[Security Solution] Add EQL query editable component with EQL options fields #199115

maximpn · 2024-11-06T12:19:41Z

Partially addresses: #171520

Summary

This PR adds is built on top of #193828 and #196948 and adds an EQL Query editable component with EQL Options fields (event_category_override, timestamp_field and tiebreaker_field) for Three Way Diff tab's final edit side of the upgrade prebuilt rule workflow.

Details

This PR make a set of changes to make existing EQL Query bar component easily reusable and type safe when used in forms. In particular the following was done

EQL query bar was wrapped in EqlQueryEdit component with UseField inside. It helps to make it type safe avoiding issues like passing invalid types to EqlQueryBar. UseField types component properties as Record<string, any> so potentially any refactoring can break some functionality. For example code in Timeline passes DataViewSpec where DataViewBase is expected while these two types aren't fully compatible.
Validation was added directly to EqlQueryEdit. Passing field configuration to UseField rewrites field configuration defined in from schema. It leads to cases when validation is defined in both form schema and as a field configuration for UseFields. Additionally we can reduce reusing complexity by incapsulating absolutely required validation in EqlQueryEdit component.
Empty string tiebreakerField was removed in Timelines. tiebreakerField is part of EQL options used for EQL validation. EQL validation endpoint /internal/search/eql returns an error when an empty string provided for tiebreakerField. This problem didn't surface earlier since It looks like EQL options weren't provided correctly before this PR. Timeline EQL validation requests were sent without EQL options.

How to test

The simplest way to test is via patching installed prebuilt rules via Rule Patch API. Please follow steps below

Ensure the prebuiltRulesCustomizationEnabled feature flag is enabled
Run Kibana locally
Install an EQL prebuilt rule, e.g. Potential Code Execution via Postgresql with rule_id 2a692072-d78d-42f3-a48a-775677d79c4e
Patch the installed rule by running a query below

curl -X PATCH --user elastic:changeme  -H 'Content-Type: application/json' -H 'kbn-xsrf: 123' -H "elastic-api-version: 2023-10-31" -d '{"rule_id":"2a692072-d78d-42f3-a48a-775677d79c4e","version":1,"query":"process where process.name == \"cmd.exe\"","language":"eql","event_category_override": "test","timestamp_field": "@timestamp","tiebreaker_field": "tiebreaker"}' http://localhost:5601/kbn/api/detection_engine/rules

Open Detection Rules (SIEM) Page -> Rule Updates -> click on Potential Code Execution via Postgresql rule -> expand EQL Query to see EQL Query -> press Edit button

Screenshots

EQL Query in Prebuilt Rules Update workflow

event_category_override + tiebreaker_field + timestamp_field (aka EQL options) in Prebuilt Rules Update workflow

Examples of invalid EQL

maximpn · 2024-11-07T07:32:26Z

x-pack/plugins/security_solution/public/timelines/store/defaults.ts

@@ -33,7 +33,6 @@ export const timelineDefaults: SubsetTimelineModel &
  description: '',
  eqlOptions: {
    eventCategoryField: 'event.category',
-    tiebreakerField: '',


tiebreakerField as an empty doesn't look correct for the EQL validator. It sends requests to /internal/search/eql to validate the request. It returns an error when a tiebreaker field has an empty string.

Additionally it looks like EQL options weren't provided correctly before this PR. Timeline EQL validation requests were sent without EQL options.

elasticmachine · 2024-11-07T07:49:48Z

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine · 2024-11-07T07:49:49Z

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine · 2024-11-07T07:49:51Z

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

yctercero · 2024-11-11T07:25:14Z

Thanks for all the work here! Pulled down and tested in rule creation/edit flow. So far LGTM. Confirmed that logic around disabling suppression for sequence queries remains. cc @dhurley14

nikitaindik · 2024-11-11T15:44:59Z

...t/components/rule_details/three_way_diff/final_edit/fields/eql_query/eql_query_edit_form.tsx

