[SIEM][Exceptions] - ExceptionsViewer cleanup #68739

yctercero · 2020-06-10T04:58:49Z

Summary

Adds missing unit tests for relevant files missing them
Changes filter search to fire request on 'Enter'
Breaks out the main ExceptionViewer component into smaller components to make more readable and better tested
Updates utility bar to have the specific list description text next to it as proposed by @spong in [SIEM][Exceptions] - ExceptionsViewer UI component part 2 #68294 (comment)
Adds loading state any time async request occurs
Now fetches list on list type toggle (if user selects to view either only detections or endpoint items), before was simply filtering already fetched items

To do

integration tests
exceptions get a bit funky on small screen sizes
modify areas using moment to use the FormattedDate instead

Screenshots & Gifs

Empty state

Only one type of list allowed

List toggles hidden, no popover for add exception.

Exceptions search

Exceptions list toggle

Delete exception

Testing

To turn on lists plugin - in kibana.dev.yml

# Enable lists feature
xpack.lists.enabled: true
xpack.lists.listIndex: '.lists-yara'
xpack.lists.listItemIndex: '.items-yara'

Use the scripts in x-pack/plugins/lists/server/scripts to create some sample exception lists and items. You can use the following:

Create detection type list ./post_exception_list.sh ./exception_lists/new/exception_list_detection.json
Create detection type list items ./post_exception_list_item.sh ./exception_lists/new/exception_list_item_detection_auto_id.json - this script auto generates the item_id so you can run it as many times as you like to create multiple items associated with the list generated in step 1
Create endpoint list ./post_exception_list.sh
Create endpoint type list items ./post_exception_list_item.sh ./exception_lists/new/exception_list_item_auto_id.json - this script auto generates the item_id so you can run it as many times as you like to create multiple items associated with the list generated in step 3
Run ./find_exception_lists.sh to get the id of the two lists you created
Update the ExceptionsViewer component in x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.tsx to something like the following:

 <ExceptionsViewer
       commentsAccordionId={'someId'}
       exceptionLists={[
         {
            id: [DETECTION_LIST_ID],  // `id` not `list_id`
            type: 'detection',
            namespaceType: 'single',
         },
         {
            id: [ENDPOINT_LIST_ID],  // `id` not `list_id`
             type: 'endpoint',
             namespaceType: 'single',
           },
         ]}  />

Navigate to the rules details page and click on the 'Exceptions' tab. Voila!

To check storybook elements, run yarn storybook security_solution from ./kibana/.

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios
This was checked for keyboard-only and screenreader accessibility
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser
This was checked for cross-browser compatibility, including a check against IE11

…to exceptions-viewer-2

…ed tests

…viewer-2

… due to be refactored but dont want to make this PR bigger

…election bug

…iewer-ux

elasticmachine · 2020-06-10T17:50:09Z

Pinging @elastic/siem (Team:SIEM)

kibanamachine · 2020-06-10T19:35:58Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 5cde937

History

💔 Build #52944 failed b4b61a8

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

FrankHassanabad · 2020-06-10T20:31:54Z

...ins/security_solution/public/common/components/exceptions/viewer/exceptions_utility.test.tsx

+    expect(wrapper.find('[data-test-subj="exceptionsEndpointMessage"]').exists()).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="exceptionsDetectionsMessage"]').exists()).toBeFalsy();
+  });
+});


Lots of nice tests 👍

FrankHassanabad · 2020-06-10T20:36:14Z

x-pack/plugins/security_solution/public/common/components/exceptions/viewer/reducer.ts

@@ -78,26 +82,34 @@ export const allExceptionItemsReducer = () => (state: State, action: Action): St
      };

      if (action.filterOptions.showEndpointList) {
-        const exceptions = state.allExceptions.filter((t) => t._tags.includes('endpoint'));
+        const list = action.allLists.filter((t) => t.type === 'endpoint');


tip: People usually use destructoring when they don't care about a variable name like so:

.filter(({ type }) => type === 'endpoint');

No changes needed, just a tip.

Ah, nice. I have an upcoming PR, will link to it with changes for this. Thanks!

FrankHassanabad

Looked it over, looks really clean easy to read. So LGTM for ya!

@spong

### Summary - Adds missing unit tests for relevant files missing them - Changes filter search to fire request on 'Enter' - Breaks out the main ExceptionViewer component into smaller components to make more readable and better tested - Updates utility bar to have the specific list description text next to it as proposed by @spong in elastic#68294 (comment) - Adds loading state any time async request occurs - Now fetches list on list type toggle (if user selects to view either only detections or endpoint items), before was simply filtering already fetched items

@spong

### Summary - Adds missing unit tests for relevant files missing them - Changes filter search to fire request on 'Enter' - Breaks out the main ExceptionViewer component into smaller components to make more readable and better tested - Updates utility bar to have the specific list description text next to it as proposed by @spong in #68294 (comment) - Adds loading state any time async request occurs - Now fetches list on list type toggle (if user selects to view either only detections or endpoint items), before was simply filtering already fetched items

