[Security Solution] Alerts Grouping MVP #149145

YulNaumenko · 2023-01-18T18:06:12Z

Current PR introducing the new grouping functionality to the alerts tables: on Alerts and Rule Details pages.
The existing grouping design is a technical preview functionality and is a subject of the change.
MVP description:

Grouping is available only for alerts tables on the Alerts and Rules Details page as selectable dropdown options list in the right top level menu of the alerts table:

2. Default selected option "None" means that the group alerts by is turned off and none of the field is selected. In 8.7 feature has a **technical preview** badge on the right of the select option.

3. The default fields options list is different for Alerts and Rule Details pages and relevant to the page context:

Group by custom field is a separate option which allows to group the alerts data by any other index field.

Custom field provides a limited to the field value only default rendering for the panel and default set of stats metrics: Rules count and Alerts count.

For rule name for example the is also additionally rendered metrics, rule name, rule description and rule tags:

Each group panel provides the list of bulk actions options which could be applied to the whole group by clicking on the Take actions button. For now the list is limited to the three available actions:

Existing technical preview functionality is limited to display only one expanded group at a time.
For a big number of groups there is a paging functionality with the ability to define the items per page:

9. Grouping setting is stored in the local storage for each page separately and after the hard refresh should be picked up and rendered on the page.

…rouping-mvp # Conflicts: # x-pack/plugins/security_solution/public/common/components/event_rendered_view/helpers.ts

…rouping-mvp

…ko/kibana into security-solution-grouping-mvp

spong · 2023-02-02T20:47:12Z

...ecurity_solution/public/detections/components/alerts_table/grouping_settings/group_stats.tsx

+        {
+          title: i18n.STATS_GROUP_USERS,
+          value: bucket.usersCountAggregation?.value ?? 0,
+        },


Super nit: looks like the badge value isn't centered when defaulting to 0.

Looks like there's an extra span in there keeping things centered when a value is present

...gins/security_solution/public/common/components/alerts_treemap/lib/flatten/flatten_bucket.ts

...s/security_solution/public/common/components/grouping/groups_selector/custom_field_panel.tsx

x-pack/plugins/security_solution/public/common/components/grouping/groups_selector/index.tsx

spong · 2023-02-02T21:10:45Z

x-pack/plugins/security_solution/public/common/components/landing_cards/index.tsx

@@ -94,7 +94,6 @@ export const LandingCards = memo(() => {
          <EuiFlexItem>
            <iframe
              allowFullScreen
-              allowTransparency


This is for the video component on the getting started page right? Is this a fix? I'm not seeing a difference with/without this attribute on chrome. 🤷‍♂️

Hrmmm, was thinking it was theme related, but seeing the white bg with or without this attribute, so not sure, haha 😅

@stephmilovic, you should know. I'm not sure about this change.

spong

Checked out, tested locally, and performed code review -- LGTM! Great work here @YulNaumenko! 🙂 🙌 🚀

I tested thoroughly and came across no major issues at all! Left some nits and questions, but nothing that can't be addressed in a follow-up if need be, so going ahead and approving now. Really nice implementation btw, and users are gonna be so stoked to finally have grouping! 🎉

…ping/groups_selector/custom_field_panel.tsx Co-authored-by: Garrett Spong <spong@users.noreply.github.com>

…ping/groups_selector/index.tsx Co-authored-by: Garrett Spong <spong@users.noreply.github.com>

stephmilovic

LGTM! Great work, awesome new feature 🥇

YulNaumenko · 2023-02-07T00:27:09Z

@elasticmachine merge upstream

…into security-solution-grouping-mvp

kibana-ci · 2023-02-07T03:37:06Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	3586	3603	+17

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	12.9MB	13.0MB	+121.2KB

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
`securitySolution`	426	427	+1

