[Defend Workflows] Convert filterQuery to kql #161806
Merged
tomsonpl merged 15 commits intoelastic:mainfrom Aug 23, 2023
Merged
[Defend Workflows] Convert filterQuery to kql #161806tomsonpl merged 15 commits intoelastic:mainfrom
tomsonpl merged 15 commits intoelastic:mainfrom
Conversation
tomsonpl
added
chore
release_note:skip
Contributor
|
Pinging @elastic/security-defend-workflows (Team:Defend Workflows) |
Contributor
Author
|
Hey @marshallmain, could you take a look if this makes sense to you? I hope this resolves the issues you mentioned to @patrykkopycinski . Big thank you in advance 👍 |
tomsonpl
changed the title
marshallmain
approved these changes
Jul 14, 2023
Contributor
marshallmain
left a comment
marshallmain
left a comment
There was a problem hiding this comment.
Looks great! Verified that the search strategies that can query as internal user are now passing KQL through buildEsQuery rather than injecting filters directly 👍
gergoabraham
approved these changes
Jul 17, 2023
Contributor
gergoabraham
left a comment
gergoabraham
left a comment
There was a problem hiding this comment.
looks great! 💯 added one small comment for avoiding some duplication, but that's all 🚀
| filter = filter + ` AND ${kql}`; | ||
| } | ||
|
|
||
| const filterQuery = getQueryFilter({ filter }); |
Contributor
There was a problem hiding this comment.
what do you think about pushing the responsibility of concatenating the filters into getQueryFilter() (e.g. getConcatenatedQueryFilter(...filters: string[])? it would eliminate the need for the duplicated logic above, and inside the function it can simply filter out the empty strings and .join(' AND ') the others
Contributor
Author
There was a problem hiding this comment.
That totally makes sense, thanks @gergoabraham 👍
2 tasks
# Conflicts: # x-pack/plugins/osquery/server/routes/live_query/find_live_query_route.ts # x-pack/plugins/osquery/server/routes/live_query/get_live_query_details_route.ts # x-pack/plugins/osquery/server/routes/live_query/get_live_query_results_route.ts # x-pack/plugins/osquery/server/search_strategy/osquery/index.ts
tomsonpl
added
release_note:breaking
Breaking Change
v8.11.0
and removed
release_note:skip
patrykkopycinski
approved these changes
Aug 22, 2023
michaelolo24
approved these changes
Aug 22, 2023
💔 Build FailedFailed CI Steps
Test Failures
Metrics [docs]Async chunks
Page load bundle
History
To update your PR or re-run it, just comment with: cc @tomsonpl |
jloleysens
added a commit
to jloleysens/kibana
that referenced
this pull request
Aug 23, 2023
* main: (150 commits) Fixes unnecessary autocompletes on HTTP methods (elastic#163233) [Defend Workflows] Convert filterQuery to kql (elastic#161806) [Fleet] copy `inactivity_timeout` when duplicating agent policy (elastic#164544) Fix 7.17 forward compatibility with 8.2+ (elastic#164274) [ML] Fixes dark mode in flyouts and modals (elastic#164399) [Defend Workflows]Changes to policy settings are not persistent until a refresh (elastic#164403) [Security Solution][Endpoint] Fixes kibana crash when going back to policy details page (elastic#164329) Prepare the Security domain HTTP APIs for Serverless (elastic#162087) skip failing test suite (elastic#160986) [Security Solution] Fix flaky Event Filters test (elastic#164473) [EDR workflows] Osquery serverless tests (elastic#163795) [Fleet] Only show agent dashboard links if there is more than one non-server agent and if the dashboards exist (elastic#164469) [Chrome UI] Fix background color in serverless (elastic#164419) [DOCS] Saved objects - resolve import errors API (elastic#162825) Remove 'Create Rule' button from Rule Group page (elastic#164167) [Security Solution] expandable flyout - fix infinite loop in correlations (elastic#163450) [Remote Clusters] Update copy about port help text (elastic#164442) [api-docs] 2023-08-23 Daily api_docs build (elastic#164524) [data views] Disable scripted fields in serverless environment (elastic#163228) [Reporting] Fix - show diagnostic only when image reporting is enabled (elastic#164336) ...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR solves: https://github.com/elastic/security-team/issues/6988