[Security team: AWP] [Session view] Add alert fly out callback #127991

zizhouW · 2022-03-17T17:49:23Z

Issue: https://github.com/elastic/security-team/issues/3266

Add callback in session view for security solution plugin to trigger an alert flyout
Add callback in session view for updating alert status on flyout close

TODO: Add tests for alert_status_route and use AlertsClient after #127500 is merged

zizhouW · 2022-03-21T15:21:15Z

x-pack/plugins/session_view/common/constants.ts

+// react-query caching keys
+export const QUERY_KEY_PROCESS_EVENTS = 'sessionViewProcessEvents';
+export const QUERY_KEY_ALERTS = 'sessionViewAlerts';
+


duplicate of https://github.com/elastic/kibana/pull/127500/files#diff-3f0eab56b857974f26a9eb0b3987c0c099c5b8b6506f19c766c9e56273eef26d

opauloh · 2022-03-21T15:55:01Z

x-pack/plugins/session_view/public/components/process_tree/hooks.ts

+  Object.keys(updatedAlertsStatus).forEach((alertUuid) => {
+    const process = processMap[updatedAlertsStatus[alertUuid].processEntityId];
+    if (process) {
+      updateAlertEventStatus(process.getAlerts(), updatedAlertsStatus);


since getAlerts() comes from ProcessImpl, what about adding an update function to ProcessImpl? i.e process.setAlerts(), to make more explicit the intention of changing alerts in the process

then also, could change to a more functional approach using map transforms:

i.e:

process.setAlerts(updateAlertEventStatus(process.getAlerts(), updatedAlertsStatus))

// updateAlertEventStatus export const updateAlertEventStatus = ( events: ProcessEvent[], updatedAlertsStatus: UpdateAlertStatus ) => ( events.map((event) => ({ ...event, kibana: { ...event.kibana, alert: { ...event.kibana.alert, workflow_status : updatedAlertsStatus[event.kibana.alert.uuid].status }} )})

The alerts currently are placed together with events in process.events. It's probably a good idea to separate them to process.events and process.alerts. It seems to relate to some changes made in #127500 in efforts to separate fetching events and alerts. Should we make the optimization in a separate PR?

cc: @mitodrummer

Yea, separate PR seems best. Maybe after i merge the alerts tab stuff.

yeah another PR sounds nice to me too

opauloh · 2022-03-21T15:56:25Z

x-pack/plugins/session_view/public/types.ts

+  ) => void;
+}
+
+export interface UpdateAlertStatus {


this type seems too generic and doesn't seem to tell much about it, can it be improved somehow?

mitodrummer · 2022-03-22T05:18:31Z

x-pack/plugins/session_view/server/routes/alert_status_route.ts

+};
+
+export const searchAlertByUuid = async (client: ElasticsearchClient, alertUuid: string) => {
+  const search = await client.search({


We may want to update this to use the AlertsClient once I've merged my alerts tab work. It handles authorized indexes and other rbac type stuff.

Sounds good, I can do it in a separate PR since the flyout callback is also needed in your PR. I will get this one merged in first

mitodrummer

LGTM!

opauloh

lgtm

michaelolo24 · 2022-03-22T13:31:30Z

x-pack/plugins/session_view/public/components/process_tree/helpers.test.ts

@@ -73,4 +75,46 @@ describe('process tree hook helpers tests', () => {
    // session leader should have autoExpand to be true
    expect(processMap[SESSION_ENTITY_ID].autoExpand).toBeTruthy();
  });
+
+  it('updateAlertEventStatus works', () => {
+    const events: ProcessEvent[] = JSON.parse(JSON.stringify([...mockEvents, ...mockAlerts]));


This is okay I think since we know the data, but using lodash clone might be safer long term and potentially faster? Not sure though...

michaelolo24 · 2022-03-22T14:12:11Z

x-pack/plugins/session_view/public/components/process_tree/helpers.ts

+) => {
+  events.forEach((event) => {
+    if (event.kibana?.alert.uuid && updatedAlertsStatus[event.kibana.alert.uuid]) {
+      event.kibana.alert.workflow_status = updatedAlertsStatus[event.kibana.alert.uuid].status;


With Kibana, I would never assume you'll actually get the data so I would do updatedAlertStatus[event.kibana?.alert?.uuid]

Thanks for letting me know! There are other places in session_view that will require similar fixes. I will fix this one here and create a tech debt ticket to address the rest separately.

Great, thanks!

michaelolo24 · 2022-03-22T14:18:41Z

x-pack/plugins/session_view/public/components/process_tree/index.tsx

@@ -36,6 +37,11 @@ interface ProcessTreeDeps {
  selectedProcess?: Process | null;
  onProcessSelected: (process: Process | null) => void;
  setSearchResults?: (results: Process[]) => void;
+


michaelolo24 · 2022-03-22T14:24:45Z

x-pack/plugins/session_view/public/components/session_view/hooks.ts

+        ...updatedAlertsStatus,
+        [alertUuid]: {
+          status: events[0].kibana?.alert.workflow_status ?? '',
+          processEntityId: events[0].process.entity_id,


Suggested change

processEntityId: events[0].process.entity_id,

processEntityId: events[0]?.process?.entity_id,

It should always be there, but best to err on the side of caution

zizhouW · 2022-03-22T16:35:37Z

@elasticmachine merge upstream

kibana-ci · 2022-03-22T18:09:46Z

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`sessionView`	37.1KB	39.1KB	+2.0KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`sessionView`	61.1KB	61.0KB	-73.0B

