[Security Solution][Detections] Adds Nested CTI row renderer #96275

rylnd · 2021-04-06T04:31:23Z

Summary

Adds a new row renderer for alerts enriched by threat indicator data.

User can enable a CTI Row Renderer that describes the circumstances of the indicator match
User can pivot to various views by sending details to the timeline, e.g.:
- threat.indicator.matched.id to pivot on a specific indicator
- threat.indicator.matched.atomic to pivot on the matched value
CTI Row Renderer is only applied to CTI alerts
Multiple inner "rows" are displayed for each indicator that matched

Row renderer on a single line:

Row renderer on multiple lines:

Row renderer with multiple matches:

Row renderer example in Customize popover:

TODO

use constants over hardcoded strings
Fix draggables
conditional rendering based on data availability
component grouping (e.g. <IndicatorMetadata>)
Translations/copy
merge [Security Solution][Timeline] Rebuild nested fields structure from fields response #96187 and rebase 😎

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
This was checked for cross-browser compatibility

For maintainers

This was checked for breaking API changes and was labeled appropriately

ecezalp

Changes look great, fantastic work! I added a few comments that you may find useful. Two notes about the UI - when there are multiple rows, and a draggable has the same value as another (such as type: file), if you start dragging one of them, all of them disappear - I think what you need is unique keys. Also, attaching a screenshot of my alerts table on the Detections page - I definitely have some unusual "data" - nevertheless we could consider using a single "line" under circumstances that there is a lot of horizontal real estate available possibly with flex doing the positioning. And maybe some padding could be added.

ecezalp · 2021-04-07T19:59:31Z

x-pack/plugins/security_solution/common/ecs/threat/index.ts

+ */
+
+interface ThreatMatchEcs {
+  atomic?: string[];


are these truly optional? if you have an atomic, shouldn't you always have a field and a type?

The existing *Ecs types seemed to be very defensive, where almost everything was optional. If it's one of our detection alerts then it should have all three, but I think these are meant to be general to anything "compliant" with ECS.

...plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/helpers.ts

x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx

ecezalp · 2021-04-07T20:19:06Z

...ecurity_solution/public/timelines/components/row_renderers_browser/examples/threat_match.tsx

+import { ROW_RENDERER_BROWSER_EXAMPLE_TIMELINE_ID } from '../constants';
+
+const ThreatMatchExampleComponent: React.FC = () => (
+  <>


depending on the return value of the renderRow method, fragment can be removed

Good call, this was just copy/pasted from the other examples.

...curity_solution/public/timelines/components/timeline/body/renderers/cti/threat_match_row.tsx

ecezalp · 2021-04-07T20:29:09Z

...n/public/timelines/components/timeline/body/renderers/cti/threat_match_row_renderer.test.tsx

+  });
+
+  describe('#renderRow', () => {
+    it('renders correctly against snapshot', () => {


would be good to cover a scenario with multiple rows for a single alert

...urity_solution/public/timelines/components/timeline/body/renderers/cti/threat_match_rows.tsx

...ck/plugins/security_solution/server/search_strategy/timeline/factory/events/all/constants.ts

...plugins/security_solution/server/search_strategy/timeline/factory/events/all/helpers.test.ts

The display details are not yet implemented, but those will be fleshed out in the ThreatMatchRow component.

This data is not used by any existing row renderers and so this commit is mostly just plumbing that data through. This is necessary, however, for our new threat match row renderer as it requires nested fields, which cannot be retrieved through the mechanism that retrieves the existing row renderer data. However, these nested fields are available, if requested, through this other data structure, hence this plumbing. For now to minimize changes I'm marking this as an optional field; however in reality a value will always be present.

Updates logic, tests and mocks accordingly.

* helpers * explicit fields file, which will hopefully be part of the renderer API at some point * parent component to split data into "rows" as defined by our renderer * row component for stateless presentation of a single match

Adds tentative copy, example row, and accompanying mock data.

…ed fields being flattened

I haven't yet deleted the old (new?) unused path yet. Cleanup to come.

* Rewrites isInstance logic for new data as helper, hasThreatMatchValue * Updating types and tests * Adds to the previously empty ThreatEcs

This reverts commit 19c93ee. We ended up extending the existing data (albeit from the fields response!).

* adds contextId and eventId to pass to draggable * We don't have a order-independent key for each individual ThreatMatchRow, due to matched.id not being mapped/returned in the fields response * Fixes up a few things related to using the new data format

* Adds missing Threat ECS types

In order to use these in both the row renderer and the server request, we need to move them to common/

These are currently hardcoded on the backend of the events/all query (via TIMELINE_EVENTS_FIELDS); declaring them on both ends is arguably confusing, and we're going with YAGNI for now.

