[Security solution] Guided onboarding rules

.github/relabel.yml

@@ -1,3 +1,3 @@
 issues:
   - missingLabel: needs-team
-    regex: ^(\:ml)|(Team:.*)$
+    regex: (^\:ml$)|(^Team:.+$)|(^EUI$)

.github/workflows/add-fleet-issues-to-ingest-project.yml

@@ -0,0 +1,51 @@
+name: Add Fleet issue to Platform Ingest project
+
+on:
+  issues:
+    types:
+      - labeled
+
+env:
+  INGEST_PROJECT_ID: 'PVT_kwDOAGc3Zs4AEzn4'
+  FLEET_LABEL: 'Team:Fleet'
+  AREA_FIELD_ID: 'PVTSSF_lADOAGc3Zs4AEzn4zgEgZSo'
+  FLEET_UI_OPTION_ID: '411a7b86'
+
+jobs:
+  add_to_ingest_project:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: octokit/graphql-action@v2.x
+        id: add_to_project
+        if: ${{ github.event.label.name == env.FLEET_LABEL }}
+        with:
+          query: |
+            # Variables have to be snake cased because of https://github.com/octokit/graphql-action/issues/164
+            mutation AddToIngestProject($project_id: ID!, $content_id: ID!) {
+              addProjectV2ItemById(input: { projectId: $project_id, contentId: $content_id }) {
+                  item {
+                    id
+                  }
+                }
+              }
+          project_id: ${{ env.INGEST_PROJECT_ID }}
+          content_id: ${{ github.event.issue.node_id }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.FLEET_TECH_KIBANA_USER_TOKEN }}
+      - uses: octokit/graphql-action@v2.x
+        id: set_fleet_ui_area
+        if: github.event.label.name == env.FLEET_LABEL
+        with:
+          query: |
+            mutation updateIngestArea($item_id: ID!, $project_id: ID!, $area_field_id: ID!, $area_id: String) {
+              updateProjectV2ItemFieldValue(
+                input: { itemId: $item_id, projectId: $project_id, fieldId: $area_field_id, value: { singleSelectOptionId: $area_id } }) {
+                  clientMutationId
+                }
+              }
+          item_id: ${{ fromJSON(steps.add_to_project.outputs.data).addProjectV2ItemById.item.id }}
+          project_id: ${{ env.INGEST_PROJECT_ID }}
+          area_field_id: ${{ env.AREA_FIELD_ID }}
+          area_id: ${{ env.FLEET_UI_OPTION_ID }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.FLEET_TECH_KIBANA_USER_TOKEN }}

docs/osquery/osquery.asciidoc

@@ -43,7 +43,7 @@ then view the results.
 and you'll get suggestions for agents by name, ID, platform, and policy.
 . Specify the query or pack to run:
 ** *Query*: Select a saved query or enter a new one in the text box. After you enter the query, you can expand the **Advanced** section to view or set <<osquery-map-fields,mapped ECS fields>> included in the results from the live query. Mapping ECS fields is optional.
-** *Pack*: Select from query packs that have been loaded and activated. After you select a pack, all of the queries in the pack are displayed.
+** *Pack*: Select from available query packs. After you select a pack, all of the queries in the pack are displayed.
 +
 TIP: Refer to <<osquery-prebuilt-packs,prebuilt packs>> to learn about using and managing Elastic prebuilt packs.
 +
@@ -173,13 +173,14 @@ For information about the prebuilt packs that are available, refer to <<prebuilt
 [[load-prebuilt-packs]]
 ==== Load and activate prebuilt Elastic packs
 
-. Go to *Packs*, and then click *Load Elastic prebuilt packs*.
-+
-NOTE: This option is only available if new or updated prebuilt packs are available.
+Follow these steps to load and turn on new or updated prebuilt packs:
 
-. For each pack that you want to schedule:
+. Go to *Packs*, and then click *Load Elastic prebuilt packs*.
+. For each pack that you want to activate and schedule:
 
-* Enable the option to make the pack *Active*.
+* Turn on the *Active* toggle to ensure the pack runs continuously.
++
+NOTE: You must manually run inactive packs.
 
