[Security Solution][Exceptions] Exception modal bulk close alerts that match exception attributes #71321

peluja1012 · 2020-07-09T21:03:23Z

Summary

Adds the bulk close feature to the Exception modal. A couple of items of note:

Bulk closing will not be supported exceptions that use Value Lists or for exceptions that contain non-ECS fields
Bulk closing will close alerts in the .signals index that match the exception's fields and values included in the Exception Modal

Bulk close disabled when "is in list" operator is selected

Bulk closing 4,100 alerts from Edit Modal

Testing

Navigate to the Alerts page, click on the overflow menu and select Add exception. After selecting the exception attributes, click the checkbox with text Close all alerts that match attributes in this exception.

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
This was checked for keyboard-only and screenreader accessibility
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser
This was checked for cross-browser compatibility

For maintainers

This was checked for breaking API changes and was labeled appropriately

peluja1012 · 2020-07-09T21:06:49Z

x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx

+            '',
+            'kuery',
+            [],
+            ['.siem-signals'],


I'll need to use the siemSignalsIndex hook here to get the right indexPattern

peluja1012 · 2020-07-09T21:08:12Z

x-pack/plugins/security_solution/common/detection_engine/build_exceptions_query.ts

 }: {
  query: Query;
  language: Language;
-  lists: ExceptionListItemSchema[] | undefined;
+  lists: Array<ExceptionListItemSchema | CreateExceptionListItemSchema> | undefined;
+  exclude?: boolean;


This is needed because the logic is negated when adding an exception (we want to exclude), but when closing alerts we don't want to do that.

peluja1012 · 2020-07-09T21:16:38Z

x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx

+            exceptionItemsToAddOrUpdate,
+            false
+          );
+          await updateAlertStatus({


@FrankHassanabad I think we may need to use wait_for_completion=false on the updateByQuery here. Otherwise the request could take a while.

FrankHassanabad · 2020-07-09T23:05:47Z

x-pack/plugins/security_solution/common/detection_engine/build_exceptions_query.ts

+          ? [buildExceptionItemEntries({ lists: exceptionItem.entries, language, exclude })]
+          : []),
+      ];
+    }, [] as string[]);


You should be able to do, lists.reduce<string>( and avoid the as string cast fwiw.

marshallmain · 2020-07-11T18:04:08Z

x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx

+            'kuery',
+            [],
+            ['.siem-signals'],
+            exceptionItemsToAddOrUpdate,


The query for bulk closing has to account for the event fields in the original event being moved to original_event in the signal - https://github.com/elastic/kibana/blob/master/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_signal.ts#L57

Does this mean that i'll have to replace any exception item fields that start with event. with signal.original_event. before creating the ES Filter?

Yeah in general signal.original_event holds the original event's event fieldset and event. in the signal refers to the "signal creation" event rather than the original event - so replacing all event. uses with signal.original_event. would be safest in case we use more signal specific event fields later on. Right now the only difference between I know of between event and signal.original_event is that event.kind is hardcoded to signal.

elasticmachine · 2020-07-12T23:11:51Z

Pinging @elastic/siem (Team:SIEM)

peluja1012 · 2020-07-12T23:14:51Z

x-pack/plugins/security_solution/common/detection_engine/build_exceptions_query.test.ts

@@ -22,10 +22,82 @@ import {
  EntryMatch,
  EntryMatchAny,
  EntriesArray,


Lots of changes in this file because I refactored the code a bit to keep it more DRY, especially since I was going to use similar expected values for the tests I was adding. The end result looks like this:

marshallmain · 2020-07-14T01:10:34Z

x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx

+
+  return exceptionItems.map((item: ExceptionListItemSchema | CreateExceptionListItemSchema) => {
+    if (item.entries !== undefined) {
+      const newEntries = item.entries.map((itemEntry: EntriesArray[0]) => {


Suggested change

const newEntries = item.entries.map((itemEntry: EntriesArray[0]) => {

const newEntries = item.entries.map((itemEntry: Entry | EntryNested) => {

I'm adding this too

marshallmain · 2020-07-14T01:11:54Z

x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx

+    if (item.entries !== undefined) {
+      const newEntries = item.entries.map((itemEntry: EntriesArray[0]) => {
+        if (itemEntry.type === 'nested') {
+          const newNestedEntries = itemEntry.entries.map((nestedEntry: EntryMatch) => {


I think we only want to replace top level entries that start with event. so we can remove the whole if (itemEntry.type === 'nested') { block and always execute what is currently the else part.

