Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[SIEM] Detection Engine Meta Cleanup #54935

Closed
28 of 34 tasks
spong opened this issue Jan 15, 2020 · 2 comments
Closed
28 of 34 tasks

[SIEM] Detection Engine Meta Cleanup #54935

spong opened this issue Jan 15, 2020 · 2 comments
Assignees
@XavierM @dhurley14 @FrankHassanabad @spong
Labels
bug Fixes for quality problems that affect the customer experience Meta Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM

Comments

@spong
Copy link
Member

spong commented Jan 15, 2020 •
edited by dhurley14
Loading

This is a meta issue for tracking the remaining Detection Engine cleanup items.

cc @XavierM, @FrankHassanabad, @dhurley14 , @MichaelMarcialis, @tsg, @cwurm, @mchopda

Generic DE
  • Add link to Rule Details in timeline for both rule_id and rule_name (column renderer) (@XavierM)
  • Pre-packaged rule (@XavierM)
  • Close Signal in Timeline (@XavierM) it is a feature let's do it 7.7
  • Update Icons (@patrykkopycinski)
  • Detection Engine Text Review (doc) (@XavierM)
  • Remove ability to add your own custom immutable rules or delete them (@FrankHassanabad)
  • Fix kibana breadcrumb for dection engine routes (@patrykkopycinski)
Signals Table
  • Field Browser Resets to default Timeline Columns (@XavierM)
  • Update column order (?) (Timestamp, Risk Score, Rule Name, etc...)
Signals Histogram
All Rules
  • Last completed run subtitle? feature so let's do for 7.7
  • Show total number of enabled rules + Deactivate (@spong ) Now showing rule totals in filters, deactivate all is feature so let's do for 7.7
  • Elastic/ Custom Rule Filters + Tags (@spong)
  • Bulk Duplicate (@spong)
  • Refresh table when deleting all on page (@spong)
  • Remove Edit selected index patterns... batch action (@spong)
  • Improve export rules error feedback will address in 7.7
  • Add Risk Score column (@spong)
  • Remove Method column (@spong)
Rule Details
  • Remove Experimental tag (@XavierM)
  • Succeeded text size consistency (@XavierM)
  • Overflow Actions Button extra edit (@XavierM)
  • Toaster not showing when deleting rule will address in 7.7
  • MITRE ATT&CK Empty (Rule: "Suricata ET WEB_SPECIFIC_APPS Jenkins RCE CVE-2019-1003000") (@XavierM)
  • Toggling enable/disable -> Did the rule run? (@dhurley14)
  • Remove duplicate failure on response if less than 5 failures have occurred. (@dhurley14)
Rule Creation / Edit Rules
@spong spong added bug Fixes for quality problems that affect the customer experience Meta Team:SIEM labels Jan 15, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/siem (Team:SIEM)

@spong spong mentioned this issue Jan 22, 2020
Merged
7 tasks
spong added a commit that referenced this issue Jan 23, 2020
@spong
[SIEM] [Detection Engine] All Rules fixes (#55641)
90e3bb0 
## Summary

This PR addresses bugs outlined in #54935

Including:
* Add Risk Score column
* Remove Method column
* Fixes `Showing Events` on Alerts table
* Fixes Tag overflow
* Shows Tags/Filters

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~
- [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~
- [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~

### For maintainers

- [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
- [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
spong added a commit to spong/kibana that referenced this issue Jan 23, 2020
@spong
[SIEM] [Detection Engine] All Rules fixes (elastic#55641)
0b883cf 
## Summary

This PR addresses bugs outlined in elastic#54935

Including:
* Add Risk Score column
* Remove Method column
* Fixes `Showing Events` on Alerts table
* Fixes Tag overflow
* Shows Tags/Filters

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~
- [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~
- [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~

### For maintainers

- [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
- [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
spong added a commit to spong/kibana that referenced this issue Jan 23, 2020
@spong
[SIEM] [Detection Engine] All Rules fixes (elastic#55641)
cd32459 
## Summary

