Add Host Risk metadata data to alerts flyout

[machadoum]

Summary

issue: https://github.com/elastic/security-team/issues/1309

• Add Host Risk metadata data to alerts flyout
• Filter out empty fields from the alerts flyout summary tab
• Update the alerts flyout summary tab "Threat Summary" section to use the same layout as Host Risk. Read more

How to test Host risk data:

0. Log into the security app and visit the alert pages and open the flyout for an alert. It shouldn't display the host risk data panel.

1. Enable the feature flag and check it again. It should display the panel and show that there is no data for the host. Add xpack.securitySolution.enableExperimental: ['riskyHostsEnabled'] to kibana.dev.yml

2. if you are using a custom .siem-signals index as per your kibana.dev.yml, run the following reindex query to obtain a .siem-signals-default-* index
   note: this step is required for properly loading Drilldown of Host Risk Score dashboard, as it looks for the index pattern .siem-signals-default-*

Create default .siem-signals index

POST _reindex
{
  "source": {
    "index": "my-custom-siem-signals-index-name"
  },
  "dest": {
    "index": ".siem-signals-default-test"
  }
}

3. make the following requests in Kibana Dev Tools

Create ml_host_risk_score_latest index

PUT ml_host_risk_score_latest
{
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "host": {
        "properties": {
          "name": {
            "type": "keyword"
           }
         }
       },
      "ingest_timestamp": {
        "type": "date"
      },
      "risk": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "risk_score": {
        "type": "float"
      }
    }
  }
}

Add data to ml_host_risk_score_latest index (please replace {MY-HOST-NAME} by a valid hostname)

POST ml_host_risk_score_latest/_doc
{"@timestamp":"2021-02-23T23:00:00.000Z","risk_score":21,"host":{"name":"{MY-HOST-NAME}"},"rules":{"Unusual Linux Username":{"average_risk":21,"rule_count":2,"rule_risk":42}},"ingest_timestamp":"2021-07-27T18:02:08.319296053Z","risk":"Low"}

Create ml_host_risk_score index

POST _reindex
{
  "source": {
    "index": "ml_host_risk_score_latest"
  },
  "dest": {
    "index": "ml_host_risk_score"
  }
}

4. Create an index pattern in Kibana / Stack Management / Index Patterns. The name of the id pattern should be ml-host-risk-score-index-pattern, and it should point to ml_host_risk_score

5. Open the flyout for an event with the same hostname as the document you added to ml_host_risk_score_latest {MY-HOST-NAME}

How to test Threat Summary new design

1. Install filebeat https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html
2. Enable threat intel module filebeat modules enable threatintel https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html
3. Start filebeat
4. Create an Indicator Match rule and map one threat intel field.
5. Open the flyout for an generated event.

Remaining items todo

• Fix rendering order of enriched data and investigation guide
• Change enriched data panel border to make it rounded
• The URL inside the tooltip isn't clickable

Checklist

Delete any items that are not applicable to this PR.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Unit or functional tests were updated or added to match the most common scenarios
• This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)

[rylnd]

As I mentioned inline, there appears to be a lot of duplicated logic between this branch and the code added in https://github.com/elastic/kibana/pull/109553/files; I think we need a pass here to ensure we're not reinventing the wheel. @ecezalp or I should be able to help as needed.

Additionally, we've just added https://github.com/elastic/security-team/issues/1785 to address the current lack of space awareness in the host risk pipeline; the changes described there are going to need to happen here, as well (namely: replacing RISKY_HOSTS_INDEX with a space-aware equivalent).

[monina-n]

Updates to text styles, padding, and margins moved for 8.1 -> https://github.com/elastic/security-team/issues/1764

[angorayc]

I have a small problem about the Host Risk Score link here, I tried hover onto in real fast, but I still couldn't reach it

[machadoum]

I have a small problem about the Host Risk Score link here, I tried hover onto in real fast, but I still couldn't reach it

Thank you Angela!

The Design team is aware and I am waiting for an alternative UI for this tooltip.

Tagging @monina-n

[machadoum]

I have a small problem about the Host Risk Score link here, I tried hover onto in real fast, but I still couldn't reach it

Issue fixed by this commit: 4a18a9d

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 48856b7
• Storybooks Preview
• Documentation Changes

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	2293	2297	+4

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
securitySolution	1299	1307	+8

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	4.3MB	4.3MB	+6.3KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
securitySolution	102.2KB	102.2KB	+8.0B

Unknown metric groups

API count

id	before	after	diff
securitySolution	1353	1361	+8

History

• 💚 Build #158436 succeeded 4a18a9d
• 💔 Build #158395 failed 7e27b6f
• 💚 Build #158341 succeeded 2994a5b17d18c116c94d427a73940b64dac1948a
• 💚 Build #158072 succeeded e7b441725065bbb0c0d624e87bc3904ab4c9272a
• 💚 Build #158012 succeeded 9f8fdf6ea5f3c4fdf08b74948382afd237231d0e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @machadoum

[stephmilovic]

Great work on turning this around quickly. Thank you for updating the tests to be in react testing library. LGTM! 🚀 🎸

[kibanamachine]

💚 Backport successful

Status	Branch	Result
✅	7.x

This backport PR will be merged automatically after passing CI.