[SECURITY SOLEIL] Fix selection of event type when no siem index signal created by XavierM · Pull Request #68291 · elastic/kibana

XavierM · 2020-06-04T17:01:43Z

Summary

Fixes an issue where the events filter in Timeline is not filtering-out non signal events.

To reproduce:

Drag a host to the timeline that does not have signals associated with it
In the timeline, change the events filter from All events to Alert events

Expected result

The non-signal events are no longer displayed

Actual result

The non-signal events still appear

Checklist

Unit or functional tests were updated or added to match the most common scenarios

elasticmachine · 2020-06-04T17:04:24Z

Pinging @elastic/siem (Team:SIEM)

andrew-goldstein

I'm wondering if the Inspect view shown in the screenshot below should display the non-existent index/sentinel value:

Pro

that's really the index being queried

Con

users may be confused when they see this unknown index

What do you think?

XavierM · 2020-06-04T20:38:12Z

I'm wondering if the Inspect view shown in the screenshot below should display the non-existent index/sentinel value:

Pro

that's really the index being queried

Con

users may be confused when they see this unknown index

What do you think?

Can we say there is no index? i mean instead of unknow... we can call it

no-index-uuid
no-alert-index-uuid

andrew-goldstein

When I exported a timeline from a 7.8 cloud instance with "eventType":"signal", and imported it in this branch, the events filter is blank, per the following screenshot:

I think this is a product of the rename to alerts and not the code in this PR.

andrew-goldstein · 2020-06-04T20:49:09Z

Can we say there is no index? i mean instead of unknow... we can call it

no-index-uuid

no-alert-index-uuid

I like the suggestion of no-alert-index-uuid

…ndex created

…e-without-signal-index

XavierM · 2020-06-05T17:05:33Z

@elasticmachine merge upstream

…erM/kibana into bug-event-type-without-signal-index

kibanamachine · 2020-06-05T19:05:18Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 7ec3913

History

💛 Build #52074 was flaky 806560c
💔 Build #52060 failed 9c69acf
💔 Build #51880 failed ceb0109

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

andrew-goldstein

Thanks for these fixes @XavierM! 🙏
Desk-tested locally:

against the repro steps in the issue (when no signals index exists in a space)
against the repro steps in a space where the signals index does exist
while toggling between All events / Raw events / Signal events for the two variants above
with an imported timeline that was exported from a 7.8 BC where the filter was set to "eventType":"signal"
when navigating from an alert on the detections page to the timeline via the Investigate in timeline action

LGTM 🚀

* master: (57 commits) Add app arch team as owner of datemath package (elastic#66880) [Observability] Landing page for Observability (elastic#67467) [SIEM] Fix timeline buildGlobalQuery (elastic#68320) Optimize saved objects getScopedClient and HTTP API (elastic#68221) [Maps] Fix mb-style interpolate style rule (elastic#68413) update script to always download node (elastic#68421) [SECURITY SOLEIL] Fix selection of event type when no siem index signal created (elastic#68291) [DOCS] Adds note about configuring File Data Visualizer (elastic#68407) [DOCS] Adds link from remote clusters to index patterns (elastic#68406) [QA] slack notify on failure (elastic#68126) upgrade eslint-plugin-react-hooks from 2.3.0 to 4.0.4 (elastic#68295) moving to jira to a gold license (elastic#67178) [DOCS] Revises doc on adding data (elastic#68038) [APM] Add ThemeProvider to support dark mode (elastic#68242) Make welcome screen disabling first action in loginIfPrompted (elastic#68238) [QA] Code coverage: unskip tests, collect tests results, exclude bundles from report (elastic#64477) [ML] Functional tests - disable flaky regression and classification creation test [Alerting] change eventLog ILM requests to absolute URLs (elastic#68331) Report page load asset size (elastic#66224) [SIEM][CASE] Change SIEM to Security (elastic#68365) ...