+  QueryLanguageEnum,
+} from '../../../../../../../../../common/api/detection_engine';
+import { EqlQueryEditAdapter } from './eql_query_edit_adapter';
+// import {


Commented out code. Can be removed.

nikitaindik · 2024-11-11T15:45:05Z

...t/components/rule_details/three_way_diff/final_edit/fields/eql_query/eql_query_edit_form.tsx

+  eqlQuery: {
+    validations: [
+      // {
+      //   validator: debounceAsync(eqlValidator, 300),


Commented out code. Can be removed.

nikitaindik · 2024-11-11T15:46:02Z

...t/components/rule_details/three_way_diff/final_edit/fields/eql_query/eql_query_edit_form.tsx

+  );
+}
+
+const kqlQuerySchema = {


Since there are no validations we can probably remove the schema

RuleFieldEditFormWrapper's ruleFieldFormSchema property is required. We still should pass an empty object. So removing it completely it's possible.

Got it. Then let's rename it to eqlQuerySchema.

nikitaindik · 2024-11-11T15:48:29Z

For some reason getting an EQL validation error in the upgrade flyout, but on the the Rule Editing page.

The error is shown right away, after opening the edit mode. Prevents me from saving.

EQL query I used

api where host.os.type == "win" and 
  process.Ext.api.name in ("OpenProcess", "OpenThread") and Target.process.name : "lsass.exe" and 
  not 
  (
    process.executable : (
        "?:\\ProgramData\\GetSupportService*\\Updates\\Update_*.exe",
        "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
        "?:\\Program Files (x86)\\Asiainfo Security\\OfficeScan Client\\NTRTScan.exe",
        "?:\\Program Files (x86)\\Blackpoint\\SnapAgent\\SnapAgent.exe",
        "?:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\EFR\\EFRService.exe",
        "?:\\Program Files (x86)\\CyberCNSAgent\\osqueryi.exe",
        "?:\\Program Files (x86)\\cisco\\cisco anyconnect secure mobility client\\vpnagent.exe",
        "?:\\Program Files (x86)\\cisco\\cisco anyconnect secure mobility client\\aciseagent.exe",
        "?:\\Program Files (x86)\\cisco\\cisco anyconnect secure mobility client\\vpndownloader.exe",
        "?:\\Program Files (x86)\\eScan\\reload.exe",
        "?:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe",
        "?:\\Program Files (x86)\\Kaspersky Lab\\*\\avp.exe",
        "?:\\Program Files (x86)\\microsoft intune management extension\\microsoft.management.services.intunewindowsagent.exe",
        "?:\\Program Files (x86)\\N-able Technologies\\Reactive\\bin\\NableReactiveManagement.exe",
        "?:\\Program Files (x86)\\N-able Technologies\\Windows Agent\\bin\\agent.exe",
        "?:\\Program Files (x86)\\Tanium\\Tanium Client\\TaniumClient.exe",
        "?:\\Program Files (x86)\\Trend Micro\\*\\CCSF\\TmCCSF.exe",
        "?:\\Program Files (x86)\\Trend Micro\\Security Agent\\TMASutility.exe",
        "?:\\Program Files*\\Windows Defender\\MsMpEng.exe",
        "?:\\Program Files\\Bitdefender\\Endpoint Security\\EPSecurityService.exe",
        "?:\\Program Files\\Cisco\\AMP\\*\\sfc.exe",
        "?:\\Program Files\\Common Files\\McAfee\\AVSolution\\mcshield.exe",
        "?:\\Program Files\\EA\\AC\\EAAntiCheat.GameService.exe",
        "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\agentbeat.exe",
        "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\metricbeat.exe",
        "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\osqueryd.exe",
        "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\packetbeat.exe",
        "?:\\Program Files\\ESET\\ESET Security\\ekrn.exe",
        "?:\\Program Files\\Fortinet\\FortiClient\\FortiProxy.exe",
        "?:\\Program Files\\Fortinet\\FortiClient\\FortiSSLVPNdaemon.exe",
        "?:\\Program Files\\Goverlan Inc\\GoverlanAgent\\GovAgentx64.exe",
        "?:\\Program Files\\Huntress\\HuntressAgent.exe",
        "?:\\Program Files\\LogicMonitor\\Agent\\bin\\sbshutdown.exe",
        "?:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe",
        "?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\Health Service State\\*\\pmfexe.exe", 
        "?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe",
        "?:\\Program Files\\Qualys\\QualysAgent\\QualysAgent.exe",
        "?:\\Program Files\\smart-x\\controlupagent\\version*\\cuagent.exe",
        "?:\\Program Files\\TDAgent\\ossec-agent\\ossec-agent.exe",
        "?:\\Program Files\\Topaz OFD\\Warsaw\\core.exe",
        "?:\\Program Files\\Trend Micro\\Deep Security Agent\\netagent\\tm_netagent.exe",
        "?:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe",
        "?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe",
        "?:\\Program Files\\Wise\\Wise Memory Optimizer\\WiseMemoryOptimzer.exe",
        "?:\\Windows\\AdminArsenal\\PDQDeployRunner\\*\\exec\\Sysmon64.exe",
        "?:\\Windows\\Sysmon.exe",
        "?:\\Windows\\Sysmon64.exe",
        "?:\\Windows\\System32\\csrss.exe",
        "?:\\Windows\\System32\\MRT.exe",
        "?:\\Windows\\System32\\msiexec.exe",
        "?:\\Windows\\System32\\taskhostw.exe",
        "?:\\Windows\\System32\\RtkAudUService64.exe",
        "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
        "?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe",
        "?:\\Windows\\tenable_mw_scan_142a90001fb65e0beb1751cc8c63edd0.exe"
    ) and not ?process.code_signature.trusted == false
  )

