[Security] Adds field mapping support to rule creation Part II #71402

spong · 2020-07-13T06:31:18Z

Summary

Followup to #70288, which includes:

Additional followup cleanup:

Adds risk_scoretorisk_score_mapping`
Improves field validation
Disables override fields for ML Rules
Orders SeverityMapping by severity on create/update
Allow unbounded max-signals

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
- Syncing w/ @benskelker
Unit or functional tests were updated or added to match the most common scenarios

For maintainers

This was checked for breaking API changes and was labeled appropriately

…and fixes EditAboutStep rehydration

elasticmachine · 2020-07-13T06:31:21Z

Pinging @elastic/siem (Team:SIEM)

…pdates-2

…ete for severityOverride, and fixes rule details description rollup

…pdates-2

rylnd

Played around a bit with creating rules with overrides and things look to be working! Nothing's obviously broken, at least 😉 .

Thanks for improving those form components while you were in there 👍

rylnd · 2020-07-14T20:04:14Z

...ck/plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx

  {
-    title: label,


Does this fix that UI warning about title being undefined?

Yeah, I think that should take care of it. Was a little split on pulling in the i18n from the fields vs leveraging the forms schema label. I think it'll be best to use the label from the schema, but will need to re-work the data model for these complex fields once the hooksform fixes land.

rylnd · 2020-07-14T20:05:04Z

x-pack/plugins/security_solution/public/detections/components/rules/description_step/index.tsx

@@ -192,18 +193,12 @@ export const getDescriptionItem = (
  } else if (Array.isArray(get(field, data))) {
    const values: string[] = get(field, data);
    return buildStringArrayDescription(label, field, values);
-    // TODO: Add custom UI for Risk/Severity Mappings (and fix missing label)


Here it is 👍

rylnd · 2020-07-14T20:07:44Z

x-pack/plugins/security_solution/public/detections/components/rules/severity_mapping/index.tsx


+const SeverityMappingParentContainer = styled(EuiFlexItem)`
+  max-width: 471px;


That is a specific number!

I want to work with @marrasherrier after the first BC to determine the best styling for the serverity/risk overrides, as it's a lot of fields bunched up together (and is hard to make sense of the longer field/values). This is just to lock the container in place with the left-most portion of the form row.

rylnd · 2020-07-14T20:11:58Z

..._solution/server/lib/detection_engine/signals/mappings/build_risk_score_from_mapping.test.ts

+    expect(riskScore).toEqual({ riskScore: 57, riskScoreMeta: {} });
+  });
+
+  // TODO: Enhance...


Yeah, there are plenty of tests to write for exercising all the areas around building these mappings. I think I saw a situation where the io-ts type wasn't validating correctly and was getting risk scores > 100. So more to dig into here for sure. 🙂

kibanamachine · 2020-07-14T21:38:30Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 0546bb4

Build metrics

✅ unchanged

History

💔 Build #61576 failed a687a93
💚 Build #61249 succeeded fc4c0e1
💚 Build #60735 succeeded fc1ebb5

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@benskelker

… (#71775) ## Summary Followup to #70288, which includes: - [X] Rule Execution logic for: - [X] Severity Override - [X] Risk Score Override - [X] Rule Name Override - [X] Timestamp Override - [X] Support for toggling display of Building Block Rules: - [X] Main Detections Page - [X] Rule Details Page - [X] Integrates `AutocompleteField` for: - [X] Severity Override - [X] Risk Score Override - [X] Rule Name Override - [X] Timestamp Override - [X] Fixes rehydration of `EditAboutStep` in `Edit Rule` - [X] Fixes `Rule Details` Description rollup Additional followup cleanup: - [ ] Adds risk_score` to `risk_score_mapping` - [ ] Improves field validation - [ ] Disables override fields for ML Rules - [ ] Orders `SeverityMapping` by `severity` on create/update - [ ] Allow unbounded max-signals ### Checklist Delete any items that are not applicable to this PR. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md) - [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials - Syncing w/ @benskelker - [X] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios ### For maintainers - [X] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)

