[SIEM][Exceptions] - Exception builder component #67013

yctercero · 2020-05-19T14:21:15Z

Summary

This PR creates the bulk functionality of the exception builder. The exception builder is the component that will be used to create exception list items. It does not deal with the actual API creation/deletion/update of exceptions, it does contain an onChange handler that can be used to access the exceptions. The builder is able to:

accept ExceptionListItem and render them correctly
allow user to add exception list item and exception list item entries
accept an indexPattern and use it to fetch relevant field and autocomplete field values
disable Or button if user is only allowed to edit/add to exception list item (not add additional exception list items)
displays Add new exception button if no exception items exist
- An exception item can be created without entries, the add new exception button will show in the case that an exception list contains exception list item(s) with an empty entries array (as long as there is one exception list item with an item in entries, button does not show)
debounces field value autocomplete searches
bubble up exceptions to parent component, stripping out any empty entries

Logic checks:

if selected field is type boolean, operators are limited to is, is not, exists, does not exist and available values are true, false
if selected field is type date, number, or ip, values combo box shows error state if values do not match field type
if selected operator is is in list or is not in list, only lists that match the selected field type will be displayed in the autocomplete
no error state shown if value box is empty, invalid fields get stripped out when exceptions are passed back to parent

Aside
Created reusable components for field, operator and field value inputs as it's already needed for other functionality. I added a README.md (x-pack/plugins/security_solution/public/common/components/autocomplete/readme.md) to try to make use of the components a bit easier.

To Do

Additional value validation checks
Nested types logic (will do follow up PR)
~~React warning on initial first field selection (wip)~~
~~Match any was acting funny~~ (was passing selected field as query to autocomplete, causing funkiness, fixed!)

Examples

Builder

List operator

Match operator

Match any operator

Boolean field type

Exists operator

Sample validation (field of type `ip`)

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios
This was checked for keyboard-only and screenreader accessibility
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser
This was checked for cross-browser compatibility, including a check against IE11

…uilder

This also adds a generic hook, useAsyncTask, that wraps an async function to provide basic utilities: * loading state * error state * abort/cancel function

These were not caught locally as I was accidentally running typescript without the full project.

…uilder

… tuple This allows callers to further leverage fp-ts functions as needed.

* leverages new validateEither fn which returns an Either * constructs a pipeline that: * validates the payload * performs the API call * validates the response and short-circuits if any of those produce a Left value. It then converts the Either into a promise that either rejects with the Left or resolves with the Right.

This cleans up our validation pipeline considerably.

…uilder

* refactors private API functions to accept the encoded request schema (i.e. snake cased) * refactors validateEither to use `schema.validate` instead of `schema.decode` since we don't actually want the decoded value, we just want to verify that it'll be able to be decoded on the backend.

* Continue to export decoded types without a qualifier * pull types used by hooks from their new location * Fix errors with usage of act()

…uilder

By pulling from the module directly instead of an index, we can hopefully narrow down our dependencies until tree-shaking does this for us.

elasticmachine · 2020-07-01T11:44:06Z

Pinging @elastic/siem (Team:SIEM)

yctercero · 2020-07-01T12:31:25Z

x-pack/plugins/security_solution/public/common/components/exceptions/builder/exception_item.tsx

+        />
+      );
+      if (index === 0 && exceptionItemIndex === 0) {
+        return <MyFirstRowContainer grow={false}>{button}</MyFirstRowContainer>;


Similar to the above comment - the first row includes the field labels, so the delete icon was centering based on that extra space. Added padding fixes that.

yctercero · 2020-07-01T12:33:22Z

x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx

+  };
+};
+
+export const filterExceptionItems = (


This is to ensure that we only bubble up valid exception item and entries. A user could add 10 blank rows or entries, this strips those out.

yctercero · 2020-07-01T12:35:14Z

x-pack/plugins/security_solution/public/common/components/exceptions/types.ts

@@ -49,3 +50,46 @@ export interface ExceptionsPagination {
  totalItemCount: number;
  pageSizeOptions: number[];
 }
+
+export interface FormattedBuilderEntryBase {


These new types are to deal with the empty states of the entries in the builder, since the exception item entries can be in what the ExceptionListItemSchema would pick up as invalid. But when bubbling up the exceptions to the parent, we do check to strip out any empties.

peluja1012 · 2020-07-01T21:41:25Z

x-pack/plugins/security_solution/public/common/components/autocomplete/readme.md

@@ -0,0 +1,122 @@
+# Autocomplete Fields


Great readme!

peluja1012

Tested by integrating the component with the Exception Modal (upcoming PR). Looks great! My only suggestion would be to look into using useMemo and useCallback where it makes sense throughout these components.