elasticmachine · 2024-11-21T23:24:43Z

💔 Build Failed

Failed CI Steps

Test Failures

[job] [logs] FTR Configs #69 / discover/group4 data view flyout "after all" hook for "update data view with no time field"
[job] [logs] FTR Configs #69 / discover/group4 data view flyout create saved data view
[job] [logs] FTR Configs #91 / Rules Management - Prebuilt Rules - Prebuilt Rules Management @ess @serverless @skipInServerlessMKI Perform Prebuilt Rules Upgrades - mode: SPECIFIC_RULES successful updates successfully resolves a non-resolvable conflict by using pick_version:RESOLVED for that field
[job] [logs] FTR Configs #106 / Rules Management - Prebuilt Rules - Prebuilt Rules Management @ess @serverless @skipInServerlessMKI Perform Prebuilt Rules Upgrades - mode: SPECIFIC_RULES successful updates successfully resolves a non-resolvable conflict by using pick_version:RESOLVED for that field
[job] [logs] FTR Configs #106 / Rules Management - Prebuilt Rules - Prebuilt Rules Management @ess @serverless @skipInServerlessMKI Perform Prebuilt Rules Upgrades - mode: SPECIFIC_RULES successful updates successfully resolves a non-resolvable conflict by using pick_version:RESOLVED for that field
[job] [logs] FTR Configs #91 / Rules Management - Prebuilt Rules - Prebuilt Rules Management @ess @serverless @skipInServerlessMKI Perform Prebuilt Rules Upgrades - mode: SPECIFIC_RULES successful updates successfully resolves a non-resolvable conflict by using pick_version:RESOLVED for that field

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`lists`	342	343	+1
`securitySolution`	6218	6222	+4
total			+5

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/securitysolution-utils`	54	55	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	13.4MB	13.4MB	+3.5KB

Unknown metric groups

API count

id	before	after	diff
`@kbn/securitysolution-utils`	60	63	+3

References to deprecated APIs

id	before	after	diff
`securitySolution`	438	437	-1

History

💔 Build #253287 failed 45bfabc

cc @maximpn

kibanamachine · 2024-11-22T07:27:58Z

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/11968313271

kibanamachine · 2024-11-22T07:32:46Z

💔 All backports failed

Status	Branch	Result
❌	8.x	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 199115

Questions ?