This PR addresses bugs outlined in elastic#54935

Including:
* Add Risk Score column
* Remove Method column
* Fixes `Showing Events` on Alerts table
* Fixes Tag overflow
* Shows Tags/Filters

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~
- [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~
- [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~

### For maintainers

- [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
- [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
spong added a commit that referenced this issue Jan 23, 2020
@spong
[SIEM] [Detection Engine] All Rules fixes (#55641) (#55651)
6d76240 
## Summary

This PR addresses bugs outlined in #54935

Including:
* Add Risk Score column
* Remove Method column
* Fixes `Showing Events` on Alerts table
* Fixes Tag overflow
* Shows Tags/Filters

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~
- [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~
- [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~

### For maintainers

- [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
- [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
spong added a commit that referenced this issue Jan 23, 2020
@spong
[SIEM] [Detection Engine] All Rules fixes (#55641) (#55650)
8e0e58b 
## Summary

This PR addresses bugs outlined in #54935

Including:
* Add Risk Score column
* Remove Method column
* Fixes `Showing Events` on Alerts table
* Fixes Tag overflow
* Shows Tags/Filters

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~
- [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~
- [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~

### For maintainers

- [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
- [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
@spong spong mentioned this issue Jan 27, 2020
Merged
17 tasks
spong added a commit that referenced this issue Jan 27, 2020
@spong
[SIEM] [Detection Engine] Fixes histogram intervals (#55969)
80087a3 
## Summary

This PR wraps up the remaining `Detection Engine` meta tickets: #55585, #54935, and elastic/siem-team#498
- [x] Histogram bar interval (bar counts and widths) consistency (#55585)
  - [x] Make the bar intervals a consistent 32 bars across the board
  * Enabled `extended_bounds`, `min_doc_count: 0`, and now setting consistent `fixed_interval` when querying to ensure the entire daterange is displayed across all histograms.
- [x] Filter out the "untitled" timelines from both timeline selection options during rule creation (elastic/siem-team#498)
  - [ ] ~Import query from saved timeline~
    * For 7.7 tracking ticket here: #56079
  - [x] `Investigate detections using this timeline template` 
- [x] Everywhere we use "Alerts" (Overview page, Host Tab, Network Tab) we should change the term to "External Alerts"
  - [x] Updated Host Page Tab/Table/Histogram/Breadcrumbs
  - [x] Updated Network Page Tab/Table/Histogram/Breadcrumbs
- [x] Updated DE permission/index  error doc links to go to [corresponding DE docs section](https://www.elastic.co/guide/en/siem/guide/7.6/detection-engine-overview.html#detections-permissions)
- [x] Removed `frequency` in favor of `count` for remaining histograms

##### Inconsistent Histogram intervals
![image](https://user-images.githubusercontent.com/2946766/73161560-04a82300-40a9-11ea-950f-ea56f9a5bfd7.png)


##### Consistent Histogram Intervals
![image](https://user-images.githubusercontent.com/2946766/73159564-fefc0e80-40a3-11ea-9b9d-4d15899dabd2.png)


cc @MichaelMarcialis @cwurm @MikePaquette 

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~
- [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~
- [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~

### For maintainers

- [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
- [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
spong added a commit to spong/kibana that referenced this issue Jan 27, 2020
@spong
[SIEM] [Detection Engine] Fixes histogram intervals (elastic#55969)
2405925 
## Summary

