[Osquery] Add default osquery_saved_query objects by tomsonpl · Pull Request #129461 · elastic/kibana

tomsonpl · 2022-04-05T12:56:50Z

Summary

Prerequisite PR: elastic/integrations#2998

Added a list of predefined Saved queries when adding/updating Osquery Manager integration.

Changed the width of columns to enable wider description + tooltip.
Make the prebuilt saved queries NOT editable

tomsonpl · 2022-04-06T08:34:19Z

@elasticmachine merge upstream

tomsonpl · 2022-04-07T07:07:27Z

@elasticmachine merge upstream

tomsonpl · 2022-04-07T11:58:55Z

@elasticmachine merge upstream

…nto osquery-default-saved-queries

tomsonpl · 2022-04-11T09:31:04Z

@elasticmachine merge upstream

elasticmachine · 2022-04-11T12:44:14Z

Pinging @elastic/security-asset-management (Team:Asset Management)

…nto osquery-default-saved-queries

elasticmachine · 2022-04-19T07:27:25Z

Pinging @elastic/fleet (Team:Fleet)

tomsonpl · 2022-04-19T07:33:05Z

@elasticmachine merge upstream

tomsonpl · 2022-05-04T07:02:53Z

@elasticmachine merge upstream

kibanamachine · 2022-05-04T07:02:55Z

merge conflict between base and head

# Conflicts: # x-pack/plugins/osquery/public/packs/queries/ecs_mapping_editor_field.tsx # x-pack/plugins/osquery/public/saved_queries/form/index.tsx

tomsonpl · 2022-05-11T17:59:17Z

@elasticmachine merge upstream

tomsonpl · 2022-05-16T06:33:40Z

@elasticmachine merge upstream

tomsonpl · 2022-05-16T09:37:00Z

@elasticmachine merge upstream

…nto osquery-default-saved-queries

tomsonpl · 2022-05-16T20:28:13Z

Alright, after a multiple heavy rookie mistakes from my side, I was able to fix the tests... ;p
@patrykkopycinski could you please take a look?

patrykkopycinski

LGTM

kibana-ci · 2022-05-17T07:28:52Z

💛 Build succeeded, but was flaky

Failed CI Steps

Osquery Cypress Tests

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`osquery`	997.3KB	998.0KB	+770.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`fleet`	90.9KB	91.1KB	+212.0B

History

💚 Build #45039 succeeded caa03f5
💔 Build #44996 failed fba7e5c
💔 Build #44988 failed 6581233
💔 Build #44954 failed 89bb6b9
💔 Build #44901 failed 258f642
💔 Build #44895 failed 6c1e8d8

