Manual rule run from rule details and rules table (#9327) by e40pud · Pull Request #184500 · elastic/kibana

e40pud · 2024-05-30T10:13:02Z

Summary

Main ticket https://github.com/elastic/security-team/issues/9327

With this changes we introduce the way to schedule rule run manually. There are two ways to do that in UI:

Via "All actions" button on rules management page
Via "All actions" button on rule's details page

NOTES:

To be able to test these changes, you need to enable feature flag manualRuleRunEnabled first
Bulk action will be part of a separate ticket/PR

RECORDING:

Screen.Recording.2024-05-30.at.11.51.16.mov

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
- [Request] Documentation for Manual Run of Security rules security-docs#5264
Unit or functional tests were updated or added to match the most common scenarios
Flaky Test Runner was used on any tests changed

e40pud · 2024-05-30T10:13:13Z

/ci

e40pud · 2024-05-30T10:29:15Z

/ci

e40pud · 2024-05-30T12:57:31Z

/ci

elasticmachine · 2024-05-30T14:22:58Z

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine · 2024-05-30T14:22:59Z

Pinging @elastic/security-detection-engine (Team:Detection Engine)

kibanamachine · 2024-05-31T05:24:42Z

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#6174

[✅] Security Solution Rule Management - Cypress: 50/50 tests passed.
[✅] Security Solution Detection Engine - Cypress: 50/50 tests passed.
[✅] [Serverless] Security Solution Rule Management - Cypress: 50/50 tests passed.
[❌] [Serverless] Security Solution Detection Engine - Cypress: 24/50 tests passed.

see run history

e40pud · 2024-06-03T12:42:05Z

@elasticmachine merge upstream

e40pud · 2024-06-03T12:53:33Z

@elasticmachine merge upstream

kibanamachine · 2024-06-08T02:14:31Z

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#6243

[✅] Security Solution Rule Management - Cypress: 100/100 tests passed.
[✅] [Serverless] Security Solution Rule Management - Cypress: 100/100 tests passed.

see run history

kibanamachine · 2024-06-08T07:43:21Z

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#6244

[✅] Security Solution Detection Engine - Cypress: 100/100 tests passed.
[❌] [Serverless] Security Solution Detection Engine - Cypress: 66/100 tests passed.

see run history

e40pud · 2024-06-09T18:10:12Z

@elasticmachine merge upstream

kibanamachine · 2024-06-09T20:01:36Z

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#6257

[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_gaps/trial_license_complete_tier/configs/ess.config.ts: 100/100 tests passed.
[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_gaps/trial_license_complete_tier/configs/serverless.config.ts: 100/100 tests passed.

see run history

kibanamachine · 2024-06-10T06:37:12Z

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#6255

[❌] Security Solution Rule Management - Cypress: 74/100 tests passed.
[✅] [Serverless] Security Solution Rule Management - Cypress: 100/100 tests passed.

see run history

e40pud · 2024-06-10T08:37:54Z

@elasticmachine merge upstream

e40pud · 2024-06-10T12:32:17Z

@elasticmachine merge upstream

kibanamachine · 2024-06-10T12:57:25Z

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#6256

[✅] Security Solution Detection Engine - Cypress: 100/100 tests passed.
[❌] [Serverless] Security Solution Detection Engine - Cypress: 69/100 tests passed.

see run history

e40pud · 2024-06-10T15:29:57Z

@elasticmachine merge upstream

kibanamachine · 2024-06-10T21:49:58Z

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#6263

[✅] Security Solution Rule Management - Cypress: 100/100 tests passed.
[✅] [Serverless] Security Solution Rule Management - Cypress: 100/100 tests passed.

see run history

e40pud · 2024-06-10T21:56:24Z

@elasticmachine merge upstream

e40pud · 2024-06-11T07:42:32Z

@elasticmachine merge upstream

kibana-ci · 2024-06-11T09:19:48Z

💚 Build Succeeded

Buildkite Build
Commit: 8b190fe

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	5500	5505	+5

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`alerting`	836	837	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	13.6MB	13.6MB	+7.0KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`alerting`	25.0KB	25.1KB	+99.0B

Unknown metric groups

API count

id	before	after	diff
`alerting`	868	869	+1

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @e40pud

vitaliidm

Thank you for addressing feedback.

