Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Backport 2.15] Remove threat intel checkbox detector creation #1240

Merged
merged 2 commits into from
Dec 19, 2024
Merged

[Backport 2.15] Remove threat intel checkbox detector creation #1240

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d39ab70
cherry picked for backport
amsiglan Dec 18, 2024
cc26c25
updated workflow file for UTs
amsiglan Dec 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions ...CreateDetector/components/DefineDetector/components/DetectorSchedule/DetectorSchedule.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
*/

import React from 'react';
import { EuiSpacer, EuiTitle } from '@elastic/eui';
import { EuiSpacer, EuiText } from '@elastic/eui';
import { PeriodSchedule } from '../../../../../../../models/interfaces';
import { Interval } from './Interval';
import { Detector } from '../../../../../../../types';
Expand All @@ -23,9 +23,9 @@ export class DetectorSchedule extends React.Component<DetectorScheduleProps> {
render() {
return (
<>
<EuiTitle size="m">
<EuiText size="m">
<h3>Detector schedule</h3>
</EuiTitle>
</EuiText>
<EuiSpacer />
<Interval
schedule={this.props.detector.schedule}
Expand Down
85 changes: 68 additions & 17 deletions ...teDetector/components/DefineDetector/components/ThreatIntelligence/ThreatIntelligence.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,36 +3,87 @@
* SPDX-License-Identifier: Apache-2.0
*/

import React from 'react';
import { EuiCheckbox, EuiText, EuiTitle, htmlIdGenerator } from '@elastic/eui';
import React, { useMemo, useState } from 'react';
import {
EuiCallOut,
EuiCheckbox,
EuiLink,
EuiSpacer,
EuiText,
htmlIdGenerator,
} from '@elastic/eui';
import { ROUTES } from '../../../../../../utils/constants';

export interface ThreatIntelligenceProps {
isEdit: boolean;
threatIntelChecked: boolean;
onThreatIntelChange: (checked: boolean) => void;
}

export const ThreatIntelligence: React.FC<ThreatIntelligenceProps> = ({
threatIntelChecked,
onThreatIntelChange,
isEdit,
}) => {
const [shouldShowEditUI] = useState(isEdit && threatIntelChecked);
const threatIntelUrl = useMemo(() => {
return `#${ROUTES.THREAT_INTEL_OVERVIEW}`;
}, []);

return (
<>
<EuiTitle size="m">
<h3>Threat intelligence feeds</h3>
</EuiTitle>
{!shouldShowEditUI && (
<>
<EuiText size="m">
<h3>Threat intelligence feeds</h3>
</EuiText>
<EuiText size="s">
<p>
To match your data source against known indicators of compromise configure logs scan
with threat intel sources on the{' '}
<EuiLink target="_blank" href={threatIntelUrl}>
Threat intelligence
</EuiLink>{' '}
page.
</p>
</EuiText>
</>
)}
{shouldShowEditUI && (
<>
<EuiText size="m">
<h3>Threat intelligence feeds</h3>
</EuiText>

<EuiText>
<p>
Match your data source against known malicious IP-addresses. Available for standard log
types only.
</p>
</EuiText>
<EuiCheckbox
id={htmlIdGenerator()()}
label="Enable threat intelligence-based detection"
checked={threatIntelChecked}
onChange={(e) => onThreatIntelChange(e.target.checked)}
/>
<EuiText size="s">
<p>
Match your data source against known malicious IP-addresses. Available for standard
log types only.
</p>
</EuiText>
<EuiSpacer size="s" />
<EuiCallOut
size="s"
title={
<p>
To match your data against known indicators of compromise we recommend configuring
scan using the new{' '}
<EuiLink target="_blank" href={threatIntelUrl}>
Threat Intelligence
</EuiLink>{' '}
platform and disabling threat intelligence in the detector.
</p>
}
/>
<EuiSpacer size="s" />
<EuiCheckbox
id={htmlIdGenerator()()}
label="Enable threat intelligence-based detection"
checked={threatIntelChecked}
onChange={(e) => onThreatIntelChange(e.target.checked)}
/>
</>
)}
</>
);
};
3 changes: 2 additions & 1 deletion public/pages/CreateDetector/components/DefineDetector/containers/DefineDetector.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,7 @@ export default class DefineDetector extends Component<DefineDetectorProps, Defin
const newDetector: Detector = {
...this.state.detector,
detector_type: detectorType,
threat_intel_enabled: this.standardLogTypes.has(detectorType),
threat_intel_enabled: false,
};

this.updateDetectorCreationState(newDetector);
Expand Down Expand Up @@ -251,6 +251,7 @@ export default class DefineDetector extends Component<DefineDetectorProps, Defin