…al created (elastic#68291) * fix selection of event type when no siem index signal created * including the term signal for the old timeline * fix import path * Add a specific msg in the inspect modal if we do not have the alert index created * fix import if eventType is siganl to match it to alert * forget to update test * fix signal view Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

…x signal created (#68291) (#68557) * [SECURITY SOLEIL] Fix selection of event type when no siem index signal created (#68291) * fix selection of event type when no siem index signal created * including the term signal for the old timeline * fix import path * Add a specific msg in the inspect modal if we do not have the alert index created * fix import if eventType is siganl to match it to alert * forget to update test * fix signal view Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> * update translation Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

…al created (#68291) (#68551) * fix selection of event type when no siem index signal created * including the term signal for the old timeline * fix import path * Add a specific msg in the inspect modal if we do not have the alert index created * fix import if eventType is siganl to match it to alert * forget to update test * fix signal view Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

elasticmachine · 2021-09-23T14:34:04Z

Pinging @elastic/security-solution (Team: SecuritySolution)

fix selection of event type when no siem index signal created

9a8bb88

XavierM requested review from a team as code owners June 4, 2020 17:01

including the term signal for the old timeline

0248d7b

XavierM added release_note:skip Skip the PR/issue when compiling release notes Team:SIEM v7.8.0 v7.9.0 v8.0.0 labels Jun 4, 2020

XavierM requested a review from andrew-goldstein June 4, 2020 17:04

fix import path

ceb0109

andrew-goldstein reviewed Jun 4, 2020

View reviewed changes

XavierM added 4 commits June 5, 2020 09:03

Add a specific msg in the inspect modal if we do not have the alert i…

e2967d4

…ndex created

fix import if eventType is siganl to match it to alert

cb95a32

Merge branch 'master' of github.com:elastic/kibana into bug-event-typ…

9c69acf

…e-without-signal-index

forget to update test

806560c

elasticmachine and others added 3 commits June 5, 2020 10:05

Merge branch 'master' into bug-event-type-without-signal-index

f2b9588

fix signal view

072adfc

Merge branch 'bug-event-type-without-signal-index' of github.com:Xavi…

7ec3913

…erM/kibana into bug-event-type-without-signal-index

andrew-goldstein approved these changes Jun 5, 2020

View reviewed changes

XavierM merged commit e3d88a4 into elastic:master Jun 5, 2020

XavierM mentioned this pull request Jun 8, 2020

[7.x] [SECURITY SOLEIL] Fix selection of event type when no siem index signal created (#68291) #68551

Merged

XavierM mentioned this pull request Jun 8, 2020

[7.8] [SECURITY SOLEIL] Fix selection of event type when no siem index signal created (#68291) #68557

Merged

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

[SECURITY SOLEIL] Fix selection of event type when no siem index signal created#68291

[SECURITY SOLEIL] Fix selection of event type when no siem index signal created#68291
XavierM merged 10 commits intoelastic:masterfrom
XavierM:bug-event-type-without-signal-index

XavierM commented Jun 4, 2020

Uh oh!

elasticmachine commented Jun 4, 2020

Uh oh!

andrew-goldstein left a comment

Uh oh!

XavierM commented Jun 4, 2020 •

edited

Loading

Uh oh!

andrew-goldstein left a comment

Uh oh!

andrew-goldstein commented Jun 4, 2020

Uh oh!

XavierM commented Jun 5, 2020

Uh oh!

kibanamachine commented Jun 5, 2020

Uh oh!

andrew-goldstein left a comment

Uh oh!

elasticmachine commented Sep 23, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Comments

Conversation

XavierM commented Jun 4, 2020

Summary

Checklist

Uh oh!

elasticmachine commented Jun 4, 2020

Uh oh!

andrew-goldstein left a comment

Choose a reason for hiding this comment

Uh oh!

XavierM commented Jun 4, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

andrew-goldstein left a comment

Choose a reason for hiding this comment

Uh oh!

andrew-goldstein commented Jun 4, 2020

Uh oh!

XavierM commented Jun 5, 2020

Uh oh!

kibanamachine commented Jun 5, 2020

💚 Build Succeeded

History

Uh oh!

andrew-goldstein left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Sep 23, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

XavierM commented Jun 4, 2020 •

edited

Loading