Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution][Detections] Disable exceptions for Threshold and ML rules #72137

Merged
merged 5 commits into from
Jul 17, 2020
Merged

[Security Solution][Detections] Disable exceptions for Threshold and ML rules #72137

merged 5 commits into from
Jul 17, 2020

Conversation

rylnd
Copy link
Contributor

@rylnd rylnd commented Jul 16, 2020 •
edited
Loading

Summary

This restricts the UI; I believe the backend still needs similar guards.

  • On Rule Creation and Rule Update, the 'Associate to Global Endpoint Exceptions List' checkbox is disabled

    b7510536-6db9-45a4-bf39-5247df589e14_-_Kibana

  • On Rule Details, the Endpoints tab is disabled

    b7510536-6db9-45a4-bf39-5247df589e14_-_Kibana

Notes:

  • We could alternately disable the 'Add Exception' button instead of the entire Exceptions tab

Checklist

Delete any items that are not applicable to this PR.

For maintainers

rylnd added 4 commits July 15, 2020 23:53
@rylnd
Move isThresholdRule predicate into our common folder
4c6d605 
This is very similar to isMlRule, which is already used extensively and
lives at this level.
@rylnd
Disable endpoint association checkbox for ML and Threshold rules
2b82e5b 
The fullWidth and isDisabled props were not used; what we want is
disabled.
@rylnd
Fix react warning about nesting buttons
782784f 
This removes the AdvancedSettingsAccordion in favor of a plain
EuiAccordion with buttonContent, as that seems to be all that's needed
here.
@rylnd
Disable Exceptions tab on Details for ML or Threshold rules
1591303 
These rule types do not currently support exceptions.
@rylnd rylnd self-assigned this Jul 16, 2020
@rylnd
Fix type error
d9a770e 
Unused import
@kibanamachine
Copy link
Contributor

💚 Build Succeeded

Build metrics

async chunks size

id value diff baseline
securitySolution 7.3MB -97.0B 7.3MB

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@rylnd rylnd marked this pull request as ready for review July 16, 2020 23:03
@rylnd rylnd requested review from a team as code owners July 16, 2020 23:03
@elasticmachine
Copy link
Contributor

Pinging @elastic/siem (Team:SIEM)

FrankHassanabad
FrankHassanabad approved these changes Jul 17, 2020
View reviewed changes
Copy link
Contributor

@FrankHassanabad FrankHassanabad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@rylnd rylnd merged commit 5c0743e into elastic:master Jul 17, 2020
@rylnd rylnd deleted the disable_exceptions_for_nonquery_rules branch July 17, 2020 01:50
rylnd added a commit to rylnd/kibana that referenced this pull request Jul 17, 2020
@rylnd
[Security Solution][Detections] Disable exceptions for Threshold and …
5545d72 
…ML rules (elastic#72137)

* Move isThresholdRule predicate into our common folder

This is very similar to isMlRule, which is already used extensively and
lives at this level.

* Disable endpoint association checkbox for ML and Threshold rules

The fullWidth and isDisabled props were not used; what we want is
disabled.

* Fix react warning about nesting buttons

This removes the AdvancedSettingsAccordion in favor of a plain
EuiAccordion with buttonContent, as that seems to be all that's needed
here.

* Disable Exceptions tab on Details for ML or Threshold rules

These rule types do not currently support exceptions.

* Fix type error

Unused import
@rylnd rylnd mentioned this pull request Jul 17, 2020
Merged
rylnd added a commit to rylnd/kibana that referenced this pull request Jul 17, 2020
@rylnd
[Security Solution][Detections] Disable exceptions for Threshold and …
5f54b84 
…ML rules (elastic#72137)

* Move isThresholdRule predicate into our common folder

This is very similar to isMlRule, which is already used extensively and
lives at this level.

* Disable endpoint association checkbox for ML and Threshold rules

The fullWidth and isDisabled props were not used; what we want is
disabled.

* Fix react warning about nesting buttons

This removes the AdvancedSettingsAccordion in favor of a plain
EuiAccordion with buttonContent, as that seems to be all that's needed
here.

* Disable Exceptions tab on Details for ML or Threshold rules

These rule types do not currently support exceptions.

* Fix type error

Unused import
@rylnd rylnd mentioned this pull request Jul 17, 2020
Merged
rylnd added a commit that referenced this pull request Jul 17, 2020
@rylnd
[Security Solution][Detections] Disable exceptions for Threshold and …
dcf745b 
…ML rules (#72137) (#72218)

* Move isThresholdRule predicate into our common folder

This is very similar to isMlRule, which is already used extensively and
lives at this level.

* Disable endpoint association checkbox for ML and Threshold rules

The fullWidth and isDisabled props were not used; what we want is
disabled.

* Fix react warning about nesting buttons

This removes the AdvancedSettingsAccordion in favor of a plain
EuiAccordion with buttonContent, as that seems to be all that's needed
here.

* Disable Exceptions tab on Details for ML or Threshold rules

These rule types do not currently support exceptions.

* Fix type error

Unused import
rylnd added a commit that referenced this pull request Jul 17, 2020
@rylnd
[Security Solution][Detections] Disable exceptions for Threshold and …
b590bc2 
…ML rules (#72137) (#72217)

* Move isThresholdRule predicate into our common folder

This is very similar to isMlRule, which is already used extensively and
lives at this level.

* Disable endpoint association checkbox for ML and Threshold rules

The fullWidth and isDisabled props were not used; what we want is
disabled.

