Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Interactive investigation guides #2821

Merged
merged 15 commits into from
Jan 24, 2023
Merged

Interactive investigation guides #2821

merged 15 commits into from
Jan 24, 2023

Conversation

joepeeples
Copy link
Contributor

@joepeeples joepeeples commented Jan 6, 2023 •
edited
Loading

@joepeeples joepeeples added Team: Threat Hunting Formerly Data Visibility v8.6.0 labels Jan 6, 2023
@joepeeples joepeeples self-assigned this Jan 6, 2023
@github-actions
Copy link

github-actions bot commented Jan 6, 2023

Documentation previews:

@joepeeples joepeeples marked this pull request as ready for review January 11, 2023 19:01
@joepeeples joepeeples changed the title Investigation guide query actions Interactive investigation guides Jan 11, 2023
jmikell821
jmikell821 reviewed Jan 11, 2023
View reviewed changes
Copy link
Contributor

@jmikell821 jmikell821 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great! Just a couple of small suggestions, thanks for pulling this together. 🌟

docs/experimental-features/investigation-guide-actions.asciidoc Outdated Show resolved Hide resolved
docs/experimental-features/investigation-guide-actions.asciidoc Outdated Show resolved Hide resolved
docs/experimental-features/investigation-guide-actions.asciidoc Outdated Show resolved Hide resolved
docs/experimental-features/investigation-guide-actions.asciidoc Outdated Show resolved Hide resolved
docs/experimental-features/investigation-guide-actions.asciidoc Outdated Show resolved Hide resolved
docs/experimental-features/investigation-guide-actions.asciidoc Outdated Show resolved Hide resolved
kqualters-elastic
kqualters-elastic reviewed Jan 12, 2023
View reviewed changes
docs/experimental-features/investigation-guide-actions.asciidoc
Each item in `providers` is defined by these attributes:

* `field`: The name of a field to query.
* `value`: The value to search for. Either a hard-coded literal value, or the name of the field on the alert whose value you want to use as a query parameter.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should mention here that any value that contains a \ character need to be double escaped, i.e. a windows file path would be "C:\\Windows\\System32". This is a bit gross without the form builder doing this for them, but won't be an issue next release. The reason for this is that JSON.stringify/JSON.parse is ultimately used twice, once on the entire markdown snippet, and once on the provider part of the snippet.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ha the github markdown behaves similarly, that was supposed to be 4 slashes delineating each part of the path, so I think it ends up being 8. "C:\\\\Windows\\\\System32"

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @kqualters-elastic! Are there any other special characters that need to be escaped, either double \\or single \?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ya I believe all the other JSON special characters as well:
\b Backspace (ascii code 08)
\f Form feed (ascii code 0C)
\n New line
\r Carriage return
\t Tab
" Double quote
\ Backslash character

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kqualters-elastic I added a note to explain escape characters, based on our Slack discussion. It's intentionally a little more general, pointing to the error icon to help users troubleshoot syntax errors. Feel free to edit as needed, once you've confirmed how exactly the characters work.

kqualters-elastic
kqualters-elastic approved these changes Jan 12, 2023
View reviewed changes
Copy link
Contributor

@kqualters-elastic kqualters-elastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is awesome, very clear and concise!

nastasha-solomon
nastasha-solomon reviewed Jan 12, 2023
View reviewed changes
Copy link
Contributor

@nastasha-solomon nastasha-solomon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Really helpful and thorough topic! Great idea to include example syntax as well. I left a handful of suggestions for your consideration and a couple of questions too. Good job!

docs/experimental-features/investigation-guide-actions.asciidoc Outdated Show resolved Hide resolved
docs/experimental-features/investigation-guide-actions.asciidoc Outdated Show resolved Hide resolved
docs/experimental-features/investigation-guide-actions.asciidoc Outdated Show resolved Hide resolved
docs/experimental-features/investigation-guide-actions.asciidoc Outdated Show resolved Hide resolved
benironside
benironside reviewed Jan 13, 2023
View reviewed changes
Copy link
Contributor

@benironside benironside left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me, just left one minor suggestion which you may choose to ignore!

docs/experimental-features/investigation-guide-actions.asciidoc Outdated Show resolved Hide resolved
@joepeeples joepeeples mentioned this pull request Jan 18, 2023
Closed
@joepeeples joepeeples merged commit 48d59b7 into main Jan 24, 2023
mergify bot pushed a commit that referenced this pull request Jan 24, 2023
@joepeeples @mergify
Interactive investigation guides (#2821)
176ec50 
* Incomplete first draft

* Expands first draft, still in progress

* Complete first draft

* Correct screenshot, some edits

* Apply line edits

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Revision based on Janeen's comments

* Apply suggestions from review

Co-authored-by: nastasha-solomon <[email protected]>

* Add draft statement about escape characters

* Edits from Paul, et al

Co-authored-by: Janeen Mikell Roberts <[email protected]>
Co-authored-by: nastasha-solomon <[email protected]>
(cherry picked from commit 48d59b7)
@mergify mergify bot mentioned this pull request Jan 24, 2023
Merged
@joepeeples joepeeples deleted the 2696-investigation-guide-actions branch January 24, 2023 15:20
joepeeples added a commit that referenced this pull request Jan 24, 2023
@mergify @joepeeples
Interactive investigation guides (#2821) (#2914)
ae54338 
* Incomplete first draft

* Expands first draft, still in progress

* Complete first draft

* Correct screenshot, some edits

* Apply line edits

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Revision based on Janeen's comments

* Apply suggestions from review

Co-authored-by: nastasha-solomon <[email protected]>

* Add draft statement about escape characters

* Edits from Paul, et al

Co-authored-by: Janeen Mikell Roberts <[email protected]>
Co-authored-by: nastasha-solomon <[email protected]>
(cherry picked from commit 48d59b7)

Co-authored-by: Joe Peeples <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@benironside benironside benironside left review comments

@nastasha-solomon nastasha-solomon nastasha-solomon left review comments

@jmikell821 jmikell821 jmikell821 left review comments

@kqualters-elastic kqualters-elastic kqualters-elastic approved these changes

@paulewing paulewing Awaiting requested review from paulewing

Assignees

@joepeeples joepeeples

Labels
Feature: Alerts Feature: Rules Feature: Timeline Team: Threat Hunting Formerly Data Visibility v8.6.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[DOCS] Markdown insights/actions from investigation guide ("playbook actions")
5 participants
@joepeeples @kqualters-elastic @jmikell821 @nastasha-solomon @benironside