[Osquery] Add to timeline button #128596

tomsonpl · 2022-03-28T10:07:25Z

Summary

Add possibility to quickly add osquery action to the timeline.

Also - remove the go back button from the Osquery Flyout

elasticmachine · 2022-03-28T10:07:28Z

Pinging @elastic/security-asset-management (Team:Asset Management)

tomsonpl · 2022-03-28T10:08:36Z

@elasticmachine merge upstream

…into osquery-add-to-timeline

YulNaumenko · 2022-03-28T16:16:02Z

x-pack/plugins/security_solution/public/detections/components/osquery/osquery_flyout.tsx

+        },
+      };
+
+      return getAddToTimelineButton({


I think we should have at least a unit test to check the flyout is rendered correctly according to the props and then check if add to timeline was executed with the right options.

tomsonpl · 2022-03-29T14:32:13Z

@elasticmachine merge upstream

YulNaumenko

Security solution changes LGTM

tomsonpl · 2022-03-31T13:01:26Z

@elasticmachine merge upstream

kqualters-elastic · 2022-03-31T17:10:39Z

x-pack/plugins/osquery/public/saved_queries/saved_query_flyout.tsx

+        onClose={onClose}
+        aria-labelledby="flyoutTitle"
+        // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
+        maskProps={{ style: 'z-index: 6000' }} // For an edge case to display above the alerts flyout


So I see below that this flyout has a form in it, did you verify that all the select dropdowns etc that render in this form, namely EuiSuperSelect options and anything that renders itself via a portal (not sure of everything) render correctly? I noticed recently that any element that renders itself in a portal and has a parent that is also in a portal, when it tries to determine it's own stacking context cannot have a z-index higher than 2000 or something. https://codesandbox.io/s/crimson-voice-zq510u?file=/demo.js for a demo. Mentioned this to eui but they didn't seem to think it's a bug, personally I do, https://github.com/elastic/eui/blob/main/src/services/popover/popover_positioning.ts#L743 for an element in a portal will not do what it should.

Hey, I don't know yet, but will take a look at this and get back to you. Big thanks! :)

Thanks, I double checked and it seems to be working just fine. Selects too :)
The only thing is the Global NavBar that doesnt really work when any of the additional flyouts is opened.

So we checked one more time, and apparently it works fine on Alerts, but messes up one of the flyouts in Osquery itself.

Thanks for pointing this out :)

the issue is fixed here #130944

tomsonpl · 2022-04-04T08:44:01Z

@elasticmachine merge upstream

kqualters-elastic · 2022-04-26T18:30:06Z

x-pack/plugins/security_solution/public/detections/components/osquery/osquery_flyout.tsx

+        dataProvider: providerA,
+        field: value,
+        ownFocus: false,
+        ...(payload.isIcon ? { showTooltip: true } : { Component: TimelineComponent }),


is this ever called with isIcon false?

No, never. It's either true or undefined

kqualters-elastic · 2022-04-26T18:31:02Z

x-pack/plugins/security_solution/public/detections/components/osquery/osquery_flyout.tsx

+
+  const handleAddToTimeline = useCallback(
+    (payload: { query: [string, string]; isIcon?: true }) => {
+      const [field, value] = payload.query;


nit: could change this to const { query: [field, value], isIcon } = payload so it's more clear that isIcon is used below

kqualters-elastic

unless i'm missing something not sure if you need to pass isIcon around as it always seems true, but otherwise lgtm 👍

tomsonpl · 2022-04-28T07:00:24Z

Thanks @kqualters-elastic :)
Regarding isIcon: we're using this handleAddToTimeline in two places. One of which contains isIcon: true in payload, the other doesn't - then we render the Component instead of tooltip.
I hope that makes sense?

tomsonpl · 2022-04-28T07:00:44Z

@elasticmachine merge upstream

kibanamachine · 2022-04-28T07:00:45Z

merge conflict between base and head

# Conflicts: # x-pack/plugins/osquery/cypress/integration/all/live_query.spec.ts # x-pack/plugins/osquery/public/live_queries/form/index.tsx # x-pack/plugins/osquery/public/live_queries/index.tsx # x-pack/plugins/osquery/public/results/results_table.tsx # x-pack/plugins/osquery/public/routes/saved_queries/edit/tabs.tsx # x-pack/plugins/osquery/public/shared_components/osquery_action/index.tsx # x-pack/plugins/security_solution/public/detections/components/osquery/osquery_flyout.tsx

tomsonpl · 2022-04-28T09:41:48Z

@elasticmachine merge upstream

tomsonpl · 2022-04-28T11:04:18Z

@elasticmachine merge upstream

…query-add-to-timeline

tomsonpl · 2022-04-28T15:12:53Z

@elasticmachine merge upstream

…query-add-to-timeline

kibana-ci · 2022-04-28T17:10:14Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	2787	2786	-1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`osquery`	998.6KB	998.9KB	+347.0B
`securitySolution`	4.8MB	4.8MB	+103.0B
total			+450.0B

History

💔 Build #41161 failed 81ebe56
💔 Build #41122 failed 6717b51
💔 Build #41098 failed faaaced
💔 Build #41070 failed dbe1048
💔 Build #41058 failed 0742331

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @tomsonpl

patrykkopycinski

Asset management LGTM

tomsonpl added 2 commits March 28, 2022 09:25

[wip]

