Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution][Notes] Make MAX_UNASSOCIATED_NOTES an advanced Kibana setting #194947

Merged

Conversation

janmonschke
Copy link
Contributor

@janmonschke janmonschke commented Oct 4, 2024

Summary

Fixes: #193097

Adds a new Kibana advanced setting that allows users to limit the maximum amount of unassociated notes. The max value for that used to be hard coded before.

Screen.Recording.2024-10-09.at.10.58.29.mov

Checklist

@janmonschke janmonschke added release_note:enhancement Team:Threat Hunting:Investigations Security Solution Investigations Team backport:prev-minor Backport to (8.x) the previous minor version (i.e. one version back from main) labels Oct 4, 2024
@janmonschke janmonschke changed the title [IN PROGRESS][Security Solution] Make MAX_UNASSOCIATED_NOTES an advanced Kibana setting [Security Solution][Notes] Make MAX_UNASSOCIATED_NOTES an advanced Kibana setting Oct 9, 2024
@janmonschke janmonschke marked this pull request as ready for review October 9, 2024 13:38
@janmonschke janmonschke requested review from a team as code owners October 9, 2024 13:38
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

@elastic elastic deleted a comment from kibana-ci Oct 10, 2024
Copy link
Contributor

@PhilippeOberti PhilippeOberti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewing this PR made me realize that I hadn't really understood well why we're doing this MAX_UNASSOCIATED_NOTES thing...

Take this example:

  • I'm setting a limit to 1 in the Advanced Settings
  • I'm creating a note in the flyout for a document only => it works
  • I'm trying to create a second note => it fails
  • I create a timeline, save it, then try to create a second note for the same document => it works
Screen.Recording.2024-10-10.at.5.03.32.PM.mov

I had a long discussion with Kevin on Slack and I'm now really confused about what we're trying to achieve here 😆

@@ -101,14 +102,19 @@ export const AddNote = memo(
setEditorValue('');
}, [dispatch, editorValue, eventId, telemetry, timelineId, onNoteAdd]);

const resetError = useCallback(() => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

currently if the user tries to close the error toast using the cross icon in the top-right corner nothing happens. You're forced to click on the See the full error button that opens the modal then it clears

Screen.Recording.2024-10-10.at.4.35.21.PM.mov

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is now fixed, thanks!

Comment on lines +347 to +366
[MAX_UNASSOCIATED_NOTES]: {
name: i18n.translate('xpack.securitySolution.uiSettings.maxUnassociatedNotesLabel', {
defaultMessage: 'Maximum amount of unassociated notes',
}),
description: i18n.translate(
'xpack.securitySolution.uiSettings.maxUnassociatedNotesDescription',
{
defaultMessage:
'Defines the maximum amount of unassociated notes (notes that are not assigned to a timeline) that can be created.',
}
),
type: 'number',
value: DEFAULT_MAX_UNASSOCIATED_NOTES,
schema: schema.number({
min: 1,
max: 1000,
defaultValue: DEFAULT_MAX_UNASSOCIATED_NOTES,
}),
requiresPageReload: false,
},
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we need to rethink the term unassociated notes because it doesn't really mean anything. Seeing this in the Advanced Settings I was like what is an unassociated note? It's specified in parenthesis that these are notes not associated with a timeline, but users will wonder what's the difference and why we're doing this...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm happy to change the wording to something more suitable if you have ideas :)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will start a discussion with Nastasha about this, we don't have to wait to merge this PR!

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here.. I don't get the meaning of this setting. Does this mean that when notes are assigned to timeline then i can go above MAX_UNASSOCIATED_NOTES but if they are not then I have to stay within the limits?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, the maximum number of notes only applies to what we call unassociated notes (which is not a good name by the way, we should change that in the future), which are notes associated to only a document

@PhilippeOberti
Copy link
Contributor

Reviewing this PR made me realize that I hadn't really understood well why we're doing this MAX_UNASSOCIATED_NOTES thing...