elasticmachine · 2021-09-23T14:31:21Z

Pinging @elastic/security-solution (Team: SecuritySolution)

spong added 2 commits July 11, 2020 17:45

Adds building block filter UI and queries

3c82c83

Adds override logic to rule execution, integrates AutocompleteField, …

fc1ebb5

…and fixes EditAboutStep rehydration

spong added enhancement New value added to drive a business result Team:SIEM release_note:skip Skip the PR/issue when compiling release notes Feature:Detection Rules Security Solution rules and Detection Engine labels Jul 13, 2020

spong requested review from a team as code owners July 13, 2020 06:31

spong self-assigned this Jul 13, 2020

spong added v7.9.0 v8.0.0 labels Jul 13, 2020

marrasherrier approved these changes Jul 13, 2020

View reviewed changes

spong added 5 commits July 13, 2020 17:37

Merge branch 'master' of github.com:elastic/kibana into rule-schema-u…

c66ae07

…pdates-2

Adds rule execution logic for timestampOverride, integrates autocompl…

fc4c0e1

…ete for severityOverride, and fixes rule details description rollup

Merge branch 'master' of github.com:elastic/kibana into rule-schema-u…

3322ca8

…pdates-2

Merge branch 'master' of github.com:elastic/kibana into rule-schema-u…

a687a93

…pdates-2

Fixing type errors from merge with main

0546bb4

rylnd approved these changes Jul 14, 2020

View reviewed changes

spong merged commit 8da80fe into elastic:master Jul 14, 2020

spong mentioned this pull request Jul 14, 2020

[7.x] [Security] Adds field mapping support to rule creation Part II (#71402) #71775

Merged

spong deleted the rule-schema-updates-2 branch July 14, 2020 21:48

spong mentioned this pull request Jul 14, 2020

[SIEM][Detections] Create Detection Rule configuration options for mapping fields #65941

Closed

5 tasks

spong mentioned this pull request Jul 20, 2020

[Meta] Expand support for populating event.ingested elastic/beats#20073

Closed

4 tasks

stephmilovic mentioned this pull request Oct 15, 2020

[SIEM] Update AutocompleteField to use hooks #46290

Closed

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security] Adds field mapping support to rule creation Part II #71402

[Security] Adds field mapping support to rule creation Part II #71402

spong commented Jul 13, 2020 •

edited

Loading

elasticmachine commented Jul 13, 2020

rylnd left a comment

rylnd Jul 14, 2020

spong Jul 14, 2020

rylnd Jul 14, 2020

rylnd Jul 14, 2020

spong Jul 14, 2020

rylnd Jul 14, 2020

spong Jul 14, 2020

kibanamachine commented Jul 14, 2020

elasticmachine commented Sep 23, 2021


		const SeverityMappingParentContainer = styled(EuiFlexItem)`
		max-width: 471px;

[Security] Adds field mapping support to rule creation Part II #71402

[Security] Adds field mapping support to rule creation Part II #71402

Conversation

spong commented Jul 13, 2020 • edited Loading

Summary

Checklist

For maintainers

elasticmachine commented Jul 13, 2020

rylnd left a comment

Choose a reason for hiding this comment

rylnd Jul 14, 2020

Choose a reason for hiding this comment

spong Jul 14, 2020

Choose a reason for hiding this comment

rylnd Jul 14, 2020

Choose a reason for hiding this comment

rylnd Jul 14, 2020

Choose a reason for hiding this comment

spong Jul 14, 2020

Choose a reason for hiding this comment

rylnd Jul 14, 2020

Choose a reason for hiding this comment

spong Jul 14, 2020

Choose a reason for hiding this comment

kibanamachine commented Jul 14, 2020

💚 Build Succeeded

Build metrics

History

elasticmachine commented Sep 23, 2021

spong commented Jul 13, 2020 •

edited

Loading