[Security Solution][Exceptions] - Exception Modal Part I #70639

peluja1012 · 2020-07-02T19:23:41Z

Summary

This PR adds modals for Adding and Editing exception items. These modals will be used in various pages in the app to enable the user to add Exceptions to their rules.

When an endpoint exception is added, the modal is pre-populated with exception items most common to the Endpoint use case
When adding an exception item, the items are enriched with comments before they're sent to the server. Endpoint exceptions are also enriched with an operating system _tag.
When a user edits an item, they can edit the item entries but also have the option to add new items. Handling of deletion of an item while editing will be address in an upcoming PR
The modals have checkboxes for "Closing the alert" and for "Bulk close alerts matching exception attributes". When editing or adding exceptions from the exceptions viewer, users will only able to bulk close alerts given that there is no "alert" context.
When creating an exception for the first time, a new exception list will be created and a new reference to this list will be added to the corresponding rule.

Coming in Part II

Handle case when user deletes an item in the Edit Modal.
Implement bulk close. Currently the checkbox doesn't trigger a bulk close action on the server.
Filter out fields not included in the list of Endpoint "exceptionable" fields when the user tries to add an Endpoint Exception
Allow the user to add Exceptions from the Timeline
Disable "Add Endpoint Exception" option for non-Endpoint alerts
Add tests for helper functions
Add tests for react components if necessary
Look into using lists plugin hooks like the persistExceptionItem hook

Usage Examples

Alerts page

Rule Details External Alerts tab

Rule Details Exceptions tab

Adding an exception from the exceptions viewer

Adding an exception from an alert event

Editing an exception

Exception comments

Testing

To turn on lists plugin - in kibana.dev.yml

# Enable lists feature
xpack.lists.enabled: true
xpack.lists.listIndex: '.lists-yara'
xpack.lists.listItemIndex: '.items-yara'

Navigate to the Alerts page or Rule Details page and select Add Exception or Add Endpoint Exception from the options in the alerts Timeline
In the Rule Details page, click on the Exceptions tab, then select Add to endpoint list or Add to detection list from the options in the Exception Viewer header.

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios
This was checked for keyboard-only and screenreader accessibility
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser
This was checked for cross-browser compatibility, including a check against IE11

For maintainers

This was checked for breaking API changes and was labeled appropriately

x-pack/plugins/lists/public/exceptions/hooks/persist_exception_item.ts

x-pack/plugins/lists/public/exceptions/hooks/use_api.ts

x-pack/plugins/lists/public/exceptions/types.ts

x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.tsx

x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.ts

x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.ts

yctercero · 2020-07-02T19:30:43Z

x-pack/plugins/lists/public/index.tsx

@@ -13,6 +13,12 @@ export { useFindLists } from './lists/hooks/use_find_lists';
 export { useImportList } from './lists/hooks/use_import_list';
 export { useDeleteList } from './lists/hooks/use_delete_list';
 export { useExportList } from './lists/hooks/use_export_list';
+export {
+  addExceptionListItem,
+  updateExceptionListItem,


I'm not sure we need to export these as they are all available in useApi

yctercero · 2020-07-02T19:34:29Z

x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.tsx

@@ -190,6 +205,21 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
    [dispatchToaster]
  );

+  const openAddExceptionModalCallback = useCallback(
+    ({ ruleName, ruleId, exceptionListType, alertData }: AddExceptionOnClick) => {
+      if (alertData !== null && alertData !== undefined) {


You can use != here to check for both null and undefined

yctercero · 2020-07-02T19:36:54Z

x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.tsx

+    setAddExceptionModalState(addExceptionModalInitialState);
+  }, [setShouldShowAddExceptionModal, setAddExceptionModalState]);
+
+  const onAddExceptionCancel = useCallback(() => {


Could onAddExceptionCancel and onAddExceptionConfirm be combined into one function like onCloseAddExceptionModal?