 * Click the pack name, then *Edit*.
 

examples/guided_onboarding_example/public/components/app.tsx

@@ -59,7 +59,7 @@ export const GuidedOnboardingExampleApp = (props: GuidedOnboardingExampleAppDeps
                   <StepOne guidedOnboarding={guidedOnboarding} />
                 </Route>
                 <Route exact path="/stepTwo">
-                  <StepTwo guidedOnboarding={guidedOnboarding} />
+                  <StepTwo />
                 </Route>
                 <Route exact path="/stepThree">
                   <StepThree guidedOnboarding={guidedOnboarding} />

examples/guided_onboarding_example/public/components/main.tsx

@@ -259,6 +259,7 @@ export const Main = (props: MainProps) => {
                   { value: 'observability', text: 'observability' },
                   { value: 'security', text: 'security' },
                   { value: 'search', text: 'search' },
+                  { value: 'testGuide', text: 'test guide' },
                 ]}
                 value={selectedGuide}
                 onChange={(e) => {
@@ -294,7 +295,7 @@ export const Main = (props: MainProps) => {
           <h3>
             <FormattedMessage
               id="guidedOnboardingExample.main.examplePages.title"
-              defaultMessage="Example pages"
+              defaultMessage="Example pages for test guide"
             />
           </h3>
         </EuiText>
@@ -316,6 +317,14 @@ export const Main = (props: MainProps) => {
               />
             </EuiButton>
           </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <EuiButton onClick={() => history.push('stepThree')}>
+              <FormattedMessage
+                id="guidedOnboardingExample.main.examplePages.stepThree.link"
+                defaultMessage="Step 3"
+              />
+            </EuiButton>
+          </EuiFlexItem>
         </EuiFlexGroup>
       </EuiPageContentBody>
     </>

examples/guided_onboarding_example/public/components/step_one.tsx

@@ -32,7 +32,7 @@ export const StepOne = ({ guidedOnboarding }: GuidedOnboardingExampleAppDeps) =>
   const [isTourStepOpen, setIsTourStepOpen] = useState<boolean>(false);
 
   const isTourActive = useObservable(
-    guidedOnboardingApi!.isGuideStepActive$('search', 'add_data'),
+    guidedOnboardingApi!.isGuideStepActive$('testGuide', 'step1'),
     false
   );
   useEffect(() => {
@@ -45,7 +45,7 @@ export const StepOne = ({ guidedOnboarding }: GuidedOnboardingExampleAppDeps) =>
           <h2>
             <FormattedMessage
               id="guidedOnboardingExample.stepOne.title"
-              defaultMessage="Example step Add data"
+              defaultMessage="Example step 1"
             />
           </h2>
         </EuiTitle>
@@ -56,7 +56,7 @@ export const StepOne = ({ guidedOnboarding }: GuidedOnboardingExampleAppDeps) =>
             <FormattedMessage
               id="guidedOnboardingExample.guidesSelection.stepOne.explanation"
               defaultMessage="The code on this page is listening to the guided setup state with a useObservable hook. If the state is set to
-              Search guide, step Add data, a EUI tour will be displayed, pointing to the button below."
+              Test guide, step 1, a EUI tour will be displayed, pointing to the button below."
             />
           </p>
         </EuiText>
@@ -72,12 +72,12 @@ export const StepOne = ({ guidedOnboarding }: GuidedOnboardingExampleAppDeps) =>
           onFinish={() => setIsTourStepOpen(false)}
           step={1}
           stepsTotal={1}
-          title="Step Add data"
+          title="Step 1"
           anchorPosition="rightUp"
         >
           <EuiButton
             onClick={async () => {
-              await guidedOnboardingApi?.completeGuideStep('search', 'add_data');
+              await guidedOnboardingApi?.completeGuideStep('testGuide', 'step1');
             }}
           >
             Complete step 1

