nAs a follow up to
#191764, this PR\r\nupdates rule
names in `Activity` tab in cases to open a rule flyout\r\ninstead of
going to rule details page.\r\n\r\n**Security solution changes**:
replace rule page navigation with a\r\n`openFlyout` call\r\n**Cases
plugin changes**: update the rules link component to accept\r\neither
`href` or
`onClick`.\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/c5dca885-61b8-4481-adfa-f9e615a01265)\r\n\r\n\r\n###
Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"09dd66d355fbb32fa0090e36945819a9509138c6"}},{"branch":"8.x","label":"v8.17.0","branchLabelMappingKey":"^v8.17.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: christineweng <[email protected]>
mgadewoll pushed a commit to mgadewoll/kibana that referenced this pull request Nov 7, 2024
@christineweng @mgadewoll
[Security Solution] Update rule link in cases activities (elastic#198836
77e43ce 
)

## Summary

As a follow up to elastic#191764, this PR
updates rule names in `Activity` tab in cases to open a rule flyout
instead of going to rule details page.

**Security solution changes**: replace rule page navigation with a
`openFlyout` call
**Cases plugin changes**: update the rules link component to accept
either `href` or `onClick`.


![image](https://github.com/user-attachments/assets/c5dca885-61b8-4481-adfa-f9e615a01265)


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@PhilippeOberti PhilippeOberti PhilippeOberti approved these changes

Assignees

@christineweng christineweng

Labels
backport:skip This commit does not require backporting release_note:enhancement Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Investigations Security Solution Investigations Team Team:Threat Hunting Security Solution Threat Hunting Team v8.16.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@christineweng @elasticmachine @kibana-ci @PhilippeOberti