[Security Solution][Exceptions] - Adds filtering to endpoint index patterns by exceptional fields #71757

dplumlee · 2020-07-14T20:53:38Z

Summary

Filters the endpoint autofill index pattern fields by exceptionable fields

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios

For maintainers

This was checked for breaking API changes and was labeled appropriately

elasticmachine · 2020-07-14T21:26:10Z

Pinging @elastic/siem (Team:SIEM)

kibanamachine · 2020-07-15T02:04:36Z

💛 Build succeeded, but was flaky

continuous-integration/kibana-ci/pull-request
Commit: 2d2c998
Flaky suites:
- xpack-kibana-ciGroup1

Test Failures

Kibana Pipeline / kibana-xpack-agent / X-Pack Detection Engine API Integration Tests.x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_prepackaged_rules·ts.detection engine api security and spaces enabled add_prepackaged_rules creating prepackaged rules should be possible to call the API twice and the second time the number of rules installed should be zero

Link to Jenkins

Standard Out

Failed Tests Reporter:
  - Test has not failed recently on tracked branches

[00:00:00]       │
[00:00:00]         └-: detection engine api security and spaces enabled
[00:00:00]           └-> "before all" hook
[00:00:00]           └-: add_prepackaged_rules
[00:00:00]             └-> "before all" hook
[00:00:00]             └-: creating prepackaged rules
[00:00:00]               └-> "before all" hook
[00:00:00]               └-> should contain two output keys of rules_installed and rules_updated
[00:00:00]                 └-> "before each" hook: global before each
[00:00:00]                 └-> "before each" hook
[00:00:00]                   │ info [o.e.x.i.a.TransportPutLifecycleAction] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] adding index lifecycle policy [.siem-signals-default]
[00:00:00]                   │ info [o.e.c.m.MetadataIndexTemplateService] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] adding template [.siem-signals-default] for index patterns [.siem-signals-default-*]
[00:00:00]                   │ info [o.e.c.m.MetadataCreateIndexService] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] [.siem-signals-default-000001] creating index, cause [api], templates [.siem-signals-default], shards [1]/[1]
[00:00:00]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] moving index [.siem-signals-default-000001] from [null] to [{"phase":"new","action":"complete","name":"complete"}] in policy [.siem-signals-default]
[00:00:00]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] moving index [.siem-signals-default-000001] from [{"phase":"new","action":"complete","name":"complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] in policy [.siem-signals-default]
[00:00:00]                 │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] moving index [.siem-signals-default-000001] from [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-follow-shard-tasks"}] in policy [.siem-signals-default]
[00:00:01]                 │ info [o.e.c.m.MetadataMappingService] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] [.kibana_1/pnxqhZkwQ0OBnGyIC3_TSQ] update_mapping [_doc]
[00:00:03]                 └- ✓ pass  (2.6s) "detection engine api security and spaces enabled add_prepackaged_rules creating prepackaged rules should contain two output keys of rules_installed and rules_updated"
[00:00:03]               └-> "after each" hook
[00:00:03]                 │ info [o.e.c.m.MetadataDeleteIndexService] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] [.siem-signals-default-000001/HwbUfhypTAa6f1wPtZF29Q] deleting index
[00:00:03]                 │ info [o.e.c.m.MetadataIndexTemplateService] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] removing template [.siem-signals-default]
[00:00:03]               └-> should create the prepackaged rules and return a count greater than zero
[00:00:03]                 └-> "before each" hook: global before each
[00:00:03]                 └-> "before each" hook
[00:00:03]                   │ info [o.e.x.i.a.TransportPutLifecycleAction] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] adding index lifecycle policy [.siem-signals-default]
[00:00:03]                   │ info [o.e.c.m.MetadataIndexTemplateService] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] adding template [.siem-signals-default] for index patterns [.siem-signals-default-*]
[00:00:03]                   │ info [o.e.c.m.MetadataCreateIndexService] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] [.siem-signals-default-000001] creating index, cause [api], templates [.siem-signals-default], shards [1]/[1]
[00:00:04]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] moving index [.siem-signals-default-000001] from [null] to [{"phase":"new","action":"complete","name":"complete"}] in policy [.siem-signals-default]
[00:00:04]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] moving index [.siem-signals-default-000001] from [{"phase":"new","action":"complete","name":"complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] in policy [.siem-signals-default]
[00:00:04]                 │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] moving index [.siem-signals-default-000001] from [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-follow-shard-tasks"}] in policy [.siem-signals-default]
[00:00:06]                 └- ✓ pass  (2.3s) "detection engine api security and spaces enabled add_prepackaged_rules creating prepackaged rules should create the prepackaged rules and return a count greater than zero"
[00:00:06]               └-> "after each" hook