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @tomsonpl

* wip I * add alert table state in case * [CI] Auto-commit changed files from 'node scripts/eslint --no-cache --fix' * add new API to get FeatureID form registrationContext and update UI to use this new API * rm dead code * [CI] Auto-commit changed files from 'node scripts/eslint --no-cache --fix' * remove unnecessary memo * adds tests for case view helpers * Move http call to API and add tests for getFeatureIds * fix type + unit test * add unit tests + cleanup * add new api integration test for _feature_ids * [CI] Auto-commit changed files from 'node scripts/eslint --no-cache --fix' * Fix small type creating typescript slowness * remove console log * use import type for validfeatureId * force any to improve typescript performance * Update APM (#132270) Co-authored-by: Renovate Bot <bot@renovateapp.com> * [ResponseOps][Docs] Updating ServiceNow docs with OAuth setup instructions (#131344) * Updating ServiceNow docs. Need screenshots * Adding screenshots * Fix nested screenshots and lists * Tweaks and screenshots * Updates * blergh * Apply suggestions from code review Co-authored-by: Lisa Cawley <lcawley@elastic.co> * Apply suggestions from code review Co-authored-by: Mike Côté <mikecote@users.noreply.github.com> Co-authored-by: lcawl <lcawley@elastic.co> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Mike Côté <mikecote@users.noreply.github.com> * Show polling options when 'Data streams' option is selected in the Console Settings modal. (#132277) * [Osquery] Make Osquery All with All base privillege (#130523) * [XY] Add normalizeTable function to correct works with esdocs (#131917) * Add normalizeTable function to correct works with esdocs * Fix types * Fix types * Fix CI * Fix CI * Some fixes * Remove fallback with min/max value for domain * Added tests * Some refactoring Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Yaroslav Kuznietsov <kuznetsov.yaroslav.yk@gmail.com> * [Osquery] Add default osquery_saved_query objects (#129461) * [Unified Search] Show error message for invalid date filter value (#131290) * feat: added show error message for invalid date * refact: move logic in HOC * feat: refactoring code and added translation * refact show error * refact: show error message * refact: remove translation * refactor: changed menu for show FilterEdit * fix: open/close popover * feat: field.type => KBN_FIELD_TYPES * feat: remove extra code with with input check and refactored filter item * feat: added tests and refactoring code * refact: getFieldValidityAndErrorMessage * feat: return isInvalid checking in valur input type for string, ip * Update navigation landing pages to use appLinks config (#132027) * Update navigation landing pages to use appLinks config * Please code review * align app links changes * Update links descriptions * Rollback title changes * Fix wrong links descriptions * Fix unit tests * Fix description Co-authored-by: semd <sergi.massaneda@elastic.co> * [Cloud Posture] add resource findings page flyout (#132243) * [Discover] Add a tour for Document Explorer (#131125) * [Discover] Add "Take a tour" button to the Document Explorer callout * [Discover] Tmp * [Discover] Add a first Document Explorer tour step * [Discover] Add other Document Explorer tour steps * [Discover] Update tour steps positioning * [Discover] Add gifs to tour steps * [Discover] Refactor how tour steps are registered * [Discover] Add new step to the tour. Update tour steps text. * [Discover] Improve steps positioning * [Discover] Fix positioning for Add field step * [Discover] Add icons to tour steps * [Discover] Reorganize components * [Discover] Skip Columns step when it's not available * [Discover] Rename components * [Discover] Add some tests * [Discover] Fix positioning * [Discover] Fix props * [Discover] Render steps only if the tour is active * [Discover] Update gifs * [Discover] Add image alt text for gifs * [Discover] Tag the Take tour button * [Discover] Update text and tests * [Discover] Add more tests * [Discover] Rename assets directory * [Discover] Fix tour in mobile view. Improve steps positioning and animation. * [Discover] Update text in tour steps * [Discover] Update sort.gif * [Discover] Update image width * Update src/plugins/discover/public/components/discover_tour/discover_tour_provider.tsx Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com> * Update src/plugins/discover/public/components/discover_tour/discover_tour_provider.tsx Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com> * [Discover] Update sort.gif * [Discover] Fix code style Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * [XY] Add `minTimeBarInterval` arg (#128726) * Added `xAxisInterval` arg * Add validation * Add tests * Rename xAxisInterval to minTimeBarInterval and add validation * Fix imports * Add tests to validation * Fix conflicts * [CI] Auto-commit changed files from 'node scripts/precommit_hook.js --ref HEAD~1..HEAD --fix' * Fix tests Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * do not use barrel imports * do not use barrel import * do not use barrel import * do not use barrel imports * do not use barrel import * import types * Add tests * Fix cases bundle size * Add more tests * [Fleet] Add new API to get current upgrades (#132276) * Add support of Data View switching for Agg-Based visualizations (#132184) * Add support of Data View switching for Agg-Based visualizations * fix CI * add use_date_view_updates * implement sync with state * cleanup * cleanup * cleanup * Update index.ts * fix PR comments * Update use_data_view_updates.ts * Update use_data_view_updates.ts Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * [Security Solution] Responsive styling fixes (#131951) * [Discover] Add Analytics No Data Page (#131965) * [Discover] Add Analytics No Data Page * Make showEmptyPrompt parameter optional * Remove unused import * Remove unnecessary test * Fix test * Update failing test? * Update failing test * Changing the order of functional tests * Fix error handling * Addressing PR comments Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * Remove barrel export from public index file * remove barrel export * Re-export missing exports * Turn off feature flag Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Esteban Beltran <esteban.beltran@elastic.co> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Renovate Bot <bot@renovateapp.com> Co-authored-by: Ying Mao <ying.mao@elastic.co> Co-authored-by: lcawl <lcawley@elastic.co> Co-authored-by: Mike Côté <mikecote@users.noreply.github.com> Co-authored-by: CJ Cenizal <cj.cenizal@elastic.co> Co-authored-by: Tomasz Ciecierski <ciecierskitomek@gmail.com> Co-authored-by: Uladzislau Lasitsa <Uladzislau_Lasitsa@epam.com> Co-authored-by: Yaroslav Kuznietsov <kuznetsov.yaroslav.yk@gmail.com> Co-authored-by: Nodir Latipov <nodir.latypov@gmail.com> Co-authored-by: Pablo Machado <pablo.nevesmachado@elastic.co> Co-authored-by: semd <sergi.massaneda@elastic.co> Co-authored-by: Or Ouziel <or.ouziel@elastic.co> Co-authored-by: Julia Rechkunova <julia.rechkunova@elastic.co> Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com> Co-authored-by: Christos Nasikas <christos.nasikas@elastic.co> Co-authored-by: Nicolas Chaulet <nicolas.chaulet@elastic.co> Co-authored-by: Alexey Antonov <alexwizp@gmail.com> Co-authored-by: Steph Milovic <stephanie.milovic@elastic.co> Co-authored-by: Maja Grubic <maja.grubic@elastic.co>

