[RAM][SECURITYSOLUTION][ALERTS] - Integrate Alert summary inside of security solution rule page #154990

e40pud · 2023-04-15T11:17:34Z

Summary

Main ticket
This PR dependant on these changes

These changes cover next two tickets:

[RAM][SECURITYSOLUTION][ALERTS] - Integrate per-action frequency field in security solution APIs [RAM][SECURITYSOLUTION][ALERTS] - Integrate per-action frequency field in security solution APIs #154532
[RAM][SECURITYSOLUTION][ALERTS] - Integrate per-action frequency UI in security solution [RAM][SECURITYSOLUTION][ALERTS] - Integrate per-action frequency UI in security solution #154534

With this PR we will integrate per-action frequency field which already works within alert framework and will update security solution UI to incorporate the possibility to select "summary" vs "for each alert" type of actions.

NOTES:

There will be no more "Perform no actions" option which mutes all the actions of the rule. For back compatibility, we need to show that rule is muted in the UI cc @peluja1012 @ARWNightingale
The ability to generate per-alert action will be done as part of [RAM][Security Solution][Alerts] Support the ability to trigger a rule action per alert generated #153611

Technical Notes:

Here are the overview of the conversions and transformations that we are going to do as part of these changes for devs who are going to review.

On rule create/read/update/patch:

We always gonna set rule level throttle to undefined from now on
If each action has frequency attribute set, then we just use those values
If actions do not have frequency attribute set (or for some reason there is a mix of actions with some of them having frequency attribute and some not), then we transform rule level throttle into frequency and set it for each action in the rule

On rule bulk editing:

We always gonna set rule level throttle to undefined
If each action has frequency attribute set, then we just use those values
If actions do not have frequency attribute set, then we transform rule level throttle into frequency and set it for each action in the rule
If user passed only throttle attribute with empty actions (actions = []), this will only remove all actions from the rule

This will bring breaking changes which we agreed on with the Advanced Correlation Group
cc @XavierM @vitaliidm @peluja1012

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios

…ecurity solution rule page * [RAM][SECURITYSOLUTION][ALERTS] - Integrate per-action frequency field in security solution APIs elastic#154532 * [RAM][SECURITYSOLUTION][ALERTS] - Integrate per-action frequency UI in security solution elastic#154534

e40pud · 2023-04-15T11:17:54Z

Initially I had two separate draft PRs for tickets above, but because of extra work I had to do to support old UI with the new field integration, I decided to merge those draft PRs into one instead. @maximpn @vitaliidm you already started reviewing one of them, sorry for making you looking into this once again.

e40pud · 2023-04-18T15:42:17Z

@elasticmachine merge upstream

# Conflicts: # x-pack/plugins/alerting/server/rules_client/methods/bulk_edit.ts # x-pack/plugins/alerting/server/rules_client/methods/create.ts # x-pack/plugins/alerting/server/rules_client/methods/update.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/normalization/rule_actions.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/normalization/rule_converters.ts # x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/utils/utils.test.ts # x-pack/test/detection_engine_api_integration/security_and_spaces/group10/legacy_actions_migrations.ts # x-pack/test/detection_engine_api_integration/security_and_spaces/group10/perform_bulk_action.ts

e40pud · 2023-04-19T12:33:09Z

@elasticmachine merge upstream

maximpn

@e40pud thank you for finally adopting frequency from Alerting Framework 👍

I've tested the PR locally and it works as expected. The changes look good though my main concern is throttle field as it may be null and returned to the client this way. While it's really not a big deal what we use under the hood (though it's better to stick to one of the options as minimum inside Security Solution plugin) it's not a good thing to mix null and undefined in the API. So far we tend to avoid null as it helps to avoid serialising fields without a meaningful value and UI part can easily fallback for undefined when reading a field. You can check rule schemas.

On top of that this task requires removing normalisation and will lead to returning value as is so it has the same problem of representing absence of a value. So far throttle is always transformed to one of a string literal values.

maximpn · 2023-04-19T08:28:46Z

x-pack/plugins/alerting/server/routes/bulk_edit_rules.ts

+      summary: schema.boolean(),
+      throttle: schema.nullable(schema.string()),
+      notifyWhen: schema.oneOf([
+        schema.literal('onActionGroupChange'),


nit: I'm rather curious than it's call for action. These are duplicates the literals from kbn-securitysolution-io-ts-alerting-types/src/frequency. I'm not sure if we should keep them at one place and reuse but if there are some changes or renamings we have to change the literals at two unrelated files.