marshallmain · 2020-07-14T01:18:05Z

x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx

+              entries: [
+                {
+                  ...getEntryMatchMock(),
+                  field: 'event.module',


the full path to this field would be host.name.event.module? In that case the field would stay the same, it wouldn't move to host.name.signal.original_event.module

kibanamachine · 2020-07-14T03:39:17Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 0aa27e1

Build metrics

@kbn/optimizer bundle module count

id	value	diff	baseline
securitySolution	755	+2	753

History

💚 Build #61212 succeeded 9820b97
💚 Build #60724 succeeded 6d4e4f1ed813ad3c9b230b05f7cec9887ad34359
💔 Build #60458 failed a9a3ea516b03c420d91ada0f22e0eb84047adafb

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* master: (314 commits) [APM] Use status_code field to calculate error rate (elastic#71109) [Observability] Change appLink passing the date range (elastic#71259) [Security] Add Timeline improvements (elastic#71506) adjust vislib bar opacity (elastic#71421) Fix ScopedHistory mock and adapt usages (elastic#71404) [Security Solution] Add hook for reading/writing resolver query params (elastic#70809) [APM] Bug fixes from ML integration testing (elastic#71564) [Discover] Add caused_by.type and caused_by.reason to error toast modal (elastic#70404) [Security Solution] Add 3rd level breadcrumb to admin page (elastic#71275) [Security Solution][Exceptions] Exception modal bulk close alerts that match exception attributes (elastic#71321) Change signal.rule.risk score mapping from keyword to float (elastic#71126) Added help text where needed on connectors and alert actions UI (elastic#69601) [SIEM][Detections] Value Lists Management Modal (elastic#67068) [test] Skips test preventing promotion of ES snapshot elastic#71582 [test] Skips test preventing promotion of ES snapshot elastic#71555 [ILM] Fix alignment of the timing field (elastic#71273) [SIEM][Detection Engine][Lists] Adds the ability for exception lists to be multi-list queried. (elastic#71540) initial telemetry setup (elastic#69330) [Reporting] Formatting fixes for CSV export in Discover, CSV download from Dashboard panel (elastic#67027) Search across spaces (elastic#67644) ...

…t-apps-page-titles * 'master' of github.com:elastic/kibana: (88 commits) [ML] Functional tests - disable DFA creation and cloning tests [APM] Use status_code field to calculate error rate (elastic#71109) [Observability] Change appLink passing the date range (elastic#71259) [Security] Add Timeline improvements (elastic#71506) adjust vislib bar opacity (elastic#71421) Fix ScopedHistory mock and adapt usages (elastic#71404) [Security Solution] Add hook for reading/writing resolver query params (elastic#70809) [APM] Bug fixes from ML integration testing (elastic#71564) [Discover] Add caused_by.type and caused_by.reason to error toast modal (elastic#70404) [Security Solution] Add 3rd level breadcrumb to admin page (elastic#71275) [Security Solution][Exceptions] Exception modal bulk close alerts that match exception attributes (elastic#71321) Change signal.rule.risk score mapping from keyword to float (elastic#71126) Added help text where needed on connectors and alert actions UI (elastic#69601) [SIEM][Detections] Value Lists Management Modal (elastic#67068) [test] Skips test preventing promotion of ES snapshot elastic#71582 [test] Skips test preventing promotion of ES snapshot elastic#71555 [ILM] Fix alignment of the timing field (elastic#71273) [SIEM][Detection Engine][Lists] Adds the ability for exception lists to be multi-list queried. (elastic#71540) initial telemetry setup (elastic#69330) [Reporting] Formatting fixes for CSV export in Discover, CSV download from Dashboard panel (elastic#67027) ... # Conflicts: # x-pack/plugins/index_management/public/application/index.tsx

* master: (72 commits) [test] Skips test preventing promotion of ES snapshot elastic#71612 [Logs UI] Remove UUID from Alert Instances (elastic#71340) [Metrics UI] Remove UUID from Alert Instance IDs (elastic#71335) [ML] Functional tests - disable DFA creation and cloning tests [APM] Use status_code field to calculate error rate (elastic#71109) [Observability] Change appLink passing the date range (elastic#71259) [Security] Add Timeline improvements (elastic#71506) adjust vislib bar opacity (elastic#71421) Fix ScopedHistory mock and adapt usages (elastic#71404) [Security Solution] Add hook for reading/writing resolver query params (elastic#70809) [APM] Bug fixes from ML integration testing (elastic#71564) [Discover] Add caused_by.type and caused_by.reason to error toast modal (elastic#70404) [Security Solution] Add 3rd level breadcrumb to admin page (elastic#71275) [Security Solution][Exceptions] Exception modal bulk close alerts that match exception attributes (elastic#71321) Change signal.rule.risk score mapping from keyword to float (elastic#71126) Added help text where needed on connectors and alert actions UI (elastic#69601) [SIEM][Detections] Value Lists Management Modal (elastic#67068) [test] Skips test preventing promotion of ES snapshot elastic#71582 [test] Skips test preventing promotion of ES snapshot elastic#71555 [ILM] Fix alignment of the timing field (elastic#71273) ...

