Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Replace host / user risk score over time with Lens Embeddable - 8.7 #149015

Closed
angorayc opened this issue Jan 17, 2023 · 1 comment
Closed

Replace host / user risk score over time with Lens Embeddable - 8.7 #149015

angorayc opened this issue Jan 17, 2023 · 1 comment
Assignees
@angorayc
Labels
Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Explore Team:Threat Hunting Security Solution Threat Hunting Team v8.7.0

Comments

@angorayc
Copy link
Contributor

angorayc commented Jan 17, 2023 •
edited

Original issue: #136409
This is to replace Host / User risk score over time with Lens Embeddable
Screenshot 2023-01-17 at 10 28 23
@angorayc angorayc mentioned this issue Jan 17, 2023
Closed
41 tasks
@botelastic botelastic bot added the needs-team Issues missing a team label label Jan 17, 2023
@jsanz jsanz added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Jan 17, 2023
@botelastic botelastic bot removed the needs-team Issues missing a team label label Jan 17, 2023
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

@angorayc angorayc self-assigned this Jan 17, 2023
@angorayc angorayc mentioned this issue Jan 17, 2023
Merged
2 tasks
@angorayc angorayc changed the title Replace host risk score over time with Lens Embeddable - 8.7 Replace host / user risk score over time with Lens Embeddable - 8.7 Jan 17, 2023
angorayc added a commit that referenced this issue Jan 24, 2023
@angorayc
[SecuritySolution] Replace risk score over time with Lens Embeddable (#…
7c4789d 
…149035)

## Summary
Implements: #149015

Please Enable feature flags. Please add this to kibana.dev.yml
xpack.securitySolution.enableExperimental: ['chartEmbeddablesEnabled']

---
### Replace risk score over time with Lens Embeddable

Before:
<img width="2543" alt="Screenshot 2023-01-17 at 10 28 23"
src="https://user-images.githubusercontent.com/6295984/212875145-f39fef08-c152-4c7e-8d0f-cf8e259c0b05.png">

After:
<img width="926" alt="Screenshot 2023-01-24 at 15 03 40"
src="https://user-images.githubusercontent.com/6295984/214329885-71e8166b-07ec-4f09-bece-919189d655ea.png">


### Alerts By severity on host / network / user details should apply
global filters
<img width="1673" alt="Screenshot 2023-01-19 at 11 06 21"
src="https://user-images.githubusercontent.com/6295984/213426977-4b803513-69f4-4074-b45d-2002c3f8fecf.png">

### Styling for donuts on Entity Analytics dashboard
(Moving the legend to left side of the chart so its actions button
wouldn't overlap with chart action)
<img width="1654" alt="Screenshot 2023-01-19 at 11 08 47"
src="https://user-images.githubusercontent.com/6295984/213427320-0fa3a9aa-f0d4-435a-87d3-5108b5c7f991.png">


Preview:
[Host risk score over
time](https://kibana-pr-148624.kb.us-west2.gcp.elastic-cloud.com:9243/s/data/app/security/hosts/name/Angelas-MacBook-Pro.local/hostRisk?sourcerer=(default:(id:security-solution-data,selectedPatterns:!(%27filebeat-*%27,%27logs-*%27,%27packetbeat-*%27,%27-*elastic-cloud-logs-*%27)))&timerange=(global:(linkTo:!(timeline),timerange:(from:%272023-01-18T00:00:00.000Z%27,fromStr:now%2Fd,kind:relative,to:%272023-01-18T23:59:59.999Z%27,toStr:now%2Fd)),timeline:(linkTo:!(global),timerange:(from:%272023-01-18T00:00:00.000Z%27,fromStr:now%2Fd,kind:relative,to:%272023-01-18T23:59:59.999Z%27,toStr:now%2Fd)))&timeline=(activeTab:query,graphEventId:%27%27,id:%2736333270-9731-11ed-a0f5-f16ed1963ee6%27,isOpen:!f))
[User risk score over
time](https://kibana-pr-148624.kb.us-west2.gcp.elastic-cloud.com:9243/s/data/app/security/users/name/angelachuang/userRisk?sourcerer=(default:(id:security-solution-data,selectedPatterns:!(%27filebeat-*%27,%27logs-*%27,%27packetbeat-*%27,%27-*elastic-cloud-logs-*%27)))&timerange=(global:(linkTo:!(timeline),timerange:(from:%272023-01-18T00:00:00.000Z%27,fromStr:now%2Fd,kind:relative,to:%272023-01-18T23:59:59.999Z%27,toStr:now%2Fd)),timeline:(linkTo:!(global),timerange:(from:%272023-01-18T00:00:00.000Z%27,fromStr:now%2Fd,kind:relative,to:%272023-01-18T23:59:59.999Z%27,toStr:now%2Fd)))&timeline=(activeTab:query,graphEventId:%27%27,id:%2736333270-9731-11ed-a0f5-f16ed1963ee6%27,isOpen:!f))

https://p.elstc.co/paste/2MIN+pHd#TETZwPh15r64HQ2z0Cn26Z321XCxe+2DqliqF5-CHmr
Designers' review:
#149123

### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
@rylnd rylnd mentioned this issue Oct 6, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@angorayc angorayc

Labels
Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Explore Team:Threat Hunting Security Solution Threat Hunting Team v8.7.0
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@jsanz @angorayc @elasticmachine