Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[SIEM] Hide untitled timelines from selection when creating rules #56079

Open
spong opened this issue Jan 27, 2020 · 1 comment
Open

[SIEM] Hide untitled timelines from selection when creating rules #56079

spong opened this issue Jan 27, 2020 · 1 comment
Labels
enhancement New value added to drive a business result Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM v7.7.1

Comments

@spong
Copy link
Member

spong commented Jan 27, 2020

Originally detailed as part of https://github.com/elastic/siem-team/issues/498, and partially fixed as part of #55969, this issue is for rounding out the following feedback when creating a rule:

Multiple "untitled" timelines make the timeline selection process in rule creation unclean. Can we simply filter out the "untitled" timelines from both timeline selection options during rule creation?

For this enhancement we'll want to perform this filter on the server side for both the SearchTimelineSuperSelect and OpenTimelineModal components. The SearchTimelineSuperSelect was patched with a client-side filter as part of #55969, so this will need to be removed.

SearchTimelineSuperSelect example

Before / After #55969

OpenTimelineModal example

image
@spong spong added enhancement New value added to drive a business result Team:SIEM v7.7.0 labels Jan 27, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/siem (Team:SIEM)

@spong spong mentioned this issue Jan 27, 2020
Merged
17 tasks
spong added a commit that referenced this issue Jan 27, 2020
@spong
[SIEM] [Detection Engine] Fixes histogram intervals (#55969)
80087a3 
## Summary

This PR wraps up the remaining `Detection Engine` meta tickets: #55585, #54935, and elastic/siem-team#498
- [x] Histogram bar interval (bar counts and widths) consistency (#55585)
  - [x] Make the bar intervals a consistent 32 bars across the board
  * Enabled `extended_bounds`, `min_doc_count: 0`, and now setting consistent `fixed_interval` when querying to ensure the entire daterange is displayed across all histograms.
- [x] Filter out the "untitled" timelines from both timeline selection options during rule creation (elastic/siem-team#498)
  - [ ] ~Import query from saved timeline~
    * For 7.7 tracking ticket here: #56079
  - [x] `Investigate detections using this timeline template` 
- [x] Everywhere we use "Alerts" (Overview page, Host Tab, Network Tab) we should change the term to "External Alerts"
  - [x] Updated Host Page Tab/Table/Histogram/Breadcrumbs
  - [x] Updated Network Page Tab/Table/Histogram/Breadcrumbs
- [x] Updated DE permission/index  error doc links to go to [corresponding DE docs section](https://www.elastic.co/guide/en/siem/guide/7.6/detection-engine-overview.html#detections-permissions)
- [x] Removed `frequency` in favor of `count` for remaining histograms

##### Inconsistent Histogram intervals
![image](https://user-images.githubusercontent.com/2946766/73161560-04a82300-40a9-11ea-950f-ea56f9a5bfd7.png)


##### Consistent Histogram Intervals
![image](https://user-images.githubusercontent.com/2946766/73159564-fefc0e80-40a3-11ea-9b9d-4d15899dabd2.png)


cc @MichaelMarcialis @cwurm @MikePaquette 

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~
- [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~
- [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~

### For maintainers

- [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
- [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
spong added a commit to spong/kibana that referenced this issue Jan 27, 2020
@spong
[SIEM] [Detection Engine] Fixes histogram intervals (elastic#55969)
2405925 
## Summary

This PR wraps up the remaining `Detection Engine` meta tickets: elastic#55585, elastic#54935, and elastic/siem-team#498
- [x] Histogram bar interval (bar counts and widths) consistency (elastic#55585)
  - [x] Make the bar intervals a consistent 32 bars across the board
  * Enabled `extended_bounds`, `min_doc_count: 0`, and now setting consistent `fixed_interval` when querying to ensure the entire daterange is displayed across all histograms.
- [x] Filter out the "untitled" timelines from both timeline selection options during rule creation (elastic/siem-team#498)
  - [ ] ~Import query from saved timeline~
    * For 7.7 tracking ticket here: elastic#56079
  - [x] `Investigate detections using this timeline template` 
- [x] Everywhere we use "Alerts" (Overview page, Host Tab, Network Tab) we should change the term to "External Alerts"
  - [x] Updated Host Page Tab/Table/Histogram/Breadcrumbs
  - [x] Updated Network Page Tab/Table/Histogram/Breadcrumbs
- [x] Updated DE permission/index  error doc links to go to [corresponding DE docs section](https://www.elastic.co/guide/en/siem/guide/7.6/detection-engine-overview.html#detections-permissions)
- [x] Removed `frequency` in favor of `count` for remaining histograms

##### Inconsistent Histogram intervals
![image](https://user-images.githubusercontent.com/2946766/73161560-04a82300-40a9-11ea-950f-ea56f9a5bfd7.png)


##### Consistent Histogram Intervals
![image](https://user-images.githubusercontent.com/2946766/73159564-fefc0e80-40a3-11ea-9b9d-4d15899dabd2.png)


cc @MichaelMarcialis @cwurm @MikePaquette 

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~
- [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~
- [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~

### For maintainers

- [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
- [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
spong added a commit to spong/kibana that referenced this issue Jan 27, 2020
@spong
[SIEM] [Detection Engine] Fixes histogram intervals (elastic#55969)
8f17622 
## Summary