* master: (38 commits) Support migrating from reserved feature privileges (elastic#68504) add `preference` field to SavedObjectsFindOptions (elastic#68620) [ILM] Add "wait for snapshot" policy field to Delete phase (elastic#68505) Cleanup old license overwrites (elastic#68744) Bump TypeScript to v3.9 (elastic#67666) [APM] Service maps - adds new storybook stories to test out various data sets (elastic#68727) Fix vega specification parsing (elastic#67963) docs: add more api information (elastic#68717) [APM] Don't show annotations on charts with no data (elastic#68829) [Metrics UI] Fix Inventory View sorting by handling null values (elastic#67889) skip flaky suite (elastic#68836) [SIEM][Detections Engine] - Fix reference rule url overflow (elastic#68640) Index pattern public api => common (elastic#68289) [APM] Lazy-load alert triggers (elastic#68806) [DOCS] Fix table formatting in ingest manager settings (elastic#68824) [Endpoint] Functional Tests cleanup (elastic#68756) revert previous commit which was unintentional Use Github token instead for project assignments [SIEM][Exceptions] - ExceptionsViewer cleanup (elastic#68739) move @kbn/storybook to devDeps (elastic#68791) ...

elasticmachine · 2021-09-23T14:33:18Z

Pinging @elastic/security-solution (Team: SecuritySolution)

yctercero added 30 commits June 2, 2020 17:14

moved and_or_badge to common folder and added tests

24ed91f

updated references to new and_or_badge location

629b832

built out exception item component for viewer

335a720

added exception item component stories for easy testing

dd2b8c8

updated text to use i18n in spots missed

990d656

added tests for exception detail component and updated braking tests

bac11c9

finished adding tests and fixing lint issue

9496085

fixed test timestamps to be UTC

f3a1fba

fix failing test that was passing locally

a8a68fa

tests

f0aeda8

fix dates

b19237f

fixes per feedback

3a31452

Merge branch 'master' of github.com:yctercero/kibana into all-exc-view

7ad2a23

cleanup

053c5d7

updated tests

c24c1ff

Merge branch 'master' of github.com:yctercero/kibana into all-exc-view

8b91e10

updated translations to use securitySolution after rename

878547e

Merge branch 'all-exc-view' of https://github.com/yctercero/kibana in…

410ecb9

…to exceptions-viewer-2

updated useExceptionList hook to use different refresh pattern, updat…

bc7b81e

…ed tests

moved exception item component into its own folder

798b1dd

added search bar, toggle, and buttons

29810e7

added exceptions viewer component

da467bf

Merge branch 'master' of github.com:yctercero/kibana into exceptions-…

c953d0f

…viewer-2

fix merge issue

32f66d2

some cleanup

8de7469

modified list scripts for help with testing

c333567

added exceptions hook for general api usage, updated exception item

8a51155

updated per feedback to allow for different filtering

9196387

Merge branch 'master' of github.com:yctercero/kibana into exceptions-…

3117815

…viewer-2

temp disabled complexity linter for rules/details/index, this file is…

aea3b16

… due to be refactored but dont want to make this PR bigger

yctercero added 7 commits June 8, 2020 22:44

updated and added more tests, cleaned up linter issues and per page s…

6027cbb

…election bug

updating viewer ux per feedback

d25ccdf

added tests and cleaned up

700e6bf

Merge branch 'master' of github.com:yctercero/kibana into exception-v…

22d3e09

…iewer-ux

cleaned up viewer index component

b4b61a8

Merge branch 'master' of github.com:yctercero/kibana into exception-v…

ad1dbbb

…iewer-ux

updated stories and unit tests

5cde937

yctercero self-assigned this Jun 10, 2020

yctercero added release_note:enhancement Team:SIEM v7.9.0 v8.0.0 labels Jun 10, 2020

yctercero marked this pull request as ready for review June 10, 2020 17:50

yctercero requested review from a team as code owners June 10, 2020 17:50

yctercero mentioned this pull request Jun 10, 2020

[SIEM][Exceptions] - ExceptionsViewer UI component part 2 #68294

Merged

14 tasks

FrankHassanabad reviewed Jun 10, 2020

View reviewed changes

FrankHassanabad approved these changes Jun 10, 2020

View reviewed changes

yctercero merged commit 49a45ec into elastic:master Jun 10, 2020

yctercero mentioned this pull request Jun 10, 2020

[7.x] [SIEM][Exceptions] - ExceptionsViewer cleanup (#68739) #68815

Merged

madirey approved these changes Jun 10, 2020

View reviewed changes

yctercero deleted the exception-viewer-ux branch October 14, 2020 12:00

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SIEM][Exceptions] - ExceptionsViewer cleanup #68739

[SIEM][Exceptions] - ExceptionsViewer cleanup #68739

yctercero commented Jun 10, 2020 •

edited

Loading

elasticmachine commented Jun 10, 2020

kibanamachine commented Jun 10, 2020

FrankHassanabad Jun 10, 2020

FrankHassanabad Jun 10, 2020

yctercero Jun 10, 2020

FrankHassanabad left a comment

elasticmachine commented Sep 23, 2021

[SIEM][Exceptions] - ExceptionsViewer cleanup #68739

[SIEM][Exceptions] - ExceptionsViewer cleanup #68739

Conversation

yctercero commented Jun 10, 2020 • edited Loading

Summary

To do

Screenshots & Gifs

Empty state

Only one type of list allowed

Exceptions search

Exceptions list toggle

Delete exception

Testing

Checklist

elasticmachine commented Jun 10, 2020

kibanamachine commented Jun 10, 2020

💚 Build Succeeded

History

FrankHassanabad Jun 10, 2020

Choose a reason for hiding this comment

FrankHassanabad Jun 10, 2020

Choose a reason for hiding this comment

yctercero Jun 10, 2020

Choose a reason for hiding this comment

FrankHassanabad left a comment

Choose a reason for hiding this comment

elasticmachine commented Sep 23, 2021

yctercero commented Jun 10, 2020 •

edited

Loading