[Security Solution][Endpoint] Actions Log API #101032

ashokaditya · 2021-06-01T09:00:42Z

Summary

This PR is to add/modify the actions_log API in order to show actions log on endpoint details.

This is a branch of off /pull/99795

screenshot:

clip

Checklist

Delete any items that are not applicable to this PR.

Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
This was checked for cross-browser compatibility

For maintainers

This was checked for breaking API changes and was labeled appropriately

add tabs for endpoint details

this is work in progress with dummy data

in order to use it in endpoint_hosts as well as in trusted _apps review suggestion

review suggestion

refs 3722552

review suggestions

this needs to be fleshed out in a later PR

review changes

review change

review changes

nchaulet

Fleet changes 🚀 hopefully we can get this soon #101603

review changes

paul-tavares

Left a few comments that I'm ok with you addressing in a subsequent PR.

Thanks

...urity_solution/public/management/pages/endpoint_hosts/view/details/endpoint_activity_log.tsx

x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/hooks/hooks.ts

x-pack/plugins/security_solution/server/endpoint/routes/actions/audit_log_handler.ts

x-pack/plugins/security_solution/server/endpoint/routes/actions/service.ts

review changes

review changes https://github.com/elastic/kibana/tree/master/packages/kbn-config-schema#schemamaybe https://github.com/elastic/kibana/tree/master/packages/kbn-config-schema#default-values

ashokaditya · 2021-06-14T09:36:50Z

@elasticmachine merge upstream

…g-api

refs 1f9ae70

review changes

kibanamachine · 2021-06-14T13:20:25Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	2242	2243	+1

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`fleet`	1006	1007	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	6.9MB	7.0MB	+7.3KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`fleet`	434.8KB	435.2KB	+343.0B

Unknown metric groups

API count

id	before	after	diff
`fleet`	1096	1097	+1

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* WIP add tabs for endpoint details * fetch activity log for endpoint this is work in progress with dummy data * refactor to hold host details and activity log within endpointDetails * api for fetching actions log * add a selector for getting selected agent id * use the new api to show actions log * review changes * move util function to common/utils in order to use it in endpoint_hosts as well as in trusted _apps review suggestion * use util function to get API path review suggestion * sync url params with details active tab review suggestion * fix types due to merge commit refs 3722552 * use AsyncResourseState type review suggestions * sort entries chronologically with recent at the top * adjust icon sizes within entries to match mocks * remove endpoint list paging stuff (not for now) * fix import after sync with master * make the search bar work (sort of) this needs to be fleshed out in a later PR * add tests to middleware for now * use snake case for naming routes review changes * rename and use own relative time function review change * use euiTheme tokens review change * add a comment review changes * log errors to kibana log and unwind stack review changes * search on two indices * fix types * use modified data * distinguish between responses and actions and respective states in UI * use indices explicitly and tune the query * fix types after sync with master * fix lint * do better types review suggestion * add paging to API call * add paging info to redux store for activityLog * decouple paging action from other API requests * use a button for now to fetch more data * add index to fleet indices else we get a type check error about the constant not being exported correctly from `x-pack/plugins/fleet/common/constants/agent` * add tests for audit log API * do semantic paging from first request * fix ts error review changes * add document id and total to API review suggestions * update test * update frontend to consume the modified api correctly * update mock * rename action review changes * wrap mock into function to create anew on each test review changes * wrap with schema.maybe and increase page size review changes * ignore 404 review changes * use i18n review changes * abstract logEntry component logic review changes * move handler logic to a service review changes * update response object review changes * fix paging to use 50 as initial fetch size * fix translations and move custom hook to component file review changes * add return type review changes * update default value for page_size review changes * remove default values review changes https://github.com/elastic/kibana/tree/master/packages/kbn-config-schema#schemamaybe https://github.com/elastic/kibana/tree/master/packages/kbn-config-schema#default-values * fix mock data refs 1f9ae70 * add selectors for data review changes Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

kibanamachine · 2021-06-14T13:42:29Z

💚 Backport successful

Status	Branch	Result
✅	7.x

This backport PR will be merged automatically after passing CI.