…t match exception attributes (#71321) (#71590) * progress on bulk close * works but could be slow * clean up, add tests * fix reduce types * address 'event.' fields * remove duplicate import * don't replace nested fields * my best friend typescript

elasticmachine · 2021-09-23T14:31:14Z

Pinging @elastic/security-solution (Team: SecuritySolution)

peluja1012 commented Jul 9, 2020

View reviewed changes

FrankHassanabad reviewed Jul 9, 2020

View reviewed changes

marshallmain reviewed Jul 11, 2020

View reviewed changes

peluja1012 force-pushed the exception-modal-bulk-close branch from a9a3ea5 to 6d4e4f1 Compare July 12, 2020 22:05

peluja1012 added release_note:enhancement Team:SIEM v7.9.0 v8.0.0 labels Jul 12, 2020

peluja1012 marked this pull request as ready for review July 12, 2020 23:11

peluja1012 requested review from a team as code owners July 12, 2020 23:11

peluja1012 commented Jul 12, 2020

View reviewed changes

peluja1012 added 5 commits July 13, 2020 20:31

progress on bulk close

a066e2c

works but could be slow

29102b2

clean up, add tests

fbeaf02

fix reduce types

1a3ce47

address 'event.' fields

e7ecadc

peluja1012 force-pushed the exception-modal-bulk-close branch from 6d4e4f1 to e7ecadc Compare July 14, 2020 00:37

remove duplicate import

9820b97

marshallmain reviewed Jul 14, 2020

View reviewed changes

peluja1012 added 2 commits July 13, 2020 21:42

don't replace nested fields

54628e6

my best friend typescript

0aa27e1

marshallmain approved these changes Jul 14, 2020

View reviewed changes

peluja1012 merged commit f4091df into elastic:master Jul 14, 2020

peluja1012 mentioned this pull request Jul 14, 2020

[7.x] [Security Solution][Exceptions] Exception modal bulk close alerts that match exception attributes (#71321) #71590

Merged

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Exceptions] Exception modal bulk close alerts that match exception attributes #71321

[Security Solution][Exceptions] Exception modal bulk close alerts that match exception attributes #71321

peluja1012 commented Jul 9, 2020 •

edited

Loading

peluja1012 Jul 9, 2020

peluja1012 Jul 9, 2020 •

edited

Loading

peluja1012 Jul 9, 2020

FrankHassanabad Jul 9, 2020

marshallmain Jul 11, 2020

peluja1012 Jul 12, 2020

marshallmain Jul 13, 2020

elasticmachine commented Jul 12, 2020

peluja1012 Jul 12, 2020

marshallmain Jul 14, 2020

peluja1012 Jul 14, 2020

marshallmain Jul 14, 2020

marshallmain Jul 14, 2020

kibanamachine commented Jul 14, 2020

elasticmachine commented Sep 23, 2021

	const newEntries = item.entries.map((itemEntry: EntriesArray[0]) => {
	const newEntries = item.entries.map((itemEntry: Entry \| EntryNested) => {

[Security Solution][Exceptions] Exception modal bulk close alerts that match exception attributes #71321

[Security Solution][Exceptions] Exception modal bulk close alerts that match exception attributes #71321

Conversation

peluja1012 commented Jul 9, 2020 • edited Loading

Summary

Bulk close disabled when "is in list" operator is selected

Bulk closing 4,100 alerts from Edit Modal

Testing

Checklist

For maintainers

Choose a reason for hiding this comment

peluja1012 Jul 9, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Jul 12, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kibanamachine commented Jul 14, 2020

💚 Build Succeeded

Build metrics

@kbn/optimizer bundle module count

History

elasticmachine commented Sep 23, 2021

peluja1012 commented Jul 9, 2020 •

edited

Loading

peluja1012 Jul 9, 2020 •

edited

Loading