Will look into this in the follow up PR

yctercero · 2020-07-02T19:52:27Z

x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.tsx

+        start={from}
+        utilityBar={utilityBarCallback}
+      />
+      {shouldShowAddExceptionModal === true && addExceptionModalState.alertData !== null && (


Same here as before, using != null will catch both undefined and null

yctercero · 2020-07-02T19:57:12Z

...ins/security_solution/public/alerts/containers/detection_engine/alerts/use_add_exception.tsx

@@ -0,0 +1,139 @@
+/*


You should just be able to use the usePersistExceptionItem hook from the lists plugin. It determines when to use the post vs put within it. Maybe you can update that existing hook to accept a list of items instead of just 1?

Will look into this in the follow up PR. This hook will eventually need to handle bulk close as well as current alert close also.

yctercero · 2020-07-02T19:59:08Z

x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.tsx

@@ -258,6 +258,21 @@ export const RuleDetailsPageComponent: FC<PropsFromRedux> = ({
    return null;
  }

+  // TODO: remove this once namespace is finalized as camecased or snakecase
+  const exceptionListsMeta = useMemo(() => {


Working to get that PR in! :) Hope to have it cleaned up EOD.

yctercero · 2020-07-02T20:12:15Z

x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_comments.tsx

+      <EuiFlexGroup gutterSize={'none'}>
+        <EuiFlexItem grow={false}>
+          <MyAvatar
+            name={currentUser !== null ? currentUser.username.toUpperCase() ?? '' : ''} // TODO: Still need to standardize this


Is there a case where there wouldn't be a username accessible here? If there isn't one does that mean they don't have certain access rights and would we at that point not let them add an exception at all?

yctercero · 2020-07-02T20:15:14Z

.../plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx

+export interface AddExceptionOnClick {
+  ruleName: string;
+  ruleId: string;
+  ruleExceptionLists?: ExceptionListSchema[];


I might be explicit here like ruleExceptionLists: ExceptionListSchema[] | undefined; Because we're using it as a tell for whether the user is creating a new list vs. editing right?

yctercero · 2020-07-02T20:17:12Z

.../plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx

+    onConfirm();
+  }, [dispatchToaster, onConfirm]);
+
+  const [{ isLoading: addExceptionIsLoading }, addOrUpdateExceptionItems] = useAddOrUpdateException(


Mentioned it above, but I think you can just use the existing persist_exception_item.ts hook in the lists plugin.

yctercero · 2020-07-02T20:19:04Z

.../plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx

+    [setShouldBulkCloseAlert]
+  );
+
+  const enrichExceptionItems = useCallback(() => {


I might move some of these functions out into a helpers.ts file so you can unit test them easily.

We'll look into moving the entire enrichExceptionItems function to the helpers file in the follow up PR.

yctercero · 2020-07-02T20:23:24Z

.../plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx

+                <EuiText>{i18n.EXCEPTION_BUILDER_INFO}</EuiText>
+                <EuiSpacer />
+                <ExceptionBuilder
+                  exceptionListItems={exceptionItemsToAdd}


I think I might avoid passing this in, since the ExceptionBuilder manages its own state, it just takes an initial list of exception list items to start with. Might be easier to discuss this one offline to see if I missed something.

elasticmachine · 2020-07-03T00:07:25Z

Pinging @elastic/siem (Team:SIEM)

peluja1012 · 2020-07-03T00:43:10Z

...ity_solution/public/common/components/exceptions/use_fetch_or_create_rule_exception_list.tsx

+        return Promise.resolve(newExceptionList);
+      } catch (error) {
+        // TODO: properly handle 409 conflict if exception list already exists
+        return Promise.reject(error);


We'll need to handle conflict errors in Part || if the exception list already exists due to stale rule references or race conditions.

peluja1012 · 2020-07-03T00:44:53Z

...ity_solution/public/common/components/exceptions/use_fetch_or_create_rule_exception_list.tsx

+        _tags: undefined,
+        tags: undefined,
+        // TODO: Make this a constant that's shared throughout the app
+        list_id: exceptionListType === 'endpoint' ? 'endpoint_list' : undefined,


In Part II, we'll create a constant and share it with the endpoint exceptions artifact builder code.