9a0ea9f

fix timeline rerender and change action_id

ef1bcd4

tomsonpl added Team:Asset Management Security Asset Management Team Feature:Osquery Security Solution Osquery feature v8.2.0 labels Mar 28, 2022

tomsonpl requested a review from patrykkopycinski March 28, 2022 10:07

tomsonpl self-assigned this Mar 28, 2022

tomsonpl requested review from a team as code owners March 28, 2022 10:07

tomsonpl changed the title ~~Osquery add to timeline~~ [Osquery] Add to timeline button Mar 28, 2022

tomsonpl added the release_note:feature Makes this part of the condensed release notes label Mar 28, 2022

kibanamachine and others added 4 commits March 28, 2022 06:08

Merge branch 'main' into osquery-add-to-timeline

635af17

fix zindex issue

e483a17

Merge branch 'osquery-add-to-timeline' of github.com:tomsonpl/kibana …

2d4b13b

…into osquery-add-to-timeline

fix eslint

0b3d977

YulNaumenko reviewed Mar 28, 2022

View reviewed changes

add timeline e2e test to alerts

b06a58f

Merge branch 'main' into osquery-add-to-timeline

9b33c21

YulNaumenko approved these changes Mar 29, 2022

View reviewed changes

tomsonpl added v8.3.0 and removed v8.2.0 labels Mar 31, 2022

Merge branch 'main' into osquery-add-to-timeline

2bdb838

kqualters-elastic reviewed Mar 31, 2022

View reviewed changes

kibanamachine and others added 2 commits April 4, 2022 04:44

Merge branch 'main' into osquery-add-to-timeline

d7cccf6

Add timeline to row (by _id)

2650b51

Merge branch 'main' into osquery-add-to-timeline

afc5980

tomsonpl marked this pull request as ready for review April 26, 2022 07:45

tomsonpl requested a review from kqualters-elastic April 26, 2022 15:31

kqualters-elastic reviewed Apr 26, 2022

View reviewed changes

kqualters-elastic approved these changes Apr 26, 2022

View reviewed changes

tomsonpl added 4 commits April 28, 2022 09:01

refactor payload destructuring

3c66905

fix after merge

0742331

fix tests

dbe1048

Merge branch 'main' into osquery-add-to-timeline

faaaced

kibanamachine and others added 3 commits April 28, 2022 06:04

Merge branch 'main' into osquery-add-to-timeline

6717b51

remove go back button from osquery flyout

7cbda37

Merge remote-tracking branch 'origin/osquery-add-to-timeline' into os…

81ebe56

…query-add-to-timeline

kibanamachine and others added 3 commits April 28, 2022 10:12

Merge branch 'main' into osquery-add-to-timeline

8cead6b

fix tests

ad9c19c

Merge remote-tracking branch 'origin/osquery-add-to-timeline' into os…

dae6719

…query-add-to-timeline

patrykkopycinski approved these changes Apr 28, 2022

View reviewed changes

tomsonpl merged commit 0b988f3 into elastic:main Apr 29, 2022

kibanamachine added the backport:skip This commit does not require backporting label Apr 29, 2022

dmlemeshko pushed a commit to dmlemeshko/kibana that referenced this pull request May 5, 2022

[Osquery] Add to timeline button (elastic#128596)

d21dd6e

kertal pushed a commit to kertal/kibana that referenced this pull request May 24, 2022

[Osquery] Add to timeline button (elastic#128596)

0065194

melissaburpo mentioned this pull request Jun 9, 2022

[DOCS] New option to add Osquery results to a timeline investigation elastic/security-docs#2060

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Osquery] Add to timeline button #128596

[Osquery] Add to timeline button #128596

tomsonpl commented Mar 28, 2022 •

edited

Loading

elasticmachine commented Mar 28, 2022

tomsonpl commented Mar 28, 2022

YulNaumenko Mar 28, 2022

tomsonpl commented Mar 29, 2022

YulNaumenko left a comment

tomsonpl commented Mar 31, 2022

kqualters-elastic Mar 31, 2022 •

edited

Loading

tomsonpl Apr 4, 2022

tomsonpl Apr 25, 2022

tomsonpl Apr 26, 2022 •

edited

Loading

tomsonpl Apr 26, 2022

tomsonpl commented Apr 4, 2022

kqualters-elastic Apr 26, 2022

tomsonpl Apr 28, 2022

kqualters-elastic Apr 26, 2022

tomsonpl Apr 29, 2022

kqualters-elastic left a comment

tomsonpl commented Apr 28, 2022

tomsonpl commented Apr 28, 2022

kibanamachine commented Apr 28, 2022

tomsonpl commented Apr 28, 2022

tomsonpl commented Apr 28, 2022

tomsonpl commented Apr 28, 2022

kibana-ci commented Apr 28, 2022

patrykkopycinski left a comment

[Osquery] Add to timeline button #128596

[Osquery] Add to timeline button #128596

Conversation

tomsonpl commented Mar 28, 2022 • edited Loading

Summary

elasticmachine commented Mar 28, 2022

tomsonpl commented Mar 28, 2022

Choose a reason for hiding this comment

tomsonpl commented Mar 29, 2022

YulNaumenko left a comment

Choose a reason for hiding this comment

tomsonpl commented Mar 31, 2022

kqualters-elastic Mar 31, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tomsonpl Apr 26, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tomsonpl commented Apr 4, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kqualters-elastic left a comment

Choose a reason for hiding this comment

tomsonpl commented Apr 28, 2022

tomsonpl commented Apr 28, 2022

kibanamachine commented Apr 28, 2022

tomsonpl commented Apr 28, 2022

tomsonpl commented Apr 28, 2022

tomsonpl commented Apr 28, 2022

kibana-ci commented Apr 28, 2022

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

History

patrykkopycinski left a comment

Choose a reason for hiding this comment

tomsonpl commented Mar 28, 2022 •

edited

Loading

kqualters-elastic Mar 31, 2022 •

edited

Loading

tomsonpl Apr 26, 2022 •

edited

Loading