Take this example:

  • I'm setting a limit to 1 in the Advanced Settings
  • I'm creating a note in the flyout for a document only => it works
  • I'm trying to create a second note => it fails
  • I create a timeline, save it, then try to create a second note for the same document => it works

I had a long discussion with Kevin on Slack and I'm now really confused about what we're trying to achieve here 😆

After more discussion I understand a bit more why we're doing this. We want to limit the number of notes that are only associated with a document because the notes associated with a timeline will be automatically deleted when the timeline is deleted.
I still feel something in the UI feels off, because we're basically telling the user: hey you have reached the quota and cannot create any new notes, unless you use this hack and associate the new notes with a timeline 😆

As a user, I would just create an empty timeline, save it, then continue create a bunch of new notes associating them with that dummy timeline...
Maybe the only change here is to NOT explicitly tell the user how to get around the limit?

I'll keep thinking about it!

Copy link
Contributor

@PhilippeOberti PhilippeOberti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While there are some texts that could be changed/improved, this PR does the expected functionality. Thanks for implementing this!

I will get with @nastasha-solomon for copy changes as we have to review all the notes stuff together.

Comment on lines +347 to +366
[MAX_UNASSOCIATED_NOTES]: {
name: i18n.translate('xpack.securitySolution.uiSettings.maxUnassociatedNotesLabel', {
defaultMessage: 'Maximum amount of unassociated notes',
}),
description: i18n.translate(
'xpack.securitySolution.uiSettings.maxUnassociatedNotesDescription',
{
defaultMessage:
'Defines the maximum amount of unassociated notes (notes that are not assigned to a timeline) that can be created.',
}
),
type: 'number',
value: DEFAULT_MAX_UNASSOCIATED_NOTES,
schema: schema.number({
min: 1,
max: 1000,
defaultValue: DEFAULT_MAX_UNASSOCIATED_NOTES,
}),
requiresPageReload: false,
},
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will start a discussion with Nastasha about this, we don't have to wait to merge this PR!

@@ -101,14 +102,19 @@ export const AddNote = memo(
setEditorValue('');
}, [dispatch, editorValue, eventId, telemetry, timelineId, onNoteAdd]);

const resetError = useCallback(() => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is now fixed, thanks!

Copy link
Contributor

@logeekal logeekal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did Desk testing and things seems to be working well. Before I approve I do have some questions.

  1. Is this limit only for the notes associated to the events and not timeline? If yes, Why? ( Answered in Philiipe's other comment )
  2. Is this a global limit. Does this mean, that if i have MAX notes associated to a single event, i cannot add any more notes to any other event ?
  3. Also, even though I cannot add any more notes to any other event, we can add more notes to the timeline?

Additionally, I have left some comments regarding the code review. They are not PR blockers, just minor comments.

@@ -199,6 +200,9 @@ export const ENABLE_ASSET_CRITICALITY_SETTING = 'securitySolution:enableAssetCri
export const EXCLUDED_DATA_TIERS_FOR_RULE_EXECUTION =
'securitySolution:excludedDataTiersForRuleExecution' as const;

/** This Kibana Advances setting allows users to define the maximum amount of unassociated notes (notes without a `timelineId`) */
export const MAX_UNASSOCIATED_NOTES = 'securitySolution:maxUnassociatedNotes' as const;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider renaming this to something as below because current name feels like it is the number of MAX_NOTES but not the setting name.

Suggested change
export const MAX_UNASSOCIATED_NOTES = 'securitySolution:maxUnassociatedNotes' as const;
export const MAX_UNASSOCIATED_NOTES_SETTING = 'securitySolution:maxUnassociatedNotes' as const;

@@ -48,7 +52,7 @@ export const getNotesRoute = (router: SecuritySolutionPluginRouter) => {
type: noteSavedObjectType,
search: docIdSearchString,
page: 1,
perPage: MAX_UNASSOCIATED_NOTES,
perPage: maxUnassociatedNotes,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know this was not the scope of this PR and should have been done when original code was added but i do not see any e2e or proper integration test for this API. I only see unit tests for this feature where almost everything seems to be mocked. Honestly, in my opinion that does not give too much confidence. Let me know what you think.