Please refer to the Backport tool documentation

maximpn · 2024-11-22T07:51:53Z

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

@timestamp

… fields (elastic#199115) **Partially addresses:** elastic#171520 ## Summary This PR adds is built on top of elastic#193828 and elastic#196948 and adds an EQL Query editable component with EQL Options fields (`event_category_override`, `timestamp_field` and `tiebreaker_field`) for Three Way Diff tab's final edit side of the upgrade prebuilt rule workflow. ## Details This PR make a set of changes to make existing EQL Query bar component easily reusable and type safe when used in forms. In particular the following was done - EQL query bar was wrapped in `EqlQueryEdit` component with `UseField` inside. It helps to make it type safe avoiding issues like passing invalid types to `EqlQueryBar`. `UseField` types component properties as `Record<string, any>` so potentially any refactoring can break some functionality. For example code in Timeline passes `DataViewSpec` where `DataViewBase` is expected while these two types aren't fully compatible. - Validation was added directly to `EqlQueryEdit`. Passing field configuration to `UseField` rewrites field configuration defined in from schema. It leads to cases when validation is defined in both form schema and as a field configuration for `UseFields`. Additionally we can reduce reusing complexity by incapsulating absolutely required validation in `EqlQueryEdit` component. - Empty string `tiebreakerField` was removed in Timelines. `tiebreakerField` is part of EQL options used for EQL validation. EQL validation endpoint `/internal/search/eql` returns an error when an empty string provided for `tiebreakerField`. This problem didn't surface earlier since It looks like EQL options weren't provided correctly before this PR. Timeline EQL validation requests were sent without EQL options. ## How to test The simplest way to test is via patching installed prebuilt rules via Rule Patch API. Please follow steps below - Ensure the `prebuiltRulesCustomizationEnabled` feature flag is enabled - Run Kibana locally - Install an EQL prebuilt rule, e.g. `Potential Code Execution via Postgresql` with rule_id `2a692072-d78d-42f3-a48a-775677d79c4e` - Patch the installed rule by running a query below ```bash curl -X PATCH --user elastic:changeme -H 'Content-Type: application/json' -H 'kbn-xsrf: 123' -H "elastic-api-version: 2023-10-31" -d '{"rule_id":"2a692072-d78d-42f3-a48a-775677d79c4e","version":1,"query":"process where process.name == \"cmd.exe\"","language":"eql","event_category_override": "test","timestamp_field": "@timestamp","tiebreaker_field": "tiebreaker"}' http://localhost:5601/kbn/api/detection_engine/rules ``` - Open `Detection Rules (SIEM)` Page -> `Rule Updates` -> click on `Potential Code Execution via Postgresql` rule -> expand `EQL Query` to see EQL Query -> press `Edit` button ## Screenshots - EQL Query in Prebuilt Rules Update workflow <img width="2560" alt="image" src="https://github.com/user-attachments/assets/59d157b2-6aca-4b21-95d0-f71a2e174df2"> - event_category_override + tiebreaker_field + timestamp_field (aka EQL options) in Prebuilt Rules Update workflow <img width="2552" alt="image" src="https://github.com/user-attachments/assets/1886d3b4-98f9-40a7-954c-2a6d4b8e925a"> - Examples of invalid EQL <img width="2560" alt="image" src="https://github.com/user-attachments/assets/d584deca-7903-45c5-9499-718552df441c"> <img width="2548" alt="image" src="https://github.com/user-attachments/assets/b734e22c-ab62-4624-85d0-e4e6dbb9d523"> (cherry picked from commit c0c803c) # Conflicts: # x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/eql/index.tsx

@timestamp

…ptions fields (#199115) (#201314) # Backport This will backport the following commits from `main` to `8.x`: - [[Security Solution] Add EQL query editable component with EQL options fields (#199115)](#199115)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)

