Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[SIEM][Detections] Updates text for severity and risk_score overrides #72244

Merged
merged 4 commits into from
Jul 21, 2020
Merged

[SIEM][Detections] Updates text for severity and risk_score overrides #72244

merged 4 commits into from
Jul 21, 2020

Conversation

MadameSheema
Copy link
Member

@MadameSheema MadameSheema commented Jul 17, 2020 •
edited
Loading

Summary

In this PR we are updating the text for severity and risk score override.

image

@MadameSheema MadameSheema added Team:SIEM v8.0.0 release_note:skip Skip the PR/issue when compiling release notes v7.9.0 labels Jul 17, 2020
@MadameSheema MadameSheema requested review from a team as code owners July 17, 2020 09:23
@MadameSheema MadameSheema self-assigned this Jul 17, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/siem (Team:SIEM)

spong
spong reviewed Jul 17, 2020
View reviewed changes
...ugins/security_solution/public/detections/components/rules/severity_mapping/translations.tsx Outdated
@@ -51,7 +51,8 @@ export const SEVERITY_DESCRIPTION = i18n.translate(
export const SEVERITY_MAPPING_DESCRIPTION = i18n.translate(
'xpack.securitySolution.alerts.severityMapping.mappingDescriptionLabel',
{
defaultMessage: 'Map a value from the source event to a specific severity.',
defaultMessage:
'Override the default severity at left with a value derived from the source event.',
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure we need at left here since we say default severity and that's the label of the field to the left. @benskelker thoughts here?

Same for Risk Score above.

Copy link
Member

@spong spong Jul 17, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, the with a value derived from the source event isn't entirely accurate here, as we're not using a value from the source event for the severity, but rather checking the equality of that value with what the user provides and then use the corresponding severity level from that row (e.g. low/medium/high/critical )

So for the below, if event.severity == 21 in the source event, we'll override the severity with low, not 21:

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@spong - yep, no need for at left.

Suggested text:

Use source event values to override the Default severity:

Use a source event value to override the Default risk score:

@MadameSheema
Copy link
Member Author

@elasticmachine merge upstream

@qn895 qn895 mentioned this pull request Jul 20, 2020
Closed
25 tasks
dhurley14
dhurley14 approved these changes Jul 20, 2020
View reviewed changes
Copy link
Contributor

@dhurley14 dhurley14 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@spong
Copy link
Member

spong commented Jul 21, 2020

@elasticmachine merge upstream

@kibanamachine
Copy link
Contributor

💚 Build Succeeded

Build metrics

async chunks size

id value diff baseline
securitySolution 7.3MB -3.0B 7.3MB

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@MadameSheema MadameSheema merged commit 20c6d9f into elastic:master Jul 21, 2020
@MadameSheema MadameSheema deleted the about-step branch July 21, 2020 08:35
@MadameSheema MadameSheema mentioned this pull request Jul 21, 2020
Merged
MadameSheema added a commit to MadameSheema/kibana that referenced this pull request Jul 21, 2020
@MadameSheema @elasticmachine
[SIEM][Detections] Updates text for severity and risk_score overrides (…
8bb895c 
…elastic#72244)

* updates severity mapping description text

* updates risk score mapping description

* updates default messages with the given suggestions

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
MadameSheema added a commit to MadameSheema/kibana that referenced this pull request Jul 21, 2020
@MadameSheema @elasticmachine
[SIEM][Detections] Updates text for severity and risk_score overrides (…
f949719 
…elastic#72244)

* updates severity mapping description text

* updates risk score mapping description

* updates default messages with the given suggestions

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
@MadameSheema MadameSheema mentioned this pull request Jul 21, 2020
Merged
MadameSheema added a commit that referenced this pull request Jul 21, 2020
@MadameSheema @elasticmachine
[SIEM][Detections] Updates text for severity and risk_score overrides (…
1bec874 
…#72244) (#72588)

* updates severity mapping description text

* updates risk score mapping description

* updates default messages with the given suggestions

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
MadameSheema added a commit that referenced this pull request Jul 21, 2020
@MadameSheema @elasticmachine
[SIEM][Detections] Updates text for severity and risk_score overrides (…
b56d397 
…#72244) (#72587)

