Skip to content

[Security Solution] Integrations card in automatic migrations#221493

Merged
semd merged 12 commits intoelastic:mainfrom
semd:12309/siem_migrations/integrations_card
May 28, 2025
Merged

[Security Solution] Integrations card in automatic migrations#221493
semd merged 12 commits intoelastic:mainfrom
semd:12309/siem_migrations/integrations_card

Conversation

@semd
Copy link
Contributor

@semd semd commented May 26, 2025 •
edited by kibanamachine
Loading

Summary

issue: https://github.com/elastic/security-team/issues/12309

Introduces the integrations card in the SIEM migrations topic, after the "start rule migration" card.

Requirements:

  • The same integrations card UI as the rest of the onboarding topics.
  • When no migration is complete, show the same recommended integrations as the default topic.
  • When some migration is complete, show the integrations detected by the rule migrations (all of them).
    • Render a label next to the title showing the number of migration rules linked to the integration (both prebuilt and custom rules)
    • Sort the integrations list by the number of rules linked.
  • As the last integration item in the list, render a card to link the integration auto-import

Screenshots

When no migration has been executed yet:

without migration

When some migrations have been completed:

with migration

Auto import card is appended at the end:

auto-import card

@semd semd self-assigned this May 26, 2025
@semd semd added release_note:skip Skip the PR/issue when compiling release notes Team:Threat Hunting Security Solution Threat Hunting Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. backport:version Backport to applied version labels v9.1.0 v8.19.0 labels May 26, 2025
@semd semd changed the title [Security Solution] Rule automatic migration integrations card [Security Solution] Integrations card in automatic migrations May 26, 2025
@semd semd marked this pull request as ready for review May 27, 2025 11:28
@semd semd requested review from a team as code owners May 27, 2025 11:28
@elasticmachine
Copy link
Contributor

elasticmachine commented May 27, 2025

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

@elasticmachine
Copy link
Contributor

elasticmachine commented May 27, 2025

Pinging @elastic/security-solution (Team: SecuritySolution)

@botelastic botelastic bot added the Team:Fleet Team label for Observability Data Collection Fleet team label May 27, 2025
@elasticmachine
Copy link
Contributor

elasticmachine commented May 27, 2025

Pinging @elastic/fleet (Team:Fleet)

agusruidiazgd
agusruidiazgd approved these changes May 27, 2025
View reviewed changes
Copy link
Contributor

@agusruidiazgd agusruidiazgd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - Thanks Sergi! 😸

.../security_solution/public/common/lib/integrations/hooks/integration_card_grid_tabs.styles.ts
Comment on lines +12 to +16
const { euiTheme, colorMode } = useEuiTheme();
if (colorMode !== COLOR_MODES_STANDARD.dark) {
return undefined;
}
// only apply styles in dark mode
Copy link
Contributor

@agusruidiazgd agusruidiazgd May 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nicely done 💯

...security_solution/server/lib/siem_migrations/rules/data/rule_migrations_data_rules_client.ts
}

/** Maximum size for searches, aggregations and terms queries */
const QUERY_MAX_SIZE = 10_000 as const;
Copy link
Contributor

@agusruidiazgd agusruidiazgd May 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✨

juliaElastic
juliaElastic approved these changes May 27, 2025
View reviewed changes
Copy link
Contributor

@juliaElastic juliaElastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fleet change LGTM

semd added 2 commits May 28, 2025 11:55
@semd
review requests
ca2b4dc
@semd
Merge remote-tracking branch 'refs/remotes/origin/12309/siem_migratio…
a2f7dd6 
…ns/integrations_card' into 12309/siem_migrations/integrations_card
@elasticmachine
Copy link
Contributor

elasticmachine commented May 28, 2025

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 7401 7407 +6

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id before after diff
fleet 1416 1417 +1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
fleet 1.7MB 1.7MB +354.0B
securitySolution 9.2MB 9.2MB +3.4KB
total +3.7KB
Unknown metric groups

API count

id before after diff
fleet 1545 1546 +1

async chunk count

id before after diff
securitySolution 103 105 +2

ESLint disabled line counts

id before after diff
securitySolution 573 574 +1

Total ESLint disabled count

id before after diff
securitySolution 660 661 +1

History

cc @semd

logeekal
logeekal reviewed May 28, 2025
View reviewed changes
...boarding/components/onboarding_body/cards/siem_migrations/integrations/integrations_card.tsx
topCalloutRenderer?: TopCalloutRenderer;
}

export const SecurityMigrationIntegrations = withAvailablePackages<SecurityIntegrationsProps>(
Copy link
Contributor

@logeekal logeekal May 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit - Consider moving this component in its own file.

logeekal
logeekal approved these changes May 28, 2025
View reviewed changes
Copy link
Contributor

@logeekal logeekal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀 . Added some small nits but no blocker from my side.