This PR wraps up the remaining `Detection Engine` meta tickets: elastic#55585, elastic#54935, and elastic/siem-team#498
- [x] Histogram bar interval (bar counts and widths) consistency (elastic#55585)
  - [x] Make the bar intervals a consistent 32 bars across the board
  * Enabled `extended_bounds`, `min_doc_count: 0`, and now setting consistent `fixed_interval` when querying to ensure the entire daterange is displayed across all histograms.
- [x] Filter out the "untitled" timelines from both timeline selection options during rule creation (elastic/siem-team#498)
  - [ ] ~Import query from saved timeline~
    * For 7.7 tracking ticket here: elastic#56079
  - [x] `Investigate detections using this timeline template` 
- [x] Everywhere we use "Alerts" (Overview page, Host Tab, Network Tab) we should change the term to "External Alerts"
  - [x] Updated Host Page Tab/Table/Histogram/Breadcrumbs
  - [x] Updated Network Page Tab/Table/Histogram/Breadcrumbs
- [x] Updated DE permission/index  error doc links to go to [corresponding DE docs section](https://www.elastic.co/guide/en/siem/guide/7.6/detection-engine-overview.html#detections-permissions)
- [x] Removed `frequency` in favor of `count` for remaining histograms

##### Inconsistent Histogram intervals
![image](https://user-images.githubusercontent.com/2946766/73161560-04a82300-40a9-11ea-950f-ea56f9a5bfd7.png)


##### Consistent Histogram Intervals
![image](https://user-images.githubusercontent.com/2946766/73159564-fefc0e80-40a3-11ea-9b9d-4d15899dabd2.png)


cc @MichaelMarcialis @cwurm @MikePaquette 

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~
- [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~
- [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~

### For maintainers

- [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
- [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
spong added a commit that referenced this issue Jan 28, 2020
@spong
[SIEM] [Detection Engine] Fixes histogram intervals (#55969) (#56086)
d997be7 
## Summary

This PR wraps up the remaining `Detection Engine` meta tickets: #55585, #54935, and elastic/siem-team#498
- [x] Histogram bar interval (bar counts and widths) consistency (#55585)
  - [x] Make the bar intervals a consistent 32 bars across the board
  * Enabled `extended_bounds`, `min_doc_count: 0`, and now setting consistent `fixed_interval` when querying to ensure the entire daterange is displayed across all histograms.
- [x] Filter out the "untitled" timelines from both timeline selection options during rule creation (elastic/siem-team#498)
  - [ ] ~Import query from saved timeline~
    * For 7.7 tracking ticket here: #56079
  - [x] `Investigate detections using this timeline template` 
- [x] Everywhere we use "Alerts" (Overview page, Host Tab, Network Tab) we should change the term to "External Alerts"
  - [x] Updated Host Page Tab/Table/Histogram/Breadcrumbs
  - [x] Updated Network Page Tab/Table/Histogram/Breadcrumbs
- [x] Updated DE permission/index  error doc links to go to [corresponding DE docs section](https://www.elastic.co/guide/en/siem/guide/7.6/detection-engine-overview.html#detections-permissions)
- [x] Removed `frequency` in favor of `count` for remaining histograms

##### Inconsistent Histogram intervals
![image](https://user-images.githubusercontent.com/2946766/73161560-04a82300-40a9-11ea-950f-ea56f9a5bfd7.png)


##### Consistent Histogram Intervals
![image](https://user-images.githubusercontent.com/2946766/73159564-fefc0e80-40a3-11ea-9b9d-4d15899dabd2.png)


cc @MichaelMarcialis @cwurm @MikePaquette 

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~
- [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~
- [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~

### For maintainers

- [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
- [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
spong added a commit that referenced this issue Jan 28, 2020
@spong
[SIEM] [Detection Engine] Fixes histogram intervals (#55969) (#56085)
99de5ee 
## Summary

This PR wraps up the remaining `Detection Engine` meta tickets: #55585, #54935, and elastic/siem-team#498
- [x] Histogram bar interval (bar counts and widths) consistency (#55585)
  - [x] Make the bar intervals a consistent 32 bars across the board
  * Enabled `extended_bounds`, `min_doc_count: 0`, and now setting consistent `fixed_interval` when querying to ensure the entire daterange is displayed across all histograms.
- [x] Filter out the "untitled" timelines from both timeline selection options during rule creation (elastic/siem-team#498)
  - [ ] ~Import query from saved timeline~
    * For 7.7 tracking ticket here: #56079
  - [x] `Investigate detections using this timeline template` 
- [x] Everywhere we use "Alerts" (Overview page, Host Tab, Network Tab) we should change the term to "External Alerts"
  - [x] Updated Host Page Tab/Table/Histogram/Breadcrumbs
  - [x] Updated Network Page Tab/Table/Histogram/Breadcrumbs
- [x] Updated DE permission/index  error doc links to go to [corresponding DE docs section](https://www.elastic.co/guide/en/siem/guide/7.6/detection-engine-overview.html#detections-permissions)
- [x] Removed `frequency` in favor of `count` for remaining histograms

##### Inconsistent Histogram intervals
![image](https://user-images.githubusercontent.com/2946766/73161560-04a82300-40a9-11ea-950f-ea56f9a5bfd7.png)


##### Consistent Histogram Intervals
![image](https://user-images.githubusercontent.com/2946766/73159564-fefc0e80-40a3-11ea-9b9d-4d15899dabd2.png)


cc @MichaelMarcialis @cwurm @MikePaquette 

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [ ] ~[Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~
- [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~
- [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~

### For maintainers

- [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
- [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
@spalger spalger added v7.7.1 and removed v7.7.0 labels May 14, 2020
@MindyRS MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Oct 27, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New value added to drive a business result Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM v7.7.1
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@spalger @MindyRS @spong @elasticmachine