Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security solution] Attack discovery tour #182605

Merged
merged 15 commits into from
May 8, 2024
Merged

Conversation

stephmilovic
Copy link
Contributor

@stephmilovic stephmilovic commented May 3, 2024

Summary

ad.mov

The Attack discovery tour is a 2 step tour.

  1. Step 1 is an EuiTourStep anchored to the nav. The tour component needs an anchor to mount to. Therefore, the nav needs to mount before the tour step. I added an onMount method to solution_side_nav.tsx and I wait for the nav to mount before mounting the AttackDiscoveryTour component. When the user clicks "Try it", the page redirects to Attack discovery and step 2 is activated. When the user clicks "Close" step 2 is activated but the page does not redirect. This way, when the user navigates on their own to Attack discovery, the video toast is up and ready.
  2. Step 2 is an EuiToast containing an overview video. Currently, we cannot make video full screen due to this core CSP issue. Therefore, we decided to open the video in a new tab to play. The video autoplays on mute. I added some fun event listeners to enable an onClick event on the iframe. When the iframe is clicked, the video opens in a new tab. When the "Watch overview video" button is clicked, the video opens in a new tab. When the user closes the toast, the tour ends.

Things to note

  • If the user navigates to Attack discovery on their own without engaging tour step 1, we will increment to tour step 2
  • If the user loads the app on Attack discovery page, we will increment to tour step 2
  • The video controls on the Attack discovery page are only accessible through the tab key
  • James wants the tour there for 8.15 too, therefore I am opening the PR against main. Here is the issue to remove the tour for 8.16 [Task] Remove Attack discovery tour in 8.16 #182855

Testing

  • No special setup, the first time you load Kibana we add a value to local storage to track your tour state
  • If you need to reset the tour, simply delete the value from local storage: securitySolution.attackDiscovery.newFeaturesTour.v8.14

Explore reviewer

Because the EuiTourStep needs the anchor to mount first, I added an onMount method to solution_side_nav.tsx. I wait to mount the tour until the side nav has mounted. I also added an id to the nav item as this is required to use as an anchor with EuiTourStep

@stephmilovic stephmilovic added release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Security Generative AI Security Generative AI v8.14.0 v8.15.0 Feature:Attack Discovery Attack discovery uses generative AI to identify active attacks labels May 3, 2024
@stephmilovic stephmilovic marked this pull request as ready for review May 7, 2024 18:07
@stephmilovic stephmilovic requested review from a team as code owners May 7, 2024 18:07
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

Comment on lines +78 to +80
<h4>
<EuiIcon type="cheer" color="success" /> {i18n.ATTACK_DISCOVERY_TOUR_VIDEO_STEP_TITLE}
</h4>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: No margin above title text to provide space between video element:

image

onFocus={handleOnMouseOver}
onBlur={handleOnMouseOut}
>
<iframe
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would be nice if we could set the background of the embedded page for dark mode. For the video itself it's transparent (and seems that way for the body/page), but it's coming through as white, so on dark mode we get these top and bottom white borders. Maybe we can change on the video site, but then would need one link for each theme (light/dark)....

Maybe we can use css/react to dig into the iframe and set the appropriate euiThemeColor?

CleanShot.2024-05-07.at.13.48.47.mp4

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

going to hold on this til i hear from design if we can use a gif here instead

referrerPolicy="no-referrer"
sandbox="allow-scripts allow-same-origin"
scrolling="no"
// since we cannot go fullscreen, we are autoplaying and removing the controls
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

minor nit: since we can't go fullscreen, can we disable the fullscreen button? It just toggles and doesn't do anything now once the other tab has been opened, so not a big deal.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

going to hold on this til i hear from design if we can use a gif here instead

Comment on lines 13 to 14
const VIDEO_CONTENT_HEIGHT = 160;
const VIDEO_CONTENT_WIDTH = 250;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since we can't go fullscreen, and you can't really tell what is going on with the video at this size (though you can hear James' beautiful voice), I wonder if we should just show an image capture of the video instead of actually embedding the video and avoid all the useEffect logic.

Alternatively, the whole page should be blank for the user, so could either make the portal bigger or even just use the empty state of the page? That's more discussion with design and there's not much time left so I don't know.