If possible, consider adding api integration tests in x-pack/test/security_solution_api_integration/

if (noteResponse.code !== 200) {
throw new Error(noteResponse.message);
}
return noteResponse.note;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider adding unit tests for this case.

return response;
};

/**
* Deletes multiple notes
*/
export const deleteNotes = async (noteIds: string[]) => {
const response = await KibanaServices.get().http.delete<{ data: unknown }>(NOTE_URL, {
const response = await KibanaServices.get().http.delete<DeleteNoteResponse>(NOTE_URL, {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👌 on adding all the types.

Comment on lines +347 to +366
[MAX_UNASSOCIATED_NOTES]: {
name: i18n.translate('xpack.securitySolution.uiSettings.maxUnassociatedNotesLabel', {
defaultMessage: 'Maximum amount of unassociated notes',
}),
description: i18n.translate(
'xpack.securitySolution.uiSettings.maxUnassociatedNotesDescription',
{
defaultMessage:
'Defines the maximum amount of unassociated notes (notes that are not assigned to a timeline) that can be created.',
}
),
type: 'number',
value: DEFAULT_MAX_UNASSOCIATED_NOTES,
schema: schema.number({
min: 1,
max: 1000,
defaultValue: DEFAULT_MAX_UNASSOCIATED_NOTES,
}),
requiresPageReload: false,
},
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here.. I don't get the meaning of this setting. Does this mean that when notes are assigned to timeline then i can go above MAX_UNASSOCIATED_NOTES but if they are not then I have to stay within the limits?

@logeekal
Copy link
Contributor

After more discussion I understand a bit more why we're doing this. We want to limit the number of notes that are only associated with a document because the notes associated with a timeline will be automatically deleted when the timeline is deleted.

Thanks @PhilippeOberti , I had same confustion. This clears it up. Do you think we should give a Toast confirming that note is associated to the timeline. Also add a warning on the Timeline's Notes tab that Notes will be deleted when timeline is deleted?

Question

Additionally I have one more question. Why the note add from Notes tab is not visible in Flyout but note added from Flyout is, even though both are attached to the timeline

timeline_event_notes_limit_confusion.mp4

@janmonschke
Copy link
Contributor Author

Additionally I have one more question. Why the note add from Notes tab is not visible in Flyout but note added from Flyout is, even though both are attached to the timeline

This seems like an inconsistent behaviour to me but imo unrelated to the PR. Maybe we should have that discussion on an issue?

Copy link
Member

@afharo afharo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Telemetry changes LGTM

@PhilippeOberti
Copy link
Contributor

Additionally I have one more question. Why the note add from Notes tab is not visible in Flyout but note added from Flyout is, even though both are attached to the timeline

This seems like an inconsistent behaviour to me but imo unrelated to the PR. Maybe we should have that discussion on an issue?

This is the expected behavior: when you add a note through the flyout Notes tab, you're attaching the note to the document being visualized in that flyout. You can also if you want attach it to the saved actived timeline. When you add a note through the timeline Notes tab, you are only attaching that note to the timeline, NOT to any document. How could that note show up in a flyout?

@PhilippeOberti
Copy link
Contributor

After more discussion I understand a bit more why we're doing this. We want to limit the number of notes that are only associated with a document because the notes associated with a timeline will be automatically deleted when the timeline is deleted.

Thanks @PhilippeOberti , I had same confustion. This clears it up. Do you think we should give a Toast confirming that note is associated to the timeline. Also add a warning on the Timeline's Notes tab that Notes will be deleted when timeline is deleted?

I don't think it's a good idea to provide that much information to the users. For us developers we want to know these things, but for a normal end user, this is waaaay too much information. Plus the functionality of deleting notes attached to a timeline when deleting that timeline is not new, it has always been like that...

@logeekal
Copy link
Contributor

This seems like an inconsistent behaviour to me but imo unrelated to the PR. Maybe we should have that discussion on an issue?

I agree @janmonschke . Thanks.