We are not using io-ts in platform, and we want to keep using kbn-schema. I think we are fine with that for now

I only meant the string literals onActionGroupChange, onActiveAlert and onThrottleInterval.

maximpn · 2023-04-19T08:38:32Z

x-pack/plugins/security_solution/cypress/e2e/detection_rules/bulk_edit_rules_actions.cy.ts

        {
          id: body.id,
          action_type_id: '.slack',
          group: 'default',
          params: {
            message: expectedExistingSlackMessage,
          },
+          frequency: {
+            summary: true,


Just curious why is summary: true here?

summary === true is the default state which is used. Right now, all actions send the summary of all generated alerts within the selected timeframe.

maximpn · 2023-04-19T09:37:15Z

...on_engine/rule_management_ui/components/rules_table/bulk_actions/forms/rule_actions_form.tsx

 import { getAllActionMessageParams } from '../../../../../../detections/pages/detection_engine/rules/helpers';

 import { RuleActionsField } from '../../../../../../detections/components/rules/rule_actions_field';
 import { debouncedValidateRuleActionsField } from '../../../../../../detections/containers/detection_engine/rules/validate_rule_actions_field';

 const CommonUseField = getUseField({ component: Field });

+export interface RuleActionForBulkActions extends RuleAction {


nit: Have you considered BulkActionsRuleAction name? Do we really need to export this interface? I don't see any usages. As far as I see the intention is to make frequency field required which could be done the following way

type BulkActionsRuleAction = RuleAction & Required<Pick<RuleAction, 'frequency'>>;

which allows to avoid importing RuleActionFrequency.

Sounds good, will do those changes

maximpn · 2023-04-19T09:46:15Z

...ck/plugins/security_solution/public/detections/components/rules/rule_actions_field/index.tsx

+  const setActionFrequency = useCallback(
+    // TODO: replace any with a concrete type
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    (key: string, value: any, index: number) => {


Why can't RuleActionParam be used for typing value here?

maximpn · 2023-04-19T09:50:52Z

...ck/plugins/security_solution/public/detections/components/rules/rule_actions_field/index.tsx

        setActionAlertsFilterProperty,
        featureId: SecurityConnectorFeatureId,
        defaultActionMessage: DEFAULT_ACTION_MESSAGE,
        defaultSummaryMessage: DEFAULT_ACTION_MESSAGE,
        hideActionHeader: true,
-        hideNotifyWhen: true,
+        hideNotifyWhen: false,


Interesting if this prop can be removed as notifyWhen should be alway displayed after merging this PR.

maximpn · 2023-04-19T10:58:05Z

x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.tsx

@@ -217,11 +186,6 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
    return application.capabilities.actions.show ? (
      <>
        <DisplayActionsHeader />
-        <UseField


It looks like throttleFieldComponentProps can be also removed with

<UseField path="throttle" componentProps={throttleFieldComponentProps} component={GhostFormField} />

and

<UseField path="actions" component={GhostFormField} /> <UseField path="kibanaSiemAppUrl" component={GhostFormField} /> <UseField path="enabled" component={GhostFormField} />

looks unnecessary here.

Good point! Will remove those components.

.../security_solution/server/lib/detection_engine/rule_management/normalization/rule_actions.ts

maximpn · 2023-04-19T11:21:15Z

.../security_solution/server/lib/detection_engine/rule_management/normalization/rule_actions.ts

+  }
+
+  const transformedActions: T[] = [];
+  actions.forEach((action) => {


nit: looks a bit overcomplicated and can be replaced with for of cycle or with

return actions.map((action) => ({ ...action, frequency, }));

where frequency is always set and it's unnecessary to use ...{ frequency }.

maximpn · 2023-04-19T12:01:13Z

...curity_solution/server/lib/detection_engine/rule_management/normalization/rule_converters.ts

@@ -401,6 +400,11 @@ export const convertPatchAPIToInternalSchema = (
 ): InternalRuleUpdate => {
  const typeSpecificParams = patchTypeSpecificSnakeToCamel(nextParams, existingRule.params);
  const existingParams = existingRule.params;
+
+  const alertActions = nextParams.actions?.map(transformRuleToAlertAction) ?? existingRule.actions;
+  const throttle = nextParams.throttle ?? transformFromAlertThrottle(existingRule, null);


nit: It's an interesting choice of providing null as throttle value instead of undefined though basically both null and undefined mean absence of a value. I try to extrapolate of using both later on and it can be confusing. Can we stick to undefined as minimum inside Security Solution?