References to deprecated APIs

id	before	after	diff
`securitySolution`	384	389	+5

Total ESLint disabled count

id	before	after	diff
`securitySolution`	503	504	+1

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @YulNaumenko

Current PR introducing the new grouping functionality to the alerts tables: on Alerts and Rule Details pages. The existing grouping design is a technical preview functionality and is a subject of the change. MVP description: 1. Grouping is available only for alerts tables on the Alerts and Rules Details page as selectable dropdown options list in the right top level menu of the alerts table: <img width="1565" alt="Screenshot 2023-01-28 at 2 00 33 PM" src="https://user-images.githubusercontent.com/55110838/215293513-a46e5989-0e49-4b4c-b191-e00d6ef14eff.png"> 2. Default selected option "None" means that the group alerts by is turned off and none of the field is selected. In 8.7 feature has a **technical preview** badge on the right of the select option. <img width="373" alt="Screenshot 2023-01-28 at 2 21 24 PM" src="https://user-images.githubusercontent.com/55110838/215293745-ae232e12-eb92-4429-a667-7b76a2be8c61.png"> 3. The default fields options list is different for Alerts and Rule Details pages and relevant to the page context: <img width="1555" alt="Screenshot 2023-01-28 at 2 30 02 PM" src="https://user-images.githubusercontent.com/55110838/215294128-a0e2a875-088b-446e-ba96-28bcb1d114d0.png"> <img width="1498" alt="Screenshot 2023-01-28 at 2 31 22 PM" src="https://user-images.githubusercontent.com/55110838/215294132-0ca11882-73e9-446c-9e75-112569b9bdc7.png"> 4. Group by custom field is a separate option which allows to group the alerts data by any other index field. <img width="980" alt="Screenshot 2023-01-28 at 2 34 28 PM" src="https://user-images.githubusercontent.com/55110838/215294168-f787093c-72e9-483d-8881-70320b1f4343.png"> 5. Custom field provides a limited to the field value only default rendering for the panel and default set of stats metrics: Rules count and Alerts count. <img width="1209" alt="Screenshot 2023-01-28 at 2 35 47 PM" src="https://user-images.githubusercontent.com/55110838/215294237-17c6105c-d9a3-4ced-be2b-c17ffd181e14.png"> For rule name for example the is also additionally rendered metrics, rule name, rule description and rule tags: <img width="1899" alt="Screenshot 2023-01-28 at 2 40 02 PM" src="https://user-images.githubusercontent.com/55110838/215294351-8935ee93-c416-4357-80cd-ce28c0127993.png"> 6. Each group panel provides the list of bulk actions options which could be applied to the whole group by clicking on the **Take actions** button. For now the list is limited to the three available actions: <img width="1557" alt="Screenshot 2023-01-28 at 2 32 24 PM" src="https://user-images.githubusercontent.com/55110838/215294393-513dc001-be83-4f76-ac09-3a36b2b89e00.png"> 7. Existing technical preview functionality is limited to display only one expanded group at a time. 8. For a big number of groups there is a paging functionality with the ability to define the items per page: <img width="735" alt="Screenshot 2023-01-28 at 2 32 40 PM" src="https://user-images.githubusercontent.com/55110838/215294444-98dfef11-b6b5-413b-b82f-0dcea90f0e65.png"> 9. Grouping setting is stored in the local storage for each page separately and after the hard refresh should be picked up and rendered on the page. --------- Co-authored-by: Steph Milovic <stephanie.milovic@elastic.co> Co-authored-by: Garrett Spong <spong@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

YulNaumenko added 3 commits January 12, 2023 17:09

added grouping select

75e7231

Merge remote-tracking branch 'upstream/main' into security-solution-g…

4500ea8

…rouping-mvp # Conflicts: # x-pack/plugins/security_solution/public/common/components/event_rendered_view/helpers.ts

Basic single level functionality

7f94a8b

YulNaumenko self-assigned this Jan 18, 2023

YulNaumenko added 10 commits January 19, 2023 14:12

added paging and groups count

69e02fb

fixed styles due to mockups

955b411

-

e0e78d9

-

5c48166

Merge remote-tracking branch 'upstream/main' into security-solution-g…

faa974f

…rouping-mvp

-

251e85e

Custom field select

18eb12d

-

a581de8

refresh groups on table settings changed

6f1d82a

Moved all the common code to grouping folder

c9c7c01

YulNaumenko added the ci:cloud-deploy Create or update a Cloud deployment label Jan 26, 2023

YulNaumenko and others added 4 commits January 25, 2023 22:46

fixed take actions

15b16d6

Merge remote-tracking branch 'upstream/main' into security-solution-g…

a17ed70

…rouping-mvp

Fixed typechecks: labels issues

300e8b9

Merge branch 'main' into security-solution-grouping-mvp

e767f34

YulNaumenko added v8.7.0 release_note:skip Skip the PR/issue when compiling release notes Team:Threat Hunting Security Solution Threat Hunting Team labels Jan 26, 2023

