[Cloud Security] Host Name Misconfiguration Datagrid & Refactor CSP Plugin PHASE 2 #192535

animehart · 2024-09-11T02:20:09Z

In an attempt to make Reviewing easier and more accurate, the implementation of Misconfiguration Data grid on Host.name flyout in Alerts Page will be split into 2 Phases

Phase 1: Move Functions, Utils or Helpers, Hooks, constants to Package
Phase 2: Implementing the feature

This is Phase 2 of the process

How to test:
Pre req: In order to test this, you need to generate some fake alerts. This repo will help you do that

Generate Some Alerts
Use the Reindex API to get some Findings data in (change the host.name field to match the host.name from alerts generated if you want to test Findings table in the left panel flyout)
Turn on Risky Entity Score if you want to test if both Risk Contribution and Insights tabs shows up, follow this guide to turn on Risk Entity Score

…tion findings

…ks into common file

animehart · 2024-09-11T20:44:56Z

/ci

animehart · 2024-09-11T21:08:33Z

/ci

animehart · 2024-09-12T20:46:05Z

/ci

…x and findingsResult check

animehart · 2024-09-12T22:00:20Z

/ci

elasticmachine · 2024-09-12T22:01:30Z

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

tiansivive

LGTM from Entity Analytics

opauloh · 2024-09-13T17:55:12Z

x-pack/plugins/security_solution/public/flyout/entity_details/host_right/index.tsx

+          isMisconfigurationFindingsIndexExist: hasMisconfigurationFindingsIndex,
+          isMisconfigurationFindingsForThisQueryExist: hasMisconfigurationFindingsForThisQuery,


having two names for the same thing might be confusing (isMisconfigurationFindingsIndexExist and hasMisconfigurationFindingsIndex), ideally, we should stick with one naming only.

hasMisconfigurationFindingsIndex seems to me easier to read and understand than isMisconfigurationFindingsIndexExist, is is often used for boolean states or conditions (e.g., isEnabled, isVisible), and has is used for existence or possession (e.g., hasItems, hasError).

can we update the references of isMisconfigurationFindingsIndexExist and isMisconfigurationFindingsForThisQueryExist to hasMisconfigurationFindingsIndex and hasMisconfigurationFindingsForThisQuery respectively across the PR?

opauloh · 2024-09-13T17:58:08Z

x-pack/plugins/security_solution/public/flyout/entity_details/host_details_left/index.test.tsx

+        isMisconfigurationFindingsIndexExist={false}
+        isMisconfigurationFindingsForThisQueryExist={true}


how this use case can happen? index does not exist, but the data exist?

woops, you are right
this one is redundant

opauloh · 2024-09-13T18:01:25Z

.../security_solution/public/cloud_security_posture/components/csp_details/insights_tab_csp.tsx

+
+const insightsButtons: EuiButtonGroupOptionProps[] = [
+  {
+    id: 'misconfigurationTabId',


let's add this id to a constant, so we avoid updating the id name and forgetting to update the activeInsightsId

opauloh · 2024-09-13T18:05:55Z

.../security_solution/public/cloud_security_posture/components/csp_details/insights_tab_csp.tsx

+        data-test-subj={'insightButtonGroupsTestId'}
+      />
+      <EuiSpacer size="xl" />
+      <MisconfigurationFindingsDetailsTable fieldName={'host.name'} queryName={name} />


having the fieldName fixed to host.name here might prevent this component from being reusable in the future, I would suggest including the fieldName in the props and pass it down from the getInsightsInputTab function.

was planning to just do that on my next ticket (do this with user.name column) as shown in this branch that i made to see how much stuff i need to change
but now that u mentioned it, might as well change it now

opauloh · 2024-09-13T18:12:12Z

...ic/cloud_security_posture/components/csp_details/misconfiguration_findings_details_table.tsx

+      navToFindings({ 'rule.id': ruleId, 'resource.id': resourceId });
+    };
+
+    const columns: Array<EuiBasicTableColumn<Pick<CspFinding, 'result' | 'rule' | 'resource'>>> = [


this type Pick<CspFinding, 'result' | 'rule' | 'resource'> is being reused multiple times, what about create one type for it:

type MisconfigurationFindingDetailFields = Pick<CspFinding, 'result' | 'rule' | 'resource'>

opauloh · 2024-09-13T18:23:36Z

x-pack/packages/kbn-cloud-security-posture/src/utils/hooks_utils.ts

+  return {
+    index: CDR_MISCONFIGURATIONS_INDEX_PATTERN,
+    size: isPreview ? 0 : 500,
+    aggs: getFindingsCountAggQueryMisconfiguration(),
+    ignore_unavailable: true,
+    query: buildMisconfigurationsFindingsQueryWithFilters(query, mutedRulesFilterQuery),
+  };


