[Security Solution][Endpoint] Hide endpoint event filters list in detections tab #102644

dasansol92 · 2021-06-18T13:57:13Z

Summary

Hides endpoint event filters from the exception lists in detections tab:

Checklist

Unit or functional tests were updated or added to match the most common scenarios)

For maintainers

This was checked for breaking API changes and was labeled appropriately

elasticmachine · 2021-06-22T07:54:13Z

Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt)

dasansol92 · 2021-06-22T07:54:26Z

@elasticmachine merge upstream

…st_in_detections_tab

ashokaditya

🚀

paul-tavares

Approving, but left a question that may result in some refactoring (in either this or a subsequent PR)

paul-tavares · 2021-06-22T11:58:11Z

packages/kbn-securitysolution-list-hooks/src/use_exception_lists/index.ts

@@ -43,6 +44,7 @@ export const useExceptionLists = ({
  namespaceTypes,
  notifications,
  showTrustedApps = false,
+  showEventFilters = false,


I'm not sure what use case outside of the Event Filters/Trusted Apps pages need this hook to pull in Trusted apps and/or event filters. I searched for showTrustedApps and its not being used today.

Proposal/suggestion:
Is there a way to remove these props and instead have this hook only pull in what it need to show (exceptions)? Feels like that would be the better long term solution. else, we'll likely have to continue to revisit this area of the system every time we add new types of exceptions.

(this might be more of a question for the @elastic/security-detections-response team)

Yeah! I'm agree that would be better to filter by what we want instead that filter what we want to skip (event filters list and trusted apps list in this case).
I'm not sure why this was done in this way. Is it supposed to have more cain of exceptions lists than the current ones? Is this something user can create and then, yes, we should just filter trusted apps and event filter lists in order to avoid loosing data?

yeah, I'm not sure either, but we can take that on to another (potential refactor) issue.

FrankHassanabad · 2021-06-22T15:32:53Z

packages/kbn-securitysolution-list-utils/src/get_filters/index.test.ts

    });

    test('it properly formats when no filters passed and "showTrustedApps" is true', () => {
-      const filter = getFilters({}, ['single'], true);
+      const filter = getFilters({}, ['single'], true, false);


This API is getting difficult to read, once we have something such as true, false on the end mixed with an object and an array. Maintainers and others will have a hard time knowing which true and false belongs to what without reading the source function.

Could we maybe just use an object so that we have named input variables?

Then this API would look something like this and be easier to read in the code base that the second false indicates that it is a showEventFilters vs showTrustedApps:

Usually when people get to 2-3 parameters it is easier to read named parameters than guessing what each true, false, etc... means.

getFilters({ filters: {}, namespaceTypes: ['single'], showTrustedApps: true, showEventFilters: false, })

FrankHassanabad

Left one comment, but don't want to hold this up. Feel free to do what you need to on this one. I will leave a LGTM for ya' since Paul is looking at this closely.

kibanamachine · 2021-06-22T18:51:37Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`lists`	221	222	+1
`securitySolution`	2188	2189	+1
total			+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`lists`	271.7KB	272.7KB	+962.0B
`securitySolution`	6.9MB	6.9MB	+989.0B
total			+1.9KB

History

💛 Build #133022 was flaky a9bcafd
💚 Build #132447 succeeded 7bb043c
💔 Build #132411 failed b600770

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @dasansol92

…ections tab (elastic#102644) * Add event filters filter on exception list to hide it in UI * Fixes unit test and added more tests for showEventFilters * fixes test adding showEventFilters test cases * Pass params as js object instead of individual variables Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

kibanamachine · 2021-06-23T14:07:02Z

💚 Backport successful

Status	Branch	Result
✅	7.x

This backport PR will be merged automatically after passing CI.

…ections tab (#102644) (#103097) * Add event filters filter on exception list to hide it in UI * Fixes unit test and added more tests for showEventFilters * fixes test adding showEventFilters test cases * Pass params as js object instead of individual variables Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: David Sánchez <davidsansol92@gmail.com>

muskangulati-qasource · 2021-07-19T10:49:22Z

Hi @kevinlog,

We tested this ticket on the latest 7.14.0-BC3 build and found that the issue is now fixed. There is no entry for event filters under the exception list.

