[Security Solution] Add rule snoozing on the rule editing page #155612

maximpn · 2023-04-24T12:06:09Z

Addresses: #147737

Summary

This PR adds rule snooze feature on the Rule editing page.

Screen.Recording.2023-04-25.at.07.51.57.mov

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios

elasticmachine · 2023-04-24T14:41:55Z

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine · 2023-04-24T14:41:56Z

Pinging @elastic/security-solution (Team: SecuritySolution)

xcrzx

I have checked and tested the PR locally. Rule snoozing on the editing page works as expected. There is just one issue with outgoing snooze status requests on the rules management page that needs to be addressed. Regardless, I approve in advance so the PR can be merged before the feature freeze.

xcrzx · 2023-04-24T15:38:50Z

...ty_solution/public/detection_engine/components/rule_snooze_badge/use_rule_snooze_settings.ts

+  const {
+    data: rulesSnoozeSettings,
+    isFetching: isSingleSnoozeSettingsFetching,
+    isError: isSingleSnoozeSettingsError,
+  } = useFetchRulesSnoozeSettings([id]);


Please pass { enabled: false } to this hook when there's a table context available. Otherwise, it sends tens of snooze requests from the rules management page.

++, in my case with 5 installed rules I'm getting 6 requests to /internal/alerting/rules/_find on page load. So I guess it's N+1 in general: one for the whole page and one for each rule on the page.

The problem has been fixed by this commit 583c096

x-pack/plugins/security_solution/public/detection_engine/components/rule_snooze_badge/index.ts

… table context

...security_solution/public/detection_engine/components/rule_snooze_badge/rule_snooze_badge.tsx

banderror · 2023-04-24T16:25:54Z

...ty_solution/public/detection_engine/components/rule_snooze_badge/use_rule_snooze_settings.ts

+  const {
+    data: rulesSnoozeSettings,
+    isFetching: isSingleSnoozeSettingsFetching,
+    isError: isSingleSnoozeSettingsError,
+  } = useFetchRulesSnoozeSettings([id]);


++, in my case with 5 installed rules I'm getting 6 requests to /internal/alerting/rules/_find on page load. So I guess it's N+1 in general: one for the whole page and one for each rule on the page.

...curity_solution/public/detections/components/rules/step_rule_actions/rule_snooze_section.tsx

x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.tsx

banderror · 2023-04-24T16:43:10Z

...curity_solution/public/detections/components/rules/step_rule_actions/rule_snooze_section.tsx

+        <EuiFlexItem grow={false}>
+          <RuleSnoozeBadge id={id} showTooltipInline />
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <EuiText size="s">
+            <strong>{i18n.SNOOZED_ACTIONS_WARNING}</strong>
+          </EuiText>
+        </EuiFlexItem>


Looks like we show the Actions will not be preformed until it is unsnoozed message unconditionally, i.e. regardless of whether the rule is snoozed or not. Since it's in bold it feels like a warning in the case where it doesn't really matter:

Can we hide it when the rule is not snoozed? If it's not trivial, can we make it look less dangerous by making the font regular and playing with the copy a little bit? E.g. If snoozed actions will not be triggered.

@banderror your comment is addressed by this PR.

banderror

Zoomed with @maximpn and went through the comments. Approving the PR in advance.

vitaliidm · 2023-04-25T09:12:32Z

When I'm trying to remove snooze, delete confirmation dialog is overlapped by snooze window.
It seems like component issue. do we have it logged somewhere so it can be fixed in future?

vitaliidm · 2023-04-25T09:02:43Z

x-pack/plugins/security_solution/public/detection_engine/rule_management/api/api.ts

@@ -211,6 +212,15 @@ export const fetchRulesSnoozeSettings = async ({
    }
  );

+  return response.data?.map((x) => ({


I would try to avoid using variables named as x, etc

I've renamed x to snoozeSettings.

maximpn · 2023-04-25T09:26:34Z

@vitaliidm thank you for reviewing my PR 🙏

When I'm trying to remove snooze, delete confirmation dialog is overlapped by snooze window.
It seems like component issue. do we have it logged somewhere so it can be fixed in future?

There is a PR #153219 to address z-index issues which solves the current problem as well (see the screenshot below).

vitaliidm

alerts area LGTM

kibana-ci · 2023-04-25T10:50:22Z

💚 Build Succeeded

Buildkite Build
Commit: 48064b1

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	3843	3845	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	9.1MB	9.1MB	+2.9KB

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
`enterpriseSearch`	17	19	+2
`securitySolution`	395	398	+3
total			+5

Total ESLint disabled count

id	before	after	diff
`enterpriseSearch`	18	20	+2
`securitySolution`	475	478	+3
total			+5

History

💚 Build #122708 succeeded 0555400
💔 Build #122691 failed 249ce32
💔 Build #122663 failed 1ac3838
💔 Build #122644 failed ed947aa
💔 Build #122628 failed e777475
💛 Build #122585 was flaky b70f92b

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @maximpn

…ic#155612) **Addresses:** elastic#147737 ## Summary This PR adds rule snooze feature on the Rule editing page. https://user-images.githubusercontent.com/3775283/234186169-72db1d91-ad34-4cea-922d-b0c96752c3d3.mov ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

