[Security Solution][Investigations] - Fix column toggle #158780

michaelolo24 · 2023-05-31T21:15:38Z

Summary

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
This was checked for cross-browser compatibility

Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to identify risks that should be tested prior to the change/feature release.

When forming the risk matrix, consider some of the following examples and how they may potentially impact the change:

Risk	Probability	Severity	Mitigation/Notes
Multiple Spaces—unexpected behavior in non-default Kibana Space.	Low	High	Integration tests will verify that all features are still supported in non-default Kibana Space and when user switches between spaces.
Multiple nodes—Elasticsearch polling might have race conditions when multiple Kibana nodes are polling for the same tasks.	High	Low	Tasks are idempotent, so executing them multiple times will not result in logical error, but will degrade performance. To test for this case we add plenty of unit tests around this logic and document manual testing procedure.
Code should gracefully handle cases when feature X or plugin Y are disabled.	Medium	High	Unit tests will verify that any feature flag or plugin combination still results in our service operational.
See more potential risk examples

For maintainers

This was checked for breaking API changes and was labeled appropriately

elasticmachine · 2023-05-31T21:16:32Z

Pinging @elastic/security-solution (Team: SecuritySolution)

michaelolo24 · 2023-05-31T21:16:34Z

Still need to add tests, but thoughts on the changes here @XavierM and @logeekal ?

logeekal · 2023-06-01T09:10:00Z

...riggers_actions_ui/public/application/sections/alerts_table/hooks/use_columns/use_columns.ts

-    // get the latest columns provided by client and
-    if (didDefaultColumnChange) {
-      defaultColumnsRef.current = defaultColumns;
-      setColumnsPopulated(false);


It looks like that this useEffect was moved below with some modification.

Actually removing this line would cause below line to not execute which enriches fields with its datatype. With new change, the ordering of fields such as timestamp breaks. See video below

const populatedColumns = populateColumns(columns, browserFields, defaultColumns);

Screen.Recording.2023-06-01.at.11.08.58.mov

I think I understand the problem and it seems to be 2 pronged.

Trigger Actions alert table does natively supported changing columns from the client side. So I added a work around, that we will provide a unique set of columns per ID and that is how we achieve columns difference between Event Rendered View v/s Grid View.

Now here, for a single ID ( i.e. gridView ) we are changing the columns for grid View from the client side (i.e. security solution ) which is causing weird issues even if I add above line : setColumnsPopulated(false)

Secondly, single source of truth on the storage is maintained by Triggers action alert table. Changing security solution columns state does will not have impact because if we add a field from field browser, it will only change trigger-actions state of columns not security solution columns state. Currently, there is no sync.

Currently, only safe way seems to me is to get handle onToggleColumn function, create a context in Security Solution and then use that toggle function anywhere to add columns to the table. This is because trigger actions table wants to handle how the columns are changed in the table.

Please let me know if something does not make sense.. we can have a meeting.

Thanks for the write up, it does make sense. Took a second pass at it if you have some time!

…-ref HEAD~1..HEAD --fix'

logeekal · 2023-06-02T09:50:07Z

...riggers_actions_ui/public/application/sections/alerts_table/hooks/use_columns/use_columns.ts

+    const oldColumnIds = defaultColumnsRef.current.map((column) => column.id);
+    const addedColumnIds = difference(newColumnIds, oldColumnIds);
+    const removedColumnIds = difference(oldColumnIds, newColumnIds);
+    return addedColumnIds.concat(removedColumnIds);


Although, this seems a little hacky, I do not see any other good alternative without making Contexts in Security Solution. It seems to be working well for me. It will good to add cypress tests for this.

michaelolo24 · 2023-06-02T19:17:59Z

x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx

@@ -210,9 +210,10 @@ export const AlertsTableComponent: FC<DetectionEngineAlertTableProps> = ({
    return undefined;
  }, [isEventRenderedView]);

-  const dataTableStorage = getDataTablesInStorageByIds(storage, [TableId.alertsOnAlertsPage]);


@logeekal this may be a much much more involved change from what I'm seeing. From what I can tell only pulling in the initial columns like this is necessary for the table to properly own control to set the columns, but haven't dug into exactly what the table is doing under the hood to manage these changes. My changes here break the tests, because the expected table updates on load aren't happening properly on the Rule details page, even though the tableId should account for the table settings for that table. Returning this to how it was previously fixes the tests, but, since localStorage updates aren't listened to, the security_solution column toggle functionality doesn't work. Also fyi @kqualters-elastic .

