Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Refactor timeline to use global query string helpers #136273

Merged
merged 5 commits into from
Jul 26, 2022
Merged

[Security Solution] Refactor timeline to use global query string helpers #136273

merged 5 commits into from
Jul 26, 2022

Conversation

machadoum
Copy link
Member

@machadoum machadoum commented Jul 13, 2022 •
edited by kibanamachine
Loading

original issue #123617
Following up #134210
Documentation use_url_state proposal

Summary

Refactor timeline to use global query string.
It also deletes use_url_state and related code.

Checklist

Delete any items that are not applicable to this PR.

Migration status

  • soucerer
  • app query
  • filters
  • saved query
  • timerange
  • timeline [current PR]

What to test

  • It should not present changes to the final user.
  • Test timelines page and timeline widget
  • Changes to the timeline should reflect on the URL
  • When opening a timeline and refreshing the page the timeline should open again.
  • I should fetch the conflicted timeline when opening a timeline from the conflict id warning message (the conflict scenario happens when migrating from an older version to 8.0+).

How to reproduce conflicted timeline ids?

  • Open the console and execute:
POST .kibana/_bulk
{"index":{"_id":"siem-ui-timeline:f3b13020-302d-11ec-8418-4787b7fe6908-test1"}}
{"siem-ui-timeline":{"columns":[{"columnHeaderType":"not-filtered","id":"@timestamp","type":"number"},{"columnHeaderType":"not-filtered","id":"message"},{"columnHeaderType":"not-filtered","id":"event.category"},{"columnHeaderType":"not-filtered","id":"event.action"},{"columnHeaderType":"not-filtered","id":"host.name"},{"columnHeaderType":"not-filtered","id":"source.ip"},{"columnHeaderType":"not-filtered","id":"destination.ip"},{"columnHeaderType":"not-filtered","id":"user.name"}],"created":1634573446178,"createdBy":"elastic","dataProviders":[],"dateRange":{"end":"2021-10-19T03:59:59.999Z","start":"2021-10-18T04:00:00.000Z"},"description":"","eqlOptions":{"eventCategoryField":"event.category","query":"","size":100,"tiebreakerField":"","timestampField":"@timestamp"},"eventType":"all","excludedRowRendererIds":[],"filters":[],"indexNames":["logs-*",".siem-signals-default"],"kqlMode":"filter","kqlQuery":{"filterQuery":{"kuery":{"expression":"event.id: * ","kind":"kuery"},"serializedQuery":"{\"bool\":{\"should\":[{\"exists\":{\"field\":\"event.id\"}}],\"minimum_should_match\":1}}"}},"sort":[{"columnId":"@timestamp","columnType":"number","sortDirection":"desc"}],"status":"active","templateTimelineId":null,"templateTimelineVersion":null,"timelineType":"default","title":"Exportable Timeline","updated":1634573457363,"updatedBy":"elastic"},"coreMigrationVersion":"8.0.0","migrationVersion":{"siem-ui-timeline":"8.0.0"},"references":[],"type":"siem-ui-timeline","updated_at":"2021-10-18T16:10:57.366Z","namespaces":["test1"]}
{"index":{"_id":"siem-ui-timeline:f3b13020-302d-11ec-8418-4787b7fe6908-test2-newId"}}
{"siem-ui-timeline":{"columns":[{"columnHeaderType":"not-filtered","id":"@timestamp","type":"number"},{"columnHeaderType":"not-filtered","id":"message"},{"columnHeaderType":"not-filtered","id":"event.category"},{"columnHeaderType":"not-filtered","id":"event.action"},{"columnHeaderType":"not-filtered","id":"host.name"},{"columnHeaderType":"not-filtered","id":"source.ip"},{"columnHeaderType":"not-filtered","id":"destination.ip"},{"columnHeaderType":"not-filtered","id":"user.name"}],"created":1634573446178,"createdBy":"elastic","dataProviders":[],"dateRange":{"end":"2021-10-19T03:59:59.999Z","start":"2021-10-18T04:00:00.000Z"},"description":"","eqlOptions":{"eventCategoryField":"event.category","query":"","size":100,"tiebreakerField":"","timestampField":"@timestamp"},"eventType":"all","excludedRowRendererIds":[],"filters":[],"indexNames":["logs-*",".siem-signals-default"],"kqlMode":"filter","kqlQuery":{"filterQuery":{"kuery":{"expression":"event.id: * ","kind":"kuery"},"serializedQuery":"{\"bool\":{\"should\":[{\"exists\":{\"field\":\"event.id\"}}],\"minimum_should_match\":1}}"}},"sort":[{"columnId":"@timestamp","columnType":"number","sortDirection":"desc"}],"status":"active","templateTimelineId":null,"templateTimelineVersion":null,"timelineType":"default","title":"Exportable Timeline","updated":1634573457363,"updatedBy":"elastic"},"coreMigrationVersion":"8.0.0","migrationVersion":{"siem-ui-timeline":"8.0.0"},"references":[],"type":"siem-ui-timeline","updated_at":"2021-10-18T16:10:57.366Z","namespaces":["test2"]}
{"index":{"_id":"siem-ui-timeline:f3b13020-302d-11ec-8418-4787b7fe6908-test3"}}