History

💔 Build #32701 failed 07e5811
💚 Build #32277 succeeded a61c73e
💔 Build #31953 failed 8a5c745
💛 Build #31525 was flaky 57f24b2

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

michaelolo24 · 2022-03-22T20:39:59Z

x-pack/plugins/session_view/public/components/process_tree/helpers.ts

+) =>
+  events.map((event) => {
+    // do nothing if event is not an alert
+    if (!event.kibana) {


Can do in a follow up PR, but in the future event.kibana may have other sub-properties, so may be best to use event?.kibana?.alert to be explicit

Thanks Michael, will update in my follow up PR!

michaelolo24

Thanks for doing this work! LGTM 🚀

Zizhou Wang added 7 commits March 16, 2022 18:07

Add alertFlyoutCallback to process_tree_alert

e69bec2

Fix merge conflicts

f65d31f

Add useCallback hook to callback functions

201b579

Rename to loadAlertDetails and add handleOnAlertDetailsClosed

57f24b2

Finish functionality

8a5c745

Fix jest tests

f1c437e

Merge branch 'main' into add-alert-fly-out-callback

26f0b5f

zizhouW marked this pull request as ready for review March 21, 2022 15:11

zizhouW requested review from mitodrummer, Tacklebox, michaelolo24, opauloh and animehart March 21, 2022 15:11

zizhouW linked an issue Mar 21, 2022 that may be closed by this pull request

[Meta Task] SessionView use callback passed from SecuitySolution to open alerts flyout. #128170

Closed

zizhouW commented Mar 21, 2022

View reviewed changes

zizhouW added release_note:feature Makes this part of the condensed release notes v8.2.0 Team: AWP: Platform Adaptive Workload Protection Platform team from Security Solution backport:skip This commit does not require backporting labels Mar 21, 2022

Add tests for updateAlertEventStatus

a61c73e

opauloh reviewed Mar 21, 2022

View reviewed changes

mitodrummer reviewed Mar 22, 2022

View reviewed changes

mitodrummer approved these changes Mar 22, 2022

View reviewed changes

opauloh approved these changes Mar 22, 2022

View reviewed changes

michaelolo24 reviewed Mar 22, 2022

View reviewed changes

Fix PR comments

07e5811

Merge branch 'main' into add-alert-fly-out-callback

bc09de9

zizhouW requested a review from michaelolo24 March 22, 2022 20:33

michaelolo24 reviewed Mar 22, 2022

View reviewed changes

michaelolo24 approved these changes Mar 22, 2022

View reviewed changes

zizhouW merged commit 9845a5c into elastic:main Mar 22, 2022

michaelolo24 mentioned this pull request Mar 23, 2022

[Security Solution][Investigations] - Integrate details flyout with session view #128369

Closed

9 tasks

zizhouW mentioned this pull request Mar 23, 2022

[Security solution][Session view] Separate alerts from events in Process #128434

Merged

michaelolo24 mentioned this pull request Mar 24, 2022

[Security Solution][Investigations] - Integrate details flyout with session view kqualters-elastic/kibana#3

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security team: AWP] [Session view] Add alert fly out callback #127991

[Security team: AWP] [Session view] Add alert fly out callback #127991

zizhouW commented Mar 17, 2022 •

edited

Loading

zizhouW Mar 21, 2022

opauloh Mar 21, 2022

zizhouW Mar 21, 2022 •

edited

Loading

mitodrummer Mar 22, 2022

opauloh Mar 22, 2022

opauloh Mar 21, 2022 •

edited

Loading

mitodrummer Mar 22, 2022

zizhouW Mar 22, 2022

mitodrummer left a comment

opauloh left a comment

michaelolo24 Mar 22, 2022

michaelolo24 Mar 22, 2022

zizhouW Mar 22, 2022 •

edited

Loading

michaelolo24 Mar 22, 2022

michaelolo24 Mar 22, 2022

michaelolo24 Mar 22, 2022

michaelolo24 Mar 22, 2022

zizhouW commented Mar 22, 2022

kibana-ci commented Mar 22, 2022

michaelolo24 Mar 22, 2022 •

edited

Loading

zizhouW Mar 22, 2022

michaelolo24 left a comment

	processEntityId: events[0].process.entity_id,
	processEntityId: events[0]?.process?.entity_id,

[Security team: AWP] [Session view] Add alert fly out callback #127991

[Security team: AWP] [Session view] Add alert fly out callback #127991

Conversation

zizhouW commented Mar 17, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zizhouW Mar 21, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

opauloh Mar 21, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mitodrummer left a comment

Choose a reason for hiding this comment

opauloh left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zizhouW Mar 22, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zizhouW commented Mar 22, 2022

kibana-ci commented Mar 22, 2022

💚 Build Succeeded

Metrics [docs]

Async chunks

Page load bundle

History

michaelolo24 Mar 22, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

michaelolo24 left a comment

Choose a reason for hiding this comment

zizhouW commented Mar 17, 2022 •

edited

Loading

zizhouW Mar 21, 2022 •

edited

Loading

opauloh Mar 21, 2022 •

edited

Loading

zizhouW Mar 22, 2022 •

edited

Loading

michaelolo24 Mar 22, 2022 •

edited

Loading