This PR wraps up the remaining `Detection Engine` meta tickets: elastic#55585, elastic#54935, and elastic/siem-team#498
- [x] Histogram bar interval (bar counts and widths) consistency (elastic#55585)
  - [x] Make the bar intervals a consistent 32 bars across the board
  * Enabled `extended_bounds`, `min_doc_count: 0`, and now setting consistent `fixed_interval` when querying to ensure the entire daterange is displayed across all histograms.
- [x] Filter out the "untitled" timelines from both timeline selection options during rule creation (elastic/siem-team#498)
  - [ ] ~Import query from saved timeline~
    * For 7.7 tracking ticket here: elastic#56079
  - [x] `Investigate detections using this timeline template` 
- [x] Everywhere we use "Alerts" (Overview page, Host Tab, Network Tab) we should change the term to "External Alerts"
  - [x] Updated Host Page Tab/Table/Histogram/Breadcrumbs
  - [x] Updated Network Page Tab/Table/Histogram/Breadcrumbs
- [x] Updated DE permission/index  error doc links to go to [corresponding DE docs section](https://www.elastic.co/guide/en/siem/guide/7.6/detection-engine-overview.html#detections-permissions)
- [x] Removed `frequency` in favor of `count` for remaining histograms

##### Inconsistent Histogram intervals
![image](https://user-images.githubusercontent.com/2946766/73161560-04a82300-40a9-11ea-950f-ea56f9a5bfd7.png)


##### Consistent Histogram Intervals
![image](https://user-images.githubusercontent.com/2946766/73159564-fefc0e80-40a3-11ea-9b9d-4d15899dabd2.png)


cc @MichaelMarcialis @cwurm @MikePaquette 

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~
- [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~
- [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~

### For maintainers

- [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
- [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
spong added a commit to spong/kibana that referenced this issue Jan 27, 2020
@spong
[SIEM] [Detection Engine] Fixes histogram intervals (elastic#55969)
8f17622 
## Summary

This PR wraps up the remaining `Detection Engine` meta tickets: elastic#55585, elastic#54935, and elastic/siem-team#498
- [x] Histogram bar interval (bar counts and widths) consistency (elastic#55585)
  - [x] Make the bar intervals a consistent 32 bars across the board
  * Enabled `extended_bounds`, `min_doc_count: 0`, and now setting consistent `fixed_interval` when querying to ensure the entire daterange is displayed across all histograms.
- [x] Filter out the "untitled" timelines from both timeline selection options during rule creation (elastic/siem-team#498)
  - [ ] ~Import query from saved timeline~
    * For 7.7 tracking ticket here: elastic#56079
  - [x] `Investigate detections using this timeline template` 
- [x] Everywhere we use "Alerts" (Overview page, Host Tab, Network Tab) we should change the term to "External Alerts"
  - [x] Updated Host Page Tab/Table/Histogram/Breadcrumbs
  - [x] Updated Network Page Tab/Table/Histogram/Breadcrumbs
- [x] Updated DE permission/index  error doc links to go to [corresponding DE docs section](https://www.elastic.co/guide/en/siem/guide/7.6/detection-engine-overview.html#detections-permissions)
- [x] Removed `frequency` in favor of `count` for remaining histograms

##### Inconsistent Histogram intervals
![image](https://user-images.githubusercontent.com/2946766/73161560-04a82300-40a9-11ea-950f-ea56f9a5bfd7.png)


##### Consistent Histogram Intervals
![image](https://user-images.githubusercontent.com/2946766/73159564-fefc0e80-40a3-11ea-9b9d-4d15899dabd2.png)


cc @MichaelMarcialis @cwurm @MikePaquette 

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~
- [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~
- [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~

### For maintainers

- [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
- [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
spong added a commit that referenced this issue Jan 28, 2020
@spong
[SIEM] [Detection Engine] Fixes histogram intervals (#55969) (#56086)
d997be7 
## Summary