* WIP add tabs for endpoint details * fetch activity log for endpoint this is work in progress with dummy data * refactor to hold host details and activity log within endpointDetails * api for fetching actions log * add a selector for getting selected agent id * use the new api to show actions log * review changes * move util function to common/utils in order to use it in endpoint_hosts as well as in trusted _apps review suggestion * use util function to get API path review suggestion * sync url params with details active tab review suggestion * fix types due to merge commit refs 3722552 * use AsyncResourseState type review suggestions * sort entries chronologically with recent at the top * adjust icon sizes within entries to match mocks * remove endpoint list paging stuff (not for now) * fix import after sync with master * make the search bar work (sort of) this needs to be fleshed out in a later PR * add tests to middleware for now * use snake case for naming routes review changes * rename and use own relative time function review change * use euiTheme tokens review change * add a comment review changes * log errors to kibana log and unwind stack review changes * search on two indices * fix types * use modified data * distinguish between responses and actions and respective states in UI * use indices explicitly and tune the query * fix types after sync with master * fix lint * do better types review suggestion * add paging to API call * add paging info to redux store for activityLog * decouple paging action from other API requests * use a button for now to fetch more data * add index to fleet indices else we get a type check error about the constant not being exported correctly from `x-pack/plugins/fleet/common/constants/agent` * add tests for audit log API * do semantic paging from first request * fix ts error review changes * add document id and total to API review suggestions * update test * update frontend to consume the modified api correctly * update mock * rename action review changes * wrap mock into function to create anew on each test review changes * wrap with schema.maybe and increase page size review changes * ignore 404 review changes * use i18n review changes * abstract logEntry component logic review changes * move handler logic to a service review changes * update response object review changes * fix paging to use 50 as initial fetch size * fix translations and move custom hook to component file review changes * add return type review changes * update default value for page_size review changes * remove default values review changes https://github.com/elastic/kibana/tree/master/packages/kbn-config-schema#schemamaybe https://github.com/elastic/kibana/tree/master/packages/kbn-config-schema#default-values * fix mock data refs 1f9ae70 * add selectors for data review changes Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Ashokaditya <am.struktr@gmail.com>

* WIP add tabs for endpoint details * fetch activity log for endpoint this is work in progress with dummy data * refactor to hold host details and activity log within endpointDetails * api for fetching actions log * add a selector for getting selected agent id * use the new api to show actions log * review changes * move util function to common/utils in order to use it in endpoint_hosts as well as in trusted _apps review suggestion * use util function to get API path review suggestion * sync url params with details active tab review suggestion * fix types due to merge commit refs 3722552 * use AsyncResourseState type review suggestions * sort entries chronologically with recent at the top * adjust icon sizes within entries to match mocks * remove endpoint list paging stuff (not for now) * fix import after sync with master * make the search bar work (sort of) this needs to be fleshed out in a later PR * add tests to middleware for now * use snake case for naming routes review changes * rename and use own relative time function review change * use euiTheme tokens review change * add a comment review changes * log errors to kibana log and unwind stack review changes * search on two indices * fix types * use modified data * distinguish between responses and actions and respective states in UI * use indices explicitly and tune the query * fix types after sync with master * fix lint * do better types review suggestion * add paging to API call * add paging info to redux store for activityLog * decouple paging action from other API requests * use a button for now to fetch more data * add index to fleet indices else we get a type check error about the constant not being exported correctly from `x-pack/plugins/fleet/common/constants/agent` * add tests for audit log API * do semantic paging from first request * fix ts error review changes * add document id and total to API review suggestions * update test * update frontend to consume the modified api correctly * update mock * rename action review changes * wrap mock into function to create anew on each test review changes * wrap with schema.maybe and increase page size review changes * ignore 404 review changes * use i18n review changes * abstract logEntry component logic review changes * move handler logic to a service review changes * update response object review changes * fix paging to use 50 as initial fetch size * fix translations and move custom hook to component file review changes * add return type review changes * update default value for page_size review changes * remove default values review changes https://github.com/elastic/kibana/tree/master/packages/kbn-config-schema#schemamaybe https://github.com/elastic/kibana/tree/master/packages/kbn-config-schema#default-values * fix mock data refs 1f9ae70 * add selectors for data review changes Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

…ll (#102261) * Show loading below the list when loading fixes elastic/security-team/issues/1245 * use intersection observer to load data when callout is visible fixes elastic/security-team/issues/1245 * remove unused `total` from API response refs 4f7d18b * toggle ability to paging based on API response and target intersection fixes elastic/security-team/issues/1245 * use a invisible target * display a message when end of log fixes elastic/security-team/issues/1245 * remove search bar fixes elastic/security-team/issues/1245 * refresh data fixes elastic/security-team/issues/1245 * rename refs 85e5add * add refresh button to empty state * add translations for copy * remove refresh button * load activity log for endpoint on activity log tab selection fixes elastic/security-team/issues/1312 * reset paging correctly on activity log tab selection * fix variable mixup refs /pull/101032/commits/c4e933a9c5954ce249942ca66bab380c1dfa79e2#diff-41a74ad41665921620230a0729728f3bf6e27a6f9dc302fb37b0d2061637c212R81 * fix react warning refs 697a3c3 * clean up review changes * use the complicated flyout version instead of styled version refs https://elastic.github.io/eui/#/layout/flyout#more-complicated-flyout refs https://github.com/elastic/kibana/pull/99795/files#r635810660 refs c26a7d4 * Page only when scrolled (so that info message is shown after paging once) fixes elastic/security-team#1245 (comment) * add tests fixes elastic/security-team/issues/1312 fixes elastic/security-team/issues/1245 * increase the parent container's height to ensure that the scroll target is well hidden below the footer refs 48e3291 * Update x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/reducer.ts Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com> * Update x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com> * address review changes * cleanup callback and effect Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com>