I don't think you need to pass a list_id here. It will be generated by the server.

yctercero · 2020-07-05T21:52:00Z

x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.tsx

@@ -90,6 +101,10 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({

  const [showClearSelectionAction, setShowClearSelectionAction] = useState(false);
  const [filterGroup, setFilterGroup] = useState<Status>(FILTER_OPEN);
+  const [shouldShowAddExceptionModal, setShouldShowAddExceptionModal] = useState(false);
+  const [addExceptionModalState, setAddExceptionModalState] = useState(


Nit: I might add the typing here like - const [addExceptionModalState, setAddExceptionModalState] = useState<AddExceptionOnClick>(addExceptionModalInitialState);

yctercero · 2020-07-05T22:55:34Z

x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.tsx

-  const setIsModalOpen = useCallback(
-    (isOpen: boolean): void => {
+  const setCurrentModal = useCallback(
+    (modalName: string | null): void => {


Nit: Can we make this an enum for the different modal types?

yctercero · 2020-07-05T22:58:00Z

x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.tsx

+          />
+        )}
+
+      {currentModal === 'addModal' && exceptionListTypeToEdit !== null && (


Here I would use the != null to catch null and undefined.

yctercero · 2020-07-05T23:00:47Z

...ity_solution/public/common/components/exceptions/use_fetch_or_create_rule_exception_list.tsx

+  ruleId,
+  exceptionListType,
+  onError,
+  onSuccess,


Do you need the onSuccess or can that be inferred from the return value?

Don't need it. Removed.

yctercero · 2020-07-05T23:10:15Z

...ity_solution/public/common/components/exceptions/use_fetch_or_create_rule_exception_list.tsx

+    ): Promise<ExceptionListSchema> {
+      const newExceptionList = await createExceptionList(ruleResponse);
+
+      let newExceptionListReferences: ListArray;


I think one pattern I've noticed is that we try to avoid using lets and casting. I think here it could be something like:

const newExceptonListReference = { id: newExceptionList.id, namespace_type: newExceptionList.namespace_type, }; const newExceptionListReferences: ListArray = [...(ruleResponse.exceptions_list ?? []), newExceptionListReference];

Good call. Updated.

x-pack/plugins/security_solution/public/common/components/exceptions/builder/index.tsx

yctercero · 2020-07-05T23:41:08Z

x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx

@@ -161,6 +167,10 @@ export const getOperatingSystems = (tags: string[]): string => {
  return osMatches;
 };

+export const getOsTagValues = (tags: string[]): string[] => {


Is this functionally the same as getOperatingSystems?

I think so. @dplumlee is going to look into dropping the additional formatting from getOperatingSystems in the next PR.

yctercero · 2020-07-05T23:44:21Z

x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx

@@ -184,7 +194,7 @@ export const getDescriptionListContent = (
  const details = [
    {
      title: i18n.OPERATING_SYSTEM,
-      value: getOperatingSystems(exceptionItem._tags),
+      value: getOperatingSystems(exceptionItem._tags ?? []),


In kibana/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts it looks like _tags gets defaulted to an empty array on creation, so we should be good to remove the ?? [].

yctercero · 2020-07-05T23:47:42Z

x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx

+  return undefined;
+};
+
+export const entryHasListType = (


I think you can use the helper export const isListType = (item: BuilderEntry): item is EmptyListEntry => item.type === OperatorTypeEnum.LIST; here?

To be addressed in follow up PR

yctercero · 2020-07-05T23:49:48Z

x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx

+  if (item != null && item.value != null) {
+    return item.value;
+  }
+  return undefined;


Could you return an empty array here and then you don't have to do checks like the following and the return type is just string[]: getMappedNonEcsValue({ data: alertData, fieldName: 'file.hash.sha1' }) ?? []

To be addressed in follow up PR

yctercero

Played around with the modal together while debugging a separate issue. Excited to see it all come together! LGTM - thanks for creating a ticket with the list of things to follow up on so they don't slip through the cracks. Some things I would make sure to follow up on is using != null, that'll help avoid missing catching an undefined or null if we try to explicitly check for each separately. Also, following up on the need for list_id on creation of exception lists. Thanks so much!

yctercero · 2020-07-07T20:36:12Z

.../plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx

+        </ModalHeader>
+
+        {fetchOrCreateListError === true && (
+          <EuiCallOut title={'Error'} color="danger" iconType="alert">


I think the title needs to be in i18n?

