Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[SIEM] Phase I - Add saved query in SIEM solution #47306

Merged
merged 10 commits into from
Oct 15, 2019
Merged

[SIEM] Phase I - Add saved query in SIEM solution #47306

merged 10 commits into from
Oct 15, 2019

Conversation

XavierM
Copy link
Contributor

@XavierM XavierM commented Oct 4, 2019 •
edited
Loading

Summary

Add the Kibana SearchBar component in SIEM with saved query functionality.
Include:

  • Add SearchBar from data pluggins
  • Update URL state
  • Update ML link, we need to talk to the ML team to follow our new URL standard who match discover
  • Update all unit testing
  • Update cypress tests
  • Remove dead code

image

Thanks @lizozom, @Bargs and @TinaHeiligers for your help on this PR, it was really appreciated.

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

For maintainers

@XavierM XavierM self-assigned this Oct 4, 2019
@elasticmachine
Copy link
Contributor

Pinging @elastic/siem (Team:SIEM)

@XavierM XavierM force-pushed the siem-saved-query branch 2 times, most recently from 6f6c9f4 to 890076c Compare October 11, 2019 15:58
@XavierM XavierM changed the title [SIEM] [skip-ci] Add saved query in SIEM solution [SIEM] Add saved query in SIEM solution Oct 12, 2019
@XavierM XavierM removed the WIP Work in progress label Oct 12, 2019
@XavierM XavierM requested a review from lizozom October 13, 2019 02:22
@XavierM XavierM changed the title [SIEM] Add saved query in SIEM solution [SIEM] Phase I - Add saved query in SIEM solution Oct 13, 2019
@angorayc
Copy link
Contributor

Hey @XavierM ,
thanks for adding the functionality, this is really helpful! I played around with it and found a behaviour that are not exactly the same as discovery.

  1. Input some query in the box
  2. Save it
  3. Open the save query list and apply the new query
  4. Update the query and save it as new query
  5. Open the save query list - Discovery's behaviour is ticking on the new query, but we are ticking on the old one.

@XavierM
Copy link
Contributor Author

XavierM commented Oct 14, 2019

Hey @XavierM ,
thanks for adding the functionality, this is really helpful! I played around with it and found a behaviour that are not exactly the same as discovery.

  1. Input some query in the box
  2. Save it
  3. Open the save query list and apply the new query
  4. Update the query and save it as new query
  5. Open the save query list - Discovery's behaviour is ticking on the new query, but we are ticking on the old one.

@angorayc Thank you, just fixed it

@XavierM XavierM mentioned this pull request Oct 14, 2019
Merged
@spong
Copy link
Member

spong commented Oct 14, 2019

Looks like the z-index is off in the SIEM app as the Saved Queries popover shows above the full page frosting. To be honest, I feel like the Saved Queries popover should just dismiss automatically as that's what it does on initial click within the active popover anyway. May want to open a core bug instead of fixing here?

Discover:

SIEM

@XavierM XavierM mentioned this pull request Oct 14, 2019
Open
@elastic elastic deleted a comment from elasticmachine Oct 14, 2019
@elastic elastic deleted a comment from elasticmachine Oct 14, 2019
@elastic elastic deleted a comment from elasticmachine Oct 14, 2019
@elastic elastic deleted a comment from elasticmachine Oct 14, 2019
@XavierM XavierM force-pushed the siem-saved-query branch 2 times, most recently from c0a0608 to 69737c5 Compare October 15, 2019 15:00
@elasticmachine
Copy link
Contributor

💚 Build Succeeded

@XavierM XavierM force-pushed the siem-saved-query branch 2 times, most recently from 3d4298d to 45294bd Compare October 15, 2019 17:29
lizozom
lizozom approved these changes Oct 15, 2019
View reviewed changes
Copy link
Contributor

@lizozom lizozom left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Absoutely LGTM.
I'm going to build on these changes in 7.6.
Thank you for making them!

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

@XavierM XavierM merged commit a02af13 into elastic:master Oct 15, 2019
@elastic elastic deleted a comment from elasticmachine Oct 15, 2019
@elastic elastic deleted a comment from elasticmachine Oct 15, 2019
@elastic elastic deleted a comment from elasticmachine Oct 15, 2019
@elastic elastic deleted a comment from elasticmachine Oct 15, 2019
@elastic elastic deleted a comment from elasticmachine Oct 15, 2019
spong pushed a commit to spong/kibana that referenced this pull request Oct 16, 2019
@XavierM @spong
[SIEM] Phase I - Add saved query in SIEM solution (elastic#47306)
8f17165 
* Add Search Bar components
Integration of the Search Bar component in host and network page
Fix state URL with new Search Bar

* update unit test

* Fix URL state to match Discover + Fix ML to match with new url state + fix cypress test

* fix behavior when save as new query

* savedQuery - do not try to update date picker when there is no timefilter

* fix refresh

* some merge issue + fix back to active page to zero

* review I

* hack to remove lag

* fix type
@spong spong mentioned this pull request Oct 16, 2019
Merged
spong added a commit that referenced this pull request Oct 16, 2019
@spong
[SIEM] Phase I - Add saved query in SIEM solution (#47306) (#48366)
689a25b 
* Add Search Bar components
Integration of the Search Bar component in host and network page
Fix state URL with new Search Bar

* update unit test

* Fix URL state to match Discover + Fix ML to match with new url state + fix cypress test

* fix behavior when save as new query

* savedQuery - do not try to update date picker when there is no timefilter

* fix refresh

* some merge issue + fix back to active page to zero

* review I

* hack to remove lag

* fix type
@spong spong mentioned this pull request May 28, 2020
Closed
@XavierM XavierM deleted the siem-saved-query branch June 4, 2020 16:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@spong spong spong approved these changes

@lizozom lizozom lizozom approved these changes

Assignees

@XavierM XavierM

Labels
release_note:enhancement Team:SIEM v7.5.0 v8.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@XavierM @elasticmachine @angorayc @spong @lizozom