[Security Solution] User can add new event filter from event filter list #98118

dasansol92 · 2021-04-23T11:04:56Z

Summary

This includes a new flyout displayed on administration/event_filters tab when trying to add/update an event filter item.
Once an entry is created, it is added to the entries list (redux store).
This flyout allow user edit the OS type on event filter form.
It also includes unit tests.

Needs eventFilteringEnabled feature flag enabled.

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
This was checked for cross-browser compatibility

For maintainers

This was checked for breaking API changes and was labeled appropriately

…state for OS. Add created entry to the entries list

…e and path management

…llback deps

dasansol92 · 2021-04-26T12:07:55Z

@elasticmachine merge upstream

elasticmachine · 2021-04-26T12:08:28Z

Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt)

… value

dasansol92 · 2021-04-26T17:11:05Z

@elasticmachine merge upstream

dasansol92 · 2021-04-27T08:07:12Z

@elasticmachine merge upstream

kevinlog · 2021-04-27T11:55:33Z

x-pack/plugins/security_solution/public/common/lib/kibana/hooks.ts

@@ -51,57 +51,66 @@ export interface AuthenticatedElasticUser {
 }

 export const useCurrentUser = (): AuthenticatedElasticUser | null => {
+  const isMounted = useRef(false);


thanks for fixing this!

kevinlog · 2021-04-27T12:54:24Z

Flyout and functionality looks good!

Without Endpoint added, we still have a working form which mirrors Exceptions

After index creation, we get the fields

successful creation:

kevinlog

🔥 🚢

…n builder

dasansol92 · 2021-04-27T16:27:25Z

@elasticmachine merge upstream

…from_event_filter_list-955

kibanamachine · 2021-04-27T16:27:37Z

expected head sha didn’t match current head ref.

…from_event_filter_list-955

paul-tavares

Looks good. Left some comments, but they are not critical enought to hold merging this in.

x-pack/plugins/security_solution/public/common/lib/kibana/hooks.ts

x-pack/plugins/security_solution/public/management/pages/event_filters/state/index.ts

...gins/security_solution/public/management/pages/event_filters/view/components/empty/index.tsx

paul-tavares · 2021-04-27T18:17:53Z

...gins/security_solution/public/management/pages/event_filters/view/components/empty/index.tsx

+import { EuiButton, EuiEmptyPrompt } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+const EmptyPrompt = styled(EuiEmptyPrompt)`


What was this needed?

Because the default max-width is too short for the text inside

Yeah, I would not set the max-width but rather let the text wrap instead. Attempting to make the element wide enough to accommodate the english version of the text show is not a good approach because the text can be localized and thus the length of the message might change.

Totally right!

...ecurity_solution/public/management/pages/event_filters/view/components/flyout/index.test.tsx

...ins/security_solution/public/management/pages/event_filters/view/event_filters_list_page.tsx

x-pack/plugins/security_solution/public/management/pages/event_filters/view/hooks.ts

…custom callback

…lter_list-955' of github.com:dasansol92/kibana into feature/olm-user_can_add_new_event_filter_from_event_filter_list-955

kibanamachine · 2021-04-28T11:11:37Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	2172	2174	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	7.0MB	7.0MB	+11.7KB

History

💚 Build #122741 succeeded 686f61c
💛 Build #122592 was flaky 85b78d8
💔 Build #122445 failed f90beee
💛 Build #122439 was flaky 3836333
💚 Build #122370 succeeded 74f9c91

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

paul-tavares

🚢 🚢 🚢

Thanks for the changes. Looks good to merge in my opinion. I need this PR in order to make some progress with mine, since this one already puts in place some of the pieces I need

paul-tavares · 2021-04-28T12:37:58Z

x-pack/plugins/security_solution/public/management/common/routing.ts

@@ -118,6 +119,26 @@ const normalizeTrustedAppsPageLocation = (
  }
 };

+const normalizeEventFiltersPageLocation = (


💡 I wonder if we can create a generic utility that could work for any use case in parsing/normalizing url params, so that we did not have to keep cloning this code. maybe a utility that takes in the defaults ++ the actual (aka: location) value and returns back the location type of information. Likely would be a TS generic function so that it can work across use cases.

…ist (elastic#98118) * New flyout with event filters form * Changes on event filters form to allow OS selector. Add new error on state for OS. Add created entry to the entries list * Fixes typo * Adds empty page with an add button that opens flyout. Alos added route and path management * Fixes type and adds a TODO comment. Also removes ESlit rule for useCallback deps * Fixes unit test. Adds consts for default page size and page index * Fixes warning state update on an unmounted component * Fixes infinite useEffect loop useFetchIndex hook because non memoized value * Adds policy:all to eventFilter.tag and disables or button on exception builder * Changes component name and simplify hook using useCallback without a custom callback Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

…ist (#98118) (#98604) * New flyout with event filters form * Changes on event filters form to allow OS selector. Add new error on state for OS. Add created entry to the entries list * Fixes typo * Adds empty page with an add button that opens flyout. Alos added route and path management * Fixes type and adds a TODO comment. Also removes ESlit rule for useCallback deps * Fixes unit test. Adds consts for default page size and page index * Fixes warning state update on an unmounted component * Fixes infinite useEffect loop useFetchIndex hook because non memoized value * Adds policy:all to eventFilter.tag and disables or button on exception builder * Changes component name and simplify hook using useCallback without a custom callback Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

