[SIEM] - Top countries by source/dest tables

[stephmilovic]

Summary

Resolves https://github.com/elastic/siem-team/issues/464

Implements Top Countries table on both Network and IP Details page. This was largely a copy/pasta of the TopNFlow table/query.

The table is in a tab on the Network page:

And between IPs and Users on the IP Details page:

A good link that has a lengthy response of countries on the IP details page: http://localhost:5601/app/siem#/network/ip/10.142.0.7?_g=()&timerange=(global:(linkTo:!(timeline),timerange:(from:1570949998180,kind:absolute,to:1571093998180)),timeline:(linkTo:!(global),timerange:(from:1570949998180,kind:absolute,to:1571093998180)))

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

• This was checked for cross-browser compatibility, including a check against IE11
• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• This was checked for keyboard-only and screenreader accessibility

For maintainers

• This was checked for breaking API changes and was labeled appropriately
• This includes a feature addition or change that requires a release note and was labeled appropriately

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[elasticmachine]

💔 Build Failed

• continuous-integration/kibana-ci/pull-request
• Commit: 159f51d

[elasticmachine]

💔 Build Failed

• continuous-integration/kibana-ci/pull-request
• Commit: fefcd56

[elasticmachine]

💔 Build Failed

• continuous-integration/kibana-ci/pull-request
• Commit: fd4826d

[cwurm]

On the IP Details page, we don't need Destination IPs on the Source Countries and Source IPs on Destination Countries - since we filter down to just one IP they'll always be 1.

I personally imagined the countries tables to be below the IP tables on the Network page as well - not in its own tab, but together in a Flows tab. Not sure what others thought? @tsg, @andrewkroh, @MichaelMarcialis?

[stephmilovic]

On the IP Details page, we don't need Destination IPs on the Source Countries and Source IPs on Destination Countries - since we filter down to just one IP they'll always be 1.

@cwurm it is already filtered down, that was an old screenshot. please reference the updated screenshot ;)

[elasticmachine]

💔 Build Failed

• continuous-integration/kibana-ci/pull-request
• Commit: 33ec6fb

[elasticmachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: b6a8e3b

[spong]

No change necessary since we're not doing it anywhere else, but I wonder if we should be using the format:number:defaultPattern Kibana advanced setting to format these numerals?

[spong]

Should we be using the format:number:defaultLocale Kibana advanced setting for all these countries.getNames() calls?

e.g.

console.log("US (Alpha-2) => " + countries.getName("US", "en")); // United States of America
console.log("US (Alpha-2) => " + countries.getName("US", "de")); // Vereinigte Staaten von Amerika

from the i18n-iso-countries docs.

[stephmilovic]

We then need to load all languages. I think we talked about this @cwurm but can't remember why we ended up with english only??

[spong]

Hmmm... If that's the case, we could use typescript's dynamic import to resolve that issue pretty easily.

As for not previously using it -- perhaps it was because country names are often stored as their English counterpart in Elasticsearch directly? Doesn't look like we're using the localized country name in any DnD/AddToKql components, so that should be fine too?

Either way, just something to note 🙂

[XavierM]

I think by creating one updateNetworksTableActivePage and adding the networkType in your action as an attribute will simplify some type issue.

[stephmilovic]

I've got an issue for this: #48332
Along with the selectors: #48330

[spong]

Checked out, performed code review, and tested locally -- from pagination, DnD, column sorting, Network vs IP Details, timefilter/refresh updates, KQL changes, tab changes, etc...

Fantastic work here @stephmilovic -- I officially declare you Champion of the Tables! I've left a few nits and cleanups that might be good to take care of now while you have a chance, but nothing major holding up this PR (you may want to open an issue to track the column sorts being persistent between pages though).

Thanks for the efficient introduction of the new Countries tables! 🎉 🚀 🙂

L	G	T	M
o	o	o	e
o	o		!
k	d
s

[elasticmachine]

💔 Build Failed

• continuous-integration/kibana-ci/pull-request
• Commit: fe214fe

[elasticmachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 8350421