Good catch. Done.

yctercero · 2020-07-07T20:44:01Z

x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_comments.tsx

+import { getFormattedComments } from './helpers';
+
+interface AddExceptionCommentsProps {
+  exceptionItemComments?: Comments[];


Nit: I think we can get rid of the ? here? Comments defaults to an empty array, so it should appear. Or maybe make it explicit Comments[] | undefined if in a not yet created exception item it's not yet defined?

My thinking was that this prop would be optional because we use this commend in the Add Modal also where there are no pre-existing comments.

yctercero · 2020-07-07T20:49:17Z

.../plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx

+                <EuiSpacer />
+                <ExceptionBuilder
+                  exceptionListItems={initialExceptionItems}
+                  listType={exceptionListType as 'endpoint' | 'detection'}


I don't think this needs to be casted here. The schema checks should validate that it's either endpoint | detection.

yctercero · 2020-07-07T20:50:23Z

x-pack/plugins/security_solution/public/common/components/exceptions/builder/index.tsx

@@ -43,7 +43,7 @@ interface OnChangeProps {
 }

 interface ExceptionBuilderProps {
-  exceptionListItems: ExceptionListItemSchema[];
+  exceptionListItems: ExceptionsBuilderExceptionItem[];
  listType: 'detection' | 'endpoint';


I think I missed this in my PR, but here we can update to use the enum from the lists plugin.

This is actually why I was having problems with listType in the modal. I'll update the builder to use the enum.

yctercero · 2020-07-07T20:51:42Z

...plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx

+            <ModalBodySection className="builder-section">
+              <ExceptionBuilder
+                exceptionListItems={[exceptionItem]}
+                listType={exceptionListType as 'endpoint' | 'detection'}


Same as comment above, I think I missed updating the prop to be ExceptionListTypeEnum (from lists plugin). That should remove any need to cast.

yctercero · 2020-07-07T20:54:11Z

x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx

@@ -292,7 +309,7 @@ export const getNewExceptionItem = ({
  namespaceType,
  ruleName,
 }: {
-  listType: 'detection' | 'endpoint';
+  listType: ExceptionListType;


I missed this in my PR. I would update to use ExceptionListTypeEnum from lists common schema.

yctercero · 2020-07-07T20:57:29Z

...olution/public/common/components/exceptions/use_fetch_or_create_rule_exception_list.test.tsx

+    ...endpointExceptionList,
+    name: 'new endpoint exception list',
+  };
+  const exceptionsListReferences: ListArray = [


I think we can use the getListMock from x-pack/plugins/security_solution/common/detection_engine/schemas/types/lists.mock.ts

Good call. Done.

yctercero · 2020-07-07T20:58:46Z

...ity_solution/public/common/components/exceptions/use_fetch_or_create_rule_exception_list.tsx

+        _tags: undefined,
+        tags: undefined,
+        // TODO: Make this a constant that's shared throughout the app
+        list_id: exceptionListType === 'endpoint' ? 'endpoint_list' : undefined,


I don't think you need to pass a list_id here. It will be generated by the server.

yctercero · 2020-07-07T20:59:58Z

...ity_solution/public/common/components/exceptions/use_fetch_or_create_rule_exception_list.tsx

+    }
+
+    async function fetchRuleExceptionLists(ruleResponse: Rule): Promise<ExceptionListSchema[]> {
+      const exceptionListReferences = ruleResponse.exceptions_list as ListArray;


Since the response gets validated, we shouldn't need to do any casting.

Yup, this is not needed. It's leftover from when the types weren't finalized yet.

yctercero · 2020-07-07T21:01:15Z

...ity_solution/public/common/components/exceptions/use_fetch_or_create_rule_exception_list.tsx

+        let exceptionListToUse: ExceptionListSchema;
+        const matchingList = exceptionLists.find((list) => {
+          if (exceptionListType === 'endpoint') {
+            return list.type === exceptionListType && list.list_id === 'endpoint_list';


I might check with @FrankHassanabad , but almost certain that we shouldn't create a list_id in the client. We should let the server create it and then reference it here using the response from the creation.