Thank you for incorporating the feedback.

@semd semd merged commit b5915de into elastic:main May 28, 2025
10 checks passed
@kibanamachine
Copy link
Contributor

kibanamachine commented May 28, 2025

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/15301412830

@kibanamachine
Copy link
Contributor

kibanamachine commented May 28, 2025

💔 All backports failed

Status Branch Result
❌ 8.19 Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 221493

Questions ?

Please refer to the Backport tool documentation

@semd semd mentioned this pull request May 28, 2025
Merged
2 tasks
@kibanamachine kibanamachine mentioned this pull request May 29, 2025
Merged
1 task
akowalska622 pushed a commit to akowalska622/kibana that referenced this pull request May 29, 2025
@semd @kibanamachine @akowalska622
[Security Solution] Integrations card in automatic migrations (elasti…
c31a077 
…c#221493)

## Summary

issue: elastic/security-team#12309

Introduces the integrations card in the SIEM migrations topic, after the
"start rule migration" card.

Requirements:

- The same integrations card UI as the rest of the onboarding topics.
- When no migration is complete, show the same recommended integrations
as the default topic.
- When some migration is complete, show the integrations detected by the
rule migrations (all of them).
- Render a label next to the title showing the number of migration rules
linked to the integration (both prebuilt and custom rules)
  - Sort the integrations list by the number of rules linked.
- As the last integration item in the list, render a card to link the
integration auto-import

### Screenshots

When no migration has been executed yet:

![without
migration](https://github.com/user-attachments/assets/de1ccd87-37b0-43fd-b52e-a044712520b0)

When some migrations have been completed:

![with
migration](https://github.com/user-attachments/assets/0bc520cd-ce35-4299-a242-bbc89a5be061)

Auto import card is appended at the end:

![auto-import
card](https://github.com/user-attachments/assets/577172f9-d348-4764-9f4e-f769a4c4a03b)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
This was referenced May 29, 2025
Merged
Merged
Merged
@kibanamachine kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label May 30, 2025
@kibanamachine
Copy link
Contributor

kibanamachine commented May 30, 2025

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 221493 locally
cc: @semd

1 similar comment
@kibanamachine
Copy link
Contributor

kibanamachine commented Jun 2, 2025

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 221493 locally
cc: @semd

@kibanamachine kibanamachine mentioned this pull request Jun 3, 2025
Merged
7 tasks
@kibanamachine
Copy link
Contributor

kibanamachine commented Jun 3, 2025

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 221493 locally
cc: @semd

1 similar comment
@kibanamachine
Copy link
Contributor

kibanamachine commented Jun 4, 2025

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 221493 locally
cc: @semd

zacharyparikh pushed a commit to zacharyparikh/kibana that referenced this pull request Jun 4, 2025
@semd @kibanamachine @zacharyparikh
[Security Solution] Integrations card in automatic migrations (elasti…
d7ef309 
…c#221493)

## Summary

issue: elastic/security-team#12309

Introduces the integrations card in the SIEM migrations topic, after the
"start rule migration" card.

Requirements:

- The same integrations card UI as the rest of the onboarding topics.
- When no migration is complete, show the same recommended integrations
as the default topic.
- When some migration is complete, show the integrations detected by the
rule migrations (all of them).
- Render a label next to the title showing the number of migration rules
linked to the integration (both prebuilt and custom rules)
  - Sort the integrations list by the number of rules linked.
- As the last integration item in the list, render a card to link the
integration auto-import

### Screenshots

When no migration has been executed yet:

![without
migration](https://github.com/user-attachments/assets/de1ccd87-37b0-43fd-b52e-a044712520b0)

When some migrations have been completed:

![with
migration](https://github.com/user-attachments/assets/0bc520cd-ce35-4299-a242-bbc89a5be061)

Auto import card is appended at the end:

![auto-import
card](https://github.com/user-attachments/assets/577172f9-d348-4764-9f4e-f769a4c4a03b)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
@kibanamachine
Copy link
Contributor

kibanamachine commented Jun 5, 2025

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 221493 locally
cc: @semd

semd added a commit to semd/kibana that referenced this pull request Jun 6, 2025
@semd
[Security Solution] Integrations card in automatic migrations (elasti…
8eb2fd2 
…c#221493)

## Summary

issue: elastic/security-team#12309

Introduces the integrations card in the SIEM migrations topic, after the
"start rule migration" card.