As a user though, I don't find any utility in watching the video in this teeny tiny portal, so would probably just watch it in a new tab.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I asked design and they don't want to make the toast bigger. it would certainly be easier to do the onClick on a gif vs the hacked iframe solution I have. let me see if that is cool with design

@bojanasan @codearos what do you think about using a gif here instead of the autoplay video?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gif or image... either way, would design be willing to provide a file?

Copy link
Member

@spong spong left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checked out, tested locally, and code changes LGTM!

Made some design nits, and noted a bug where un-muting triggers the 'open in a new tab' behavior, but overall if we're keen on keeping Step 2 of the tour the size it is, I think we should just show a screenshot of the video to avoid all these issues since we can't fullscreen at the moment.

Code looks good though, and I appreciate the tests + follow-up issue to disable this in 8.16, so I think we just need to check with design and see what they think. Thanks @stephmilovic!

@stephmilovic
Copy link
Contributor Author

@elasticmachine merge upstream

@semd
Copy link
Contributor

semd commented May 8, 2024

Hi @stephmilovic, the implementation looks good.
I'm not a big fan of the new onMount prop to the sideNav component, but since this sideNav component is going to be deprecated in a couple of releases (and the tour as well), that's okay.

However, this approach won't work with the new side nav (here's our PR adapting to it #179971), it is still in "internal preview" stage so I guess it is not strictly necessary. But this won't work in the serverless nav either (it uses the same shared-ux component), actually, I tested that in serverless and I don't even see the Attack discovery link (with attackDiscoveryEnabled flag enabled), is this feature intended to be available only in stateful?

serverless

Copy link
Contributor

@semd semd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@stephmilovic stephmilovic added the ci:cloud-deploy Create or update a Cloud deployment label May 8, 2024
@stephmilovic
Copy link
Contributor Author

@elasticmachine merge upstream

@kibana-ci
Copy link
Collaborator

kibana-ci commented May 8, 2024

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 5485 5490 +5

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id before after diff
@kbn/security-solution-side-nav 23 24 +1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 15.3MB 15.3MB +3.9KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
securitySolution 83.5KB 83.5KB +74.0B
Unknown metric groups

API count

id before after diff
@kbn/security-solution-side-nav 29 30 +1

miscellaneous assets size

id before after diff
securitySolution 4.5MB 6.2MB ⚠️ +1.7MB

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@stephmilovic stephmilovic merged commit ef0bd2e into elastic:main May 8, 2024
38 checks passed
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request May 8, 2024
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
8.14

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request May 9, 2024
# Backport

This will backport the following commits from `main` to `8.14`:
- [[Security solution] Attack discovery tour
(#182605)](#182605)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Steph
Milovic","email":"stephanie.milovic@elastic.co"},"sourceCommit":{"committedDate":"2024-05-08T20:16:54Z","message":"[Security
solution] Attack discovery tour
(#182605)","sha":"ef0bd2e23146a3a8242be451540a7cad34c9b605","branchLabelMapping":{"^v8.15.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:
SecuritySolution","ci:cloud-deploy","Team:Security Generative
AI","v8.14.0","v8.15.0","Feature:Attack Discovery"],"title":"[Security
solution] Attack discovery
tour","number":182605,"url":"#182605
solution] Attack discovery tour
(#182605)","sha":"ef0bd2e23146a3a8242be451540a7cad34c9b605"}},"sourceBranch":"main","suggestedTargetBranches":["8.14"],"targetPullRequestStates":[{"branch":"8.14","label":"v8.14.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.15.0","branchLabelMappingKey":"^v8.15.0$","isSourceBranch":true,"state":"MERGED","url":"#182605
solution] Attack discovery tour
(#182605)","sha":"ef0bd2e23146a3a8242be451540a7cad34c9b605"}}]}]
BACKPORT-->

Co-authored-by: Steph Milovic <stephanie.milovic@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ci:cloud-deploy Create or update a Cloud deployment Feature:Attack Discovery Attack discovery uses generative AI to identify active attacks release_note:skip Skip the PR/issue when compiling release notes Team:Security Generative AI Security Generative AI Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.14.0 v8.15.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

6 participants