…uilder

### Summary This PR creates the bulk functionality of the exception builder. The exception builder is the component that will be used to create exception list items. It does not deal with the actual API creation/deletion/update of exceptions, it does contain an `onChange` handler that can be used to access the exceptions. The builder is able to: - accept `ExceptionListItem` and render them correctly - allow user to add exception list item and exception list item entries - accept an `indexPattern` and use it to fetch relevant field and autocomplete field values - disable `Or` button if user is only allowed to edit/add to exception list item (not add additional exception list items) - displays `Add new exception` button if no exception items exist - An exception item can be created without entries, the `add new exception` button will show in the case that an exception list contains exception list item(s) with an empty `entries` array (as long as there is one exception list item with an item in `entries`, button does not show) - debounces field value autocomplete searches - bubble up exceptions to parent component, stripping out any empty entries

kibanamachine · 2020-07-02T02:15:29Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 7749035

Build metrics

✅ unchanged

History

💚 Build #58074 succeeded 7749035
💔 Build #58009 failed ac3074e
💔 Build #57984 failed 9341cba
💔 Build #57909 failed 3026957
💔 Build #57865 failed 58b2ceb

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

### Summary This PR creates the bulk functionality of the exception builder. The exception builder is the component that will be used to create exception list items. It does not deal with the actual API creation/deletion/update of exceptions, it does contain an `onChange` handler that can be used to access the exceptions. The builder is able to: - accept `ExceptionListItem` and render them correctly - allow user to add exception list item and exception list item entries - accept an `indexPattern` and use it to fetch relevant field and autocomplete field values - disable `Or` button if user is only allowed to edit/add to exception list item (not add additional exception list items) - displays `Add new exception` button if no exception items exist - An exception item can be created without entries, the `add new exception` button will show in the case that an exception list contains exception list item(s) with an empty `entries` array (as long as there is one exception list item with an item in `entries`, button does not show) - debounces field value autocomplete searches - bubble up exceptions to parent component, stripping out any empty entries

* master: (46 commits) [Visualize] Add missing advanced settings and custom label for pipeline aggs (elastic#69688) Use dynamic: false for config saved object mappings (elastic#70436) [Ingest Pipelines] Error messages (elastic#70167) [APM] Show transaction rate per minute on Observability Overview page (elastic#70336) Filter out error when calculating a label (elastic#69934) [Visualizations] Each visType returns its supported triggers (elastic#70177) [Telemetry] Report data shippers (elastic#64935) Reduce SavedObjects mappings for Application Usage (elastic#70475) [Lens] fix dimension label performance issues (elastic#69978) Skip failing endgame tests (elastic#70548) [SIEM] Reenabling Cypress tests (elastic#70397) [SIEM][Security Solution][Endpoint] Endpoint Artifact Manifest Management + Artifact Download and Distribution (elastic#67707) [Security] Adds field mapping support to rule creation (elastic#70288) SECURITY-ENDPOINT: add fields for events to metadata document (elastic#70491) Fixed assertion in hybrid index pattern test to iterate through indices (elastic#70130) [SIEM][Exceptions] - Exception builder component (elastic#67013) [Ingest Manager] Rename data sources to package configs (elastic#70259) skip suites blocking es snapshot promomotion (elastic#70532) [Metrics UI] Fix asynchronicity and error handling in Snapshot API (elastic#70503) fix export response (elastic#70473) ...

elasticmachine · 2021-09-23T14:34:26Z

Pinging @elastic/security-solution (Team: SecuritySolution)

yctercero and others added 30 commits May 17, 2020 21:58

added modified and or badge, should move to common folder

c2702ed

added and or buttons with tests

1a0b722

added exception item entry component and helpers with tests

4436fed

added exception item, needs tests, and some additional utils

ad80d70

added exception item tests and made some modifications

3008b0d

added tests, index, cleaned up

6b47020

moved exception builder into common components

e1c02e4

Merge branch 'master' of github.com:yctercero/kibana into exception-b…

cf861dc

…uilder

cleaned up a few things, wip

8b93681

Merge branch 'master' of github.com:yctercero/kibana into exception-b…

a7dc8e6

…uilder

Merge branch 'master' of github.com:yctercero/kibana into exception-b…

3ded2df

…uilder

Merge branch 'master' of github.com:yctercero/kibana into exception-b…

0934ca8

…uilder

Merge branch 'master' of github.com:yctercero/kibana into exception-b…

0f84083

…uilder

Merge branch 'master' of github.com:yctercero/kibana into exception-b…

fe16cdf

…uilder

Add pure API functions and react hooks for value list APIs

c35bb4b

This also adds a generic hook, useAsyncTask, that wraps an async function to provide basic utilities: * loading state * error state * abort/cancel function

Fix type errors in hook tests

c83dabc

These were not caught locally as I was accidentally running typescript without the full project.