Requirements:

- The same integrations card UI as the rest of the onboarding topics.
- When no migration is complete, show the same recommended integrations
as the default topic.
- When some migration is complete, show the integrations detected by the
rule migrations (all of them).
- Render a label next to the title showing the number of migration rules
linked to the integration (both prebuilt and custom rules)
  - Sort the integrations list by the number of rules linked.
- As the last integration item in the list, render a card to link the
integration auto-import

### Screenshots

When no migration has been executed yet:

![without
migration](https://github.com/user-attachments/assets/de1ccd87-37b0-43fd-b52e-a044712520b0)

When some migrations have been completed:

![with
migration](https://github.com/user-attachments/assets/0bc520cd-ce35-4299-a242-bbc89a5be061)

Auto import card is appended at the end:

![auto-import
card](https://github.com/user-attachments/assets/577172f9-d348-4764-9f4e-f769a4c4a03b)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
(cherry picked from commit b5915de)

# Conflicts:
#	x-pack/solutions/security/plugins/security_solution/public/common/lib/integrations/hooks/use_integration_card_list.ts
@semd
Copy link
Contributor Author

semd commented Jun 6, 2025

💚 All backports created successfully

Status Branch Result
✅ 8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

@semd semd mentioned this pull request Jun 6, 2025
Merged
semd added a commit that referenced this pull request Jun 6, 2025
@semd
[8.19] [Security Solution] Integrations card in automatic migrations (#…
483c12f 
…221493) (#222965)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Security Solution] Integrations card in automatic migrations
(#221493)](#221493)

