Skip to content

[SecuritySolution] Fix account switch visualisation and remove filter for multiple fields#227574

Merged
machadoum merged 7 commits intoelastic:mainfrom
machadoum:siem-ea-226166
Jul 16, 2025
Merged

[SecuritySolution] Fix account switch visualisation and remove filter for multiple fields#227574
machadoum merged 7 commits intoelastic:mainfrom
machadoum:siem-ea-226166

Conversation

@machadoum
Copy link
Member

@machadoum machadoum commented Jul 11, 2025 •
edited by kibanamachine
Loading

Summary

  • Update the account switch query to return data from non-endpoint logs
    • It adds a FORK
  • Add su .* to the query filter for match commands like su admin
  • Remove filter from the UI for columns represented by multiple fields
    • This filter is removed to avoid bugs, since we can't filter by multiple fields
  • Update the new dataview to use the Explorer sourcerer

*** To test the new data view, you have to enable newDataViewPickerEnabled

ECS docs ⬇️

Location Field Set Description
user.effective.* user User whose privileges were assumed

@machadoum machadoum self-assigned this Jul 11, 2025
This was referenced Jul 11, 2025
Merged
Closed
@machadoum machadoum added release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Theme: entity_analytics Feature:Entity Analytics Security Solution Entity Analytics features Team:Entity Analytics Security Entity Analytics Team backport:version Backport to applied version labels v9.1.0 labels Jul 11, 2025
@machadoum machadoum marked this pull request as ready for review July 11, 2025 08:20
@machadoum machadoum requested a review from a team as a code owner July 11, 2025 08:20
@machadoum machadoum requested a review from hop-dev July 11, 2025 08:20
@elasticmachine
Copy link
Contributor

elasticmachine commented Jul 11, 2025

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

elasticmachine commented Jul 11, 2025

Pinging @elastic/security-entity-analytics (Team:Entity Analytics)

@machadoum machadoum requested a review from hop-dev July 15, 2025 12:37
@elasticmachine
Copy link
Contributor

elasticmachine commented Jul 15, 2025 •
edited
Loading

💔 Build Failed

Failed CI Steps

Test Failures

  • [job] [logs] Serverless Rule Management - Security Solution Cypress Tests #4 / Detection rules, bulk edit of rule actions All actions privileges Add a rule action to rules (new connector) Add a rule action to rules (new connector)
  • [job] [logs] Rule Management - Security Solution Cypress Tests #2 / Detection rules, bulk edit of rule actions All actions privileges Add a rule action to rules (new connector) Add a rule action to rules (new connector)

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 9.8MB 9.8MB +259.0B

History

cc @machadoum

tiansivive
tiansivive approved these changes Jul 16, 2025
View reviewed changes
Copy link
Contributor

@tiansivive tiansivive left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

code LGTM

@machadoum machadoum merged commit 7e191f9 into elastic:main Jul 16, 2025
13 checks passed
@kibanamachine
Copy link
Contributor

kibanamachine commented Jul 16, 2025

Starting backport for target branches: 9.1

https://github.com/elastic/kibana/actions/runs/16319996545

@kibanamachine
Copy link
Contributor

kibanamachine commented Jul 16, 2025

💔 All backports failed

Status Branch Result
❌ 9.1 Backport failed because of merge conflicts

You might need to backport the following PRs to 9.1:
- [SecuritySolution] [Bug] Hide timeline for priv mon onboarding (#225442)
- [Investigations][DataViews] - Remove non-performant toSpec usage (#225726)

Manual backport

To create the backport manually run:

node scripts/backport --pr 227574

Questions ?

Please refer to the Backport tool documentation

@machadoum machadoum mentioned this pull request Jul 16, 2025
Merged
@machadoum
Copy link
Member Author

machadoum commented Jul 16, 2025

💚 All backports created successfully

Status Branch Result
✅ 9.1

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

machadoum added a commit to machadoum/kibana that referenced this pull request Jul 16, 2025
@machadoum
[SecuritySolution] Fix account switch visualisation and remove filter…
6496187 
… for multiple fields (elastic#227574)

## Summary

* Update the account switch query to return data from non-endpoint logs
  * It adds a FORK
* Add `su .*` to the query filter for match commands like `su admin`
* Remove filter from the UI for columns represented by multiple fields
* This filter is removed to avoid bugs, since we can't filter by
multiple fields
* Update the new dataview to use the Explorer sourcerer

*** To test the new data view, you have to enable
`newDataViewPickerEnabled`

[ECS docs](https://www.elastic.co/docs/reference/ecs/ecs-user) ⬇️
Location | Field Set | Description
-- | -- | --
user.effective.* | user | User whose privileges were assumed

(cherry picked from commit 7e191f9)

# Conflicts:
#	x-pack/solutions/security/plugins/security_solution/public/entity_analytics/pages/entity_analytics_privileged_user_monitoring_page.tsx
machadoum added a commit that referenced this pull request Jul 16, 2025
@machadoum @kibanamachine @jaredburgettelastic
[9.1] [SecuritySolution] Fix account switch visualisation and remove …
9bcaee8 
…filter for multiple fields (#227574) (#228249)

# Backport

This will backport the following commits from `main` to `9.1`:
- [[SecuritySolution] Fix account switch visualisation and remove filter
for multiple fields
(#227574)](#227574)