Looks like Cypress tests still a bit unstable

kibanamachine · 2024-06-12T02:13:27Z

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#6280

[❌] Security Solution Detection Engine - Cypress: 74/100 tests passed.
[❌] [Serverless] Security Solution Detection Engine - Cypress: 99/100 tests passed.

see run history

…ction_engine/rule_gaps/components/manual_rule_run - ManualRuleRunModal should render confirmation button disabled if selected end date is in future (#186189) (#186296) ## Summary Related tickets #186189 and #186187, and #186188 Attempt to fix failing manual rule run tests added in this PR #184500 --------- Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

…ction_engine/rule_gaps/components/manual_rule_run - ManualRuleRunModal should render confirmation button disabled if selected end date is in future (elastic#186189) (elastic#186296) ## Summary Related tickets elastic#186189 and elastic#186187, and elastic#186188 Attempt to fix failing manual rule run tests added in this PR elastic#184500 --------- Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

## Summary report following events: - open modal window for manual rule run - execute manual rule run + save time range in ms - cancel backfill job - filter in event log by run type - show source event date range Epic - elastic/security-team#2840 ### How to test enable feature flag - `manualRuleRunEnabled` You can see feature demo here - #184500 Check that events appears here after some time - https://telemetry-v2-staging.elastic.dev/s/securitysolution/app/r/s/7YYlg --------- Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

Manual rule run from rule details and rules table (elastic#9327)

dde5ddc

e40pud added Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. release_note:feature Makes this part of the condensed release notes Team:Detection Engine Security Solution Detection Engine Area labels May 30, 2024

e40pud self-assigned this May 30, 2024

Fix types

af84055

Fix tests

4061665

e40pud marked this pull request as ready for review May 30, 2024 14:22

e40pud requested review from a team as code owners May 30, 2024 14:22

e40pud requested review from dplumlee and rylnd May 30, 2024 14:22

e40pud requested a review from ymao1 May 30, 2024 14:23

Integration tests

b63a495

e40pud requested review from a team as code owners June 3, 2024 12:41

Merge branch 'main' into security/feature/9327-manual-rule-run

e53d3fb

Merge branch 'main' into security/feature/9327-manual-rule-run

488bd6e

jbudz approved these changes Jun 3, 2024

View reviewed changes

Fix cypress tests

f586215

Merge branch 'main' into security/feature/9327-manual-rule-run

2bd80c3

Merge branch 'main' into security/feature/9327-manual-rule-run

7bf15a6

Merge branch 'main' into security/feature/9327-manual-rule-run

35ef8e3

Merge branch 'main' into security/feature/9327-manual-rule-run

14b9166

Merge branch 'main' into security/feature/9327-manual-rule-run

e55435c

Merge branch 'main' into security/feature/9327-manual-rule-run

8b190fe

vitaliidm approved these changes Jun 11, 2024

View reviewed changes

e40pud merged commit 4392ee8 into elastic:main Jun 11, 2024

kibanamachine added v8.15.0 backport:skip This PR does not require backporting labels Jun 11, 2024

e40pud mentioned this pull request Jun 17, 2024

Failing test: Jest Tests.x-pack/plugins/security_solution/public/detection_engine/rule_gaps/components/manual_rule_run - ManualRuleRunModal should render confirmation button disabled if selected end date is in future (#186189) #186296

Merged

nkhristinin mentioned this pull request Jun 18, 2024

Telemetry for manual rule run #186364

Merged

Conversation

e40pud commented May 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

e40pud commented May 30, 2024

Uh oh!

e40pud commented May 30, 2024

Uh oh!

e40pud commented May 30, 2024

Uh oh!

elasticmachine commented May 30, 2024

Uh oh!

elasticmachine commented May 30, 2024

Uh oh!

kibanamachine commented May 31, 2024

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#6174

Uh oh!

e40pud commented Jun 3, 2024

Uh oh!

e40pud commented Jun 3, 2024

Uh oh!

kibanamachine commented Jun 8, 2024

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#6243

Uh oh!

kibanamachine commented Jun 8, 2024

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#6244

Uh oh!

e40pud commented Jun 9, 2024

Uh oh!

kibanamachine commented Jun 9, 2024

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#6257

Uh oh!

kibanamachine commented Jun 10, 2024

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#6255

Uh oh!

e40pud commented Jun 10, 2024

Uh oh!

e40pud commented Jun 10, 2024

Uh oh!

kibanamachine commented Jun 10, 2024

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#6256

Uh oh!

e40pud commented Jun 10, 2024

Uh oh!

kibanamachine commented Jun 10, 2024

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#6263

Uh oh!

e40pud commented Jun 10, 2024

Uh oh!

e40pud commented Jun 11, 2024

Uh oh!

kibana-ci commented Jun 11, 2024

💚 Build Succeeded

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Page load bundle

API count

History

Uh oh!

vitaliidm left a comment

Choose a reason for hiding this comment

Uh oh!

kibanamachine commented Jun 12, 2024

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#6280

Uh oh!

Reviewers

Assignees

Labels

e40pud commented May 30, 2024 •

edited

Loading