Since we are only using a couple of fields, it would be nice to update the query to only retrieve the fields we need. We can do that by including a source filtering:

const MISCONFIGURATIONS_SOURCE_FIELDS = ['result.*', 'rule.*', 'resource.*']; //... return { index: CDR_MISCONFIGURATIONS_INDEX_PATTERN, size: isPreview ? 0 : 500, aggs: getFindingsCountAggQueryMisconfiguration(), ignore_unavailable: true, query: buildMisconfigurationsFindingsQueryWithFilters(query, mutedRulesFilterQuery), _source: MISCONFIGURATIONS_SOURCE_FIELDS };

That's important in this context since the Alerts component already loads a bunch of data at the same time, we can save some bandwidth by not loading unnecessary data.

ooo good thing to know, i never knew this

opauloh

looking good, just a few more questions

opauloh · 2024-09-13T22:46:52Z

x-pack/plugins/security_solution/public/flyout/entity_details/host_details_left/index.tsx

+
+    // Determine if the Insights tab should be included
+    const insightsTab =
+      hasMisconfigurationFindingsIndex && hasMisconfigurationFindingsForThisQuery


Is it really useful to have both hasMisconfigurationFindingsIndex and hasMisconfigurationFindingsForThisQuery?

Most of the conditions seem to be checking for hasMisconfigurationFindingsIndex && hasMisconfigurationFindingsForThisQuery, in that case, wouldn't it be better to work only the hasMisconfigurationFindingsForThisQuery? since when hasMisconfigurationFindingsForThisQuery is true it means hasMisconfigurationFindingsIndex is also true.

Unless there is a use case for having only the hasMisconfigurationFindingsIndex that I'm missing

opauloh · 2024-09-13T22:47:25Z

...plugins/security_solution/public/entity_analytics/components/entity_details_flyout/index.tsx

+  fieldName,
+}: {
+  name: string;
+  fieldName: 'host.name' | 'user.name';


opauloh · 2024-09-13T22:48:42Z

...ution/public/cloud_security_posture/components/misconfiguration/misconfiguration_preview.tsx

+            css={css`
+              font-weight: ${euiTheme.font.weight.bold};
+            `}


Isn't font-weight: bold applied by default in EuiTitle?

opauloh

LGTM, just left with a nit after the changes

opauloh · 2024-09-13T23:54:38Z

x-pack/plugins/security_solution/public/flyout/entity_details/host_right/index.tsx

+  const passedFindings = data?.count.passed || 0;
+  const failedFindings = data?.count.failed || 0;
+
+  const hasMisconfigurationFindingsForThisQuery = passedFindings > 0 || failedFindings > 0;


nit: we could rename this to hasMisconfigurationFindings now

kibana-ci · 2024-09-14T02:14:46Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: cc06d27
Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-192535-cc06d2793947
Security Deployment

Failed CI Steps

Jest Tests #4

Test Failures

[job] [logs] Jest Tests #4 / FilterPopover renders button label correctly

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	5758	5764	+6

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/cloud-security-posture`	63	74	+11
`@kbn/cloud-security-posture-common`	56	60	+4
total			+15

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	20.3MB	20.4MB	+45.4KB

Unknown metric groups

API count

id	before	after	diff
`@kbn/cloud-security-posture`	63	74	+11
`@kbn/cloud-security-posture-common`	57	61	+4
total			+15

History

💔 Build #234206 failed bbe5cbe
💛 Build #234191 was flaky 0489ed8
💛 Build #234146 was flaky c4eaa27
💚 Build #233872 succeeded db82481

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

…lugin PHASE 2 (elastic#192535) In an attempt to make Reviewing easier and more accurate, the implementation of Misconfiguration Data grid on Host.name flyout in Alerts Page will be split into 2 Phases Phase 1: Move Functions, Utils or Helpers, Hooks, constants to Package Phase 2: Implementing the feature This is **Phase 2** of the process <img width="1712" alt="Screenshot 2024-09-11 at 2 16 20 PM" src="https://github.com/user-attachments/assets/29ab56db-8561-486c-ae8d-c254b932cea4"> How to test: Pre req: In order to test this, you need to generate some fake alerts. This [repo](https://github.com/elastic/security-documents-generator) will help you do that 1. Generate Some Alerts 2. Use the Reindex API to get some Findings data in (change the host.name field to match the host.name from alerts generated if you want to test Findings table in the left panel flyout) 3. Turn on Risky Entity Score if you want to test if both Risk Contribution and Insights tabs shows up, follow this [guide](https://www.elastic.co/guide/en/security/current/turn-on-risk-engine.html) to turn on Risk Entity Score (cherry picked from commit 28becfd)

kibanamachine · 2024-09-14T04:46:30Z

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…ctor CSP Plugin PHASE 2 (#192535) (#192942) # Backport This will backport the following commits from `main` to `8.x`: - [[Cloud Security] Host Name Misconfiguration Datagrid & Refactor CSP Plugin PHASE 2 (#192535)](#192535)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Rickyanto Ang <rickyangwyn@gmail.com>

