Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Detections] Fixes ip on threshold preview button when selecting an ip data type such as source.ip #105126

Merged
merged 2 commits into from
Jul 9, 2021
Merged

[Security Detections] Fixes ip on threshold preview button when selecting an ip data type such as source.ip #105126

merged 2 commits into from
Jul 9, 2021

Conversation

FrankHassanabad
Copy link
Contributor

@FrankHassanabad FrankHassanabad commented Jul 9, 2021 •
edited
Loading

Summary

See #100433 for details and test instructions.

This is considered critical and a small fix for 7.14.0 has been requested.

  • Wrote Cypress test that exercises the bug
  • Fixed mutation in one part of the Cypress Test
  • Decided to remove the "missing" that we were telling users was "others" since missing is not the same as others. It no longer errors, but some users might be asking why we don't show "others" anymore. The reality is that we only showed "missing" which isn't adding value to the preview of what detections will end up looking like.
  • Later if we want a true "others" we should implement it as a larger feature request and not a bug fix IMHO

Before you would get errors in your network panel:
errors_threshold

After you now get the source.ip without errors:
Screen Shot 2021-07-09 at 1 28 24 PM

Checklist

@FrankHassanabad FrankHassanabad self-assigned this Jul 9, 2021
@FrankHassanabad FrankHassanabad added Team:Detections and Resp Security Detection Response Team Feature:Detection Rule Preview Security Solution Rule Preview bug Fixes for quality problems that affect the customer experience release_note:fix v8.0.0 v7.15.0 v7.14.0 labels Jul 9, 2021
@FrankHassanabad FrankHassanabad added the auto-backport Deprecated - use backport:version if exact versions are needed label Jul 9, 2021
@FrankHassanabad FrankHassanabad marked this pull request as ready for review July 9, 2021 19:31
@FrankHassanabad FrankHassanabad requested a review from a team as a code owner July 9, 2021 19:31
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@FrankHassanabad FrankHassanabad linked an issue Jul 9, 2021 that may be closed by this pull request
[Security Solution] Rule Preview feature throws error for Threshold rule configured with group by field of type "ip" #100433
Closed
@FrankHassanabad FrankHassanabad changed the title [Security Detections] Fixes ip errors from happening on threshold preview button [Security Detections] Fixes ip on threshold preview button when selecting an ip data type such as source.ip Jul 9, 2021
@kibanamachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 6.3MB 6.3MB +22.0B

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @FrankHassanabad

yctercero
yctercero approved these changes Jul 9, 2021
View reviewed changes
Copy link
Contributor

@yctercero yctercero left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! I didn't get to pull down and test, though I worked on this section before so am familiar with the changes. Code lgtm!

@FrankHassanabad FrankHassanabad merged commit c07f51e into elastic:master Jul 9, 2021
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jul 9, 2021
@FrankHassanabad @kibanamachine
[Security Detections] Fixes ip on threshold preview button when selec…
d2c783e 
…ting an ip data type such as source.ip (elastic#105126)

## Summary

See elastic#100433 for details and test instructions.

This is considered critical and a small fix for 7.14.0 has been requested.

* Wrote Cypress test that exercises the bug
* Fixed mutation in one part of the Cypress Test
* Decided to remove the "missing" that we were telling users was "others" since missing is not the same as others. It no longer errors, but some users might be asking why we don't show "others" anymore. The reality is that we only showed "missing" which isn't adding value to the preview of what detections will end up looking like.
* Later if we want a true "others" we should implement it as a larger feature request and not a bug fix IMHO

Before you would get errors in your network panel: 
![errors_threshold](https://user-images.githubusercontent.com/1151048/125126681-b0380e00-e0b8-11eb-9f2c-a75e2909754c.png)

After you now get the `source.ip` without errors:
<img width="1074" alt="Screen Shot 2021-07-09 at 1 28 24 PM" src="https://user-images.githubusercontent.com/1151048/125127326-94813780-e0b9-11eb-9367-bb3b406ff55a.png">

### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
@kibanamachine kibanamachine mentioned this pull request Jul 9, 2021
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jul 9, 2021
@FrankHassanabad @kibanamachine
[Security Detections] Fixes ip on threshold preview button when selec…
c47e577 
…ting an ip data type such as source.ip (elastic#105126)

## Summary

See elastic#100433 for details and test instructions.

This is considered critical and a small fix for 7.14.0 has been requested.