@logeekal
Copy link
Contributor

This is the expected behavior: when you add a note through the flyout Notes tab, you're attaching the note to the document being visualized in that flyout. You can also if you want attach it to the saved actived timeline. When you add a note through the timeline Notes tab, you are only attaching that note to the timeline, NOT to any document. How could that note show up in a flyout?

@PhilippeOberti , okay i understand now then do you think we can update the working when note is being attached in the flyout from Attach to active timeline -> Attach also to active Timeline? May be it will clear things up. But if you think users already will understand this working, then feel free to ignore my comment.

@PhilippeOberti
Copy link
Contributor

This is the expected behavior: when you add a note through the flyout Notes tab, you're attaching the note to the document being visualized in that flyout. You can also if you want attach it to the saved actived timeline. When you add a note through the timeline Notes tab, you are only attaching that note to the timeline, NOT to any document. How could that note show up in a flyout?

@PhilippeOberti , okay i understand now then do you think we can update the working when note is being attached in the flyout from Attach to active timeline -> Attach also to active Timeline? May be it will clear things up. But if you think users already will understand this working, then feel free to ignore my comment.

I will discuss this with @nastasha-solomon when we review the final copy changes. I thought it was clear enough but I've been working closely to this for too long, and the fact that you and I Jan were a bit confused makes me thing users will be as well, so I need to revisit this (not in this PR though)

@elasticmachine
Copy link
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #103 / Serverless security API cloud_security_posture Intercept the usage API request sent by the metering background task manager Should intercept usage API request for KSPM

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 20.8MB 20.8MB +584.0B

History

@janmonschke janmonschke merged commit 925329e into elastic:main Oct 14, 2024
48 checks passed
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/11332124818

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Oct 14, 2024
…bana setting (elastic#194947)

## Summary

Fixes: elastic#193097

Adds a new Kibana advanced setting that allows users to limit the
maximum amount of unassociated notes. The max value for that used to be
hard coded before.

https://github.com/user-attachments/assets/34af7f67-9109-4251-a5a3-a1af68f123fe

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 925329e)
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Oct 14, 2024
…ced Kibana setting (#194947) (#196192)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution][Notes] Make MAX_UNASSOCIATED_NOTES an advanced
Kibana setting (#194947)](#194947)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Jan
Monschke","email":"jan.monschke@elastic.co"},"sourceCommit":{"committedDate":"2024-10-14T17:14:11Z","message":"[Security
Solution][Notes] Make MAX_UNASSOCIATED_NOTES an advanced Kibana setting
(#194947)\n\n## Summary\r\n\r\nFixes:
https://github.com/elastic/kibana/issues/193097\r\n\r\nAdds a new Kibana
advanced setting that allows users to limit the\r\nmaximum amount of
unassociated notes. The max value for that used to be\r\nhard coded
before.\r\n\r\n\r\nhttps://github.com/user-attachments/assets/34af7f67-9109-4251-a5a3-a1af68f123fe\r\n\r\n\r\n###
Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"925329ec8429741db1c403795c0c3598a29226bb","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","v9.0.0","Team:Threat
Hunting:Investigations","backport:prev-minor"],"title":"[Security
Solution][Notes] Make MAX_UNASSOCIATED_NOTES an advanced Kibana
setting","number":194947,"url":"https://github.com/elastic/kibana/pull/194947","mergeCommit":{"message":"[Security
Solution][Notes] Make MAX_UNASSOCIATED_NOTES an advanced Kibana setting
(#194947)\n\n## Summary\r\n\r\nFixes:
https://github.com/elastic/kibana/issues/193097\r\n\r\nAdds a new Kibana
advanced setting that allows users to limit the\r\nmaximum amount of
unassociated notes. The max value for that used to be\r\nhard coded
before.\r\n\r\n\r\nhttps://github.com/user-attachments/assets/34af7f67-9109-4251-a5a3-a1af68f123fe\r\n\r\n\r\n###
Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"925329ec8429741db1c403795c0c3598a29226bb"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/194947","number":194947,"mergeCommit":{"message":"[Security
Solution][Notes] Make MAX_UNASSOCIATED_NOTES an advanced Kibana setting
(#194947)\n\n## Summary\r\n\r\nFixes:
https://github.com/elastic/kibana/issues/193097\r\n\r\nAdds a new Kibana
advanced setting that allows users to limit the\r\nmaximum amount of
unassociated notes. The max value for that used to be\r\nhard coded
before.\r\n\r\n\r\nhttps://github.com/user-attachments/assets/34af7f67-9109-4251-a5a3-a1af68f123fe\r\n\r\n\r\n###
Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"925329ec8429741db1c403795c0c3598a29226bb"}}]}]
BACKPORT-->