@timestamp

… fields (elastic#199115) **Partially addresses:** elastic#171520 ## Summary This PR adds is built on top of elastic#193828 and elastic#196948 and adds an EQL Query editable component with EQL Options fields (`event_category_override`, `timestamp_field` and `tiebreaker_field`) for Three Way Diff tab's final edit side of the upgrade prebuilt rule workflow. ## Details This PR make a set of changes to make existing EQL Query bar component easily reusable and type safe when used in forms. In particular the following was done - EQL query bar was wrapped in `EqlQueryEdit` component with `UseField` inside. It helps to make it type safe avoiding issues like passing invalid types to `EqlQueryBar`. `UseField` types component properties as `Record<string, any>` so potentially any refactoring can break some functionality. For example code in Timeline passes `DataViewSpec` where `DataViewBase` is expected while these two types aren't fully compatible. - Validation was added directly to `EqlQueryEdit`. Passing field configuration to `UseField` rewrites field configuration defined in from schema. It leads to cases when validation is defined in both form schema and as a field configuration for `UseFields`. Additionally we can reduce reusing complexity by incapsulating absolutely required validation in `EqlQueryEdit` component. - Empty string `tiebreakerField` was removed in Timelines. `tiebreakerField` is part of EQL options used for EQL validation. EQL validation endpoint `/internal/search/eql` returns an error when an empty string provided for `tiebreakerField`. This problem didn't surface earlier since It looks like EQL options weren't provided correctly before this PR. Timeline EQL validation requests were sent without EQL options. ## How to test The simplest way to test is via patching installed prebuilt rules via Rule Patch API. Please follow steps below - Ensure the `prebuiltRulesCustomizationEnabled` feature flag is enabled - Run Kibana locally - Install an EQL prebuilt rule, e.g. `Potential Code Execution via Postgresql` with rule_id `2a692072-d78d-42f3-a48a-775677d79c4e` - Patch the installed rule by running a query below ```bash curl -X PATCH --user elastic:changeme -H 'Content-Type: application/json' -H 'kbn-xsrf: 123' -H "elastic-api-version: 2023-10-31" -d '{"rule_id":"2a692072-d78d-42f3-a48a-775677d79c4e","version":1,"query":"process where process.name == \"cmd.exe\"","language":"eql","event_category_override": "test","timestamp_field": "@timestamp","tiebreaker_field": "tiebreaker"}' http://localhost:5601/kbn/api/detection_engine/rules ``` - Open `Detection Rules (SIEM)` Page -> `Rule Updates` -> click on `Potential Code Execution via Postgresql` rule -> expand `EQL Query` to see EQL Query -> press `Edit` button ## Screenshots - EQL Query in Prebuilt Rules Update workflow <img width="2560" alt="image" src="https://github.com/user-attachments/assets/59d157b2-6aca-4b21-95d0-f71a2e174df2"> - event_category_override + tiebreaker_field + timestamp_field (aka EQL options) in Prebuilt Rules Update workflow <img width="2552" alt="image" src="https://github.com/user-attachments/assets/1886d3b4-98f9-40a7-954c-2a6d4b8e925a"> - Examples of invalid EQL <img width="2560" alt="image" src="https://github.com/user-attachments/assets/d584deca-7903-45c5-9499-718552df441c"> <img width="2548" alt="image" src="https://github.com/user-attachments/assets/b734e22c-ab62-4624-85d0-e4e6dbb9d523">