<!--- Backport version: 10.0.1 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Pablo
Machado","email":"pablo.nevesmachado@elastic.co"},"sourceCommit":{"committedDate":"2025-07-16T12:52:39Z","message":"[SecuritySolution]
Fix account switch visualisation and remove filter for multiple fields
(#227574)\n\n## Summary\n\n* Update the account switch query to return
data from non-endpoint logs\n * It adds a FORK\n* Add `su .*` to the
query filter for match commands like `su admin` \n* Remove filter from
the UI for columns represented by multiple fields\n* This filter is
removed to avoid bugs, since we can't filter by\nmultiple fields\n*
Update the new dataview to use the Explorer sourcerer\n\n*** To test the
new data view, you have to enable\n`newDataViewPickerEnabled`\n\n\n[ECS
docs](https://www.elastic.co/docs/reference/ecs/ecs-user) ⬇️ \nLocation
| Field Set | Description\n-- | -- | --\nuser.effective.* | user | User
whose privileges were
assumed","sha":"7e191f90e8bcd2c08915045f518c4678f19708eb","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:
SecuritySolution","Theme: entity_analytics","Feature:Entity
Analytics","Team:Entity
Analytics","backport:version","v9.1.0","v9.2.0"],"title":"[SecuritySolution]
Fix account switch visualisation and remove filter for multiple
fields","number":227574,"url":"https://github.com/elastic/kibana/pull/227574","mergeCommit":{"message":"[SecuritySolution]
Fix account switch visualisation and remove filter for multiple fields
(#227574)\n\n## Summary\n\n* Update the account switch query to return
data from non-endpoint logs\n * It adds a FORK\n* Add `su .*` to the
query filter for match commands like `su admin` \n* Remove filter from
the UI for columns represented by multiple fields\n* This filter is
removed to avoid bugs, since we can't filter by\nmultiple fields\n*
Update the new dataview to use the Explorer sourcerer\n\n*** To test the
new data view, you have to enable\n`newDataViewPickerEnabled`\n\n\n[ECS
docs](https://www.elastic.co/docs/reference/ecs/ecs-user) ⬇️ \nLocation
| Field Set | Description\n-- | -- | --\nuser.effective.* | user | User
whose privileges were
assumed","sha":"7e191f90e8bcd2c08915045f518c4678f19708eb"}},"sourceBranch":"main","suggestedTargetBranches":["9.1"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/227574","number":227574,"mergeCommit":{"message":"[SecuritySolution]
Fix account switch visualisation and remove filter for multiple fields
(#227574)\n\n## Summary\n\n* Update the account switch query to return
data from non-endpoint logs\n * It adds a FORK\n* Add `su .*` to the
query filter for match commands like `su admin` \n* Remove filter from
the UI for columns represented by multiple fields\n* This filter is
removed to avoid bugs, since we can't filter by\nmultiple fields\n*
Update the new dataview to use the Explorer sourcerer\n\n*** To test the
new data view, you have to enable\n`newDataViewPickerEnabled`\n\n\n[ECS
docs](https://www.elastic.co/docs/reference/ecs/ecs-user) ⬇️ \nLocation
| Field Set | Description\n-- | -- | --\nuser.effective.* | user | User
whose privileges were
assumed","sha":"7e191f90e8bcd2c08915045f518c4678f19708eb"}}]}]
BACKPORT-->

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: jaredburgettelastic <jared.burgett@elastic.co>
Bluefinger pushed a commit to Bluefinger/kibana that referenced this pull request Jul 22, 2025
@machadoum @Bluefinger
[SecuritySolution] Fix account switch visualisation and remove filter…
5a79823 
… for multiple fields (elastic#227574)

## Summary

* Update the account switch query to return data from non-endpoint logs
  * It adds a FORK
* Add `su .*` to the query filter for match commands like `su admin` 
* Remove filter from the UI for columns represented by multiple fields
* This filter is removed to avoid bugs, since we can't filter by
multiple fields
* Update the new dataview to use the Explorer sourcerer

*** To test the new data view, you have to enable
`newDataViewPickerEnabled`


[ECS docs](https://www.elastic.co/docs/reference/ecs/ecs-user) ⬇️ 
Location | Field Set | Description
-- | -- | --
user.effective.* | user | User whose privileges were assumed
kertal pushed a commit to kertal/kibana that referenced this pull request Jul 25, 2025
@machadoum @kertal
[SecuritySolution] Fix account switch visualisation and remove filter…
ad1cee9 
… for multiple fields (elastic#227574)

## Summary

* Update the account switch query to return data from non-endpoint logs
  * It adds a FORK
* Add `su .*` to the query filter for match commands like `su admin` 
* Remove filter from the UI for columns represented by multiple fields
* This filter is removed to avoid bugs, since we can't filter by
multiple fields
* Update the new dataview to use the Explorer sourcerer

*** To test the new data view, you have to enable
`newDataViewPickerEnabled`


[ECS docs](https://www.elastic.co/docs/reference/ecs/ecs-user) ⬇️ 
Location | Field Set | Description
-- | -- | --
user.effective.* | user | User whose privileges were assumed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tiansivive tiansivive tiansivive approved these changes

@hop-dev hop-dev hop-dev approved these changes

Assignees

@machadoum machadoum

Labels

backport:version Backport to applied version labels Feature:Entity Analytics Security Solution Entity Analytics features release_note:skip Skip the PR/issue when compiling release notes Team:Entity Analytics Security Entity Analytics Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Theme: entity_analytics v9.1.0 v9.2.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@machadoum @elasticmachine @kibanamachine @tiansivive @hop-dev