Co-authored-by: Jan Monschke <jan.monschke@elastic.co>
PhilippeOberti added a commit that referenced this pull request Oct 22, 2024
…e the unassociated note advanced setting under the Security Solution section (#197312)

## Summary

This PR tackles 2 small tasks:
- move the unassociated advanced settings introduced in [this
PR](#194947) under the `Security
Solution` category instead of `General`
- make some copy changes on the notes functionality, mainly the
following ([copy changes
document](https://docs.google.com/document/d/10blyxRfkMIR8gk4cw6nFzajA-L63iUzQaxQXHauL8LM/edit#heading=h.mlyibn1i5q84))
  - make sure we don't use a capital `N` for the word `note`
  - make sure that we use a capital `T` for the word `timeline`
  - change some of the no message and callout texts
  - prioritize using `attach` instead of `associate`

All changes have been done with @nastasha-solomon.

#193495
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Oct 22, 2024
…e the unassociated note advanced setting under the Security Solution section (elastic#197312)

## Summary

This PR tackles 2 small tasks:
- move the unassociated advanced settings introduced in [this
PR](elastic#194947) under the `Security
Solution` category instead of `General`
- make some copy changes on the notes functionality, mainly the
following ([copy changes
document](https://docs.google.com/document/d/10blyxRfkMIR8gk4cw6nFzajA-L63iUzQaxQXHauL8LM/edit#heading=h.mlyibn1i5q84))
  - make sure we don't use a capital `N` for the word `note`
  - make sure that we use a capital `T` for the word `timeline`
  - change some of the no message and callout texts
  - prioritize using `attach` instead of `associate`

All changes have been done with @nastasha-solomon.

elastic#193495
(cherry picked from commit 800e392)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Oct 22, 2024
…e the unassociated note advanced setting under the Security Solution section (elastic#197312)

## Summary

This PR tackles 2 small tasks:
- move the unassociated advanced settings introduced in [this
PR](elastic#194947) under the `Security
Solution` category instead of `General`
- make some copy changes on the notes functionality, mainly the
following ([copy changes
document](https://docs.google.com/document/d/10blyxRfkMIR8gk4cw6nFzajA-L63iUzQaxQXHauL8LM/edit#heading=h.mlyibn1i5q84))
  - make sure we don't use a capital `N` for the word `note`
  - make sure that we use a capital `T` for the word `timeline`
  - change some of the no message and callout texts
  - prioritize using `attach` instead of `associate`

All changes have been done with @nastasha-solomon.

elastic#193495
(cherry picked from commit 800e392)
kibanamachine added a commit that referenced this pull request Oct 23, 2024
…e + move the unassociated note advanced setting under the Security Solution section (#197312) (#197350)