<!--- Backport version: 10.0.0 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Sergi
Massaneda","email":"sergi.massaneda@elastic.co"},"sourceCommit":{"committedDate":"2025-05-28T13:27:59Z","message":"[Security
Solution] Integrations card in automatic migrations (#221493)\n\n##
Summary\n\nissue:
https://github.com/elastic/security-team/issues/12309\n\nIntroduces the
integrations card in the SIEM migrations topic, after the\n\"start rule
migration\" card.\n\nRequirements:\n\n- The same integrations card UI as
the rest of the onboarding topics.\n- When no migration is complete,
show the same recommended integrations\nas the default topic.\n- When
some migration is complete, show the integrations detected by the\nrule
migrations (all of them).\n- Render a label next to the title showing
the number of migration rules\nlinked to the integration (both prebuilt
and custom rules)\n - Sort the integrations list by the number of rules
linked.\n- As the last integration item in the list, render a card to
link the\nintegration auto-import\n\n### Screenshots\n\nWhen no
migration has been executed
yet:\n\n![without\nmigration](https://github.com/user-attachments/assets/de1ccd87-37b0-43fd-b52e-a044712520b0)\n\nWhen
some migrations have been
completed:\n\n![with\nmigration](https://github.com/user-attachments/assets/0bc520cd-ce35-4299-a242-bbc89a5be061)\n\nAuto
import card is appended at the
end:\n\n![auto-import\ncard](https://github.com/user-attachments/assets/577172f9-d348-4764-9f4e-f769a4c4a03b)\n\n---------\n\nCo-authored-by:
kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"b5915de827ecb1656e242c4e0bc4317b12d546cf","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","backport
missing","Team:Fleet","Team:Threat Hunting","Team:
SecuritySolution","backport:version","v9.1.0","v8.19.0"],"title":"[Security
Solution] Integrations card in automatic
migrations","number":221493,"url":"https://github.com/elastic/kibana/pull/221493","mergeCommit":{"message":"[Security
Solution] Integrations card in automatic migrations (#221493)\n\n##
Summary\n\nissue:
https://github.com/elastic/security-team/issues/12309\n\nIntroduces the
integrations card in the SIEM migrations topic, after the\n\"start rule
migration\" card.\n\nRequirements:\n\n- The same integrations card UI as
the rest of the onboarding topics.\n- When no migration is complete,
show the same recommended integrations\nas the default topic.\n- When
some migration is complete, show the integrations detected by the\nrule
migrations (all of them).\n- Render a label next to the title showing
the number of migration rules\nlinked to the integration (both prebuilt
and custom rules)\n - Sort the integrations list by the number of rules
linked.\n- As the last integration item in the list, render a card to
link the\nintegration auto-import\n\n### Screenshots\n\nWhen no
migration has been executed
yet:\n\n![without\nmigration](https://github.com/user-attachments/assets/de1ccd87-37b0-43fd-b52e-a044712520b0)\n\nWhen
some migrations have been
completed:\n\n![with\nmigration](https://github.com/user-attachments/assets/0bc520cd-ce35-4299-a242-bbc89a5be061)\n\nAuto
import card is appended at the
end:\n\n![auto-import\ncard](https://github.com/user-attachments/assets/577172f9-d348-4764-9f4e-f769a4c4a03b)\n\n---------\n\nCo-authored-by:
kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"b5915de827ecb1656e242c4e0bc4317b12d546cf"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/221493","number":221493,"mergeCommit":{"message":"[Security
Solution] Integrations card in automatic migrations (#221493)\n\n##
Summary\n\nissue:
https://github.com/elastic/security-team/issues/12309\n\nIntroduces the
integrations card in the SIEM migrations topic, after the\n\"start rule
migration\" card.\n\nRequirements:\n\n- The same integrations card UI as
the rest of the onboarding topics.\n- When no migration is complete,
show the same recommended integrations\nas the default topic.\n- When
some migration is complete, show the integrations detected by the\nrule
migrations (all of them).\n- Render a label next to the title showing
the number of migration rules\nlinked to the integration (both prebuilt
and custom rules)\n - Sort the integrations list by the number of rules
linked.\n- As the last integration item in the list, render a card to
link the\nintegration auto-import\n\n### Screenshots\n\nWhen no
migration has been executed
yet:\n\n![without\nmigration](https://github.com/user-attachments/assets/de1ccd87-37b0-43fd-b52e-a044712520b0)\n\nWhen
some migrations have been
completed:\n\n![with\nmigration](https://github.com/user-attachments/assets/0bc520cd-ce35-4299-a242-bbc89a5be061)\n\nAuto
import card is appended at the
end:\n\n![auto-import\ncard](https://github.com/user-attachments/assets/577172f9-d348-4764-9f4e-f769a4c4a03b)\n\n---------\n\nCo-authored-by:
kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"b5915de827ecb1656e242c4e0bc4317b12d546cf"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->
@kibanamachine kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Jun 6, 2025
nickpeihl pushed a commit to nickpeihl/kibana that referenced this pull request Jun 12, 2025
@semd @kibanamachine @nickpeihl
[Security Solution] Integrations card in automatic migrations (elasti…
c11f4c0 
…c#221493)

## Summary

issue: elastic/security-team#12309

Introduces the integrations card in the SIEM migrations topic, after the
"start rule migration" card.

Requirements:

- The same integrations card UI as the rest of the onboarding topics.
- When no migration is complete, show the same recommended integrations
as the default topic.
- When some migration is complete, show the integrations detected by the
rule migrations (all of them).
- Render a label next to the title showing the number of migration rules
linked to the integration (both prebuilt and custom rules)
  - Sort the integrations list by the number of rules linked.
- As the last integration item in the list, render a card to link the
integration auto-import

### Screenshots

When no migration has been executed yet:

![without
migration](https://github.com/user-attachments/assets/de1ccd87-37b0-43fd-b52e-a044712520b0)

When some migrations have been completed:

![with
migration](https://github.com/user-attachments/assets/0bc520cd-ce35-4299-a242-bbc89a5be061)

Auto import card is appended at the end:

![auto-import
card](https://github.com/user-attachments/assets/577172f9-d348-4764-9f4e-f769a4c4a03b)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@logeekal logeekal logeekal approved these changes

@NicholasPeretti NicholasPeretti NicholasPeretti left review comments

@agusruidiazgd agusruidiazgd agusruidiazgd approved these changes

@juliaElastic juliaElastic juliaElastic approved these changes

Assignees

@semd semd

Labels

backport:version Backport to applied version labels release_note:skip Skip the PR/issue when compiling release notes Team:Fleet Team label for Observability Data Collection Fleet team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting Security Solution Threat Hunting Team v8.19.0 v9.1.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@semd @elasticmachine @kibanamachine @logeekal @NicholasPeretti @agusruidiazgd @juliaElastic