This was causing type errors as this enum exists both here and in common/, and I had only updated one of them.

One is still failing due to an outdated test subject, but I expect this to change after an upcoming meeting so leaving it for now.

One for displaying match details, and another for indicator details The indicator details will be sparse, so there's going to be some conditional rendering in there.

* Adds translations for copy * Fixes most of our layout woes with more flexbox! * Conditional rendering of indicator details based on data * tests

…erer

These tests are all implicitly testing the list of row renderers.

At certain container widths, a half-width hr is not sufficient.

elasticmachine · 2021-04-15T15:36:43Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

ecezalp

changes look good. There is only one thing I noticed about the drag & drop functionality, it seemed like the entire row is disappearing while dragging a single field from the row, instead of just the field itself disappearing. That being said I experienced this with some exceptionally suboptimal data (two rows of identical content), so please take that with a grain of salt.

x-pack/plugins/security_solution/common/cti/constants.ts

x-pack/plugins/security_solution/public/common/mock/mock_timeline_data.ts

ecezalp · 2021-04-15T15:36:52Z

...plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/helpers.ts

+const getIndicatorEcs = (data: Ecs): ThreatIndicatorEcs[] =>
+  get(data, INDICATOR_DESTINATION_PATH) ?? [];
+
+export const hasThreatMatchValue = (data: Ecs): boolean =>


I have the same logic in use_threat_intel_tabs.ts file, there is a bool called isThreatPresent that is determined in a similar way. we should consider consolidating those, ideally somewhere proximate to CTI constants, unless those were in the timeline directory - I guess that is so, where should it live?

The logic looks similar but definitely not identical. I agree that they should at least live close to each other or build from the same base functions; we'll have to tackle that when these are both merged.

ecezalp · 2021-04-15T15:38:32Z

...urity_solution/public/timelines/components/timeline/body/renderers/cti/indicator_details.tsx

+interface IndicatorDetailsProps {
+  contextId: string;
+  eventId: string;
+  indicatorDataset: string | undefined;


indicatorDataset?: string would be shorter

But not identical! My preference is for this form, as it prevents consumers from accidentally dropping a known value.

ecezalp · 2021-04-15T15:41:28Z

...urity_solution/public/timelines/components/timeline/body/renderers/cti/indicator_details.tsx

+      <>
+        <EuiFlexItem grow={false}>
+          <HorizontalSpacer>
+            <FormattedMessage


this looks a bit different from the i18n.FOO pattern that was present in other places for internationalized strings - is there an additional benefit to using the FormattedMessage component? would be happy to know

This is just a react wrapper around the same logic. Since I don't expect/intend for these strings to be shared, they can just live in the component itself (for now).

ecezalp · 2021-04-15T15:50:45Z

...urity_solution/public/timelines/components/timeline/body/renderers/cti/indicator_details.tsx

+    )}
+    {indicatorReference && (
+      <>
+        <EuiFlexItem grow={false}>


do you think there could be a DRYer way around these <EuiFlexItem grow={false}> wrappers? maybe something super tiny such as IndicatorDetail = ({...props, children}) => <EuiFlexItem grow=false {...props}>{children}</EuiFlexItem>

So then it would look like:

Suggested change

<EuiFlexItem grow={false}>

<IndicatorDetail>

?

There's not a huge benefit to that IMO, but we certainly could. I'm inclined to leave these dumb for now, at least until people start 👀 ing this row renderer and give UI feedback; premature DRYing often leads to unnecessary work.

ecezalp · 2021-04-15T16:01:56Z

...curity_solution/public/timelines/components/timeline/body/renderers/cti/threat_match_row.tsx

+      justifyContent="center"
+    >
+      <EuiFlexItem grow={false}>
+        <MatchDetails


this is interesting - I would have written this either without desctructuring the props, or without the MatchDetails / IndicatorDetails components (embedding the contents of those components directly into the ThreatMatchRowView instead). This looks nice and clean, but it is also slightly more verbose, what do you think?

I don't disagree with anything you said :)

...urity_solution/public/timelines/components/timeline/body/renderers/cti/threat_match_rows.tsx

ecezalp · 2021-04-15T16:05:00Z

...ck/plugins/security_solution/server/search_strategy/timeline/factory/events/all/constants.ts

@@ -239,5 +232,8 @@ export const TIMELINE_EVENTS_FIELDS = [
  'zeek.ssl.established',
  'zeek.ssl.resumed',
  'zeek.ssl.version',
-  ...TIMELINE_CTI_FIELDS,
+  // TODO in the future, our alerts timeline fields should be derived from the


is there a ticket for this work?

cc @andrew-goldstein

is there a ticket for this work?