examples/guided_onboarding_example/public/components/step_three.tsx

@@ -30,7 +30,7 @@ export const StepThree = (props: StepThreeProps) => {
 
   useEffect(() => {
     const subscription = guidedOnboardingApi
-      ?.isGuideStepActive$('search', 'search_experience')
+      ?.isGuideStepActive$('testGuide', 'step3')
       .subscribe((isStepActive) => {
         setIsTourStepOpen(isStepActive);
       });
@@ -53,9 +53,17 @@ export const StepThree = (props: StepThreeProps) => {
         <EuiText>
           <p>
             <FormattedMessage
-              id="guidedOnboardingExample.guidesSelection.stepThree.explanation"
-              defaultMessage="The code on this page is listening to the guided setup state using an Observable subscription. If the state is set to
-              Search guide, step Search experience, a EUI tour will be displayed, pointing to the button below."
+              id="guidedOnboardingExample.guidesSelection.stepThree.explanation1"
+              defaultMessage="The code on this page is listening to the guided setup state using an Observable subscription.
+              If the state is set to Test, step 3, a EUI tour will be displayed, pointing to the button below."
+            />
+          </p>
+          <p>
+            <FormattedMessage
+              id="guidedOnboardingExample.guidesSelection.stepTwo.explanation2"
+              defaultMessage="This page is used for the manual completion of Test guide, step 3. After clicking the page,
+              the manual completion popover
+              should appear on the header button 'Setup guide' to open the panel and mark the step done."
             />
           </p>
         </EuiText>
@@ -73,12 +81,12 @@ export const StepThree = (props: StepThreeProps) => {
           }}
           step={1}
           stepsTotal={1}
-          title="Step Build search experience"
+          title="Step 3"
           anchorPosition="rightUp"
         >
           <EuiButton
             onClick={async () => {
-              await guidedOnboardingApi?.completeGuideStep('search', 'search_experience');
+              await guidedOnboardingApi?.completeGuideStep('testGuide', 'step3');
             }}
           >
             Complete step 3

examples/guided_onboarding_example/public/components/step_two.tsx

@@ -6,37 +6,17 @@
  * Side Public License, v 1.
  */
 
-import React, { useEffect, useState } from 'react';
+import React from 'react';
 
-import { EuiButton, EuiSpacer, EuiText, EuiTitle, EuiTourStep } from '@elastic/eui';
+import { EuiText, EuiTitle } from '@elastic/eui';
 
-import { GuidedOnboardingPluginStart } from '@kbn/guided-onboarding-plugin/public/types';
 import { FormattedMessage } from '@kbn/i18n-react';
 import {
   EuiPageContentHeader_Deprecated as EuiPageContentHeader,
   EuiPageContentBody_Deprecated as EuiPageContentBody,
 } from '@elastic/eui';
 