There is a task I've been working on which requires removing of throttle normalization. It will lead it to fallback to undefined when it's not set as we don't use both null and undefined in our APIs according to the schemas.

This is gone after Vitalii's changes been merged.

maximpn · 2023-04-19T12:37:31Z

packages/kbn-securitysolution-io-ts-alerting-types/src/frequency/index.ts

+export const RuleActionFrequency = t.type({
+  summary: RuleActionSummary,
+  notifyWhen: RuleActionNotifyWhen,
+  throttle: t.union([RuleActionThrottle, t.null]),


Why do we need to return null when throttle is not set while it could be an optional field resolved to undefined if there is no a value. This was it won't be serialised and sent to the client. On top of that we try to avoid to use null in our API according to https://github.com/elastic/kibana/blob/main/x-pack/plugins/security_solution/common/detection_engine/rule_schema/model/rule_schemas.ts.

throttle is set to null everywhere in security solution, alert framework and triggering actions plugins when notifyWhen attribute is not onThrottleInterval.

Our rule schemas are also use it here https://github.com/elastic/kibana/blob/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_schema/model/rule_schemas.ts

Even if we want to avoid setting it to null and just keep undefined in case it is not set, we would need to go through many places make sure everything works as expected. So, I would not do this as part of this PR.

e40pud · 2023-04-19T15:56:00Z

@elasticmachine merge upstream

vitaliidm · 2023-04-21T09:12:22Z

I left all options that action form provides and instead extended the allowed time units. I think it will make it more flexible for users and on the other hand will align our UI with the rest of the kibana apps.

There are still some errors:

@e40pud , is there any ability to limit choice of units and values in per action frequency component?
We need somehow to address it. Maybe by adding validation to our form if we can't change units?
Let's create a ticket for it and prioritise this fix if it is not easy to limit units and numbers on a form

vitaliidm

Thanks for implementing this feature.
Approving it.
And after, we need to figure out how to handle validation of throttle if it less than 5m

e40pud · 2023-04-21T12:11:53Z

Thanks for implementing this feature.
Approving it.
And after, we need to figure out how to handle validation of throttle if it less than 5m

There is a minimumThrottleInterval property on action form which we can use for showing the warning message. I will add it in a separate PR. Here is the ticket to track it #155502

And it will look like that

e40pud · 2023-04-21T13:31:14Z

@elasticmachine merge upstream

banderror

Checked out, did some (non-exhaustive) local testing, and reviewed some of the code.

As for the code changes, overall LGTM, I just left a few comments. I think only one of them is about correctness, the rest are minor.

My brain-power was over before I started looking at the tests, so I decided to skip it at least for today. Do we have a test plan for this feature that could help review the coverage? Are there any plans to write more tests for it?

In my local testing, I checked the following:

How the actions form works when you create or edit a rule
Bulk editing rule actions (adding and overriding)
Import/export, including import of legacy rules with actions and rule-level frequency.

All worked well, I was especially glad that the import worked as I'd expect. Yay!

Overall, this is a very complex PR @e40pud, and it looks very good to me. I appreciate all your efforts! I'll approve the PR in advance, but it'd be great to sync on some of the comments once you have time.

banderror · 2023-04-21T15:58:24Z

packages/kbn-securitysolution-io-ts-alerting-types/src/frequency/index.ts

+export type RuleActionFrequency = t.TypeOf<typeof RuleActionFrequency>;
+export const RuleActionFrequency = t.type({
+  summary: RuleActionSummary,
+  notifyWhen: RuleActionNotifyWhen,


Nit: Is notifyWhen intentionally left camel-cased for some reason? In our API we use snake_case.

Good point! I did not notice it. I will create a separate ticket and will update it to snake_case in a separate PR.

banderror · 2023-04-21T16:00:29Z

packages/kbn-securitysolution-io-ts-alerting-types/src/frequency/index.ts

+/**
+ * Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
+ */
+export type RuleActionSummary = t.TypeOf<typeof RuleActionSummary>;


Nit: Thanks for adding this comment, could you please comment on the rest of the types in this file?