This PR wraps up the remaining `Detection Engine` meta tickets: #55585, #54935, and elastic/siem-team#498
- [x] Histogram bar interval (bar counts and widths) consistency (#55585)
  - [x] Make the bar intervals a consistent 32 bars across the board
  * Enabled `extended_bounds`, `min_doc_count: 0`, and now setting consistent `fixed_interval` when querying to ensure the entire daterange is displayed across all histograms.
- [x] Filter out the "untitled" timelines from both timeline selection options during rule creation (elastic/siem-team#498)
  - [ ] ~Import query from saved timeline~
    * For 7.7 tracking ticket here: #56079
  - [x] `Investigate detections using this timeline template` 
- [x] Everywhere we use "Alerts" (Overview page, Host Tab, Network Tab) we should change the term to "External Alerts"
  - [x] Updated Host Page Tab/Table/Histogram/Breadcrumbs
  - [x] Updated Network Page Tab/Table/Histogram/Breadcrumbs
- [x] Updated DE permission/index  error doc links to go to [corresponding DE docs section](https://www.elastic.co/guide/en/siem/guide/7.6/detection-engine-overview.html#detections-permissions)
- [x] Removed `frequency` in favor of `count` for remaining histograms

##### Inconsistent Histogram intervals
![image](https://user-images.githubusercontent.com/2946766/73161560-04a82300-40a9-11ea-950f-ea56f9a5bfd7.png)


##### Consistent Histogram Intervals
![image](https://user-images.githubusercontent.com/2946766/73159564-fefc0e80-40a3-11ea-9b9d-4d15899dabd2.png)


cc @MichaelMarcialis @cwurm @MikePaquette 

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~
- [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~
- [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~

### For maintainers

- [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
- [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
spong added a commit that referenced this issue Jan 28, 2020
@spong
[SIEM] [Detection Engine] Fixes histogram intervals (#55969) (#56085)
99de5ee 
## Summary

This PR wraps up the remaining `Detection Engine` meta tickets: #55585, #54935, and elastic/siem-team#498
- [x] Histogram bar interval (bar counts and widths) consistency (#55585)
  - [x] Make the bar intervals a consistent 32 bars across the board
  * Enabled `extended_bounds`, `min_doc_count: 0`, and now setting consistent `fixed_interval` when querying to ensure the entire daterange is displayed across all histograms.
- [x] Filter out the "untitled" timelines from both timeline selection options during rule creation (elastic/siem-team#498)
  - [ ] ~Import query from saved timeline~
    * For 7.7 tracking ticket here: #56079
  - [x] `Investigate detections using this timeline template` 
- [x] Everywhere we use "Alerts" (Overview page, Host Tab, Network Tab) we should change the term to "External Alerts"
  - [x] Updated Host Page Tab/Table/Histogram/Breadcrumbs
  - [x] Updated Network Page Tab/Table/Histogram/Breadcrumbs
- [x] Updated DE permission/index  error doc links to go to [corresponding DE docs section](https://www.elastic.co/guide/en/siem/guide/7.6/detection-engine-overview.html#detections-permissions)
- [x] Removed `frequency` in favor of `count` for remaining histograms

##### Inconsistent Histogram intervals
![image](https://user-images.githubusercontent.com/2946766/73161560-04a82300-40a9-11ea-950f-ea56f9a5bfd7.png)


##### Consistent Histogram Intervals
![image](https://user-images.githubusercontent.com/2946766/73159564-fefc0e80-40a3-11ea-9b9d-4d15899dabd2.png)


cc @MichaelMarcialis @cwurm @MikePaquette 

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~
- [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~
- [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~

### For maintainers

- [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
- [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
@spong
Copy link
Member Author

spong commented Jan 28, 2020

Looks like we've got all these taken care of (or be tackling in 7.7) -- thanks @XavierM @patrykkopycinski @FrankHassanabad @dhurley14 @andrew-goldstein ! 😀 🎉

@spong spong closed this as completed Jan 28, 2020
@MindyRS MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Oct 27, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@XavierM XavierM

@dhurley14 dhurley14

@FrankHassanabad FrankHassanabad

@spong spong

Labels
bug Fixes for quality problems that affect the customer experience Meta Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@XavierM @dhurley14 @FrankHassanabad @MindyRS @spong @elasticmachine