[00:00:06]                 │ info [o.e.c.m.MetadataDeleteIndexService] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] [.siem-signals-default-000001/S8v5MeVkTxiffwJhqlanvg] deleting index
[00:00:06]                 │ info [o.e.c.m.MetadataIndexTemplateService] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] removing template [.siem-signals-default]
[00:00:06]               └-> should create the prepackaged rules that the rules_updated is of size zero
[00:00:06]                 └-> "before each" hook: global before each
[00:00:06]                 └-> "before each" hook
[00:00:06]                   │ info [o.e.x.i.a.TransportPutLifecycleAction] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] adding index lifecycle policy [.siem-signals-default]
[00:00:06]                   │ info [o.e.c.m.MetadataIndexTemplateService] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] adding template [.siem-signals-default] for index patterns [.siem-signals-default-*]
[00:00:06]                   │ info [o.e.c.m.MetadataCreateIndexService] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] [.siem-signals-default-000001] creating index, cause [api], templates [.siem-signals-default], shards [1]/[1]
[00:00:06]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] moving index [.siem-signals-default-000001] from [null] to [{"phase":"new","action":"complete","name":"complete"}] in policy [.siem-signals-default]
[00:00:07]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] moving index [.siem-signals-default-000001] from [{"phase":"new","action":"complete","name":"complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] in policy [.siem-signals-default]
[00:00:07]                 │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] moving index [.siem-signals-default-000001] from [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-follow-shard-tasks"}] in policy [.siem-signals-default]
[00:00:08]                 └- ✓ pass  (1.6s) "detection engine api security and spaces enabled add_prepackaged_rules creating prepackaged rules should create the prepackaged rules that the rules_updated is of size zero"
[00:00:08]               └-> "after each" hook
[00:00:08]                 │ info [o.e.c.m.MetadataDeleteIndexService] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] [.siem-signals-default-000001/cZ0n5LkBQ8WdIjZvDjF8zQ] deleting index
[00:00:08]                 │ info [o.e.c.m.MetadataIndexTemplateService] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] removing template [.siem-signals-default]
[00:00:08]               └-> should be possible to call the API twice and the second time the number of rules installed should be zero
[00:00:08]                 └-> "before each" hook: global before each
[00:00:08]                 └-> "before each" hook
[00:00:08]                   │ info [o.e.x.i.a.TransportPutLifecycleAction] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] adding index lifecycle policy [.siem-signals-default]
[00:00:09]                   │ info [o.e.c.m.MetadataIndexTemplateService] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] adding template [.siem-signals-default] for index patterns [.siem-signals-default-*]
[00:00:09]                   │ info [o.e.c.m.MetadataCreateIndexService] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] [.siem-signals-default-000001] creating index, cause [api], templates [.siem-signals-default], shards [1]/[1]
[00:00:09]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] moving index [.siem-signals-default-000001] from [null] to [{"phase":"new","action":"complete","name":"complete"}] in policy [.siem-signals-default]
[00:00:09]                   │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] moving index [.siem-signals-default-000001] from [{"phase":"new","action":"complete","name":"complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] in policy [.siem-signals-default]
[00:00:09]                 │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-ubuntu-18-tests-xl-1594772229053175898] moving index [.siem-signals-default-000001] from [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-follow-shard-tasks"}] in policy [.siem-signals-default]
[00:00:10]                 └- ✖ fail: detection engine api security and spaces enabled add_prepackaged_rules creating prepackaged rules should be possible to call the API twice and the second time the number of rules installed should be zero
[00:00:10]                 │       Error: expected 1 to sort of equal 0
[00:00:10]                 │       + expected - actual
[00:00:10]                 │ 
[00:00:10]                 │       -1
[00:00:10]                 │       +0
[00:00:10]                 │       
[00:00:10]                 │       at Assertion.assert (/dev/shm/workspace/kibana/packages/kbn-expect/expect.js:100:11)
[00:00:10]                 │       at Assertion.eql (/dev/shm/workspace/kibana/packages/kbn-expect/expect.js:244:8)
[00:00:10]                 │       at Context.it (test/detection_engine_api_integration/security_and_spaces/tests/add_prepackaged_rules.ts:99:41)
[00:00:10]                 │ 
[00:00:10]                 │

Stack Trace

{ Error: expected 1 to sort of equal 0
    at Assertion.assert (/dev/shm/workspace/kibana/packages/kbn-expect/expect.js:100:11)
    at Assertion.eql (/dev/shm/workspace/kibana/packages/kbn-expect/expect.js:244:8)
    at Context.it (test/detection_engine_api_integration/security_and_spaces/tests/add_prepackaged_rules.ts:99:41) actual: '1', expected: '0', showDiff: true }

Build metrics

‼️ unable to find a baseline build for [master@754ade5]. Try merging the upstream branch and trying again.