Yes, will do that!

banderror · 2023-04-21T16:06:27Z

packages/kbn-securitysolution-io-ts-alerting-types/src/throttle/index.ts

@@ -13,5 +13,5 @@ export type RuleActionThrottle = t.TypeOf<typeof RuleActionThrottle>;
 export const RuleActionThrottle = t.union([
  t.literal('no_actions'),
  t.literal('rule'),
-  TimeDuration({ allowedUnits: ['h', 'd'] }),


Are we ok with letting users specify throttle as low as 1s? Should we limit it by specifying some lower bound, or maybe there's such a limit enforced by the Framework?

See discussion with Vitalii about this above #154990 (comment)

banderror · 2023-04-21T16:19:57Z

...ty_solution/common/detection_engine/rule_management/api/rules/bulk_actions/request_schema.ts

+    t.type({
+      actions: t.array(NormalizedRuleAction),
+    }),
+  ]),


@e40pud could you please add this list of priorities as a comment for BulkActionEditPayloadRuleActions?

banderror · 2023-04-21T16:25:29Z

x-pack/plugins/security_solution/common/detection_engine/rule_schema/model/rule_schemas.ts

+    // Throttle
+    throttle: RuleActionThrottle,


(Not sure) Probably it shouldn't be part of the baseSchema anymore, because we won't be returning it in responses of read operations. Instead of adding it here, maybe it would be semantically better to add it to SharedCreateProps, SharedUpdateProps and SharedPatchProps.

The comment is not very informative btw 🙂

As we discussed rule level throttle is gonna be always undefined it makes sense to remove the field altogether as JSON.stringify({ throttle: undefined }) gives {}.

I tried to remove it but reverted the change back. There are many places involved which I did not think about and I broke many tests. I will add a separate ticket to do such a change separately.

Here is the ticket to cover this: #155577

it makes sense to remove the field altogether

@maximpn we can't remove it from the request parameters

banderror · 2023-04-21T16:38:57Z

...ck/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.test.tsx

+              throttle: null,
+              notifyWhen: 'onActiveAlert',
+            },
+          } as RuleAlertAction,


Can we avoid using as casting?

banderror · 2023-04-21T16:43:10Z

x-pack/plugins/security_solution/server/lib/detection_engine/rule_schema/model/rule_schemas.ts

  throttle: t.union([RuleActionThrottle, t.null]),
-  notifyWhen,
+  notifywhen: t.union([RuleActionNotifyWhen, t.null]),


Can we completely remove these from internalRuleCreateOptional and internalRuleUpdateOptional, or they're still needed because the normalization to action-level frequencies is implemented inside the RulesClient?

I will explore this in a separate PR. I will create a ticket for all related topics, where we can try to remove throttle and notifyWhen from rule schema.

Here is the ticket to cover this: #155577

banderror · 2023-04-21T16:47:01Z

.../lib/detection_engine/rule_management/logic/bulk_actions/action_to_rules_client_operation.ts

+          value: transformToActionFrequency(action.value.actions, action.value.throttle),
        },
-        getThrottleOperation(action.value.throttle),
-        getNotifyWhenOperation(action.value.throttle),
+        ...(action.value.throttle
+          ? [
+              getThrottleOperation(action.value.throttle),
+              getNotifyWhenOperation(action.value.throttle),
+            ]
+          : []),
      ];

    case BulkActionEditType.set_rule_actions:
      return [
        {
          field: 'actions',
          operation: 'set',
-          value: action.value.actions,
+          value: transformToActionFrequency(action.value.actions, action.value.throttle),
        },
-        getThrottleOperation(action.value.throttle),
-        getNotifyWhenOperation(action.value.throttle),
+        ...(action.value.throttle
+          ? [
+              getThrottleOperation(action.value.throttle),
+              getNotifyWhenOperation(action.value.throttle),
+            ]
+          : []),


Let's add comments explaining why we check action.value.throttle here and how this works.