* updates severity mapping description text

* updates risk score mapping description

* updates default messages with the given suggestions

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
gmmorris added a commit to gmmorris/kibana that referenced this pull request Jul 21, 2020
@gmmorris
Merge branch 'master' into alerting/consumer-based-rbac
407b09a 
* master: (28 commits)
  allow some env settings for ingest manager (elastic#72544)
  Add inspector for VEGA (elastic#70941)
  chore(NA): fix grunt task for test:coverage (elastic#72539)
  Archive e2e test results in ES (elastic#72575)
  preserve 401 errors from new es client (elastic#71248)
  [SIEM][Detections] Updates text for severity and risk_score overrides  (elastic#72244)
  fixing error occurences tooltip (elastic#72425)
  use KibanaClient interface instead of Client for new client interface (elastic#72388)
  [APM] Handle ML errors (elastic#72316)
  [Discover] Improve histogram tests (elastic#72235)
  [ftr/webdriver] retry on all errors, use Rx so that timers are canceled (elastic#72540)
  [pre-req] Move .storybook to storybook; standardize files (elastic#72384)
  [Security_Solution][Resolver][Bug]: Restore breadcrumb background (elastic#72538)
  [ML] Fix annotation detector linking & delayed_data(0) (elastic#72468)
  [Security Solution][Exceptions] - Make esTypes and subType available to index patterns (elastic#72336)
  [SIEM] Uses faster wait from testing-library and removes duplicate older wait idiom (elastic#72509)
  Fix long combo box items breaking out of flex item width (elastic#72512)
  [pipeline/commitStatus] update commit status in baseline-capture job (elastic#72366)
  [Security Solution][Resolver] Update the resolver element ref on scroll events if the position of the element has changed within the page (elastic#72461)
  [Maps] auto-fit to data bounds (elastic#72129)
  ...
gmmorris added a commit to gmmorris/kibana that referenced this pull request Jul 21, 2020
@gmmorris
Merge branch 'alerting/consumer-based-rbac' into alerting/management-…
8545f64 
…feature-privileges

* alerting/consumer-based-rbac: (30 commits)
  removed uneeded tests
  expclude security wrapper in SO client passed to ActionsClient
  allow some env settings for ingest manager (elastic#72544)
  Add inspector for VEGA (elastic#70941)
  chore(NA): fix grunt task for test:coverage (elastic#72539)
  Archive e2e test results in ES (elastic#72575)
  preserve 401 errors from new es client (elastic#71248)
  [SIEM][Detections] Updates text for severity and risk_score overrides  (elastic#72244)
  fixing error occurences tooltip (elastic#72425)
  use KibanaClient interface instead of Client for new client interface (elastic#72388)
  [APM] Handle ML errors (elastic#72316)
  [Discover] Improve histogram tests (elastic#72235)
  [ftr/webdriver] retry on all errors, use Rx so that timers are canceled (elastic#72540)
  [pre-req] Move .storybook to storybook; standardize files (elastic#72384)
  [Security_Solution][Resolver][Bug]: Restore breadcrumb background (elastic#72538)
  [ML] Fix annotation detector linking & delayed_data(0) (elastic#72468)
  [Security Solution][Exceptions] - Make esTypes and subType available to index patterns (elastic#72336)
  [SIEM] Uses faster wait from testing-library and removes duplicate older wait idiom (elastic#72509)
  Fix long combo box items breaking out of flex item width (elastic#72512)
  [pipeline/commitStatus] update commit status in baseline-capture job (elastic#72366)
  ...
@MindyRS MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@benskelker benskelker benskelker left review comments

@spong spong spong left review comments

@dhurley14 dhurley14 dhurley14 approved these changes

@peluja1012 peluja1012 Awaiting requested review from peluja1012

@rylnd rylnd Awaiting requested review from rylnd

@FrankHassanabad FrankHassanabad Awaiting requested review from FrankHassanabad

@yctercero yctercero Awaiting requested review from yctercero

@dontcallmesherryli dontcallmesherryli Awaiting requested review from dontcallmesherryli

Assignees

@MadameSheema MadameSheema

Labels
release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM v7.9.0 v8.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@MadameSheema @elasticmachine @spong @kibanamachine @dhurley14 @benskelker @MindyRS