[Security Solution][Detections] Fixes Severity Override not matching for Elastic Endpoint Security rule #74317

spong · 2020-08-04T23:06:05Z

Summary

Fixes an issue where the Severity Override would not match for the Elastic Endpoint Security rule. This is a temporary fix until we can provide more robust comparisons between the user provided severityMapping.value (string) and the severityMapping.field's type.

Checklist

Unit or functional tests were updated or added to match the most common scenarios

elasticmachine · 2020-08-04T23:06:07Z

Pinging @elastic/siem (Team:SIEM)

FrankHassanabad · 2020-08-04T23:31:48Z

x-pack/plugins/security_solution/server/lib/detection_engine/signals/__mocks__/es_results.ts

+  _id: sampleIdGuid,
+  _source: {
+    someKey: 'someValue',
+    '@timestamp': '2020-04-20T21:27:45+0000',


That doesn't look like a Zulu? It's fine if you want to test other values, just mentioning

I had used a similar mock from above, that's all.

FrankHassanabad · 2020-08-04T23:32:24Z

x-pack/plugins/security_solution/server/lib/detection_engine/signals/__mocks__/es_results.ts

@@ -109,6 +109,24 @@ export const sampleDocNoSortId = (
  sort: [],
 });

+export const sampleDocSeverity = (
+  severity?: Array<string | number | null> | string | number | null


👍 looks like you covered your bases of odd ball types that can come up

...ty_solution/server/lib/detection_engine/signals/mappings/build_severity_from_mapping.test.ts

FrankHassanabad

LGTM, looks good, some good unit tests and simple enough to handle the majority of the use cases.

I approve this as UFDC approved, United Frank Department of Code approved.

peluja1012

Thanks for the fix!

kibanamachine · 2020-08-05T01:32:53Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: a46a61e

Build metrics

✅ unchanged

History

💔 Build #66516 failed 2ebfe60
💔 Build #66522 failed 73adc99

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

…for Elastic Endpoint Security rule (elastic#74317) ## Summary Fixes an issue where the `Severity Override` would not match for the `Elastic Endpoint Security` rule. This is a temporary fix until we can provide more robust comparisons between the user provided `severityMapping.value` (string) and the `severityMapping.field`'s type. ### Checklist - [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios

…for Elastic Endpoint Security rule (#74317) (#74325) ## Summary Fixes an issue where the `Severity Override` would not match for the `Elastic Endpoint Security` rule. This is a temporary fix until we can provide more robust comparisons between the user provided `severityMapping.value` (string) and the `severityMapping.field`'s type. ### Checklist - [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios

…for Elastic Endpoint Security rule (#74317) (#74324) ## Summary Fixes an issue where the `Severity Override` would not match for the `Elastic Endpoint Security` rule. This is a temporary fix until we can provide more robust comparisons between the user provided `severityMapping.value` (string) and the `severityMapping.field`'s type. ### Checklist - [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios

* master: (74 commits) [Discover] Inline noWhiteSpace function (elastic#74331) [DOCS] Add Observability topic (elastic#73041) skip flaky suite (elastic#74327) [Security Solution][Detections] Fixes Severity Override not matching for Elastic Endpoint Security rule (elastic#74317) [Security Solution][Exceptions] - Fixes exceptions builder nested deletion issue and adds unit tests (elastic#74250) Fixed Alert details does not update page title and breadcrumb (elastic#74214) [src/dev/build] build Kibana Platform bundles from source (elastic#73591) [Reporting] Shorten asset path to help CLI FS Watcher (elastic#74185) Fix TMS not loaded in legacy maps (elastic#73570) [Security Solution] styling for notes' panel (elastic#74274) [Security Solution][Tech Debt] cleans up ts-ignore issues and some smaller linter issues (elastic#74268) Make the actions plugin support generics (elastic#71439) [Security Solution] Keep original note creator (elastic#74203) [CI] Fix xpack kibana build dir in xpack visual regression script [CI] Fix baseline_capture job by adding parallel process number back [Monitoring] Ensure setup mode works on cloud but only for alerts (elastic#73127) [Maps] Custom color ramps should show correctly on the map for mvt layers (elastic#74169) [kbn/optimizer] remove unused modules (elastic#74195) [CI] Add pipeline task queue framework and merge workers into one (elastic#71268) Using msearch for tree api endpoint (elastic#73813) ...

* master: (115 commits) [Logs UI] Correct trial period duration in anomaly splash screen (elastic#74249) [Discover] Inline noWhiteSpace function (elastic#74331) [DOCS] Add Observability topic (elastic#73041) skip flaky suite (elastic#74327) [Security Solution][Detections] Fixes Severity Override not matching for Elastic Endpoint Security rule (elastic#74317) [Security Solution][Exceptions] - Fixes exceptions builder nested deletion issue and adds unit tests (elastic#74250) Fixed Alert details does not update page title and breadcrumb (elastic#74214) [src/dev/build] build Kibana Platform bundles from source (elastic#73591) [Reporting] Shorten asset path to help CLI FS Watcher (elastic#74185) Fix TMS not loaded in legacy maps (elastic#73570) [Security Solution] styling for notes' panel (elastic#74274) [Security Solution][Tech Debt] cleans up ts-ignore issues and some smaller linter issues (elastic#74268) Make the actions plugin support generics (elastic#71439) [Security Solution] Keep original note creator (elastic#74203) [CI] Fix xpack kibana build dir in xpack visual regression script [CI] Fix baseline_capture job by adding parallel process number back [Monitoring] Ensure setup mode works on cloud but only for alerts (elastic#73127) [Maps] Custom color ramps should show correctly on the map for mvt layers (elastic#74169) [kbn/optimizer] remove unused modules (elastic#74195) [CI] Add pipeline task queue framework and merge workers into one (elastic#71268) ...