We don't really need it anymore. So, I will remove passing those two parameters.

banderror · 2023-04-21T16:58:23Z

.../security_solution/server/lib/detection_engine/rule_management/normalization/rule_actions.ts

+  // If each action has frequency attribute set, then ignore the rule level throttle
+  if (actions.every((action) => action.frequency)) {
+    return actions;
+  }
+
+  const frequency = transformToFrequency(throttle);
+  return actions.map((action) => ({ ...action, frequency }));


I'm not sure this matches the logic we discussed yesterday, please correct me if I'm wrong, but I thought action-level frequency should always take precedence over the rule-level one. However, { ...action, frequency } allows to override an existing action-level frequency with the rule-level one. It seems like the correct implementation should be:

export const transformToActionFrequency = <T extends ActionWithFrequency>( actions: T[], throttle: string | null | undefined ): T[] => { const defaultFrequency = transformToFrequency(throttle); return actions.map((action) => ({ ...action, frequency: action.frequency ?? defaultFrequency, })); };

Will update accordingly.

yctercero

Codeowners LGTM - this needs to get in to be tested with other PRs. Will continue review - @e40pud if you don't mind following up on anything that comes up in testing.

maximpn

@e40pud thank you for addressing my previous comments 🙏 I've done testing and it works like a charm 🥳

From my side though I have two questions which can be addressed later on

Why don't remove throttle from the rule response schema? As rule level throttle should be always undefined and JSON.stringify({ throttle: undefined }) gives {} it looks quite logical to remove it.
Throttle input validation as extended to accept values in seconds and minutes. There is a valid comment from @banderror regarding 1s interval and I'm keen on knowing the side effects of this too.

e40pud · 2023-04-22T20:51:34Z

From my side though I have two questions which can be addressed later on

Why don't remove throttle from the rule response schema? As rule level throttle should be always undefined and JSON.stringify({ throttle: undefined }) gives {} it looks quite logical to remove it.

I tried to remove it but reverted the change back. There are many places involved which I did not think about and I broke many tests. I will add a separate ticket to do such a change separately.

Throttle input validation as extended to accept values in seconds and minutes. There is a valid comment from @banderror regarding 1s interval and I'm keen on knowing the side effects of this too.

Also, as for the intervals, see my discussion with Vitalii above #154990 (comment)

e40pud · 2023-04-22T20:52:12Z

@elasticmachine merge upstream

This reverts commit 441a4bb.

e40pud · 2023-04-22T23:08:41Z

.../plugins/alerting/server/rules_client/lib/siem_legacy_actions/transform_to_alert_throttle.ts

@vitaliidm I brought this function to correctly transform the throttle, same what you did with transformToNotifyWhen.

e40pud · 2023-04-22T23:11:19Z

x-pack/plugins/alerting/server/rules_client/lib/siem_legacy_actions/format_legacy_actions.ts

@vitaliidm I found a bug with the throttle conversion. Throttle cannot be 'no_actions', this is a notifyWhen value. Throttle can to be either null or a time duration value when notifyWhen is onThrottleInterval.

kibana-ci · 2023-04-22T23:18:00Z

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/securitysolution-io-ts-alerting-types`	122	125	+3

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	9.1MB	9.1MB	-3.0KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	59.9KB	60.0KB	+116.0B

Unknown metric groups

API count

id	before	after	diff
`@kbn/securitysolution-io-ts-alerting-types`	141	147	+6

ESLint disabled line counts

id	before	after	diff
`enterpriseSearch`	16	18	+2
`securitySolution`	395	398	+3
total			+5

Total ESLint disabled count

id	before	after	diff
`enterpriseSearch`	17	19	+2
`securitySolution`	475	478	+3
total			+5

History

💔 Build #122238 failed 9cade39
💔 Build #122235 failed 86eabde
💛 Build #122000 was flaky 437a542
💔 Build #121961 failed a6b1def
💛 Build #121872 was flaky 1846e80

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @e40pud

e40pud · 2023-04-23T09:50:46Z

@banderror Thanks for the review!!

Here are the answers to your questions:

My brain-power was over before I started looking at the tests, so I decided to skip it at least for today. Do we have a test plan for this feature that could help review the coverage? Are there any plans to write more tests for it?

Her is the test plan for the Conditional Actions feature which also includes testing of legacy action migration: https://docs.google.com/document/d/1w4ZRj-JXNzTGaTBkyfHrfNIyGpSL-AylOwBefPzCso8

I also added functional tests to cover the new functionality.

e40pud added release_note:enhancement ci:cloud-deploy Create or update a Cloud deployment labels Apr 15, 2023

e40pud self-assigned this Apr 15, 2023

e40pud requested review from a team as code owners April 15, 2023 11:17

e40pud requested a review from jpdjere April 15, 2023 11:17

e40pud requested review from XavierM, maximpn, banderror, vitaliidm and marshallmain April 15, 2023 11:18