animehart added 5 commits September 10, 2024 19:18

Initial Push: added table for left flyout panel showing misconfigura…

5a72315

…tion findings

Merge branch 'main' into misconfiguration-datagrid-phase-2

a9e558f

Merge branch 'main' into misconfiguration-datagrid-phase-2

3dc0abd

cleaning up, moving functions and types that was used on separate hoo…

d048ecc

…ks into common file

Clean up

0123fd7

fix for tabs, now it follows figma design where its not expanded

92ca53e

animehart added 2 commits September 11, 2024 21:12

fix issue with flyout showing wrong tabs or table

a35d865

fixes regarding errors + tabs directory

083467b

fix variable name, update left panel props so it accepts findingsInde…

db82481

…x and findingsResult check

animehart marked this pull request as ready for review September 12, 2024 22:00

animehart requested review from a team as code owners September 12, 2024 22:01

animehart requested a review from tiansivive September 12, 2024 22:01

animehart added v8.16.0 Team:Cloud Security Cloud Security team related labels Sep 12, 2024

animehart added the release_note:skip Skip the PR/issue when compiling release notes label Sep 12, 2024

tiansivive approved these changes Sep 13, 2024

View reviewed changes

animehart added backport:prev-minor Backport to (8.x) the previous minor version (i.e. one version back from main) ci:project-deploy-security Create a Security Serverless Project labels Sep 13, 2024

Merge branch 'main' into misconfiguration-datagrid-phase-2

c4eaa27

opauloh reviewed Sep 13, 2024

View reviewed changes

addressing PR Comments

0489ed8

animehart requested a review from opauloh September 13, 2024 20:42

opauloh reviewed Sep 13, 2024

View reviewed changes

PR Comments, removed redundant props

bbe5cbe

opauloh approved these changes Sep 13, 2024

View reviewed changes

PR comments, fix quick check failures

cc06d27

animehart merged commit 28becfd into elastic:main Sep 14, 2024
42 checks passed

kibanamachine added the v9.0.0 label Sep 14, 2024

kibanamachine mentioned this pull request Sep 14, 2024

[8.x] [Cloud Security] Host Name Misconfiguration Datagrid & Refactor CSP Plugin PHASE 2 (#192535) #192942

Merged

kibanamachine mentioned this pull request Sep 18, 2024

[Cloud Security] User Name Misconfiguration Table and Preview Contextual Flyout #192946

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Cloud Security] Host Name Misconfiguration Datagrid & Refactor CSP Plugin PHASE 2 #192535

[Cloud Security] Host Name Misconfiguration Datagrid & Refactor CSP Plugin PHASE 2 #192535

animehart commented Sep 11, 2024 •

edited by kibanamachine

Loading

animehart commented Sep 11, 2024

animehart commented Sep 11, 2024

animehart commented Sep 12, 2024

animehart commented Sep 12, 2024

elasticmachine commented Sep 12, 2024

tiansivive left a comment

opauloh Sep 13, 2024

opauloh Sep 13, 2024

animehart Sep 13, 2024

opauloh Sep 13, 2024

opauloh Sep 13, 2024

animehart Sep 13, 2024

opauloh Sep 13, 2024

opauloh Sep 13, 2024

animehart Sep 13, 2024 •

edited

Loading

opauloh left a comment

opauloh Sep 13, 2024

opauloh Sep 13, 2024

opauloh Sep 13, 2024

opauloh left a comment

opauloh Sep 13, 2024

kibana-ci commented Sep 14, 2024 •

edited

Loading

API count

kibanamachine commented Sep 14, 2024

		isMisconfigurationFindingsIndexExist: hasMisconfigurationFindingsIndex,
		isMisconfigurationFindingsForThisQueryExist: hasMisconfigurationFindingsForThisQuery,

		isMisconfigurationFindingsIndexExist={false}
		isMisconfigurationFindingsForThisQueryExist={true}

[Cloud Security] Host Name Misconfiguration Datagrid & Refactor CSP Plugin PHASE 2 #192535

[Cloud Security] Host Name Misconfiguration Datagrid & Refactor CSP Plugin PHASE 2 #192535

Conversation

animehart commented Sep 11, 2024 • edited by kibanamachine Loading

animehart commented Sep 11, 2024

animehart commented Sep 11, 2024

animehart commented Sep 12, 2024

animehart commented Sep 12, 2024

elasticmachine commented Sep 12, 2024

tiansivive left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

animehart Sep 13, 2024 • edited Loading

Choose a reason for hiding this comment

opauloh left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

opauloh left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kibana-ci commented Sep 14, 2024 • edited Loading

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

API count

History

kibanamachine commented Sep 14, 2024

💚 All backports created successfully

Questions ?

animehart commented Sep 11, 2024 •

edited by kibanamachine

Loading

animehart Sep 13, 2024 •

edited

Loading

kibana-ci commented Sep 14, 2024 •

edited

Loading