* master: (154 commits) [ML] Fix initial plugin's bundle size (elastic#74047) [Ingest Manager] prevent crash on unhandled rejection from setupIngestManager (elastic#74300) [Logs UI] Correct trial period duration in anomaly splash screen (elastic#74249) [Discover] Inline noWhiteSpace function (elastic#74331) [DOCS] Add Observability topic (elastic#73041) skip flaky suite (elastic#74327) [Security Solution][Detections] Fixes Severity Override not matching for Elastic Endpoint Security rule (elastic#74317) [Security Solution][Exceptions] - Fixes exceptions builder nested deletion issue and adds unit tests (elastic#74250) Fixed Alert details does not update page title and breadcrumb (elastic#74214) [src/dev/build] build Kibana Platform bundles from source (elastic#73591) [Reporting] Shorten asset path to help CLI FS Watcher (elastic#74185) Fix TMS not loaded in legacy maps (elastic#73570) [Security Solution] styling for notes' panel (elastic#74274) [Security Solution][Tech Debt] cleans up ts-ignore issues and some smaller linter issues (elastic#74268) Make the actions plugin support generics (elastic#71439) [Security Solution] Keep original note creator (elastic#74203) [CI] Fix xpack kibana build dir in xpack visual regression script [CI] Fix baseline_capture job by adding parallel process number back [Monitoring] Ensure setup mode works on cloud but only for alerts (elastic#73127) [Maps] Custom color ramps should show correctly on the map for mvt layers (elastic#74169) ...

elasticmachine · 2021-09-23T14:27:37Z

Pinging @elastic/security-solution (Team: SecuritySolution)

Fixes severity mapping not matching for Elastic Endpoint Security rule

2ebfe60

spong added bug Fixes for quality problems that affect the customer experience Team:SIEM v8.0.0 release_note:skip Skip the PR/issue when compiling release notes v7.10.0 v7.9.0 labels Aug 4, 2020

spong requested review from peluja1012 and FrankHassanabad August 4, 2020 23:06

spong requested review from a team as code owners August 4, 2020 23:06

spong self-assigned this Aug 4, 2020

Removing unneccessary optional chaining

73adc99

FrankHassanabad reviewed Aug 4, 2020

View reviewed changes

...ty_solution/server/lib/detection_engine/signals/mappings/build_severity_from_mapping.test.ts Outdated Show resolved Hide resolved

Comments from review

6556b2f

FrankHassanabad approved these changes Aug 4, 2020

View reviewed changes

Fixing type issue

a46a61e

peluja1012 approved these changes Aug 5, 2020

View reviewed changes

spong merged commit 2280927 into elastic:master Aug 5, 2020

spong deleted the fix-severity-mapping-type-mismatch branch August 5, 2020 01:36

spong mentioned this pull request Aug 5, 2020

[7.x] [Security Solution][Detections] Fixes Severity Override not matching for Elastic Endpoint Security rule (#74317) #74324

Merged

spong mentioned this pull request Aug 5, 2020

[7.9] [Security Solution][Detections] Fixes Severity Override not matching for Elastic Endpoint Security rule (#74317) #74325

Merged

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Detections] Fixes Severity Override not matching for Elastic Endpoint Security rule #74317

[Security Solution][Detections] Fixes Severity Override not matching for Elastic Endpoint Security rule #74317

spong commented Aug 4, 2020

elasticmachine commented Aug 4, 2020

FrankHassanabad Aug 4, 2020

spong Aug 4, 2020

FrankHassanabad Aug 4, 2020

FrankHassanabad left a comment

peluja1012 left a comment

kibanamachine commented Aug 5, 2020

elasticmachine commented Sep 23, 2021

[Security Solution][Detections] Fixes Severity Override not matching for Elastic Endpoint Security rule #74317

[Security Solution][Detections] Fixes Severity Override not matching for Elastic Endpoint Security rule #74317

Conversation

spong commented Aug 4, 2020

Summary

Checklist

elasticmachine commented Aug 4, 2020

FrankHassanabad Aug 4, 2020

Choose a reason for hiding this comment

spong Aug 4, 2020

Choose a reason for hiding this comment

FrankHassanabad Aug 4, 2020

Choose a reason for hiding this comment

FrankHassanabad left a comment

Choose a reason for hiding this comment

peluja1012 left a comment

Choose a reason for hiding this comment

kibanamachine commented Aug 5, 2020

💚 Build Succeeded

Build metrics

History

elasticmachine commented Sep 23, 2021