This was referenced Apr 15, 2023

[RAM][SECURITYSOLUTION][ALERTS] - Integrate per-action frequency UI in security solution #154637

Closed

[RAM][SECURITYSOLUTION][ALERTS] - Integrate per-action frequency field in security solution APIs (#154532) #154527

Closed

kibanamachine and others added 2 commits April 18, 2023 11:42

Merge branch 'main' into security/feature/summary-actions

627612b

kibanamachine and others added 2 commits April 19, 2023 08:33

Merge branch 'main' into security/feature/summary-actions

47eddf5

Fix tests

238ae31

maximpn reviewed Apr 19, 2023

View reviewed changes

Fix tests

ddb5017

Merge branch 'main' into security/feature/summary-actions

f88cf70

Merge branch 'main' into security/feature/summary-actions

1846e80

vitaliidm approved these changes Apr 21, 2023

View reviewed changes

Functional tests

a6b1def

vitaliidm mentioned this pull request Apr 21, 2023

[SECURITYSOLUTION][ALERTS] - Show warning that custom action intervals cannot be shorter than the rule's check interval #155502

Open

Merge branch 'main' into security/feature/summary-actions

437a542

banderror approved these changes Apr 21, 2023

View reviewed changes

yctercero approved these changes Apr 21, 2023

View reviewed changes

maximpn approved these changes Apr 22, 2023

View reviewed changes

Review feedback

441a4bb

kibanamachine and others added 4 commits April 22, 2023 16:52

Merge branch 'main' into security/feature/summary-actions

86eabde

Revert "Review feedback"

bcf15b1

This reverts commit 441a4bb.

Review feedback

9cade39

Fix jest tests

a1ab1b2

e40pud commented Apr 22, 2023

View reviewed changes

e40pud merged commit 68719bd into elastic:main Apr 23, 2023

kibanamachine added v8.8.0 backport:skip This commit does not require backporting labels Apr 23, 2023

e40pud mentioned this pull request Apr 23, 2023

[Security Solution] Consider removing throttle from the rule schema #155577

Open

e40pud mentioned this pull request Apr 23, 2023

[Security Solution] Fix workarounds for migrating from rule-level notifyWhen/throttle to action-level #148414

Closed

mikecote mentioned this pull request Jun 23, 2023

Some legacy mustache variables are not rendering for Security Solution rules after upgrading to 8.8.x #160446

Closed

e40pud deleted the security/feature/summary-actions branch October 10, 2023 12:44

[RAM][SECURITYSOLUTION][ALERTS] - Integrate Alert summary inside of security solution rule page #154990

[RAM][SECURITYSOLUTION][ALERTS] - Integrate Alert summary inside of security solution rule page #154990

Conversation

e40pud commented Apr 15, 2023 • edited Loading

Summary

NOTES:

Technical Notes:

Checklist

e40pud commented Apr 15, 2023

e40pud commented Apr 18, 2023

e40pud commented Apr 19, 2023

maximpn left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

e40pud Apr 19, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

e40pud Apr 19, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

e40pud Apr 19, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

e40pud commented Apr 19, 2023

vitaliidm commented Apr 21, 2023

vitaliidm left a comment • edited Loading

Choose a reason for hiding this comment

e40pud commented Apr 21, 2023 • edited by XavierM Loading

e40pud commented Apr 21, 2023

banderror left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

e40pud Apr 22, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yctercero left a comment

Choose a reason for hiding this comment

maximpn left a comment

Choose a reason for hiding this comment

e40pud commented Apr 22, 2023 • edited Loading

e40pud commented Apr 22, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kibana-ci commented Apr 22, 2023 • edited Loading

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Async chunks

Page load bundle

API count

ESLint disabled line counts

Total ESLint disabled count

History

e40pud commented Apr 23, 2023

e40pud commented Apr 15, 2023 •

edited

Loading

maximpn left a comment •

edited

Loading

e40pud Apr 19, 2023 •

edited

Loading

e40pud Apr 19, 2023 •

edited

Loading

e40pud Apr 19, 2023 •

edited

Loading

vitaliidm left a comment •

edited

Loading

e40pud commented Apr 21, 2023 •

edited by XavierM

Loading

e40pud Apr 22, 2023 •

edited

Loading

e40pud commented Apr 22, 2023 •

edited

Loading

kibana-ci commented Apr 22, 2023 •

edited

Loading