…ll (elastic#102261) * Show loading below the list when loading fixes elastic/security-team/issues/1245 * use intersection observer to load data when callout is visible fixes elastic/security-team/issues/1245 * remove unused `total` from API response refs 4f7d18b * toggle ability to paging based on API response and target intersection fixes elastic/security-team/issues/1245 * use a invisible target * display a message when end of log fixes elastic/security-team/issues/1245 * remove search bar fixes elastic/security-team/issues/1245 * refresh data fixes elastic/security-team/issues/1245 * rename refs 85e5add * add refresh button to empty state * add translations for copy * remove refresh button * load activity log for endpoint on activity log tab selection fixes elastic/security-team/issues/1312 * reset paging correctly on activity log tab selection * fix variable mixup refs elastic/pull/101032/commits/c4e933a9c5954ce249942ca66bab380c1dfa79e2#diff-41a74ad41665921620230a0729728f3bf6e27a6f9dc302fb37b0d2061637c212R81 * fix react warning refs 697a3c3 * clean up review changes * use the complicated flyout version instead of styled version refs https://elastic.github.io/eui/#/layout/flyout#more-complicated-flyout refs https://github.com/elastic/kibana/pull/99795/files#r635810660 refs c26a7d4 * Page only when scrolled (so that info message is shown after paging once) fixes elastic/security-team#1245 (comment) * add tests fixes elastic/security-team/issues/1312 fixes elastic/security-team/issues/1245 * increase the parent container's height to ensure that the scroll target is well hidden below the footer refs 48e3291 * Update x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/reducer.ts Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com> * Update x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com> * address review changes * cleanup callback and effect Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com>

…ll (#102261) (#103047) * Show loading below the list when loading fixes elastic/security-team/issues/1245 * use intersection observer to load data when callout is visible fixes elastic/security-team/issues/1245 * remove unused `total` from API response refs 4f7d18b * toggle ability to paging based on API response and target intersection fixes elastic/security-team/issues/1245 * use a invisible target * display a message when end of log fixes elastic/security-team/issues/1245 * remove search bar fixes elastic/security-team/issues/1245 * refresh data fixes elastic/security-team/issues/1245 * rename refs 85e5add * add refresh button to empty state * add translations for copy * remove refresh button * load activity log for endpoint on activity log tab selection fixes elastic/security-team/issues/1312 * reset paging correctly on activity log tab selection * fix variable mixup refs /pull/101032/commits/c4e933a9c5954ce249942ca66bab380c1dfa79e2#diff-41a74ad41665921620230a0729728f3bf6e27a6f9dc302fb37b0d2061637c212R81 * fix react warning refs 697a3c3 * clean up review changes * use the complicated flyout version instead of styled version refs https://elastic.github.io/eui/#/layout/flyout#more-complicated-flyout refs https://github.com/elastic/kibana/pull/99795/files#r635810660 refs c26a7d4 * Page only when scrolled (so that info message is shown after paging once) fixes elastic/security-team#1245 (comment) * add tests fixes elastic/security-team/issues/1312 fixes elastic/security-team/issues/1245 * increase the parent container's height to ensure that the scroll target is well hidden below the footer refs 48e3291 * Update x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/reducer.ts Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com> * Update x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com> * address review changes * cleanup callback and effect Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com> Co-authored-by: Ashokaditya <am.struktr@gmail.com> Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com>

…109776) * move activity log paging method close to call api method refs 417d093 * add middleware additional activity log tests * add a more specific server side test for activity log actions and responses refs /pull/101032 * remove obsolete server side audit log index mock method refs /pull/101032 Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

…lastic#109776) * move activity log paging method close to call api method refs 417d093 * add middleware additional activity log tests * add a more specific server side test for activity log actions and responses refs elastic/pull/101032 * remove obsolete server side audit log index mock method refs elastic/pull/101032 Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

…109776) (#110074) * move activity log paging method close to call api method refs 417d093 * add middleware additional activity log tests * add a more specific server side test for activity log actions and responses refs /pull/101032 * remove obsolete server side audit log index mock method refs /pull/101032 Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Ashokaditya <am.struktr@gmail.com>