* Fix react warning about nesting buttons

This removes the AdvancedSettingsAccordion in favor of a plain
EuiAccordion with buttonContent, as that seems to be all that's needed
here.

* Disable Exceptions tab on Details for ML or Threshold rules

These rule types do not currently support exceptions.

* Fix type error

Unused import
gmmorris added a commit to gmmorris/kibana that referenced this pull request Jul 17, 2020
@gmmorris
Merge branch 'master' into task-manager/batch-update-delete
edb3f1e 
* master: (214 commits)
  replacing hard coded links for ela.st (elastic#72240)
  skip flaky suite (elastic#60865)
  chore(NA): teardown dynamic dll plugin (elastic#72096)
  Register navLink actions for declared applications (elastic#72109)
  Fix value for process.hash.sha256 draggable (elastic#72142)
  Call setupIngest before fleet_install tests (elastic#72214)
  [Security Solution][Detections] Better toast errors (elastic#72205)
  skip flaky suite (elastic#64696)
  [Security Solution][Detections] Disable exceptions for Threshold and ML rules (elastic#72137)
  [Security Solution][Detections,Lists] Miscellaneous post-FF fixes (elastic#71990)
  [baseline/capture] use high-memory nodes with ramDisks (elastic#71894)
  skip flaky suite (elastic#77207)
  [Maps] Fix issue preventing TMS from rendering correctly (elastic#71946)
  using test_user with minimum privs (elastic#71988)
  Fixed Webhook connector doesn't retain added HTTP header settings (elastic#71924)
  [Ingest Manager] Do not show enrolling and unenrolling agents as online in agent counters (elastic#71921)
  [Maps] fix 'New Map' from getting added to recently accessed (elastic#72125)
  [Visualizations] Pass 'aggs' parameter to custom request handlers (elastic#71423)
  [Monitoring] Out of the box alert tweaks (elastic#71942)
  [ML] Fix datafeed start time is incorrect when the job has trailing empty buckets (elastic#71976)
  ...
gmmorris added a commit to gmmorris/kibana that referenced this pull request Jul 17, 2020
@gmmorris
Merge branch 'master' into alerting/consumer-based-rbac
cbee849 
* master: (55 commits)
  updates 'External alerts' tab text (elastic#72237)
  [Security Solution][Case] Fix connector's dropdown with conflicting requests (elastic#72037)
  replacing hard coded links for ela.st (elastic#72240)
  skip flaky suite (elastic#60865)
  chore(NA): teardown dynamic dll plugin (elastic#72096)
  Register navLink actions for declared applications (elastic#72109)
  Fix value for process.hash.sha256 draggable (elastic#72142)
  Call setupIngest before fleet_install tests (elastic#72214)
  [Security Solution][Detections] Better toast errors (elastic#72205)
  skip flaky suite (elastic#64696)
  [Security Solution][Detections] Disable exceptions for Threshold and ML rules (elastic#72137)
  [Security Solution][Detections,Lists] Miscellaneous post-FF fixes (elastic#71990)
  [baseline/capture] use high-memory nodes with ramDisks (elastic#71894)
  skip flaky suite (elastic#77207)
  [Maps] Fix issue preventing TMS from rendering correctly (elastic#71946)
  using test_user with minimum privs (elastic#71988)
  Fixed Webhook connector doesn't retain added HTTP header settings (elastic#71924)
  [Ingest Manager] Do not show enrolling and unenrolling agents as online in agent counters (elastic#71921)
  [Maps] fix 'New Map' from getting added to recently accessed (elastic#72125)
  [Visualizations] Pass 'aggs' parameter to custom request handlers (elastic#71423)
  ...
gmmorris added a commit to gmmorris/kibana that referenced this pull request Jul 17, 2020
@gmmorris
Merge branch 'alerting/consumer-based-rbac' into alerting/management-…
fead80a 
…feature-privileges

* alerting/consumer-based-rbac: (56 commits)
  take into account which features available in the active space
  updates 'External alerts' tab text (elastic#72237)
  [Security Solution][Case] Fix connector's dropdown with conflicting requests (elastic#72037)
  replacing hard coded links for ela.st (elastic#72240)
  skip flaky suite (elastic#60865)
  chore(NA): teardown dynamic dll plugin (elastic#72096)
  Register navLink actions for declared applications (elastic#72109)
  Fix value for process.hash.sha256 draggable (elastic#72142)
  Call setupIngest before fleet_install tests (elastic#72214)
  [Security Solution][Detections] Better toast errors (elastic#72205)
  skip flaky suite (elastic#64696)
  [Security Solution][Detections] Disable exceptions for Threshold and ML rules (elastic#72137)
  [Security Solution][Detections,Lists] Miscellaneous post-FF fixes (elastic#71990)
  [baseline/capture] use high-memory nodes with ramDisks (elastic#71894)
  skip flaky suite (elastic#77207)
  [Maps] Fix issue preventing TMS from rendering correctly (elastic#71946)
  using test_user with minimum privs (elastic#71988)
  Fixed Webhook connector doesn't retain added HTTP header settings (elastic#71924)
  [Ingest Manager] Do not show enrolling and unenrolling agents as online in agent counters (elastic#71921)
  [Maps] fix 'New Map' from getting added to recently accessed (elastic#72125)
  ...
@MindyRS MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@FrankHassanabad FrankHassanabad FrankHassanabad approved these changes

Assignees

@rylnd rylnd

Labels
release_note:enhancement Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM v7.9.0 v8.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@rylnd @kibanamachine @elasticmachine @FrankHassanabad @MindyRS