Merge branch 'master' of github.com:yctercero/kibana into exception-b…

3572c6e

…uilder

Merge branch 'master' into value_lists_api

fa512d7

Document current limitations of useAsyncTask

247f8e4

Defines a new validation function that returns an Either instead of a…

b657229

… tuple This allows callers to further leverage fp-ts functions as needed.

Remove duplicated copyright comment

d627a64

Adds helper function to convert a TaskEither back to a Promise

d99ba54

This cleans up our validation pipeline considerably.

Merge branch 'master' of github.com:yctercero/kibana into exception-b…

ef0a29e

…uilder

Refactor our API types

6d6b5cc

Add request/response validation to import/export functions

0f223aa

Fix type errors

e7f5b86

* Continue to export decoded types without a qualifier * pull types used by hooks from their new location * Fix errors with usage of act()

Merge branch 'master' of github.com:yctercero/kibana into exception-b…

2fe8948

…uilder

Attempting to reduce plugin bundle size

f433c51

By pulling from the module directly instead of an index, we can hopefully narrow down our dependencies until tree-shaking does this for us.

continued cleanup, added some more validation

a9b3e95

yctercero changed the title ~~[SIEM][Exceptions] - Exception builder component (wip)~~ [SIEM][Exceptions] - Exception builder component Jul 1, 2020

yctercero self-assigned this Jul 1, 2020

yctercero added release_note:enhancement Team:SIEM v7.9.0 v8.0.0 labels Jul 1, 2020

yctercero marked this pull request as ready for review July 1, 2020 11:44

yctercero requested review from a team as code owners July 1, 2020 11:44

yctercero commented Jul 1, 2020

View reviewed changes

yctercero added 4 commits July 1, 2020 09:51

updated operator field label

58b2ceb

fixed react warning, updated validation and tests

3026957

few changes didnt get in, updated tests

9341cba

updated creation of new exception item

ac3074e

peluja1012 reviewed Jul 1, 2020

View reviewed changes

peluja1012 approved these changes Jul 1, 2020

View reviewed changes

Merge branch 'master' of github.com:yctercero/kibana into exception-b…

7749035

…uilder

yctercero merged commit 6581450 into elastic:master Jul 2, 2020

yctercero mentioned this pull request Jul 2, 2020

[7.x] [SIEM][Exceptions] - Exception builder component (#67013) #70539

Merged

yctercero deleted the exception-builder branch October 14, 2020 12:00

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SIEM][Exceptions] - Exception builder component #67013

[SIEM][Exceptions] - Exception builder component #67013

yctercero commented May 19, 2020 •

edited

Loading

elasticmachine commented Jul 1, 2020

yctercero Jul 1, 2020

yctercero Jul 1, 2020

yctercero Jul 1, 2020

peluja1012 Jul 1, 2020

peluja1012 left a comment

kibanamachine commented Jul 2, 2020

elasticmachine commented Sep 23, 2021

[SIEM][Exceptions] - Exception builder component #67013

[SIEM][Exceptions] - Exception builder component #67013

Conversation

yctercero commented May 19, 2020 • edited Loading

Summary

To Do

Examples

Builder

List operator

Match operator

Match any operator

Boolean field type

Exists operator

Sample validation (field of type ip)

Checklist

elasticmachine commented Jul 1, 2020

yctercero Jul 1, 2020

Choose a reason for hiding this comment

yctercero Jul 1, 2020

Choose a reason for hiding this comment

yctercero Jul 1, 2020

Choose a reason for hiding this comment

peluja1012 Jul 1, 2020

Choose a reason for hiding this comment

peluja1012 left a comment

Choose a reason for hiding this comment

kibanamachine commented Jul 2, 2020

💚 Build Succeeded

Build metrics

History

elasticmachine commented Sep 23, 2021

yctercero commented May 19, 2020 •

edited

Loading

Sample validation (field of type `ip`)