…age (#155850) **Addresses:** #147737 **Relates to:** #155612 ## Summary After merging #155612 back there is one issue is left unresolved described in this [comment](#155612 (comment)): > Looks like we show the `Actions will not be preformed until it is unsnoozed` message unconditionally, i.e. regardless of whether the rule is snoozed or not. Since it's in bold it feels like a warning in the case where it doesn't really matter: > Can we hide it when the rule is not snoozed? If it's not trivial, can we make it look less dangerous by making the font regular and playing with the copy a little bit? E.g. `If snoozed actions will not be triggered`. This PR resolves rule snooze description text issue. As snooze settings are resolved outside the security solution plugin having any logic to conditionally display a message will increase the complexity. This way the message was changes to avoid any text to appear conditionally. *Before:* <img width="703" alt="Screenshot 2023-04-24 at 18 36 31" src="https://user-images.githubusercontent.com/7359339/234060523-fe9161a1-0e83-4d39-a193-81c946d95106.png"> *After:* ![image](https://user-images.githubusercontent.com/3775283/236254424-533a6502-49ba-444e-87e5-9cda7e84c315.png) ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)

…age (elastic#155850) **Addresses:** elastic#147737 **Relates to:** elastic#155612 ## Summary After merging elastic#155612 back there is one issue is left unresolved described in this [comment](elastic#155612 (comment)): > Looks like we show the `Actions will not be preformed until it is unsnoozed` message unconditionally, i.e. regardless of whether the rule is snoozed or not. Since it's in bold it feels like a warning in the case where it doesn't really matter: > Can we hide it when the rule is not snoozed? If it's not trivial, can we make it look less dangerous by making the font regular and playing with the copy a little bit? E.g. `If snoozed actions will not be triggered`. This PR resolves rule snooze description text issue. As snooze settings are resolved outside the security solution plugin having any logic to conditionally display a message will increase the complexity. This way the message was changes to avoid any text to appear conditionally. *Before:* <img width="703" alt="Screenshot 2023-04-24 at 18 36 31" src="https://user-images.githubusercontent.com/7359339/234060523-fe9161a1-0e83-4d39-a193-81c946d95106.png"> *After:* ![image](https://user-images.githubusercontent.com/3775283/236254424-533a6502-49ba-444e-87e5-9cda7e84c315.png) ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) (cherry picked from commit 6714d92)

…ting page (#155850) (#156888) # Backport This will backport the following commits from `main` to `8.8`: - [[Security Solution] Fix rule snooze description on the rule editing page (#155850)](#155850)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>

add rule snoozing on the rule editing page

298568a

maximpn self-assigned this Apr 24, 2023

move rule snooze settings fetching functionality to a hook

b98ad2b

maximpn marked this pull request as ready for review April 24, 2023 14:41

maximpn requested review from a team as code owners April 24, 2023 14:41

maximpn requested a review from banderror April 24, 2023 14:41

maximpn requested a review from xcrzx April 24, 2023 14:43

xcrzx approved these changes Apr 24, 2023

View reviewed changes

banderror requested changes Apr 24, 2023

View reviewed changes

x-pack/plugins/security_solution/public/detection_engine/components/rule_snooze_badge/index.ts Outdated Show resolved Hide resolved

avoid sending an unnecessary request if snooze data is found in rules…

b70f92b

… table context

banderror reviewed Apr 24, 2023

View reviewed changes

banderror approved these changes Apr 24, 2023

View reviewed changes

maximpn added 8 commits April 24, 2023 19:58

move RuleSnoozeBadge component to rule_management sub domain

870e138

avoid sending N+1 requests on the rules table

583c096

use RuleObjectId type for rule id

e777475

use RuleObjectId type for rule id

ed947aa

add API data mapping

89d6733

fix wrong mock

091106d

rename missing props

1ac3838

fix typings

249ce32

fix typings

0555400

vitaliidm reviewed Apr 25, 2023

View reviewed changes

rename an internal variable

48064b1

vitaliidm approved these changes Apr 25, 2023

View reviewed changes

maximpn merged commit 65a4ae6 into elastic:main Apr 25, 2023
18 checks passed

kibanamachine added the backport:skip This commit does not require backporting label Apr 25, 2023

maximpn deleted the add-rule-snoozing-support-on-rule-editing-page branch April 25, 2023 10:52

maximpn mentioned this pull request Apr 26, 2023

[Security Solution] Fix rule snooze description on the rule editing page #155850

Merged

1 task

maximpn mentioned this pull request May 5, 2023

[Security Solution] Support rule snoozing on the Rule Editing page #147737

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Add rule snoozing on the rule editing page #155612

[Security Solution] Add rule snoozing on the rule editing page #155612

maximpn commented Apr 24, 2023 •

edited

elasticmachine commented Apr 24, 2023

elasticmachine commented Apr 24, 2023

xcrzx left a comment

xcrzx Apr 24, 2023

banderror Apr 24, 2023

maximpn Apr 24, 2023

banderror Apr 24, 2023

banderror Apr 24, 2023

maximpn Apr 26, 2023

banderror left a comment

vitaliidm commented Apr 25, 2023

vitaliidm Apr 25, 2023

maximpn Apr 25, 2023

maximpn commented Apr 25, 2023 •

edited

vitaliidm left a comment

kibana-ci commented Apr 25, 2023

ESLint disabled line counts

Total ESLint disabled count

[Security Solution] Add rule snoozing on the rule editing page #155612

[Security Solution] Add rule snoozing on the rule editing page #155612

Conversation

maximpn commented Apr 24, 2023 • edited

Summary

Checklist

elasticmachine commented Apr 24, 2023

elasticmachine commented Apr 24, 2023

xcrzx left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

banderror left a comment

Choose a reason for hiding this comment

vitaliidm commented Apr 25, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maximpn commented Apr 25, 2023 • edited

vitaliidm left a comment

Choose a reason for hiding this comment

kibana-ci commented Apr 25, 2023

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

ESLint disabled line counts

Total ESLint disabled count

History

maximpn commented Apr 24, 2023 •

edited

maximpn commented Apr 25, 2023 •

edited