{this.standardLogTypes.has(detector_type) && (
<ThreatIntelligence
isEdit={isEdit}
threatIntelChecked={threat_intel_enabled}
onThreatIntelChange={this.onThreatIntelligenceChanged}
/>
Expand Down
19 changes: 17 additions & 2 deletions public/pages/Detectors/components/DetectorBasicDetailsView/DetectorBasicDetailsView.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,12 +3,12 @@
* SPDX-License-Identifier: Apache-2.0
*/

import { EuiButton, EuiSpacer, EuiLink, EuiIcon, EuiText } from '@elastic/eui';
import { EuiButton, EuiSpacer, EuiLink, EuiIcon, EuiText, EuiCallOut } from '@elastic/eui';
import React from 'react';
import { ContentPanel } from '../../../../components/ContentPanel';
import { createTextDetailsGroup, parseSchedule } from '../../../../utils/helpers';
import moment from 'moment';
import { DEFAULT_EMPTY_DATA, logTypesWithDashboards } from '../../../../utils/constants';
import { DEFAULT_EMPTY_DATA, logTypesWithDashboards, ROUTES } from '../../../../utils/constants';
import { Detector } from '../../../../../types';
import { getLogTypeLabel } from '../../../LogTypes/utils/helpers';

Expand Down Expand Up @@ -101,6 +101,21 @@ export const DetectorBasicDetailsView: React.FC<DetectorBasicDetailsViewProps> =
{createTextDetailsGroup([
{ label: 'Threat intelligence', content: threat_intel_enabled ? 'Enabled' : 'Disabled' },
])}
{threat_intel_enabled && (
<EuiCallOut
size="s"
title={
<p>
To match your data against known indicators of compromise we recommend configuring
scan using the new{' '}
<EuiLink target="_blank" href={`#${ROUTES.THREAT_INTEL_OVERVIEW}`}>
Threat Intelligence
</EuiLink>{' '}
platform and disabling threat intelligence in the detector.
</p>
}
/>
)}
{rulesCanFold ? children : null}
</ContentPanel>
);
Expand Down
1 change: 1 addition & 0 deletions public/pages/Detectors/components/UpdateBasicDetails/UpdateBasicDetails.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,6 +292,7 @@ export const UpdateDetectorBasicDetails: React.FC<UpdateDetectorBasicDetailsProp
<EuiSpacer size={'l'} />

<ThreatIntelligence
isEdit={true}
threatIntelChecked={detector.threat_intel_enabled}
onThreatIntelChange={onThreatIntelFeedToggle}
/>
Expand Down
100 changes: 56 additions & 44 deletions ...tors/components/UpdateBasicDetails/__snapshots__/UpdateDetectorBasicDetails.test.tsx.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1144,57 +1144,67 @@ exports[`<UpdateDetectorBasicDetails /> spec renders the component 1`] = `
/>
</EuiSpacer>
<ThreatIntelligence
isEdit={true}
onThreatIntelChange={[Function]}
>
<EuiTitle
<EuiText
size="m"
>
<h3
className="euiTitle euiTitle--medium"
>
Threat intelligence feeds
</h3>
</EuiTitle>
<EuiText>
<div
className="euiText euiText--medium"
>
<p>
Match your data source against known malicious IP-addresses. Available for standard log types only.
</p>
<h3>
Threat intelligence feeds
</h3>
</div>
</EuiText>
<EuiCheckbox
checked={false}
compressed={false}
disabled={false}
id="some_html_id"
indeterminate={false}
label="Enable threat intelligence-based detection"
onChange={[Function]}
<EuiText
size="s"
>
<div
className="euiCheckbox"
className="euiText euiText--small"
>
<input
checked={false}
className="euiCheckbox__input"
disabled={false}
id="some_html_id"
onChange={[Function]}
type="checkbox"
/>
<div
className="euiCheckbox__square"
/>
<label
className="euiCheckbox__label"
htmlFor="some_html_id"
>
Enable threat intelligence-based detection
</label>
<p>
To match your data source against known indicators of compromise configure logs scan with threat intel sources on the

<EuiLink
href="#/threat-intel"
target="_blank"
>
<a
className="euiLink euiLink--primary"
href="#/threat-intel"
rel="noopener noreferrer"
target="_blank"
>
Threat intelligence
<EuiIcon
aria-label="External link"
className="euiLink__externalIcon"
size="s"
type="popout"
>
EuiIconMock
</EuiIcon>
<EuiScreenReaderOnly>
<span
className="euiScreenReaderOnly"
>
<EuiI18n
default="(opens in a new tab or window)"
token="euiLink.newTarget.screenReaderOnlyText"
>
(opens in a new tab or window)
</EuiI18n>
</span>
</EuiScreenReaderOnly>
</a>
</EuiLink>

page.
</p>
</div>
</EuiCheckbox>
</EuiText>
</ThreatIntelligence>
<EuiSpacer
size="l"
Expand Down Expand Up @@ -1390,15 +1400,17 @@ exports[`<UpdateDetectorBasicDetails /> spec renders the component 1`] = `
}
onDetectorScheduleChange={[Function]}
>
<EuiTitle
<EuiText
size="m"
>
<h3
className="euiTitle euiTitle--medium"
<div
className="euiText euiText--medium"
>
Detector schedule
</h3>
</EuiTitle>
<h3>
Detector schedule
</h3>
</div>
</EuiText>
<EuiSpacer>
<div
className="euiSpacer euiSpacer--l"
Expand Down
Loading