-
Notifications
You must be signed in to change notification settings - Fork 8.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Security Solution] [Platform] Adds support for data views and runtime field mappings in rule creation, exceptions, and during execution #130929
Merged
Merged
Changes from 1 commit
Commits
Show all changes
107 commits
Select commit
Hold shift + click to select a range
4ab6be4
WIP
dhurley14 195480b
WIP - reset me
dhurley14 c29db7d
Merge remote-tracking branch 'upstream/main' into dataview-rule-exec
dhurley14 1e5de0d
more WIP, added runtime_mappings field to search after function in ru…
dhurley14 452e7ea
data view id saved on rule creation, then pull runtime mappings from …
dhurley14 818e0eb
fix bug where runtime mappings were not parsed
dhurley14 51c9db1
merge with master
dhurley14 111e7c0
Merge branch 'main' into dataview-rule-exec
dhurley14 c241aa6
undo me - combo box. not working / funtional / demo-able right now
dhurley14 e3c0d21
merge with main
dhurley14 a463132
working data view selector
dhurley14 628e7e7
adds radio group buttons, need to update callback to disable when one…
dhurley14 1744714
on change of radio selection we update which index patterns to use
dhurley14 603b72c
more working stuff, need to fix rule preview and getIsRulePreviewDisa…
dhurley14 47c9baf
WIP - undo me
dhurley14 95bebf0
Merge remote-tracking branch 'upstream/main' into dataview-rule-exec
dhurley14 9f554de
when editing a rule, the data view id stored on that rules params wil…
dhurley14 b684a26
Merge remote-tracking branch 'upstream/main' into dataview-rule-exec
dhurley14 1c51bea
add dataViewId to preview rule route + preview rule state
dhurley14 8ab0609
fixes types
dhurley14 864c178
fix test
dhurley14 2e7381a
fixes linting errors
dhurley14 c77ec73
remove extra console.log
dhurley14 d68a8b9
remove unnecessary new line
dhurley14 c6088f2
possibly fixed everything
dhurley14 bad4c7e
we do not use this field anymore so we can probably get rid of it.
dhurley14 b152cf8
Merge remote-tracking branch 'upstream/main' into dataview-rule-exec
dhurley14 52985b2
[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…
kibanamachine 9966b44
Merge remote-tracking branch 'upstream/main' into dataview-rule-exec
dhurley14 120e02f
Merge remote-tracking branch 'origin/dataview-rule-exec' into datavie…
dhurley14 9b2b7d9
fixes cypress tests, updates response validation from server to inclu…
dhurley14 113c937
updates validation
dhurley14 e48bb65
update validation logic and updates import rule route validations to …
dhurley14 f754090
WIP - using dataview services
dhurley14 d734c12
fixes missing fields in rule overrides in about rule section
dhurley14 cab37f3
WIP -fixed exception flyout, fixed threshold rule input selector
dhurley14 c36ccae
[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…
kibanamachine b57ed3a
merge with master
dhurley14 60328cc
fix jest test for about rule
dhurley14 28de147
Merge remote-tracking branch 'origin/dataview-rule-exec' into datavie…
dhurley14 362a3e1
working EQL runtime mapping fields
dhurley14 5f94d20
fixes double exceptions viewer and fixes bug where data viewer select…
dhurley14 c2776c6
use dataViewId injected by saved objects references, not the one stor…
dhurley14 3f416bb
remove data view id during bulk update of rules + changing index patt…
dhurley14 b2c5586
fixed a test
dhurley14 14a6c55
remove console.errors
dhurley14 bb97d75
fixes type check errors, need to replace ruleIndices prop in exceptio…
dhurley14 f272d37
adds runtime mappings parameters to threshold and threat match rule t…
dhurley14 1c1b8fa
update pre-execution checks to work with data views and runtime mappings
dhurley14 4774d8f
bug fixes, cleanup, still trying to figure out how to get the default…
dhurley14 6a5e490
merge main with master
dhurley14 7fd22fb
fixes last typescript error
dhurley14 c39e57d
return undefined instead of empty string when a data view is not foun…
dhurley14 58b2432
Merge remote-tracking branch 'upstream/main' into dataview-rule-exec
dhurley14 3722a4a