# Backport

This will backport the following commits from `main` to `8.16`:
- [[Security Solution][Notes] - copy changes for note and timeline +
move the unassociated note advanced setting under the Security Solution
section (#197312)](#197312)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Philippe
Oberti","email":"philippe.oberti@elastic.co"},"sourceCommit":{"committedDate":"2024-10-22T23:20:10Z","message":"[Security
Solution][Notes] - copy changes for note and timeline + move the
unassociated note advanced setting under the Security Solution section
(#197312)\n\n## Summary\r\n\r\nThis PR tackles 2 small tasks:\r\n- move
the unassociated advanced settings introduced in
[this\r\nPR](#194947) under the
`Security\r\nSolution` category instead of `General`\r\n- make some copy
changes on the notes functionality, mainly the\r\nfollowing ([copy
changes\r\ndocument](https://docs.google.com/document/d/10blyxRfkMIR8gk4cw6nFzajA-L63iUzQaxQXHauL8LM/edit#heading=h.mlyibn1i5q84))\r\n
- make sure we don't use a capital `N` for the word `note`\r\n - make
sure that we use a capital `T` for the word `timeline`\r\n - change some
of the no message and callout texts\r\n - prioritize using `attach`
instead of `associate`\r\n\r\nAll changes have been done with
@nastasha-solomon.\r\n\r\nhttps://github.com//issues/193495","sha":"800e39224eed1335519d00e62e423af241495be9","branchLabelMapping":{"^v9.0.0$":"main","^v8.17.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["backport","release_note:skip","v9.0.0","Team:Threat
Hunting:Investigations","v8.16.0"],"title":"[Security Solution][Notes] -
copy changes for note and timeline + move the unassociated note advanced
setting under the Security Solution
section","number":197312,"url":"https://github.com/elastic/kibana/pull/197312","mergeCommit":{"message":"[Security
Solution][Notes] - copy changes for note and timeline + move the
unassociated note advanced setting under the Security Solution section
(#197312)\n\n## Summary\r\n\r\nThis PR tackles 2 small tasks:\r\n- move
the unassociated advanced settings introduced in
[this\r\nPR](#194947) under the
`Security\r\nSolution` category instead of `General`\r\n- make some copy
changes on the notes functionality, mainly the\r\nfollowing ([copy
changes\r\ndocument](https://docs.google.com/document/d/10blyxRfkMIR8gk4cw6nFzajA-L63iUzQaxQXHauL8LM/edit#heading=h.mlyibn1i5q84))\r\n
- make sure we don't use a capital `N` for the word `note`\r\n - make
sure that we use a capital `T` for the word `timeline`\r\n - change some
of the no message and callout texts\r\n - prioritize using `attach`
instead of `associate`\r\n\r\nAll changes have been done with
@nastasha-solomon.\r\n\r\nhttps://github.com//issues/193495","sha":"800e39224eed1335519d00e62e423af241495be9"}},"sourceBranch":"main","suggestedTargetBranches":["8.16"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/197312","number":197312,"mergeCommit":{"message":"[Security
Solution][Notes] - copy changes for note and timeline + move the
unassociated note advanced setting under the Security Solution section
(#197312)\n\n## Summary\r\n\r\nThis PR tackles 2 small tasks:\r\n- move
the unassociated advanced settings introduced in
[this\r\nPR](#194947) under the
`Security\r\nSolution` category instead of `General`\r\n- make some copy
changes on the notes functionality, mainly the\r\nfollowing ([copy
changes\r\ndocument](https://docs.google.com/document/d/10blyxRfkMIR8gk4cw6nFzajA-L63iUzQaxQXHauL8LM/edit#heading=h.mlyibn1i5q84))\r\n
- make sure we don't use a capital `N` for the word `note`\r\n - make
sure that we use a capital `T` for the word `timeline`\r\n - change some
of the no message and callout texts\r\n - prioritize using `attach`
instead of `associate`\r\n\r\nAll changes have been done with
@nastasha-solomon.\r\n\r\nhttps://github.com//issues/193495","sha":"800e39224eed1335519d00e62e423af241495be9"}},{"branch":"8.16","label":"v8.16.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Philippe Oberti <philippe.oberti@elastic.co>
kibanamachine added a commit that referenced this pull request Oct 23, 2024
… + move the unassociated note advanced setting under the Security Solution section (#197312) (#197351)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution][Notes] - copy changes for note and timeline +