@timestamp

… fields (elastic#199115) **Partially addresses:** elastic#171520 ## Summary This PR adds is built on top of elastic#193828 and elastic#196948 and adds an EQL Query editable component with EQL Options fields (`event_category_override`, `timestamp_field` and `tiebreaker_field`) for Three Way Diff tab's final edit side of the upgrade prebuilt rule workflow. ## Details This PR make a set of changes to make existing EQL Query bar component easily reusable and type safe when used in forms. In particular the following was done - EQL query bar was wrapped in `EqlQueryEdit` component with `UseField` inside. It helps to make it type safe avoiding issues like passing invalid types to `EqlQueryBar`. `UseField` types component properties as `Record<string, any>` so potentially any refactoring can break some functionality. For example code in Timeline passes `DataViewSpec` where `DataViewBase` is expected while these two types aren't fully compatible. - Validation was added directly to `EqlQueryEdit`. Passing field configuration to `UseField` rewrites field configuration defined in from schema. It leads to cases when validation is defined in both form schema and as a field configuration for `UseFields`. Additionally we can reduce reusing complexity by incapsulating absolutely required validation in `EqlQueryEdit` component. - Empty string `tiebreakerField` was removed in Timelines. `tiebreakerField` is part of EQL options used for EQL validation. EQL validation endpoint `/internal/search/eql` returns an error when an empty string provided for `tiebreakerField`. This problem didn't surface earlier since It looks like EQL options weren't provided correctly before this PR. Timeline EQL validation requests were sent without EQL options. ## How to test The simplest way to test is via patching installed prebuilt rules via Rule Patch API. Please follow steps below - Ensure the `prebuiltRulesCustomizationEnabled` feature flag is enabled - Run Kibana locally - Install an EQL prebuilt rule, e.g. `Potential Code Execution via Postgresql` with rule_id `2a692072-d78d-42f3-a48a-775677d79c4e` - Patch the installed rule by running a query below ```bash curl -X PATCH --user elastic:changeme -H 'Content-Type: application/json' -H 'kbn-xsrf: 123' -H "elastic-api-version: 2023-10-31" -d '{"rule_id":"2a692072-d78d-42f3-a48a-775677d79c4e","version":1,"query":"process where process.name == \"cmd.exe\"","language":"eql","event_category_override": "test","timestamp_field": "@timestamp","tiebreaker_field": "tiebreaker"}' http://localhost:5601/kbn/api/detection_engine/rules ``` - Open `Detection Rules (SIEM)` Page -> `Rule Updates` -> click on `Potential Code Execution via Postgresql` rule -> expand `EQL Query` to see EQL Query -> press `Edit` button ## Screenshots - EQL Query in Prebuilt Rules Update workflow <img width="2560" alt="image" src="https://github.com/user-attachments/assets/59d157b2-6aca-4b21-95d0-f71a2e174df2"> - event_category_override + tiebreaker_field + timestamp_field (aka EQL options) in Prebuilt Rules Update workflow <img width="2552" alt="image" src="https://github.com/user-attachments/assets/1886d3b4-98f9-40a7-954c-2a6d4b8e925a"> - Examples of invalid EQL <img width="2560" alt="image" src="https://github.com/user-attachments/assets/d584deca-7903-45c5-9499-718552df441c"> <img width="2548" alt="image" src="https://github.com/user-attachments/assets/b734e22c-ab62-4624-85d0-e4e6dbb9d523">

maximpn self-assigned this Nov 6, 2024

maximpn requested a review from nikitaindik November 6, 2024 14:28

maximpn commented Nov 7, 2024

View reviewed changes

maximpn marked this pull request as ready for review November 7, 2024 07:49

maximpn requested review from a team as code owners November 7, 2024 07:49

maximpn requested a review from nkhristinin November 7, 2024 07:49

maximpn mentioned this pull request Nov 7, 2024

[Security Solution] Rework Update flyout to display all field updates and build Three-Way-Diff field component #171520