YulNaumenko and others added 8 commits January 26, 2023 12:44

Added empty state panel

5bedcce

Show one table at a time

4597358

Fixed empty panel and default title for group select

aa4ef24

Force accordion to close fix

014b476

right top menu test

6a79345

Merge branch 'security-solution-grouping-mvp' of github.com:YulNaumen…

1161121

…ko/kibana into security-solution-grouping-mvp

Move query from alerts file

6b778a3

Splitted local storage for rule details and alerts pages

d31eb43

spong reviewed Feb 2, 2023

View reviewed changes

...gins/security_solution/public/common/components/alerts_treemap/lib/flatten/flatten_bucket.ts Outdated Show resolved Hide resolved

spong reviewed Feb 2, 2023

View reviewed changes

...s/security_solution/public/common/components/grouping/groups_selector/custom_field_panel.tsx Outdated Show resolved Hide resolved

spong reviewed Feb 2, 2023

View reviewed changes

x-pack/plugins/security_solution/public/common/components/grouping/groups_selector/index.tsx Outdated Show resolved Hide resolved

spong reviewed Feb 2, 2023

View reviewed changes

spong approved these changes Feb 2, 2023

View reviewed changes

YulNaumenko and others added 4 commits February 4, 2023 15:20

Merge branch 'main' into security-solution-grouping-mvp

fb8e1d2

Fixed due to comments

87d41e2

Update x-pack/plugins/security_solution/public/common/components/grou…

9457a38

…ping/groups_selector/custom_field_panel.tsx Co-authored-by: Garrett Spong <spong@users.noreply.github.com>

Update x-pack/plugins/security_solution/public/common/components/grou…

09cad3a

…ping/groups_selector/index.tsx Co-authored-by: Garrett Spong <spong@users.noreply.github.com>

stephmilovic approved these changes Feb 6, 2023

View reviewed changes

YulNaumenko added 4 commits February 6, 2023 12:04

Fixed click on customField

d07948c

Design changes

57bf483

FIxed tests

6b36938

Merge branch 'main' into security-solution-grouping-mvp

de28174

kibanamachine and others added 5 commits February 6, 2023 19:27

Merge branch 'main' into security-solution-grouping-mvp

1802189

tests fix

7d1c21b

Merge remote-tracking branch 'origin/security-solution-grouping-mvp' …

be77c53

…into security-solution-grouping-mvp

fixed default state to none

2e64142

Merge branch 'main' into security-solution-grouping-mvp

429579b

YulNaumenko merged commit 705ba7b into elastic:main Feb 7, 2023

kibanamachine added the backport:skip This commit does not require backporting label Feb 7, 2023

michaelolo24 added release_note:feature Makes this part of the condensed release notes and removed release_note:skip Skip the PR/issue when compiling release notes labels Feb 8, 2023

YulNaumenko mentioned this pull request Feb 9, 2023

[Security Solution][Epic] Grouping feature #150517

Open

14 tasks

stephmilovic mentioned this pull request Feb 24, 2023

[Security Solution] Bring Alert Grouping Feature into GA #152134

Closed

11 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Alerts Grouping MVP #149145

[Security Solution] Alerts Grouping MVP #149145

YulNaumenko commented Jan 18, 2023 •

edited

spong Feb 2, 2023

spong Feb 2, 2023

spong Feb 2, 2023

YulNaumenko Feb 6, 2023

spong left a comment

stephmilovic left a comment

YulNaumenko commented Feb 7, 2023

kibana-ci commented Feb 7, 2023 •

edited

ESLint disabled line counts

References to deprecated APIs

Total ESLint disabled count

[Security Solution] Alerts Grouping MVP #149145

[Security Solution] Alerts Grouping MVP #149145

Conversation

YulNaumenko commented Jan 18, 2023 • edited

spong Feb 2, 2023

Choose a reason for hiding this comment

spong Feb 2, 2023

Choose a reason for hiding this comment

spong Feb 2, 2023

Choose a reason for hiding this comment

YulNaumenko Feb 6, 2023

Choose a reason for hiding this comment

spong left a comment

Choose a reason for hiding this comment

stephmilovic left a comment

Choose a reason for hiding this comment

YulNaumenko commented Feb 7, 2023

kibana-ci commented Feb 7, 2023 • edited

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

ESLint disabled line counts

References to deprecated APIs

Total ESLint disabled count

History

YulNaumenko commented Jan 18, 2023 •

edited

kibana-ci commented Feb 7, 2023 •

edited