Add default osquery_saved_query objects

8d30d07

tomsonpl added release_note:enhancement enhancement New value added to drive a business result Team:Asset Management Security Asset Management Team Feature:Osquery Security Solution Osquery feature v8.3.0 labels Apr 5, 2022

tomsonpl requested a review from a team April 5, 2022 12:56

tomsonpl self-assigned this Apr 5, 2022

Fix mock data

3fbbff8

kibanamachine and others added 3 commits April 6, 2022 04:34

Merge branch 'main' into osquery-default-saved-queries

daf8add

Disable edit for prebuilt queries

077cf45

Disable form on viewMode

18d4060

Merge branch 'main' into osquery-default-saved-queries

ad087ad

kibanamachine and others added 3 commits April 7, 2022 07:58

Merge branch 'main' into osquery-default-saved-queries

d589556

Uncomment integration tests, and add saved queries check

667a341

Merge remote-tracking branch 'origin/osquery-default-saved-queries' i…

be070ba

…nto osquery-default-saved-queries

Merge branch 'main' into osquery-default-saved-queries

ccf1777

tomsonpl marked this pull request as ready for review April 11, 2022 12:44

tomsonpl requested a review from a team as a code owner April 11, 2022 12:44

tomsonpl added 2 commits April 19, 2022 09:26

Add test that gets saved object

e673efb

Merge remote-tracking branch 'origin/osquery-default-saved-queries' i…

b0d342c

…nto osquery-default-saved-queries

botelastic bot added the Team:Fleet Team label for Observability Data Collection Fleet team label Apr 19, 2022

Merge branch 'main' into osquery-default-saved-queries

f453048

tomsonpl added 3 commits May 4, 2022 09:09

Merge branch 'main' into osquery-default-saved-queries

f36e158

# Conflicts: # x-pack/plugins/osquery/public/packs/queries/ecs_mapping_editor_field.tsx # x-pack/plugins/osquery/public/saved_queries/form/index.tsx

pass props with disabled flag to ecs editor

41ec3cc

update translations key

80c2633

Merge branch 'main' into osquery-default-saved-queries

42918b0

kibanamachine and others added 2 commits May 16, 2022 01:33

Merge branch 'main' into osquery-default-saved-queries

dc4a385

[WIP] change tests to see ID

aead9f0

kibanamachine and others added 9 commits May 16, 2022 04:37

Merge branch 'main' into osquery-default-saved-queries

3654078

add sample saved query

cad793c

Merge remote-tracking branch 'origin/osquery-default-saved-queries' i…

4e8414c

…nto osquery-default-saved-queries

change id for test, and adjust width of saved query columns

6c1e8d8

fix usememo

258f642

add 0.2.0 so

89bb6b9

add console log

6581233

fix missing object

fba7e5c

remove new id

caa03f5

joeypoon approved these changes May 16, 2022

View reviewed changes

parkiino approved these changes May 16, 2022

View reviewed changes

fix description to be optional;

96763ba

patrykkopycinski approved these changes May 17, 2022

View reviewed changes

tomsonpl merged commit 05b7308 into elastic:main May 17, 2022

kibanamachine added the backport:skip This PR does not require backporting label May 17, 2022

academo pushed a commit to XavierM/kibana that referenced this pull request May 17, 2022

[Osquery] Add default osquery_saved_query objects (elastic#129461)

a06e781

Conversation

tomsonpl commented Apr 5, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

tomsonpl commented Apr 6, 2022

Uh oh!

tomsonpl commented Apr 7, 2022

Uh oh!

tomsonpl commented Apr 7, 2022

Uh oh!

tomsonpl commented Apr 11, 2022

Uh oh!

elasticmachine commented Apr 11, 2022

Uh oh!

elasticmachine commented Apr 19, 2022

Uh oh!

tomsonpl commented Apr 19, 2022

Uh oh!

tomsonpl commented May 4, 2022

Uh oh!

kibanamachine commented May 4, 2022

Uh oh!

tomsonpl commented May 11, 2022

Uh oh!

tomsonpl commented May 16, 2022

Uh oh!

tomsonpl commented May 16, 2022

Uh oh!

tomsonpl commented May 16, 2022

Uh oh!

patrykkopycinski left a comment

Choose a reason for hiding this comment

Uh oh!

kibana-ci commented May 17, 2022

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Async chunks

Page load bundle

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

tomsonpl commented Apr 5, 2022 •

edited

Loading