[ti_recordedfuture] Drop redundant [Logs RecordedFuture] suffix from panel titles - #20383
Merged
efd6 merged 8 commits intoAug 2, 2026
Conversation
Contributor
ReviewersBuildkite won't run for external contributors automatically; you need to add a comment:
NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details. |
andrewkroh
added
dashboard
…panel titles Per the documented dashboard naming convention, the "[Logs <PACKAGE>]" prefix is reserved for the dashboard-level title; individual panel titles should use just the descriptive name. All five ti_recordedfuture dashboards (Overview, Files, URLs, Playbook Alert, Triggered Alert) repeated the prefix on every panel-level title and its matching embedded Lens/embeddableConfig title. Stripped the suffix from both title levels (60 occurrences total) so panel titles read e.g. "Unique MD5" instead of "Unique MD5 [Logs RecordedFuture]". Dashboard-level titles are untouched and keep the prefix, which is correct. Fixes elastic#20370 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01STTaWPq6nDxykUYmFe73D3
smnschndr
force-pushed
the
worktree-fix-20370-ti_recordedfuture-panel-title-prefix
branch
from
July 29, 2026 12:57
23ddf50 to
b213746
Compare
smnschndr
marked this pull request as ready for review
July 29, 2026 12:57
Contributor
Author
|
/test |
andrewkroh
added
the
Team:Security-Service Integrations
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
![vera-review-bot[bot]](https://avatars.githubusercontent.com/in/3297022?s=60&v=4){kind=small}
…board Six by-value panels (Total Indicators Hash/IP/URL/Domain, Total Sources Identifying the Indicators, Total Sightings) shared the identical embeddableConfig.attributes.title "Total Indicators" even though each measures a different metric. Set each embedded title to match its panel-level title. Addresses vera-review-bot finding on PR elastic#20383. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014tzkjPV4wxbHf7cfgre8iw
…tity Detections saved search The "Recent Identity Detections" saved search embedded in the Identity Detections dashboard still carried the redundant [Logs RecordedFuture] suffix that elastic#20383 removes elsewhere. It was masked by the dashboard panel's own title override, only visible when the saved object is opened directly. Found during a focused review of PR elastic#20383 for other assets sharing the same suffix pattern. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014tzkjPV4wxbHf7cfgre8iw
Contributor
Author
|
/test |
…ch titles
- Sync the last remaining embedded Lens title in the Overview dashboard
("Indicators ingested per Datastream" -> "Indicators ingested timeline")
to match its panel title, completing the title-sync pass.
- Restore the `[Logs RecordedFuture]` prefix on the "Recent Identity
Detections" saved search: unlike dashboard panel titles, a saved search
is a standalone top-level asset (Discover, Saved Objects) with no
dashboard title to supply package context, and every other saved search
in the repo carries a package identifier.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014tzkjPV4wxbHf7cfgre8iw
Contributor
Author
|
/test |
…board
Two side-by-side panels (bar chart of counts, donut of percentages) were
both titled "Top File Hash Types" after the suffix strip, a pre-existing
ambiguity carried forward from upstream. Rename the donut's panel-level
and embedded Lens title to "% of File Hash Types", matching the naming
pattern already used on the Overview dashboard ("Top Indicator Criticality
Labels" vs "% of Indicator Criticality").
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014tzkjPV4wxbHf7cfgre8iw
Contributor
Author
|
/test |
The Files dashboard's "% of File Hash Types" donut had all 5 Lens filter labels set to empty strings (pre-existing, but this is the same panel whose title this PR already touches), so its legend rendered raw KQL instead of MD5/SHA1/SHA256/SHA384/SHA512. Label it to match the adjacent bar chart, which already carries the correct labels for the identical filters. Also condense the 2.7.2 changelog entry to a single user-facing sentence, per repository convention, instead of enumerating internal saved-object mechanics. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014tzkjPV4wxbHf7cfgre8iw
Contributor
Author
|
/test |
The "Top File Hashes" donut in the Files dashboard only buckets on threat.indicator.file.hash.md5 (a single terms aggregation), so the generic plural title is misleading next to the "% of File Hash Types" donut, which does cover all five algorithms. Rename both the panel title and embedded Lens title to "Top MD5 File Hashes" to match the sourceField it actually aggregates. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014tzkjPV4wxbHf7cfgre8iw
Contributor
Author
|
/test |
Bundling the suffix strip, title-mismatch fixes, and filter labeling into one run-on sentence made the entry hard to read. Split into three separate change entries under the same version, matching the repository convention used when several distinct changes land in the same PR (e.g. packages/panw/changelog.yml version 2.2.1). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014tzkjPV4wxbHf7cfgre8iw
Contributor
Author
|
/test |
|
No issues across the latest commits f154992. Review summaryIssues found across earlier commits bf061fd — 1 low
Issues found across earlier commits 4acab8d — 1 low
Issues found across earlier commits 04a8f0d — 2 low
Issues found across earlier commits 6b7b5d8 — 1 low
Issues found across earlier commits 9a14946 — 1 medium
Issues found across earlier commits bf769f7 — 1 low
Issues found across earlier commits b213746 — 1 low
🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills
|
Contributor
Author
|
@elastic/security-service-integrations This PR is ready for review/merge — all checks are green (CLA, Buildkite/Summary) and it's out of draft. It went through several rounds of automated review (Vera) covering both the original scope (redundant |
Contributor
|
/test |
Contributor
|
✅ All changelog entries have the correct PR link. |
💚 Build Succeeded
|
efd6
approved these changes
Aug 2, 2026
Contributor
|
Tick the box to add this pull request to the merge queue (same as
|
Contributor
|
Package ti_recordedfuture - 2.7.2 containing this change is available at https://epr.elastic.co/package/ti_recordedfuture/2.7.2/ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
[Logs <PACKAGE>]prefix is reserved for the dashboard-level title; individual panel titles should use just the descriptive name.ti_recordedfuturedashboards (Overview, Files, URLs, Playbook Alert, Triggered Alert) repeated the prefix on every panel-level title and its matching embedded Lens/embeddableConfig title.Unique MD5instead ofUnique MD5 [Logs RecordedFuture]. Dashboard-level titles are untouched and keep the prefix, which is correct.2.7.0->2.7.2and added a changelog entry.Fixes #20370
This PR was branched independently of #20367 (which bumps the same package to
2.7.1), so the version here is set to2.7.2assuming #20367 merges first. GitHub doesn't support a native "depends on" relationship between pull requests (only between issues), so noting it here instead:2.7.1, this PR is ready to rebase/merge as-is at2.7.2.2.7.1and [ti_recordedfuture] Fix stale AbuseCH dashboard references #20367 would need to be rebased to2.7.2instead.Test plan
kbdashthat no title-mismatch warnings were introduced (panel-level and embedded titles remain in sync after stripping the suffix).elastic-package lint— the two errors it reports (transform.ymlnum_failure_retries, manifestagentless.release) are pre-existing onmainand unrelated to this change.🤖 Generated with Claude Code