...I may be missing something, but wanted to drop details about what I'm seeing just in case I have to start my leave early next week

Hey @michaelolo24, I am not sure I fully understand but I tested it in rule details page and it seems to be working fine. I see that you have removed the hard coding of TableId.alertsOnAlertsPage , which is great. Could you please point me to exact scenarios that fail.

kibana-ci · 2023-06-06T12:55:35Z

💔 Build Failed

Failed CI Steps

Test Failures

[job] [logs] Security Solution Tests #2 / Enrichment Custom query rule Should has enrichment fields
[job] [logs] Security Solution Tests #2 / Enrichment Custom query rule Should has enrichment fields

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	9.4MB	9.4MB	-76.0B
`triggersActionsUi`	1.4MB	1.4MB	+140.0B
total			+64.0B

History

💔 Build #131915 failed 521e8e7
💔 Build #131532 failed 250e50c

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

michaelolo24 · 2023-11-08T16:48:46Z

Closing as this issue was completed in a separate PR

michaelolo24 marked this pull request as ready for review May 31, 2023 21:16

michaelolo24 requested review from a team as code owners May 31, 2023 21:16

michaelolo24 requested review from XavierM and logeekal May 31, 2023 21:16

logeekal reviewed Jun 1, 2023

View reviewed changes

michaelolo24 marked this pull request as draft June 1, 2023 13:36

rely on referential equality

8f5741b

michaelolo24 force-pushed the fix-toggle-column branch from 250e50c to 8f5741b Compare June 1, 2023 20:27

[CI] Auto-commit changed files from 'node scripts/precommit_hook.js -…

521e8e7

…-ref HEAD~1..HEAD --fix'

logeekal reviewed Jun 2, 2023

View reviewed changes

michaelolo24 commented Jun 2, 2023

View reviewed changes

refactor: custom alert table defaults

e0e5b05

michaelolo24 removed the bug Fixes for quality problems that affect the customer experience label Jun 6, 2023

michaelolo24 assigned logeekal and michaelolo24 Jun 6, 2023

michaelolo24 closed this Nov 8, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Investigations] - Fix column toggle #158780

[Security Solution][Investigations] - Fix column toggle #158780

michaelolo24 commented May 31, 2023 •

edited

elasticmachine commented May 31, 2023

michaelolo24 commented May 31, 2023

logeekal Jun 1, 2023

logeekal Jun 1, 2023

michaelolo24 Jun 1, 2023

logeekal Jun 2, 2023

michaelolo24 Jun 2, 2023 •

edited

logeekal Jun 5, 2023

kibana-ci commented Jun 6, 2023 •

edited

michaelolo24 commented Nov 8, 2023

[Security Solution][Investigations] - Fix column toggle #158780

[Security Solution][Investigations] - Fix column toggle #158780

Conversation

michaelolo24 commented May 31, 2023 • edited

Summary

Checklist

Risk Matrix

For maintainers

elasticmachine commented May 31, 2023

michaelolo24 commented May 31, 2023

logeekal Jun 1, 2023

Choose a reason for hiding this comment

logeekal Jun 1, 2023

Choose a reason for hiding this comment

michaelolo24 Jun 1, 2023

Choose a reason for hiding this comment

logeekal Jun 2, 2023

Choose a reason for hiding this comment

michaelolo24 Jun 2, 2023 • edited

Choose a reason for hiding this comment

logeekal Jun 5, 2023

Choose a reason for hiding this comment

kibana-ci commented Jun 6, 2023 • edited

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

Async chunks

History

michaelolo24 commented Nov 8, 2023

michaelolo24 commented May 31, 2023 •

edited

michaelolo24 Jun 2, 2023 •

edited

kibana-ci commented Jun 6, 2023 •

edited