-
Notifications
You must be signed in to change notification settings - Fork 188
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Docs]Timeline and Template UI updates #84
Conversation
|
||
. Go to *Security* -> *Timelines*. | ||
. Click the *Templates* tab. | ||
. Click the More actions icon in the relevant row, and then select the action: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
could we briefly mention about what the More actions
icon looks like and its position as well, many users couldn't find for the first time
TIP: To perform the same action on multiple templates, select templates and | ||
then the required action from the _Bulk actions_ menu. | ||
|
||
NOTE: You cannot delete prebuilt templates. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
users cannot favourite it, or edit it either.
I think it would be nice to let them know that if they want to update the elastic prebuilt templates, they can duplicate them first and then they becomes custom templates, and they can do all the changes.
*Bulk actions* -> _Export selected_. | ||
|
||
. To import templates, click *Import Timeline* and then select or drap-and-drop | ||
the template `ndjson` file. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
could we put a note here to let them know the content of the ndjson has to be in minimised format to import it properly.
e.g.
This is ok
{"savedObjectId":"67664480-d191-11ea-ae67-4f4be8c1847b","version":"WzU1NSwxXQ==","columns":[{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"@timestamp","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"message","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"event.category","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"event.action","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"host.name","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"source.ip","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"destination.ip","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"user.name","searchable":null}],"dataProviders":[],"description":"","eventType":"all","filters":[],"kqlMode":"filter","timelineType":"default","kqlQuery":{"filterQuery":{"serializedQuery":"{\"bool\":{\"should\":[{\"exists\":{\"field\":\"@timestamp\"}}],\"minimum_should_match\":1}}","kuery":{"expression":"@timestamp : * ","kind":"kuery"}}},"title":"x2","sort":{"columnId":"@timestamp","sortDirection":"desc"},"created":1596036895488,"createdBy":"angela","updated":1596491470411,"updatedBy":"angelachuang","templateTimelineId":null,"templateTimelineVersion":null,"dateRange":{"start":"2020-04-10T14:10:58.373Z","end":"2020-05-30T14:16:58.373Z"},"savedQueryId":null,"eventNotes":[{"noteId":"7d875ba0-d5d3-11ea-9899-ebec3d084fe0","version":"WzU1NiwxXQ==","eventId":"8KtMKnIBOS_moQ_K9fAe","note":"hi Xavier","timelineId":"67664480-d191-11ea-ae67-4f4be8c1847b","created":1596491490806,"createdBy":"angelachuang","updated":1596491490806,"updatedBy":"angelachuang"}],"globalNotes":[],"pinnedEventIds":["K99zy3EBDTDlbwBfpf6x","GKpFKnIBOS_moQ_Ke5AO","8KtMKnIBOS_moQ_K9fAe"]}
This will fail
{
"savedObjectId": "67664480-d191-11ea-ae67-4f4be8c1847b",
"version": "WzU1NSwxXQ==",
"columns": [
{
"indexes": null,
"name": null,
"columnHeaderType": "not-filtered",
"id": "@timestamp",
"searchable": null
},
{
"indexes": null,
"name": null,
"columnHeaderType": "not-filtered",
"id": "message",
"searchable": null
},
{
"indexes": null,
"name": null,
"columnHeaderType": "not-filtered",
"id": "event.category",
"searchable": null
},
{
"indexes": null,
"name": null,
"columnHeaderType": "not-filtered",
"id": "event.action",
"searchable": null
},
{
"indexes": null,
"name": null,
"columnHeaderType": "not-filtered",
"id": "host.name",
"searchable": null
},
{
"indexes": null,
"name": null,
"columnHeaderType": "not-filtered",
"id": "source.ip",
"searchable": null
},
{
"indexes": null,
"name": null,
"columnHeaderType": "not-filtered",
"id": "destination.ip",
"searchable": null
},
{
"indexes": null,
"name": null,
"columnHeaderType": "not-filtered",
"id": "user.name",
"searchable": null
}
],
"dataProviders": [],
"description": "",
"eventType": "all",
"filters": [],
"kqlMode": "filter",
"timelineType": "default",
"kqlQuery": {
"filterQuery": {
"serializedQuery": "{\"bool\":{\"should\":[{\"exists\":{\"field\":\"@timestamp\"}}],\"minimum_should_match\":1}}",
"kuery": {
"expression": "@timestamp : * ",
"kind": "kuery"
}
}
},
"title": "x2",
"sort": {
"columnId": "@timestamp",
"sortDirection": "desc"
},
"created": 1596036895488,
"createdBy": "angela",
"updated": 1596491470411,
"updatedBy": "angelachuang",
"templateTimelineId": null,
"templateTimelineVersion": null,
"dateRange": {
"start": "2020-04-10T14:10:58.373Z",
"end": "2020-05-30T14:16:58.373Z"
},
"savedQueryId": null,
"eventNotes": [
{
"noteId": "7d875ba0-d5d3-11ea-9899-ebec3d084fe0",
"version": "WzU1NiwxXQ==",
"eventId": "8KtMKnIBOS_moQ_K9fAe",
"note": "hi Xavier",
"timelineId": "67664480-d191-11ea-ae67-4f4be8c1847b",
"created": 1596491490806,
"createdBy": "angelachuang",
"updated": 1596491490806,
"updatedBy": "angelachuang"
}
],
"globalNotes": [],
"pinnedEventIds": [
"K99zy3EBDTDlbwBfpf6x",
"GKpFKnIBOS_moQ_Ke5AO",
"8KtMKnIBOS_moQ_K9fAe"
]
}
* timeline and template updates * uncomments out original timeline section in SIEM UI * removes original timeline IDs to avoid build conflict * add all actions screenshot * add all actions screenshot * corrections * adds filter explanation and legend
* timeline and template updates * uncomments out original timeline section in SIEM UI * removes original timeline IDs to avoid build conflict * add all actions screenshot * add all actions screenshot * corrections * adds filter explanation and legend
* timeline and template updates * uncomments out original timeline section in SIEM UI * removes original timeline IDs to avoid build conflict * add all actions screenshot * add all actions screenshot * corrections * adds filter explanation and legend
* timeline and template updates * uncomments out original timeline section in SIEM UI * removes original timeline IDs to avoid build conflict * add all actions screenshot * add all actions screenshot * corrections * adds filter explanation and legend
Adds all the new 7.9 Timeline and Timeline template features.
Timeline preview
Template preview