Open

69 tasks

banderror added backport:version Backport to applied version labels and removed backport:prev-minor Backport to (8.x) the previous minor version (i.e. one version back from main) labels Nov 7, 2024

maximpn force-pushed the add-eql-query-edit-component branch from 2291ad0 to db856ba Compare November 7, 2024 21:15

nikitaindik reviewed Nov 11, 2024

View reviewed changes

maximpn force-pushed the add-eql-query-edit-component branch from 326eeb0 to 64b371f Compare November 11, 2024 17:00

maximpn added 14 commits November 21, 2024 14:03

use comma delimiter while joining index patterns

d2adba9

fix a typo

635fcc9

add assertUnreachable for rules having all editable fields implemented

c54ac35

fix post-rebase issues

ca8b4af

add fieldsToValidateOnChange to EqlQueryEdit

94a2be9

use form field for EQL Options

35bf0d3

prevent dispatching unchanged EQL Options

dd8dd2b

skip EQL validation for prebuilt rules customization workflow

2499e50

combine EQL query and EQL options

557782a

show EQL options in rule details page

58b2f35

move eql edit component in a shared folder

3f7c96f

make eqlOptionsPath required

0b8fd8f

move EQL options combo box options calc inside EQL Query bar

1eedbd2

display EQL options diff

45bfabc

maximpn force-pushed the add-eql-query-edit-component branch from d11b456 to 45bfabc Compare November 21, 2024 16:57

move debounceAsync to a package

e9ee5c7

maximpn enabled auto-merge (squash) November 21, 2024 22:09

map properly EQL options to eql_query in upgrade perform API endpoint

9f5d1f8

maximpn force-pushed the add-eql-query-edit-component branch from 568ea87 to 9f5d1f8 Compare November 22, 2024 05:38

maximpn merged commit c0c803c into elastic:main Nov 22, 2024
48 checks passed

maximpn deleted the add-eql-query-edit-component branch November 22, 2024 07:34

maximpn mentioned this pull request Nov 22, 2024

[8.x] [Security Solution] Add EQL query editable component with EQL options fields (#199115) #201314

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Add EQL query editable component with EQL options fields #199115

[Security Solution] Add EQL query editable component with EQL options fields #199115

maximpn commented Nov 6, 2024 •

edited by kibanamachine

Loading

maximpn Nov 7, 2024

elasticmachine commented Nov 7, 2024

elasticmachine commented Nov 7, 2024

elasticmachine commented Nov 7, 2024

yctercero commented Nov 11, 2024

nikitaindik Nov 11, 2024

nikitaindik Nov 11, 2024

nikitaindik Nov 11, 2024

maximpn Nov 11, 2024

nikitaindik Nov 12, 2024

nikitaindik commented Nov 11, 2024 •

edited

Loading

elasticmachine commented Nov 21, 2024 •

edited

Loading

API count

References to deprecated APIs

kibanamachine commented Nov 22, 2024

kibanamachine commented Nov 22, 2024

maximpn commented Nov 22, 2024

[Security Solution] Add EQL query editable component with EQL options fields #199115

[Security Solution] Add EQL query editable component with EQL options fields #199115

Conversation

maximpn commented Nov 6, 2024 • edited by kibanamachine Loading

Summary

Details

How to test

Screenshots

maximpn Nov 7, 2024

Choose a reason for hiding this comment

elasticmachine commented Nov 7, 2024

elasticmachine commented Nov 7, 2024

elasticmachine commented Nov 7, 2024

yctercero commented Nov 11, 2024

nikitaindik Nov 11, 2024

Choose a reason for hiding this comment

nikitaindik Nov 11, 2024

Choose a reason for hiding this comment

nikitaindik Nov 11, 2024

Choose a reason for hiding this comment

maximpn Nov 11, 2024

Choose a reason for hiding this comment

nikitaindik Nov 12, 2024

Choose a reason for hiding this comment

nikitaindik commented Nov 11, 2024 • edited Loading

elasticmachine commented Nov 21, 2024 • edited Loading

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

API count

References to deprecated APIs

History

kibanamachine commented Nov 22, 2024

kibanamachine commented Nov 22, 2024

💔 All backports failed

Manual backport

Questions ?

maximpn commented Nov 22, 2024

💚 All backports created successfully

Questions ?

maximpn commented Nov 6, 2024 •

edited by kibanamachine

Loading

nikitaindik commented Nov 11, 2024 •

edited

Loading

elasticmachine commented Nov 21, 2024 •

edited

Loading