Please find below the testing details.

Build details:

VERSION: 7.14.0-BC3
BUILD: 42545
COMMIT: c314921a9893e0b46d9a3958f5520e3d6b1ce7d5
ARTIFACT: https://staging.elastic.co/7.14.0-682a8012/summary-7.14.0.html

Screenshot:

Hence, marking it as "Validated".

Thanks!

dasansol92 added 2 commits June 18, 2021 15:41

Add event filters filter on exception list to hide it in UI

050aa04

Fixes unit test and added more tests for showEventFilters

b600770

dasansol92 added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution auto-backport Deprecated - use backport:version if exact versions are needed labels Jun 18, 2021

dasansol92 self-assigned this Jun 18, 2021

dasansol92 added the v7.14.0 label Jun 18, 2021

ashokaditya approved these changes Jun 18, 2021

View reviewed changes

fixes test adding showEventFilters test cases

7bb043c

dasansol92 marked this pull request as ready for review June 22, 2021 07:54

dasansol92 requested review from a team as code owners June 22, 2021 07:54

Merge branch 'master' into feature/olm-hide_endpoint_event_filters_li…

a9bcafd

…st_in_detections_tab

ashokaditya approved these changes Jun 22, 2021

View reviewed changes

paul-tavares approved these changes Jun 22, 2021

View reviewed changes

FrankHassanabad reviewed Jun 22, 2021

View reviewed changes

FrankHassanabad approved these changes Jun 22, 2021

View reviewed changes

Pass params as js object instead of individual variables

653a40b

dasansol92 merged commit eb97269 into elastic:master Jun 23, 2021

kibanamachine mentioned this pull request Jun 23, 2021

[7.x] [Security Solution][Endpoint] Hide endpoint event filters list in detections tab (#102644) #103097

Merged

dasansol92 added OLM Sprint QA:Ready for Testing Code is merged and ready for QA to validate labels Jun 23, 2021

muskangulati-qasource added QA:Validated Issue has been validated by QA and removed QA:Ready for Testing Code is merged and ready for QA to validate labels Jul 19, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Endpoint] Hide endpoint event filters list in detections tab #102644

[Security Solution][Endpoint] Hide endpoint event filters list in detections tab #102644

dasansol92 commented Jun 18, 2021

elasticmachine commented Jun 22, 2021

dasansol92 commented Jun 22, 2021

ashokaditya left a comment

paul-tavares left a comment

paul-tavares Jun 22, 2021

dasansol92 Jun 22, 2021

paul-tavares Jun 23, 2021

FrankHassanabad Jun 22, 2021 •

edited

Loading

FrankHassanabad left a comment

kibanamachine commented Jun 22, 2021

kibanamachine commented Jun 23, 2021

muskangulati-qasource commented Jul 19, 2021

[Security Solution][Endpoint] Hide endpoint event filters list in detections tab #102644

[Security Solution][Endpoint] Hide endpoint event filters list in detections tab #102644

Conversation

dasansol92 commented Jun 18, 2021

Summary

Checklist

For maintainers

elasticmachine commented Jun 22, 2021

dasansol92 commented Jun 22, 2021

ashokaditya left a comment

Choose a reason for hiding this comment

paul-tavares left a comment

Choose a reason for hiding this comment

paul-tavares Jun 22, 2021

Choose a reason for hiding this comment

dasansol92 Jun 22, 2021

Choose a reason for hiding this comment

paul-tavares Jun 23, 2021

Choose a reason for hiding this comment

FrankHassanabad Jun 22, 2021 • edited Loading

Choose a reason for hiding this comment

FrankHassanabad left a comment

Choose a reason for hiding this comment

kibanamachine commented Jun 22, 2021

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

History

kibanamachine commented Jun 23, 2021

💚 Backport successful

muskangulati-qasource commented Jul 19, 2021

FrankHassanabad Jun 22, 2021 •

edited

Loading