Migrate tile_map objects to map objects

[thomasneirynck]

All the map visualizations in the integration packages use the tile_map visualization type. The editor for this visualization has been removed in 8.0.

These maps should use the map saved object type instead. This way, they can be immediately edited in the Maps-app.

(As of now, those tile_map-maps continue to work on Dashboards, but to make edits they need to be migrated to a map saved object. Kibana provides a built-in a migration shortcut tool).

[thomasneirynck]

Following integrations would require a migration:

• apache
• auditd
• cef
• cloudflare
• haproxy
• iis
• iptables
• netflow
• nginx
• nginx_ingress_controller
• panw
• suricata
• system
• traefik
• zeek

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[andrewkroh]

The steps to update a dashboard are:

1. Open the dashboard with old map.
2. Edit the dashboard.
3. Edit the tile map visualization.
4. Click "View in Maps". This will convert the tile_map for you. (Screenshot below.)
5. Click save. Set the title similar to the old map. Save the map into the existing dashboard object.
6. Delete the old map from the dashboard.
7. Move the new map into place on the dashboard.
8. Save the dashboard.
9. Export the dashboard into the integration using elastic-package export command.

[andrewkroh]

The work will be completed by integration's respective owners.

Security External Integrations

• auditd
• cef
• cloudflare
• iptables
• netflow
• panw
• suricata
• zeek

Observability Integrations

• apache
• haproxy
• iis
• nginx
• nginx_ingress_controller
• system
• traefik

[thomasneirynck]

wrt

a built-in a migration shortcut tool

To clarify: as of now, this tool is the "migrate" button on the right-hand editor pane. Clicking this button automates the transformation of the tile_map-saved object to a maps saved-object. This still requires some manual steps (outlined here #2617 (comment)) to complete the migration and add the new version to the Dashboard.

Ideally, this whole process would be automated when the user upgrades the cluster, and use the built-in SO-migration framework of Kibana.

This is currently not possible, because this SO-migration framework cannot migrate saved-objects to a different type. This is tracked by elastic/kibana#105115. It is unclear when exactly this will happen.

cc @nreese

[ulab]

Quick heads up:

The [SSH failed login attempts source locations] map needs to have a filter system.auth.ssh.event:Failed OR system.auth.ssh.event:Invalid too.

[ishleenk17]

As discussed with @akshay-saraswat , we are good to have support for these integrations from 8.0 onwards as tile map migration to map is supported from 8.0 onwards. (Support for 7.x will not be taken forward for these)
cc: @rameshelastic