[Secutiy Solution] Timeline kpis #89210

kqualters-elastic · 2021-01-25T19:27:51Z

Summary

Adds a component to timeline that shows kpi statistics. Also adds a search strategy kpi query to power these statistics, along with a container component that uses a series of hooks to fetch data based on existing timeline filters.

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
This was checked for cross-browser compatibility

For maintainers

This was checked for breaking API changes and was labeled appropriately

…ana into siem-timeline-kpis

elasticmachine · 2021-01-26T08:06:32Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

michaelolo24 · 2021-01-27T18:38:26Z

...ck/plugins/security_solution/common/search_strategy/timeline/events/last_event_time/index.ts

+export interface TimelineKpiStrategyResponse extends IEsSearchResponse {
+  destinationIpCount: Maybe<number>;
+  inspect?: Maybe<Inspect>;
+  hostCount: Maybe<number>;


All of these should technically be optional since Maybe<T> = T | null

Yes I agree, you do not need the Maybe or the optional since you will have 0 or the value.

For history, the Maybe is coming from the graphql when we had both type at the same time

michaelolo24 · 2021-01-27T18:40:08Z

x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.test.tsx

+
+  beforeEach(() => {
+    mockUseSourcererScope.mockImplementation(() => defaultMocks);
+    useKibanaMock().services.application.capabilities = {


Can you leave a comment explaining what these are and why their needed?

michaelolo24 · 2021-01-27T18:51:24Z

x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx

+  const getStartSelector = useMemo(() => startSelector(), []);
+  const getEndSelector = useMemo(() => endSelector(), []);
+  const isActive = useMemo(() => timelineId === TimelineId.active, [timelineId]);
+  const from = useDeepEqualSelector((state) => {


This isn't specific to your PR, but I wonder what the performance improvement we get for the useDeepEqual vs just useSelector. Like are all these deep checks more costly than just re-rendering? Also, maybe just combining all of them into one, so you're only doing one deep check? 🤷🏾‍♂️

x-pack/plugins/security_solution/public/timelines/components/flyout/header/kpis.tsx

michaelolo24 · 2021-01-27T19:13:27Z

x-pack/plugins/security_solution/public/timelines/containers/kpis/index.tsx

+
+  useEffect(() => {
+    if (isBlankTimeline) {
+      timelineKpiSearch(null);


What's the point of making a request that'll just return null? Can you comment?

this was an extra line from an earlier way of doing this that after some refactoring amounted to just a noop basically, good catch though removing.

XavierM · 2021-01-29T19:03:08Z

x-pack/plugins/security_solution/public/timelines/containers/kpis/index.tsx

+  }, [docValueFields, defaultIndex, timerange, filterQuery]);
+
+  useEffect(() => {
+    if (isBlankTimeline) {


I think we can simplify it just by doing that

if (!isBlankTimeline) { timelineKpiSearch(timelineKpiRequest); }

kqualters-elastic · 2021-02-01T16:36:31Z

@elasticmachine merge upstream

michaelolo24 · 2021-02-02T13:33:31Z

Only thing I noticed is when you clear the filters so there's nothing in the view the KPI's don't clear out.

Also, given that case ^^ Does it make sense to have the KPI's visible in other views like the pinned events view (see image below)? Maybe that's a question for @XavierM

michaelolo24

Thanks, nice work!

michaelolo24 · 2021-02-02T19:43:20Z

x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx

@@ -328,7 +328,7 @@ const FlyoutHeaderComponent: React.FC<FlyoutHeaderProps> = ({ timelineId }) => {
      </EuiFlexItem>

      <EuiFlexItem grow={1}>
-        <TimelineKPIs kpis={kpis} isLoading={loading} />
+        {activeTab === 'query' ? <TimelineKPIs kpis={kpis} isLoading={loading} /> : null}


If you end up having to push any other changes there's an enum TimelineTabs.query that you can use here. Not necessary though

kibanamachine · 2021-02-02T21:46:06Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: bff5c8e

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	2177	2179	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	7.5MB	7.5MB	+8.8KB