…109776) (#110075) * move activity log paging method close to call api method refs 417d093 * add middleware additional activity log tests * add a more specific server side test for activity log actions and responses refs /pull/101032 * remove obsolete server side audit log index mock method refs /pull/101032 Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Ashokaditya <am.struktr@gmail.com>

ashokaditya and others added 30 commits May 11, 2021 16:33

WIP

c26a7d4

add tabs for endpoint details

fetch activity log for endpoint

b8fba34

this is work in progress with dummy data

refactor to hold host details and activity log within endpointDetails

a2eb777

api for fetching actions log

24d392f

add a selector for getting selected agent id

62e38fe

use the new api to show actions log

b6aa967

Merge branch 'master' into sec-team-1105/endpoint-details-activity-log

21fe79e

review changes

2dd22ed

Merge branch 'master' into sec-team-1105/endpoint-details-activity-log

567af29

Merge branch 'master' into sec-team-1105/endpoint-details-activity-log

13e8963

move util function to common/utils

46c187d

in order to use it in endpoint_hosts as well as in trusted _apps review suggestion

use util function to get API path

691b90a

review suggestion

sync url params with details active tab

3859af9

review suggestion

Merge branch 'master' into sec-team-1105/endpoint-details-activity-log

3722552

fix types due to merge commit

923a157

refs 3722552

use AsyncResourseState type

c5ade7b

review suggestions

sort entries chronologically with recent at the top

0f08908

adjust icon sizes within entries to match mocks

f760aca

remove endpoint list paging stuff (not for now)

72c7b77

Merge branch 'master' into sec-team-1105/endpoint-details-activity-log

f2dd6cc

fix import after sync with master

eb5f67e

Merge branch 'master' into sec-team-1105/endpoint-details-activity-log

fd390c8

make the search bar work (sort of)

f9b95b9

this needs to be fleshed out in a later PR

add tests to middleware for now

299dc91

Merge branch 'master' into sec-team-1105/endpoint-details-activity-log

0d907f8

use snake case for naming routes

1c54aaa

review changes

rename and use own relative time function

e38e202

review change

use euiTheme tokens

31cf7af

review change

add a comment

33f7d0b

review changes

log errors to kibana log and unwind stack

8d46a98

review changes

move handler logic to a service

856cefb

review changes

nchaulet approved these changes Jun 10, 2021

View reviewed changes

ashokaditya added 2 commits June 10, 2021 20:09

update response object

20f4ab9

review changes

fix paging to use 50 as initial fetch size

e7671c2

paul-tavares approved these changes Jun 10, 2021

View reviewed changes

ashokaditya added 4 commits June 14, 2021 11:11

fix translations and move custom hook to component file

c4e933a

review changes

add return type

0434718

review changes

update default value for page_size

751fa68

review changes

remove default values

1db7cbe

review changes https://github.com/elastic/kibana/tree/master/packages/kbn-config-schema#schemamaybe https://github.com/elastic/kibana/tree/master/packages/kbn-config-schema#default-values

kibanamachine and others added 3 commits June 14, 2021 05:36

Merge branch 'master' into sec-team-1150/endpoint-details-activity-lo…

574f72d

…g-api

fix mock data

3e0303d

refs 1f9ae70

add selectors for data

2eb2063

review changes

ashokaditya merged commit 71a81f7 into elastic:master Jun 14, 2021

ashokaditya deleted the sec-team-1150/endpoint-details-activity-log-api branch June 14, 2021 13:39

kibanamachine mentioned this pull request Jun 14, 2021

[7.x] [Security Solution][Endpoint] Actions Log API (#101032) #102064

Merged

ashokaditya mentioned this pull request Jun 16, 2021

[Security Solution][Endpoint] Paginate actions log with infinite scroll #102261

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Endpoint] Actions Log API #101032

[Security Solution][Endpoint] Actions Log API #101032

ashokaditya commented Jun 1, 2021 •

edited

Loading

nchaulet left a comment

paul-tavares left a comment

ashokaditya commented Jun 14, 2021

kibanamachine commented Jun 14, 2021

API count

kibanamachine commented Jun 14, 2021

[Security Solution][Endpoint] Actions Log API #101032

[Security Solution][Endpoint] Actions Log API #101032

Conversation

ashokaditya commented Jun 1, 2021 • edited Loading

Summary

Checklist

For maintainers

nchaulet left a comment

Choose a reason for hiding this comment

paul-tavares left a comment

Choose a reason for hiding this comment

ashokaditya commented Jun 14, 2021

kibanamachine commented Jun 14, 2021

💚 Build Succeeded

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Page load bundle

API count

History

kibanamachine commented Jun 14, 2021

💚 Backport successful

ashokaditya commented Jun 1, 2021 •

edited

Loading