We need to think about the right behavior is here when there is no exception list present. We can iterate on it.

kibanamachine · 2020-07-08T00:50:18Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: f03a20f

Build metrics

@kbn/optimizer bundle module count

id	value	diff	baseline
securitySolution	810	+1	809

History

💛 Build #59567 was flaky 1fd2a48
💔 Build #59545 failed 052a80e
💔 Build #59074 failed 169cd10
💔 Build #59029 failed 08a2f68
💔 Build #58748 failed 931bc45

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

…1035) * adds 2 menu items to alert page, progress on exception modal * adds enriching * remove unused useExceptionList() * implements some types * move add exception modal files * Exception builder changes to support latest schema * Changes to lists plugin schemas and fix api bug Needed to make the schemas more forgiving. Before this change they required name, description, etc for creation and update. The update item API was using the wrong url. * Adding and editing exceptions working - Modifies add_exception_modal component - Creates edit_exception_modal component - Creates shared comments component - Creates use_add_exception api hook for adding or editing exceptions - Updates viewer code to support adding and editing exceptions - Updates alerts table code to use updated version of add_exception_modal * fixes duplicate types * updates os tag input * fixes comment style * removes checkbox programatically * grahpql updates to expose exceptions_list * Add fetch_or_create_exception_list hook * fixes data population * refactor use_add_exception hook, add tests * fix rebase issues, pending updates to edit modal * fix edit modal and default endpoint exceptions * adds second checkbox * adds signal index stuff * switches boolean logic * fix some type errors * remove unnecesary code * fixes checkbox logic in edit modal * fixes recursive prop passing * addresses comments/fixes types * Revert schema type changes * type fixes * fixes regular exception modal * fix more type errors, remove console log * fix tests * move add exception hook, lint * close alert checkbox closes alert * address PR comments * add type to patch rule call, fix ts errors * fix lint * fix merge problems after conflict * Address PR comments * undo graphql type change Co-authored-by: Davis Plumlee <[email protected]> Co-authored-by: Davis Plumlee <[email protected]>

* master: (36 commits) fixed api url in example plugin (elastic#70934) [data.search.aggs]: Remove remaining client dependencies (elastic#70251) [Security Solution][Endpoint] Fix base64 download bug and adopt new user artifact/manifest format (elastic#70998) [Security Solution][Exceptions] - Exception Modal Part I (elastic#70639) [SIEM][Detection Engine][Lists] Adds additional data types to value based lists [SIEM][Detection Engine][Lists] Removes feature flag for lists [APM] Show license callout in ML settings (elastic#70959) Migrate service settings test to jest (elastic#70992) [APM] Add cloud attributes to data telemetry (elastic#71008) Fix breadcrumb on panels for visibility / round corners (elastic#71010) Improve search typescript (elastic#69333) [savedObjects field count] run in baseline job (elastic#70999) [Security Solution] [Timeline] Timeline manager tweaks (elastic#69988) [Endpoint] Support redirect from Policy Details to Ingest when user initiates Edit Policy from Datasource Edit page (elastic#70874) [APM] Add API tests (elastic#70740) [Security Solution][Exceptions] - Tie server and client code together (elastic#70918) [Audit Logging] Add AuditTrail service (elastic#69278) [Usage Collection] Ensure no type duplicates (elastic#70946) [Security Solution] [Timeline] Bugfix for timeline row actions disappear sometimes (elastic#70958) [CI] Add pipeline task queue framework and merge workers into one (elastic#64011) ...