* Wrote Cypress test that exercises the bug
* Fixed mutation in one part of the Cypress Test
* Decided to remove the "missing" that we were telling users was "others" since missing is not the same as others. It no longer errors, but some users might be asking why we don't show "others" anymore. The reality is that we only showed "missing" which isn't adding value to the preview of what detections will end up looking like.
* Later if we want a true "others" we should implement it as a larger feature request and not a bug fix IMHO

Before you would get errors in your network panel: 
![errors_threshold](https://user-images.githubusercontent.com/1151048/125126681-b0380e00-e0b8-11eb-9f2c-a75e2909754c.png)

After you now get the `source.ip` without errors:
<img width="1074" alt="Screen Shot 2021-07-09 at 1 28 24 PM" src="https://user-images.githubusercontent.com/1151048/125127326-94813780-e0b9-11eb-9367-bb3b406ff55a.png">

### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
@kibanamachine kibanamachine mentioned this pull request Jul 9, 2021
Merged
@kibanamachine
Copy link
Contributor

💚 Backport successful

Status Branch Result
✅ 7.14
✅ 7.x

The backport PRs will be merged automatically after passing CI.

@FrankHassanabad FrankHassanabad added the impact:critical This issue should be addressed immediately due to a critical level of impact on the product. label Jul 10, 2021
kibanamachine added a commit that referenced this pull request Jul 10, 2021
@kibanamachine @FrankHassanabad
[Security Detections] Fixes ip on threshold preview button when selec…
43c08d2 
…ting an ip data type such as source.ip (#105126) (#105159)

## Summary

See #100433 for details and test instructions.

This is considered critical and a small fix for 7.14.0 has been requested.

* Wrote Cypress test that exercises the bug
* Fixed mutation in one part of the Cypress Test
* Decided to remove the "missing" that we were telling users was "others" since missing is not the same as others. It no longer errors, but some users might be asking why we don't show "others" anymore. The reality is that we only showed "missing" which isn't adding value to the preview of what detections will end up looking like.
* Later if we want a true "others" we should implement it as a larger feature request and not a bug fix IMHO

Before you would get errors in your network panel: 
![errors_threshold](https://user-images.githubusercontent.com/1151048/125126681-b0380e00-e0b8-11eb-9f2c-a75e2909754c.png)

After you now get the `source.ip` without errors:
<img width="1074" alt="Screen Shot 2021-07-09 at 1 28 24 PM" src="https://user-images.githubusercontent.com/1151048/125127326-94813780-e0b9-11eb-9367-bb3b406ff55a.png">

### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

Co-authored-by: Frank Hassanabad <[email protected]>
kibanamachine added a commit that referenced this pull request Jul 10, 2021
@kibanamachine @FrankHassanabad
[Security Detections] Fixes ip on threshold preview button when selec…
c6cc910 
…ting an ip data type such as source.ip (#105126) (#105160)

## Summary

See #100433 for details and test instructions.

This is considered critical and a small fix for 7.14.0 has been requested.

* Wrote Cypress test that exercises the bug
* Fixed mutation in one part of the Cypress Test
* Decided to remove the "missing" that we were telling users was "others" since missing is not the same as others. It no longer errors, but some users might be asking why we don't show "others" anymore. The reality is that we only showed "missing" which isn't adding value to the preview of what detections will end up looking like.
* Later if we want a true "others" we should implement it as a larger feature request and not a bug fix IMHO

Before you would get errors in your network panel: 
![errors_threshold](https://user-images.githubusercontent.com/1151048/125126681-b0380e00-e0b8-11eb-9f2c-a75e2909754c.png)

After you now get the `source.ip` without errors:
<img width="1074" alt="Screen Shot 2021-07-09 at 1 28 24 PM" src="https://user-images.githubusercontent.com/1151048/125127326-94813780-e0b9-11eb-9367-bb3b406ff55a.png">

### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

Co-authored-by: Frank Hassanabad <[email protected]>
@spong spong mentioned this pull request Aug 11, 2021
Closed
@peluja1012 peluja1012 mentioned this pull request Nov 9, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@yctercero yctercero yctercero approved these changes

@madirey madirey Awaiting requested review from madirey

Assignees

@FrankHassanabad FrankHassanabad

Labels
auto-backport Deprecated - use backport:version if exact versions are needed bug Fixes for quality problems that affect the customer experience Feature:Detection Rule Preview Security Solution Rule Preview impact:critical This issue should be addressed immediately due to a critical level of impact on the product. release_note:fix Team:Detections and Resp Security Detection Response Team v7.14.0 v7.15.0 v8.0.0
Projects
None yet
Milestone
No milestone
4 participants
@FrankHassanabad @elasticmachine @kibanamachine @yctercero