-interface StepTwoProps {
-  guidedOnboarding: GuidedOnboardingPluginStart;
-}
-
-export const StepTwo = (props: StepTwoProps) => {
-  const {
-    guidedOnboarding: { guidedOnboardingApi },
-  } = props;
-
-  const [isTourStepOpen, setIsTourStepOpen] = useState<boolean>(false);
-
-  useEffect(() => {
-    const subscription = guidedOnboardingApi
-      ?.isGuideStepActive$('search', 'browse_docs')
-      .subscribe((isStepActive) => {
-        setIsTourStepOpen(isStepActive);
-      });
-    return () => subscription?.unsubscribe();
-  }, [guidedOnboardingApi]);
-
+export const StepTwo = () => {
   return (
     <>
       <EuiPageContentHeader>
@@ -54,36 +34,11 @@ export const StepTwo = (props: StepTwoProps) => {
           <p>
             <FormattedMessage
               id="guidedOnboardingExample.guidesSelection.stepTwo.explanation"
-              defaultMessage="The code on this page is listening to the guided setup state using an Observable subscription. If the state is set to
-              Search guide, step Browse documents, a EUI tour will be displayed, pointing to the button below."
+              defaultMessage="This page is used for the manual completion of Test guide, step 2. The manual completion popover
+              should appear on the header button 'Setup guide' to open the panel and mark the step done."
             />
           </p>
         </EuiText>
-        <EuiSpacer />
-        <EuiTourStep
-          content={
-            <EuiText>
-              <p>Click this button to complete step 2.</p>
-            </EuiText>
-          }
-          isStepOpen={isTourStepOpen}
-          minWidth={300}
-          onFinish={() => {
-            setIsTourStepOpen(false);
-          }}
-          step={1}
-          stepsTotal={1}
-          title="Step Browse documents"
-          anchorPosition="rightUp"
-        >
-          <EuiButton
-            onClick={async () => {
-              await guidedOnboardingApi?.completeGuideStep('search', 'browse_docs');
-            }}
-          >
-            Complete step 2
-          </EuiButton>
-        </EuiTourStep>
       </EuiPageContentBody>
     </>
   );

package.json

@@ -1319,7 +1319,7 @@
     "callsites": "^3.1.0",
     "chance": "1.0.18",
     "chokidar": "^3.5.3",
-    "chromedriver": "^105.0.1",
+    "chromedriver": "^107.0.0",
     "clean-webpack-plugin": "^3.0.0",
     "compression-webpack-plugin": "^4.0.0",
     "copy-webpack-plugin": "^6.0.2",
@@ -1328,13 +1328,13 @@
     "cssnano": "^5.1.12",
     "cssnano-preset-default": "^5.2.12",
     "csstype": "^3.0.2",
-    "cypress": "^10.9.0",
+    "cypress": "^10.10.0",
     "cypress-axe": "^1.0.0",
     "cypress-file-upload": "^5.0.8",
     "cypress-multi-reporters": "^1.6.1",
     "cypress-pipe": "^2.0.0",
     "cypress-react-selector": "^3.0.0",
-    "cypress-real-events": "^1.7.1",
+    "cypress-real-events": "^1.7.2",
     "cypress-recurse": "^1.23.0",
     "debug": "^2.6.9",
     "delete-empty": "^2.0.0",

packages/kbn-apm-config-loader/src/apm_config.ts

@@ -8,14 +8,12 @@
 
 import { schema } from '@kbn/config-schema';
 
-export const apmConfigSchema = schema.object({
-  apm: schema.object(
-    {
-      active: schema.maybe(schema.boolean()),
-      serverUrl: schema.maybe(schema.uri()),
-      secretToken: schema.maybe(schema.string()),
-      globalLabels: schema.object({}, { unknowns: 'allow' }),
-    },
-    { unknowns: 'allow' }
-  ),
-});
+export const apmConfigSchema = schema.object(
+  {
+    active: schema.maybe(schema.boolean()),
+    serverUrl: schema.maybe(schema.uri()),
+    secretToken: schema.maybe(schema.string()),
+    globalLabels: schema.object({}, { unknowns: 'allow' }),
+  },
+  { unknowns: 'allow' }
+);

packages/kbn-apm-synthtrace/index.ts

@@ -8,6 +8,7 @@
 
 export { timerange } from './src/lib/timerange';
 export { apm } from './src/lib/apm';
+export { dedot } from './src/lib/utils/dedot';
 export { stackMonitoring } from './src/lib/stack_monitoring';
 export { observer } from './src/lib/agent_config';
 export { cleanWriteTargets } from './src/lib/utils/clean_write_targets';

packages/kbn-apm-synthtrace/src/lib/apm/apm_error.ts

@@ -27,4 +27,10 @@ export class ApmError extends Serializable<ApmFields> {
     );
     return [data];
   }
+
+  timestamp(value: number) {
+    const ret = super.timestamp(value);
+    this.fields['timestamp.us'] = value * 1000;
+    return ret;
+  }
 }