elasticmachine · 2021-09-23T14:31:49Z

Pinging @elastic/security-solution (Team: SecuritySolution)

peluja1012 commented Jul 2, 2020

View reviewed changes

x-pack/plugins/lists/public/exceptions/hooks/persist_exception_item.ts Outdated Show resolved Hide resolved

peluja1012 commented Jul 2, 2020

View reviewed changes

x-pack/plugins/lists/public/exceptions/hooks/use_api.ts Outdated Show resolved Hide resolved

peluja1012 commented Jul 2, 2020

View reviewed changes

x-pack/plugins/lists/public/exceptions/types.ts Outdated Show resolved Hide resolved

peluja1012 commented Jul 2, 2020

View reviewed changes

x-pack/plugins/security_solution/public/common/components/exceptions/viewer/index.tsx Outdated Show resolved Hide resolved

yctercero reviewed Jul 2, 2020

View reviewed changes

x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.ts Outdated Show resolved Hide resolved

yctercero reviewed Jul 2, 2020

View reviewed changes

x-pack/plugins/lists/common/schemas/response/exception_list_item_schema.ts Outdated Show resolved Hide resolved

yctercero reviewed Jul 2, 2020

View reviewed changes

peluja1012 added Team:SIEM release_note:enhancement v7.9.0 v8.0.0 labels Jul 2, 2020

peluja1012 marked this pull request as ready for review July 3, 2020 00:07

peluja1012 requested review from a team as code owners July 3, 2020 00:07

peluja1012 commented Jul 3, 2020

View reviewed changes

peluja1012 changed the title ~~[SIEM][Exceptions] - Exception Modal Part I~~ [Security Solution][Exceptions] - Exception Modal Part I Jul 3, 2020

yctercero reviewed Jul 5, 2020

View reviewed changes

peluja1012 force-pushed the exception-modal branch from 931bc45 to 08a2f68 Compare July 6, 2020 15:48

dplumlee mentioned this pull request Jul 6, 2020

[Security Solution][Exceptions] - Exceptions modal pt 2 #70886

Merged

23 tasks

peluja1012 force-pushed the exception-modal branch from 169cd10 to 052a80e Compare July 7, 2020 20:22

yctercero approved these changes Jul 7, 2020

View reviewed changes

peluja1012 and others added 6 commits July 7, 2020 17:50

adds 2 menu items to alert page, progress on exception modal

7754af5

adds enriching

effa4bd

remove unused useExceptionList()

3f0ec65

implements some types

b98db45

move add exception modal files

82cf87c

Exception builder changes to support latest schema

03435bc

peluja1012 and others added 21 commits July 7, 2020 17:56

fix edit modal and default endpoint exceptions

d69be16

adds second checkbox

0a6453e

adds signal index stuff

05e6688

switches boolean logic

17a2fe7

fix some type errors

d0fb00d

remove unnecesary code

d56903a

fixes checkbox logic in edit modal

08aefd2

fixes recursive prop passing

7e7e515

addresses comments/fixes types

c48087e

Revert schema type changes

1de1ac6

type fixes

a1c0fc3

fixes regular exception modal

e941f6c

fix more type errors, remove console log

2cf0d15

fix tests

c27cfd7

move add exception hook, lint

ab22755

close alert checkbox closes alert

5acc645

address PR comments

0ef4817

add type to patch rule call, fix ts errors

6feff18

fix lint

1b27b62

fix merge problems after conflict

b49a1b0

Address PR comments

0fe335b

peluja1012 force-pushed the exception-modal branch from 1fd2a48 to 0fe335b Compare July 7, 2020 23:16

undo graphql type change

f03a20f

peluja1012 merged commit 8facae7 into elastic:master Jul 8, 2020

peluja1012 mentioned this pull request Jul 8, 2020

[7.x] [Security Solution][Exceptions] - Exception Modal Part I (#70639) #71035

Merged

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

[Security Solution][Exceptions] - Exception Modal Part I #70639

[Security Solution][Exceptions] - Exception Modal Part I #70639

Conversation

peluja1012 commented Jul 2, 2020 • edited Loading

Summary

Coming in Part II

Usage Examples

Alerts page

Rule Details External Alerts tab

Rule Details Exceptions tab

Adding an exception from the exceptions viewer

Adding an exception from an alert event

Editing an exception

Exception comments

Testing

Checklist

For maintainers

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Jul 3, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yctercero left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kibanamachine commented Jul 8, 2020

💚 Build Succeeded

Build metrics

@kbn/optimizer bundle module count

History

elasticmachine commented Sep 23, 2021

peluja1012 commented Jul 2, 2020 •

edited

Loading