History

💔 Build #61731 failed 8d23695
💔 Build #61685 failed 4054f3a
💔 Build #61661 failed 2d1bc2e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* master: (82 commits) Fixed the spacing of child accordion items for policy response dialog. (elastic#71677) [SECURITY] Timeline bug 7.9 (elastic#71748) use fixed isChromeVisible method (elastic#71813) [SIEM][Detection Engine][Lists] Adds specific endpoint_list REST API and API for abilities to auto-create the endpoint_list if it gets deleted (elastic#71792) [test] Skips flaky Saved Objects Management test [APM] Remove watcher integration (elastic#71655) [APM] Increase `xpack.apm.ui.transactionGroupBucketSize` (elastic#71661) [test] Skips Ingest Manager test preventing ES promotion [test] Skips flaky detection engine tests Revert "re-fix navigate path for master add SAML login to login_page (elastic#71337)" [tests] Temporarily skipped Fleet tests [test] Skipped monitoring test [Security Solution][Detections] Associate Endpoint Exceptions List to Rule during rule creation/update (elastic#71794) Add endpoint exception creation API validation (elastic#71791) Skip jest tests that timeout waiting for react (elastic#71801) [Security Solution][Exceptions] - Adds filtering to endpoint index patterns by exceptional fields (elastic#71757) [Reporting] Re-delete a file (elastic#71730) [Security Solution] [Detections] Fixes bug for determining when we hit max signals after filtering with lists (elastic#71768) [Ingest Manager] Better display of Fleet requirements (elastic#71686) [tests] Temporarily skipped to promote snapshot ...

…tterns by exceptional fields (#71757) (#71804) Co-authored-by: Elastic Machine <[email protected]>

elasticmachine · 2021-09-23T14:30:43Z

Pinging @elastic/security-solution (Team: SecuritySolution)

dplumlee force-pushed the exceptions-modal-timeline branch 3 times, most recently from e6a95cc to 2d1bc2e Compare July 14, 2020 20:59

dplumlee changed the title ~~Adds open exception from timeline feature to exception modal~~ [Security Solution][Exceptions] - Adds open exception from timeline feature to exception modal Jul 14, 2020

dplumlee added release_note:enhancement Team:SIEM v7.9.0 v8.0.0 labels Jul 14, 2020

dplumlee marked this pull request as ready for review July 14, 2020 21:26

dplumlee requested review from a team as code owners July 14, 2020 21:26

dplumlee force-pushed the exceptions-modal-timeline branch from 2d1bc2e to 4054f3a Compare July 14, 2020 21:31

revert timeline changes

8d23695

dplumlee force-pushed the exceptions-modal-timeline branch from 3b550b8 to 8d23695 Compare July 14, 2020 23:34

dplumlee changed the title ~~[Security Solution][Exceptions] - Adds open exception from timeline feature to exception modal~~ [Security Solution][Exceptions] - Adds filtering to endpoint index patterns by exceptional fields Jul 14, 2020

changes ts to json

2d2c998

peluja1012 approved these changes Jul 15, 2020

View reviewed changes

marshallmain approved these changes Jul 15, 2020

View reviewed changes

dplumlee merged commit 8a99880 into elastic:master Jul 15, 2020

dplumlee deleted the exceptions-modal-timeline branch July 15, 2020 02:05

dplumlee mentioned this pull request Jul 15, 2020

[7.x] [Security Solution][Exceptions] - Adds filtering to endpoint index patterns by exceptional fields (#71757) #71804

Merged

angorayc pushed a commit that referenced this pull request Jul 15, 2020

[Security Solution][Exceptions] - Adds filtering to endpoint index pa…

7c1ed4c

…tterns by exceptional fields (#71757) (#71804) Co-authored-by: Elastic Machine <[email protected]>

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Exceptions] - Adds filtering to endpoint index patterns by exceptional fields #71757

[Security Solution][Exceptions] - Adds filtering to endpoint index patterns by exceptional fields #71757

dplumlee commented Jul 14, 2020 •

edited

Loading

elasticmachine commented Jul 14, 2020

kibanamachine commented Jul 15, 2020

Standard Out

Stack Trace

elasticmachine commented Sep 23, 2021

[Security Solution][Exceptions] - Adds filtering to endpoint index patterns by exceptional fields #71757

[Security Solution][Exceptions] - Adds filtering to endpoint index patterns by exceptional fields #71757

Conversation

dplumlee commented Jul 14, 2020 • edited Loading

Summary

Checklist

For maintainers

elasticmachine commented Jul 14, 2020

kibanamachine commented Jul 15, 2020

💛 Build succeeded, but was flaky

Test Failures

Standard Out

Stack Trace

Build metrics

History

elasticmachine commented Sep 23, 2021

dplumlee commented Jul 14, 2020 •

edited

Loading