…ist (elastic#98118) * New flyout with event filters form * Changes on event filters form to allow OS selector. Add new error on state for OS. Add created entry to the entries list * Fixes typo * Adds empty page with an add button that opens flyout. Alos added route and path management * Fixes type and adds a TODO comment. Also removes ESlit rule for useCallback deps * Fixes unit test. Adds consts for default page size and page index * Fixes warning state update on an unmounted component * Fixes infinite useEffect loop useFetchIndex hook because non memoized value * Adds policy:all to eventFilter.tag and disables or button on exception builder * Changes component name and simplify hook using useCallback without a custom callback Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

dasansol92 added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v7.14.0 labels Apr 23, 2021

dasansol92 added 4 commits April 23, 2021 18:07

New flyout with event filters form

a48ec3b

Changes on event filters form to allow OS selector. Add new error on …

2fe9ee3

…state for OS. Add created entry to the entries list

Fixes typo

7aef7c9

Adds empty page with an add button that opens flyout. Alos added rout…

dd7e246

…e and path management

dasansol92 force-pushed the feature/olm-user_can_add_new_event_filter_from_event_filter_list-955 branch from 70a7c3d to dd7e246 Compare April 26, 2021 09:33

dasansol92 added 2 commits April 26, 2021 11:51

Fixes type and adds a TODO comment. Also removes ESlit rule for useCa…

b757731

…llback deps

Fixes unit test. Adds consts for default page size and page index

95d0031

dasansol92 marked this pull request as ready for review April 26, 2021 12:08

dasansol92 requested a review from a team as a code owner April 26, 2021 12:08

Fixes warning state update on an unmounted component

74f9c91

dasansol92 force-pushed the feature/olm-user_can_add_new_event_filter_from_event_filter_list-955 branch from 6571bee to 74f9c91 Compare April 26, 2021 15:09

Fixes infinite useEffect loop useFetchIndex hook because non memoized…

3836333

… value

kevinlog reviewed Apr 27, 2021

View reviewed changes

kevinlog approved these changes Apr 27, 2021

View reviewed changes

Adds policy:all to eventFilter.tag and disables or button on exceptio…

5b3e7e5

…n builder

dasansol92 force-pushed the feature/olm-user_can_add_new_event_filter_from_event_filter_list-955 branch from 85b78d8 to 5b3e7e5 Compare April 27, 2021 16:26

Merge branch 'master' into feature/olm-user_can_add_new_event_filter_…

686f61c

…from_event_filter_list-955

Merge branch 'master' into feature/olm-user_can_add_new_event_filter_…

46dcdcb

…from_event_filter_list-955

paul-tavares approved these changes Apr 27, 2021

View reviewed changes

dasansol92 added 2 commits April 28, 2021 11:08

Changes component name and simplify hook using useCallback without a …

9eec29c

…custom callback

Merge branch 'feature/olm-user_can_add_new_event_filter_from_event_fi…

4606ad7

…lter_list-955' of github.com:dasansol92/kibana into feature/olm-user_can_add_new_event_filter_from_event_filter_list-955

paul-tavares approved these changes Apr 28, 2021

View reviewed changes

dasansol92 merged commit 1ac3c57 into elastic:master Apr 28, 2021

dasansol92 mentioned this pull request Apr 28, 2021

[7.x] [Security Solution] User can add new event filter from event filter list (#98118) #98604

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] User can add new event filter from event filter list #98118

[Security Solution] User can add new event filter from event filter list #98118

dasansol92 commented Apr 23, 2021 •

edited

Loading

dasansol92 commented Apr 26, 2021

elasticmachine commented Apr 26, 2021

dasansol92 commented Apr 26, 2021

dasansol92 commented Apr 27, 2021

kevinlog Apr 27, 2021

kevinlog commented Apr 27, 2021

kevinlog left a comment

dasansol92 commented Apr 27, 2021

kibanamachine commented Apr 27, 2021

paul-tavares left a comment

paul-tavares Apr 27, 2021

dasansol92 Apr 28, 2021

paul-tavares Apr 28, 2021

dasansol92 Apr 28, 2021

kibanamachine commented Apr 28, 2021

paul-tavares left a comment

paul-tavares Apr 28, 2021

[Security Solution] User can add new event filter from event filter list #98118

[Security Solution] User can add new event filter from event filter list #98118

Conversation

dasansol92 commented Apr 23, 2021 • edited Loading

Summary

Checklist

For maintainers

dasansol92 commented Apr 26, 2021

elasticmachine commented Apr 26, 2021

dasansol92 commented Apr 26, 2021

dasansol92 commented Apr 27, 2021

kevinlog Apr 27, 2021

Choose a reason for hiding this comment

kevinlog commented Apr 27, 2021

kevinlog left a comment

Choose a reason for hiding this comment

dasansol92 commented Apr 27, 2021

kibanamachine commented Apr 27, 2021

paul-tavares left a comment

Choose a reason for hiding this comment

paul-tavares Apr 27, 2021

Choose a reason for hiding this comment

dasansol92 Apr 28, 2021

Choose a reason for hiding this comment

paul-tavares Apr 28, 2021

Choose a reason for hiding this comment

dasansol92 Apr 28, 2021

Choose a reason for hiding this comment

kibanamachine commented Apr 28, 2021

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

History

paul-tavares left a comment

Choose a reason for hiding this comment

paul-tavares Apr 28, 2021

Choose a reason for hiding this comment

dasansol92 commented Apr 23, 2021 •

edited

Loading