[Security Solution][RAC] - Update UI signal references#107713
[Security Solution][RAC] - Update UI signal references#107713michaelolo24 wants to merge 37 commits intoelastic:masterfrom
Conversation
e08a013 to
de21f63
Compare
There was a problem hiding this comment.
What is this mapping from/to? As far as I can tell, it's only used in eventFieldsMap and that map doesn't appear to be used by anything.
There was a problem hiding this comment.
Yea, this file is actually ported across three different plugins and I don't think any of them are being used. I'll delete them and see what happens 🤷🏾♂️
There was a problem hiding this comment.
Unclear to me if we're using ALERT_STATUS or ALERT_WORKFLOW_STATUS (ALERT_STATUS isn't actually in the spreadsheet). Open question...
There was a problem hiding this comment.
pretty sure it's going to be ALERT_WORKFLOW_STATUS, we'll update these
There was a problem hiding this comment.
Were you able to verify that these are coming back as nested objects, rather than a flattened set of key/values at the top level of the Ecs object? On the backend, we're handling as a flat set of key/value pairs before indexing.
There was a problem hiding this comment.
You could use ALERT_NAMESPACE here.
|
Lookin' good, thanks for adding all the constants! |
de21f63 to
3c3850a
Compare
| * must be replaced by `ALERT_WORKFLOW_STATUS` field name constant | ||
| * @deprecated | ||
| */ | ||
| const replaceStatusField = (query: string): string => |
There was a problem hiding this comment.
@semd just updated the query to use the ALERT_WORKFLOW_STATUS directly
|
Pinging @elastic/security-threat-hunting (Team:Threat Hunting) |
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
x-pack/plugins/security_solution/public/common/mock/mock_detection_alerts.ts
Show resolved
Hide resolved
x-pack/plugins/security_solution/public/detections/components/alerts_table/default_config.tsx
Outdated
Show resolved
Hide resolved
...y_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
Outdated
Show resolved
Hide resolved
...rity_solution/public/detections/containers/detection_engine/rules/use_rule_with_fallback.tsx
Outdated
Show resolved
Hide resolved
⏳ Build in-progress, with failures
Failed CI Steps
Test FailuresKibana Pipeline / general / task-queue-process-15 / X-Pack Endpoint Functional Tests.x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_list·ts.endpoint endpoint list when there is data, finds page titleStandard OutStack TraceKibana Pipeline / general / task-queue-process-15 / X-Pack Endpoint Functional Tests.x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_list·ts.endpoint endpoint list when there is data, finds page titleStandard OutStack TraceKibana Pipeline / jest / Jest Tests.x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions.Actions Alert context menu enabled? it enables for eventType=signalStandard OutStack TraceHistory
To update your PR or re-run it, just comment with: |
| return combinedQuery | ||
| ? { | ||
| filterQuery: replaceStatusField(combinedQuery!.filterQuery), | ||
| filterQuery: combinedQuery!.filterQuery, |

UPDATE: This PR was closed in favor of: #112113
NOTE: This PR will be merged for 7.16 to not cause any disruptions to the 7.15 release
TODO: If any column configurations are stored in localStorage, those will need to be updated from
signal.*to the newkibana.alert.*referencesSummary
This work coincides with the work done in #105096 and #106049 to migrate the
signal.xtokibana.alert.xfields in the ui.Testing: