[Security Solution][Detections] Adds UI for bulk applying timeline template

[banderror]

Addresses: #93083, https://github.com/elastic/security-team/issues/2078 (internal)

Summary

This PR adds a UI for applying a timeline template to multiple rules in bulk.

• A new bulk actions menu item to the Rule Management table.
• A new form flyout for applying a timeline template.
• Some glue code to connect them.

There are a few issues that I'd like to address in a follow-up PR after the FF:

1. Resetting already applied templates to None doesn't work because of the way the patchRules function works. This is a known bug in this implementation. We will need to replace patchRules with something else for bulk editing actions.
2. I need to add some test coverage.

Other notes:

• I changed some copies to hopefully make it a little bit clearer. Let me know if you want to rephrase.

Screenshots

The template selector doesn't look good on a smaller screen:

Checklist

Delete any items that are not applicable to this PR.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
• Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
• This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
• This was checked for cross-browser compatibility

For maintainers

• This was checked for breaking API changes and was labeled appropriately

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[spong]

This appears to be pre-existing, but the focus state of the Timeline Template selector component seems off in Dark Mode and doesn't match the combo box focus state from EUI here:

Within flyout:

Within Edit Rules (also notice how it re-open after selection....weird)

Also found this interesting click behavior where if you click the 'favorite star' when selecting the first component it can't be reselected until focus is lost 😅 . This component needs some 💙 it seems. No need to do any of that here, but maybe open an issue to revisit this component and throw it on the backlog?

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 3c3b469
• Storybooks Preview
• Webpack Bundle Analyzer

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	3000	3002	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	4.8MB	4.8MB	+2.6KB

History

• 💔 Build #34261 failed 7e8aaee
• 💔 Build #34239 failed d113dd7

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @banderror

[spong]

Checked out, code reviewed and tested locally -- LGTM! Couple interesting behaviors with the ole Timeline Template component itself (pre-existing), so may want to open an issue to track those, and did notice the behavior where you cannot reset timeline templates to None as mentioned in the description, but 👍 for addressing that in a follow-up.

Other than that testing went great and I was able to apply timeline templates to custom rules just as we can make changes to index patterns or tags. Great to see how little code it takes to start exposing these bulk actions! 🙌 🙂

[banderror]

Couple interesting behaviors with the ole Timeline Template component itself (pre-existing), so may want to open an issue to track those

@spong Yup, here we go: #128740 🙂

Great to see how little code it takes to start exposing these bulk actions!

I agree, it was pretty easy. Many thanks to @vitaliidm for making it possible!

[yiyangliu9286]

Hi @banderror, thanks for the screenshots. I am wondering that can I get a url to actually try and test this?
Regarding to the content changes, I'm looping in @joepeeples to see if there needs to be any edits to adjust here.

[banderror]

@yiyangliu9286 At this point the best option for trying and testing it would be to pull from main and run Kibana locally.

Deployment to Cloud from CI won't work because the PR has been closed. I also checked the current 8.2.0 snapshot version on Staging Cloud and it seems to be out of date (way behind main) - I don't know what's the cadence of updating the snapshot builds, I thought it was 1 day, but the current snapshot seems staler than that.

Please ping me if you need any help with running it locally.

Next time I'll make sure to prepare a cloud deployment beforehand.

[yiyangliu9286]

@yiyangliu9286 At this point the best option for trying and testing it would be to pull from main and run Kibana locally.

Deployment to Cloud from CI won't work because the PR has been closed. I also checked the current 8.2.0 snapshot version on Staging Cloud and it seems to be out of date (way behind main) - I don't know what's the cadence of updating the snapshot builds, I thought it was 1 day, but the current snapshot seems staler than that.

Please ping me if you need any help with running it locally.

Next time I'll make sure to prepare a cloud deployment beforehand.

Thanks for the feedback @banderror. I am a little unfamiliar with the process to run Kibana locally (last time I run it took me 2 hours ish to do). I've also check the staging environment as this has not been updated yet. Next time let's make sure that we have the url or other ways to test it before we merged this branch, which would be ideal.

I have updated my design regarding to @joepeeples's feedback. I think we will need to update Timeline to be capitalized to align with docs that this is a feature. And also update the copy within the warning Callout, here are the lists of things to update:

• Update copy in the bulk actions list, to be as "Apply Timeline template":

• Update warning Callout copy based on what @joepeeples suggested:
• Capitalizing all the Timeline in the Flyout:

@banderror I noticed that this PR has already merged, please let me know if we need to start another issue to address these changes, I'd be happy to do that. thanks!

[banderror]

@yiyangliu9286 @joepeeples thanks so much for your feedback! I'm going to submit a new PR with the proposed changes and fixes and figure out how to deploy the PR to Cloud. I'll add you to the reviewers when it's ready.