History

💚 Build #103104 succeeded b21625b
💛 Build #103067 was flaky bf60d6c
💔 Build #103009 failed 6de598e
💚 Build #102632 succeeded ded4eda
💚 Build #102330 succeeded 09f8c8e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* Stub kpi component * search strategy scheleton timeline KPI * search strategy scheleton timeline KPI * Add timeline kpis component and search strategy container * Use getEmptyValue in timeline kpis * Prevent request from being made for blank timeline properly * Add kpi search strategy api integration test * Add jest tests for timeline kpis * Clear mocks in afterAll * Decouple some tests from EUI structure * Combine some selector calls, change types to be more appropriate * Simplify hook logic * Set loading and response on blank timeline * Only render kpi component when query is active tab * Use TimelineTabs enum for query tab string Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

kqualters-elastic and others added 7 commits January 13, 2021 11:15

Stub kpi component

201c344

search strategy scheleton timeline KPI

5b24e9c

search strategy scheleton timeline KPI

298addc

Merge branch 'siem-timeline-kpis' of github.com:kqualters-elastic/kib…

d372ff2

…ana into siem-timeline-kpis

Add timeline kpis component and search strategy container

f69aca5

Merge branch 'master' into siem-timeline-kpis

66aed05

Use getEmptyValue in timeline kpis

5a82ae6

kqualters-elastic added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes v7.12.0 Team:Threat Hunting Security Solution Threat Hunting Team labels Jan 25, 2021

kqualters-elastic added 3 commits January 25, 2021 15:02

Prevent request from being made for blank timeline properly

88bbf7b

Add kpi search strategy api integration test

d4173ee

Add jest tests for timeline kpis

bd1e9cf

kqualters-elastic marked this pull request as ready for review January 26, 2021 08:06

kqualters-elastic requested review from a team as code owners January 26, 2021 08:06

kqualters-elastic added 3 commits January 26, 2021 06:39

Clear mocks in afterAll

f3e34fd

Decouple some tests from EUI structure

e4dd6a2

Merge remote-tracking branch 'upstream/master' into siem-timeline-kpis

c884e25

michaelolo24 reviewed Jan 27, 2021

View reviewed changes

x-pack/plugins/security_solution/public/timelines/components/flyout/header/kpis.tsx Show resolved Hide resolved

michaelolo24 reviewed Jan 27, 2021

View reviewed changes

Combine some selector calls, change types to be more appropriate

5f53d96

XavierM reviewed Jan 29, 2021

View reviewed changes

kqualters-elastic added 2 commits January 29, 2021 14:13

Simplify hook logic

48e8842

Merge branch 'master' into siem-timeline-kpis

09f8c8e

Merge branch 'master' into siem-timeline-kpis

ded4eda

kqualters-elastic added 3 commits February 2, 2021 10:08

Set loading and response on blank timeline

6de598e

Merge remote-tracking branch 'upstream/master' into siem-timeline-kpis

bf60d6c

Only render kpi component when query is active tab

b21625b

michaelolo24 approved these changes Feb 2, 2021

View reviewed changes

michaelolo24 reviewed Feb 2, 2021

View reviewed changes

Use TimelineTabs enum for query tab string

bff5c8e

kqualters-elastic merged commit 3da4c6b into elastic:master Feb 2, 2021

kqualters-elastic deleted the siem-timeline-kpis branch February 2, 2021 23:30

kqualters-elastic mentioned this pull request Feb 2, 2021

[7.x] [Secutiy Solution] Timeline kpis (#89210) #90105

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Secutiy Solution] Timeline kpis #89210

[Secutiy Solution] Timeline kpis #89210

kqualters-elastic commented Jan 25, 2021 •

edited

Loading

elasticmachine commented Jan 26, 2021

michaelolo24 Jan 27, 2021

XavierM Jan 28, 2021

michaelolo24 Jan 27, 2021

michaelolo24 Jan 27, 2021

michaelolo24 Jan 27, 2021

kqualters-elastic Jan 28, 2021

XavierM Jan 29, 2021

kqualters-elastic commented Feb 1, 2021

michaelolo24 commented Feb 2, 2021

michaelolo24 left a comment

michaelolo24 Feb 2, 2021

kibanamachine commented Feb 2, 2021

[Secutiy Solution] Timeline kpis #89210

[Secutiy Solution] Timeline kpis #89210

Conversation

kqualters-elastic commented Jan 25, 2021 • edited Loading

Summary

Checklist

For maintainers

elasticmachine commented Jan 26, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kqualters-elastic commented Feb 1, 2021

michaelolo24 commented Feb 2, 2021

michaelolo24 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kibanamachine commented Feb 2, 2021

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

History

kqualters-elastic commented Jan 25, 2021 •

edited

Loading