{"siem-ui-timeline":{"columns":[{"columnHeaderType":"not-filtered","id":"@timestamp","type":"number"},{"columnHeaderType":"not-filtered","id":"message"},{"columnHeaderType":"not-filtered","id":"event.category"},{"columnHeaderType":"not-filtered","id":"event.action"},{"columnHeaderType":"not-filtered","id":"host.name"},{"columnHeaderType":"not-filtered","id":"source.ip"},{"columnHeaderType":"not-filtered","id":"destination.ip"},{"columnHeaderType":"not-filtered","id":"user.name"}],"created":1634573446178,"createdBy":"elastic","dataProviders":[],"dateRange":{"end":"2021-10-19T03:59:59.999Z","start":"2021-10-18T04:00:00.000Z"},"description":"","eqlOptions":{"eventCategoryField":"event.category","query":"","size":100,"tiebreakerField":"","timestampField":"@timestamp"},"eventType":"all","excludedRowRendererIds":[],"filters":[],"indexNames":["logs-*",".siem-signals-default"],"kqlMode":"filter","kqlQuery":{"filterQuery":{"kuery":{"expression":"event.id: * ","kind":"kuery"},"serializedQuery":"{\"bool\":{\"should\":[{\"exists\":{\"field\":\"event.id\"}}],\"minimum_should_match\":1}}"}},"sort":[{"columnId":"@timestamp","columnType":"number","sortDirection":"desc"}],"status":"active","templateTimelineId":null,"templateTimelineVersion":null,"timelineType":"default","title":"Exportable Timeline","updated":1634573457363,"updatedBy":"elastic"},"coreMigrationVersion":"8.0.0","migrationVersion":{"siem-ui-timeline":"8.0.0"},"references":[],"type":"siem-ui-timeline","updated_at":"2021-10-18T16:10:57.366Z","namespaces":["test3"]}
{"index":{"_id":"siem-ui-timeline:f3b13020-302d-11ec-8418-4787b7fe6908-test3-newId"}}
{"siem-ui-timeline":{"columns":[{"columnHeaderType":"not-filtered","id":"@timestamp","type":"number"},{"columnHeaderType":"not-filtered","id":"message"},{"columnHeaderType":"not-filtered","id":"event.category"},{"columnHeaderType":"not-filtered","id":"event.action"},{"columnHeaderType":"not-filtered","id":"host.name"},{"columnHeaderType":"not-filtered","id":"source.ip"},{"columnHeaderType":"not-filtered","id":"destination.ip"},{"columnHeaderType":"not-filtered","id":"user.name"}],"created":1634573446178,"createdBy":"elastic","dataProviders":[],"dateRange":{"end":"2021-10-19T03:59:59.999Z","start":"2021-10-18T04:00:00.000Z"},"description":"","eqlOptions":{"eventCategoryField":"event.category","query":"","size":100,"tiebreakerField":"","timestampField":"@timestamp"},"eventType":"all","excludedRowRendererIds":[],"filters":[],"indexNames":["logs-*",".siem-signals-default"],"kqlMode":"filter","kqlQuery":{"filterQuery":{"kuery":{"expression":"event.id: * ","kind":"kuery"},"serializedQuery":"{\"bool\":{\"should\":[{\"exists\":{\"field\":\"event.id\"}}],\"minimum_should_match\":1}}"}},"sort":[{"columnId":"@timestamp","columnType":"number","sortDirection":"desc"}],"status":"active","templateTimelineId":null,"templateTimelineVersion":null,"timelineType":"default","title":"Exportable Timeline","updated":1634573457363,"updatedBy":"elastic"},"coreMigrationVersion":"8.0.0","migrationVersion":{"siem-ui-timeline":"8.0.0"},"references":[],"type":"siem-ui-timeline","updated_at":"2021-10-18T16:10:57.366Z","namespaces":["test3"]}
{"index":{"_id":"legacy-url-alias:test2:siem-ui-timeline:f3b13020-302d-11ec-8418-4787b7fe6908-test2"}}
{"legacy-url-alias":{"targetNamespace":"test2","targetType":"siem-ui-timeline","targetId":"f3b13020-302d-11ec-8418-4787b7fe6908-test2-newId","sourceId":"f3b13020-302d-11ec-8418-4787b7fe6908-test2"},"type":"legacy-url-alias","references":[]}
{"index":{"_id":"legacy-url-alias:test3:siem-ui-timeline:f3b13020-302d-11ec-8418-4787b7fe6908-test3"}}
{"legacy-url-alias":{"targetNamespace":"test3","targetType":"siem-ui-timeline","targetId":"f3b13020-302d-11ec-8418-4787b7fe6908-test3-newId","sourceId":"f3b13020-302d-11ec-8418-4787b7fe6908-test3"},"type":"legacy-url-alias","references":[]}
{"index":{"_id":"space:test1"}}
{"space":{"name":"Test 1: Resolve Exact Match","initials":"T1","description":"In this space, test object(s) will resolve with an \"exactMatch\" outcome.","disabledFeatures":[]},"type":"space"}
{"index":{"_id":"space:test2"}}
{"space":{"name":"Test 2: Resolve Alias Match","initials":"T2","description":"In this space, test object(s) will resolve with an \"aliasMatch\" outcome.","disabledFeatures":[]},"type":"space"}
{"index":{"_id":"space:test3"}}
{"space":{"name":"Test 3: Resolve Conflict","initials":"T3","description":"In this space, test object(s) will resolve with a \"conflict\" outcome.","disabledFeatures":[]},"type":"space"}
  • Go to security solutions and open the conflicted id workspace (Test 3: Resolve Conflict).
  • Open the timelines page and click on one of the timelines
  • A warning message will show up. Then you click on the link
  • It should fetch the data for the new timeline.

