Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] expandable flyout - fix topN opening with Raw Events instead of Detection Alerts + add missing interaction in cell actions #164923

Merged
merged 2 commits into from
Aug 28, 2023
Merged

[Security Solution] expandable flyout - fix topN opening with Raw Events instead of Detection Alerts + add missing interaction in cell actions #164923

merged 2 commits into from
Aug 28, 2023

Conversation

PhilippeOberti
Copy link
Contributor

@PhilippeOberti PhilippeOberti commented Aug 26, 2023 •
edited by kibanamachine

Summary

This PR aims at fixing a couple of behaviors related to cell actions in the new expandable flyout:

  • showTopN action now shows Detection Alerts by default instead of Raw Events for:
    • the severity and status components in the header
    • the highlighted field table
    • the alert reason preview
  • display more cell actions (we were the toggleColumInTable action) for:
    • the severity and status components in the header
    • the highlighted field table
      I couldn't have the toggleColumInTable action in the alert reason preview because the component we're using doesn't expose the option (the other instances of that component don't provide the option either...)
Screen.Recording.2023-08-26.at.6.46.47.PM.mov
Screen.Recording.2023-08-26.at.6.56.02.PM.mov

The following places could not be changed:

  • entities overview (user and host) in the right panel Insights section
  • entities details (user and hosts) in the left panel Insights section
    Because we're leveraging existing components. Changing those is feasible (I had a working POC) but seems very risky a couple of days before BC3, as it impacts other teams.
Screen.Recording.2023-08-26.at.6.47.14.PM.mov

Fixes #164801
Partially fixes #164553

Checklist

@PhilippeOberti PhilippeOberti requested a review from a team as a code owner August 26, 2023 17:11
This was referenced Aug 26, 2023
Closed
Open
christineweng
christineweng approved these changes Aug 26, 2023
View reviewed changes
Copy link
Contributor

@christineweng christineweng left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes LGTM. Thanks for updating the entities sections as well! Left a comment regarding the toggle column option.

I did some research on the host info and user info top n, they are still using the old hover actions. The new hover action uses sourcererScopeId, the older version still leverages scopeId. It seems the scopeId got lost in between components. I will check with explore to see whether they will use new hover actions everywhere soon, if not, will get a PR in 8.11

x-pack/plugins/security_solution/public/flyout/left/components/host_details.tsx Outdated
data={{
field: 'user.name',
value: user,
}}
mode={CellActionsMode.HOVER_RIGHT}
triggerId={SecurityCellActionsTrigger.DETAILS_FLYOUT}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI - toggle column is not working due to this bug. Is it safer to revert back to default until it is fixed?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm divided, on one side I agree we should not show an option if it doesn't work, but on the other side the old flyout shows the option... Also the day we actually fix the source of the issue we would have to make sure to put it back everywhere...
I have a feeling that @paulewing will choose to not show the option, so I'm going to prepare a commit right now to remove it, and will merge once I have confirmation that's the behavior we want

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@christineweng see newest commit

@PhilippeOberti
[Security Solution] expandable flyout - fix topN opening with Raw Eve…
ac30183 
…nts instead of Detection Alerts + add missing interaction in cell actions
@PhilippeOberti
revert DETAIL_FLYOUT to DEFAULT and 6 to 5 because of toggle column n…
0e97079 
…ot working on alerts table
@kibana-ci
Copy link
Collaborator

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 16.0MB 16.0MB +1.4KB

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@PhilippeOberti PhilippeOberti merged commit 94b947e into main Aug 28, 2023
33 checks passed
@PhilippeOberti PhilippeOberti deleted the expandable-flyout-cellactions branch August 28, 2023 16:32
@kibanamachine kibanamachine mentioned this pull request Aug 28, 2023
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Aug 28, 2023
@PhilippeOberti
[Security Solution] expandable flyout - fix topN opening with Raw Eve…
ae778d3 
…nts instead of Detection Alerts + add missing interaction in cell actions (elastic#164923)

(cherry picked from commit 94b947e)
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
✅ 8.10

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Aug 28, 2023
@kibanamachine @PhilippeOberti
[8.10] [Security Solution] expandable flyout - fix topN opening with …
41e5dd0 
…Raw Events instead of Detection Alerts + add missing interaction in cell actions (#164923) (#165016)

# Backport

This will backport the following commits from `main` to `8.10`:
- [[Security Solution] expandable flyout - fix topN opening with Raw
Events instead of Detection Alerts + add missing interaction in cell
actions (#164923)](#164923)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Philippe
Oberti","email":"philippe.oberti@elastic.co"},"sourceCommit":{"committedDate":"2023-08-28T16:32:49Z","message":"[Security
Solution] expandable flyout - fix topN opening with Raw Events instead
of Detection Alerts + add missing interaction in cell actions
(#164923)","sha":"94b947e625b4fdbb2affb8e6e9d8507f639d3ac6","branchLabelMapping":{"^v8.11.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Threat
Hunting:Investigations","v8.10.0","v8.11.0"],"number":164923,"url":"#164923
Solution] expandable flyout - fix topN opening with Raw Events instead
of Detection Alerts + add missing interaction in cell actions
(#164923)","sha":"94b947e625b4fdbb2affb8e6e9d8507f639d3ac6"}},"sourceBranch":"main","suggestedTargetBranches":["8.10"],"targetPullRequestStates":[{"branch":"8.10","label":"v8.10.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.11.0","labelRegex":"^v8.11.0$","isSourceBranch":true,"state":"MERGED","url":"#164923
Solution] expandable flyout - fix topN opening with Raw Events instead
of Detection Alerts + add missing interaction in cell actions
(#164923)","sha":"94b947e625b4fdbb2affb8e6e9d8507f639d3ac6"}}]}]
BACKPORT-->

Co-authored-by: Philippe Oberti <philippe.oberti@elastic.co>
bryce-b pushed a commit to bryce-b/kibana that referenced this pull request Sep 19, 2023
@PhilippeOberti @bryce-b
[Security Solution] expandable flyout - fix topN opening with Raw Eve…
164cf3d 
…nts instead of Detection Alerts + add missing interaction in cell actions (elastic#164923)
This was referenced Oct 1, 2023
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@christineweng christineweng christineweng approved these changes

Assignees
No one assigned
Labels
release_note:fix Team:Threat Hunting:Investigations Security Solution Investigations Team v8.10.0 v8.11.0
Projects
None yet
Milestone
No milestone
4 participants
@PhilippeOberti @kibana-ci @kibanamachine @christineweng