[Data View Rule Creation] - Update UI and data view check on rule run…
yctercero a4c90b4
possible test fixes
dhurley14 d0fbb9b
Merge branch 'dataview-rule-exec' of github.com:dhurley14/kibana into…
dhurley14 b9e8656
fixes data view bug with indicator and threshold rules
dhurley14 bdddbce
resolve type check failures
dhurley14 0696ce8
fix cypress
dhurley14 1bb5867
fix exceptions cypress test and update typecheck error
dhurley14 c076b76
forgot to uncomment tests
dhurley14 b873b55
do not block displaying / selection of options when fetching the data…
dhurley14 d91afd4
Merge remote-tracking branch 'upstream/main' into dataview-rule-exec
dhurley14 110f277
[Data Views for Rules] - adding unit tests (#24)
yctercero 51cd358
[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…
kibanamachine 2ce7c44
updates with type fixes from review and test re-names. I still need t…
dhurley14 3ff1d99
Merge branch 'dataview-rule-exec' of github.com:dhurley14/kibana into…
dhurley14 34dd775
display data view title in rule details, not the id
dhurley14 da37d23
fixes bug where validation was failing and users could not reset/clea…
dhurley14 471d9fb
fix type check errors
dhurley14 39d1f3d
adds data view id to patch rules and patch rules bulk route, also add…
dhurley14 e8bb209
fix jest tests and type failuers
dhurley14 7b8e62a
update jest tests and fix bug found by saved query integration test
dhurley14 a8a8d98
fix code + tests related to bulk editing rules + dataviews
dhurley14 8974a8f
update snapshot
dhurley14 d27f613
remove console.logs, clean up logic for get input indices
dhurley14 45a6f70
skipping related_cases tests as they are timing out
dhurley14 1b4a9c6
fix e2e test
dhurley14 f26eeae
remove null from type
dhurley14 9c85a3f
remove changes from useFetchIndex
dhurley14 e35a168
merge with main
dhurley14 e8e9e5a
skipping add exceptions flyout as possible root cause for timeouts in…
dhurley14 5be1079
remove unnecessary useEffect which was causing jest test to hang in CI
dhurley14 7754d84
undo changes while trying to figure out why jest tests were hanging i…
dhurley14 c9d18ad
undo cypress changes
dhurley14 ebeed1f
merge with main
dhurley14 6954036
undo changes to query_bar test
dhurley14 9baef65
intermediary work for resolving cypress failures with exceptions
dhurley14 f5e0989
merge with main
dhurley14 24d181a
fix missed merge conflict
dhurley14 357121e
update jest test
dhurley14 c1bb307
do not reset querybar
dhurley14 b5954cc
set the rule indices state in rule details page if the rule has a non…
dhurley14 4f69c78
undo change made while debugging t_grid
dhurley14 b535d5c
exports Ancestor830 from alerts schema, removes fetching of data view…
dhurley14 ef10521
Merge remote-tracking branch 'upstream/main' into dataview-rule-exec
dhurley14 3b39205
undo changes to endpoint data loader while testing
dhurley14 2b2e531
Merge remote-tracking branch 'upstream/main' into dataview-rule-exec
dhurley14 6ef4f2a
removes commented out useEffect
dhurley14 6637e05
fix bug where rule form was blowing up because of a missing index fie…
dhurley14 5d069c8
fix validation logic in eql validator
dhurley14 645ca2b
Merge remote-tracking branch 'upstream/main' into dataview-rule-exec
dhurley14 594b1c0
fix logic for only adding data_view_id to rule form if ml rule type
dhurley14 56bed04
remove commented out code
dhurley14 bebc731
Revert "fix bug where rule form was blowing up because of a missing i…
dhurley14 d2da1da
Revert "fix validation logic in eql validator"
dhurley14 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
remove commented out code
- Loading branch information
commit 56bed04c108fc562752a4d34785fbd40702af678
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This will now wipe data views each time, no longer honoring the API's overwrite dataviews param I think. Is that intentional?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah yeah this is a bug from when I tried to fix something else in your PR where the index patterns wouldn't be overwritten unless that checkbox was clicked. I have a fix for that here along with passing tests:
a8a8d98