@machadoum machadoum force-pushed the use_url_state_4 branch 3 times, most recently from 51b41f4 to 4fcf122 Compare July 14, 2022 14:21
@machadoum machadoum force-pushed the use_url_state_4 branch 2 times, most recently from afa6112 to 3ceeedc Compare July 25, 2022 09:44
@machadoum
Copy link
Member Author

@elasticmachine merge upstream

@machadoum machadoum self-assigned this Jul 25, 2022
@machadoum machadoum added release_note:skip Skip the PR/issue when compiling release notes Team:Threat Hunting Security Solution Threat Hunting Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Explore v8.5.0 labels Jul 25, 2022
@machadoum machadoum marked this pull request as ready for review July 25, 2022 11:49
@machadoum machadoum requested a review from a team July 25, 2022 11:49
@machadoum machadoum requested review from a team as code owners July 25, 2022 11:49
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

@machadoum machadoum requested a review from xcrzx July 25, 2022 11:49
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

zizhouW
zizhouW approved these changes Jul 25, 2022
View reviewed changes
Copy link
Contributor

@zizhouW zizhouW left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

x-pack/plugins/security_solution/public/common/components/sessions_viewer/index.test.tsx changes LGTM

semd
semd approved these changes Jul 25, 2022
View reviewed changes
Copy link
Contributor

@semd semd left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's amazing Pablo. The url query logic has much more sense now. thanks for doing this improvement, and the cleaning 🧹 Tested locally, I have not detected any change in the application behavior.
I only left a small suggestion.
LGTM!

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

1 similar comment
@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@machadoum machadoum removed the v8.5.0 label Aug 4, 2022
@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

11 similar comments
@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@michaelolo24 michaelolo24 removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Aug 22, 2022
@kibanamachine kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Aug 23, 2022
@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

9 similar comments
@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 136273 locally

@machadoum machadoum added backport:skip This commit does not require backporting and removed backport missing Added to PRs automatically when the are determined to be missing a backport. v8.4.0 labels Sep 6, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@xcrzx xcrzx xcrzx approved these changes

@angorayc angorayc angorayc approved these changes

@yctercero yctercero yctercero approved these changes

@zizhouW zizhouW zizhouW approved these changes

@michaelolo24 michaelolo24 michaelolo24 approved these changes

@semd semd semd approved these changes

@kqualters-elastic kqualters-elastic kqualters-elastic approved these changes

Assignees

@machadoum machadoum

Labels
backport:skip This commit does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Explore Team:Threat Hunting Security Solution Threat Hunting Team
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.