move the unassociated note advanced setting under the Security Solution
section (#197312)](#197312)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Philippe
Oberti","email":"philippe.oberti@elastic.co"},"sourceCommit":{"committedDate":"2024-10-22T23:20:10Z","message":"[Security
Solution][Notes] - copy changes for note and timeline + move the
unassociated note advanced setting under the Security Solution section
(#197312)\n\n## Summary\r\n\r\nThis PR tackles 2 small tasks:\r\n- move
the unassociated advanced settings introduced in
[this\r\nPR](#194947) under the
`Security\r\nSolution` category instead of `General`\r\n- make some copy
changes on the notes functionality, mainly the\r\nfollowing ([copy
changes\r\ndocument](https://docs.google.com/document/d/10blyxRfkMIR8gk4cw6nFzajA-L63iUzQaxQXHauL8LM/edit#heading=h.mlyibn1i5q84))\r\n
- make sure we don't use a capital `N` for the word `note`\r\n - make
sure that we use a capital `T` for the word `timeline`\r\n - change some
of the no message and callout texts\r\n - prioritize using `attach`
instead of `associate`\r\n\r\nAll changes have been done with
@nastasha-solomon.\r\n\r\nhttps://github.com//issues/193495","sha":"800e39224eed1335519d00e62e423af241495be9","branchLabelMapping":{"^v9.0.0$":"main","^v8.17.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["backport","release_note:skip","v9.0.0","Team:Threat
Hunting:Investigations","v8.16.0"],"title":"[Security Solution][Notes] -
copy changes for note and timeline + move the unassociated note advanced
setting under the Security Solution
section","number":197312,"url":"https://github.com/elastic/kibana/pull/197312","mergeCommit":{"message":"[Security
Solution][Notes] - copy changes for note and timeline + move the
unassociated note advanced setting under the Security Solution section
(#197312)\n\n## Summary\r\n\r\nThis PR tackles 2 small tasks:\r\n- move
the unassociated advanced settings introduced in
[this\r\nPR](#194947) under the
`Security\r\nSolution` category instead of `General`\r\n- make some copy
changes on the notes functionality, mainly the\r\nfollowing ([copy
changes\r\ndocument](https://docs.google.com/document/d/10blyxRfkMIR8gk4cw6nFzajA-L63iUzQaxQXHauL8LM/edit#heading=h.mlyibn1i5q84))\r\n
- make sure we don't use a capital `N` for the word `note`\r\n - make
sure that we use a capital `T` for the word `timeline`\r\n - change some
of the no message and callout texts\r\n - prioritize using `attach`
instead of `associate`\r\n\r\nAll changes have been done with
@nastasha-solomon.\r\n\r\nhttps://github.com//issues/193495","sha":"800e39224eed1335519d00e62e423af241495be9"}},"sourceBranch":"main","suggestedTargetBranches":["8.16"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/197312","number":197312,"mergeCommit":{"message":"[Security
Solution][Notes] - copy changes for note and timeline + move the
unassociated note advanced setting under the Security Solution section
(#197312)\n\n## Summary\r\n\r\nThis PR tackles 2 small tasks:\r\n- move
the unassociated advanced settings introduced in
[this\r\nPR](#194947) under the
`Security\r\nSolution` category instead of `General`\r\n- make some copy
changes on the notes functionality, mainly the\r\nfollowing ([copy
changes\r\ndocument](https://docs.google.com/document/d/10blyxRfkMIR8gk4cw6nFzajA-L63iUzQaxQXHauL8LM/edit#heading=h.mlyibn1i5q84))\r\n
- make sure we don't use a capital `N` for the word `note`\r\n - make
sure that we use a capital `T` for the word `timeline`\r\n - change some
of the no message and callout texts\r\n - prioritize using `attach`
instead of `associate`\r\n\r\nAll changes have been done with
@nastasha-solomon.\r\n\r\nhttps://github.com//issues/193495","sha":"800e39224eed1335519d00e62e423af241495be9"}},{"branch":"8.16","label":"v8.16.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Philippe Oberti <philippe.oberti@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport:prev-minor Backport to (8.x) the previous minor version (i.e. one version back from main) release_note:enhancement Team:Threat Hunting:Investigations Security Solution Investigations Team v8.16.0 v9.0.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Security Solution][Notes] - make the number of note limit customizable in an advanced settings
6 participants