API changes for RAC: #94520

andrew-goldstein · 2021-04-15T17:26:26Z

Thanks for pairing to desk test this @rylnd!

The following entry:

threat_match = 'threat_match',

is required in the RowRendererId enum in x-pack/plugins/security_solution/public/graphql/types.ts

After adding the above, run start-bean-gen to update the graphql types. (This resolves the error that appears in the TImelines tab, or when accessing the Open Timelines modal.)

Regarding @ecezalp's comment:

if you start dragging one of them, all of them disappear - I think what you need is unique keys

This occurs when the same draggable fields are rendered twice per-row for a nested row renderer, because the context + field id + event id + value is no longer unique. Consider including the "nesting level" in the key to make the IDs unique again.

andrew-goldstein

Thanks for the new row renderer @rylnd!
Looks ready apart from the two items that came up while desk testing locally
LGTM 🚀

Obviates the need for the accompanying comments.

Also ensures less traffic to urlhaus ;)

Gennin' beanz

We need to add the row index to our contextId to ensure that our draggables work correctly for multiple rows, since each row will necessarily have the same eventId and timelineId.

rylnd · 2021-04-15T20:48:55Z

@elasticmachine merge upstream

rylnd · 2021-04-15T23:18:41Z

@elasticmachine merge upstream

kibanamachine · 2021-04-16T01:28:14Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	2208	2216	+8

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	7.3MB	7.3MB	+12.2KB

History

💔 Build #120168 failed 8f667c7
💔 Build #120137 failed b115dfe
💛 Build #120088 was flaky d8bf839
💚 Build #119839 succeeded d8bf839
💚 Build #119834 succeeded 5a04c28

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @rylnd

…#96275) * Move alert-specific mocks to more declarative mock file * Add placeholder interface for ECS threat fields * Test and implement CTI row renderer The display details are not yet implemented, but those will be fleshed out in the ThreatMatchRow component. * Pass full fields data to our row renderers This data is not used by any existing row renderers and so this commit is mostly just plumbing that data through. This is necessary, however, for our new threat match row renderer as it requires nested fields, which cannot be retrieved through the mechanism that retrieves the existing row renderer data. However, these nested fields are available, if requested, through this other data structure, hence this plumbing. For now to minimize changes I'm marking this as an optional field; however in reality a value will always be present. * Rewrite existing row renderer in terms of flattened data Updates logic, tests and mocks accordingly. * Moving logic into discrete files * helpers * explicit fields file, which will hopefully be part of the renderer API at some point * parent component to split data into "rows" as defined by our renderer * row component for stateless presentation of a single match * Register threat match row rendere Adds tentative copy, example row, and accompanying mock data. * WIP: Rendering draggable fields but hit the data loss issue with nested fields being flattened * WIP: implementing row renderer against new data format I haven't yet deleted the old (new?) unused path yet. Cleanup to come. * Updating based on new data * Rewrites isInstance logic for new data as helper, hasThreatMatchValue * Updating types and tests * Adds to the previously empty ThreatEcs * Revert "Pass full fields data to our row renderers" This reverts commit 19c93ee. We ended up extending the existing data (albeit from the fields response!). * Fix draggables * adds contextId and eventId to pass to draggable * We don't have a order-independent key for each individual ThreatMatchRow, due to matched.id not being mapped/returned in the fields response * Fixes up a few things related to using the new data format * Move indicator field strings to constants * Fix example data for CTI row renderer * Adds missing Threat ECS types * Move CTI field constants to common folder In order to use these in both the row renderer and the server request, we need to move them to common/ * Remove redundant CTI fields from client request These are currently hardcoded on the backend of the events/all query (via TIMELINE_EVENTS_FIELDS); declaring them on both ends is arguably confusing, and we're going with YAGNI for now. * Add missing graphQL type This was causing type errors as this enum exists both here and in common/, and I had only updated one of them. * Updates tests One is still failing due to an outdated test subject, but I expect this to change after an upcoming meeting so leaving it for now. * Split ThreatMatchRow into subcomponents One for displaying match details, and another for indicator details The indicator details will be sparse, so there's going to be some conditional rendering in there. * Make CTI row renderer look nice * Adds translations for copy * Fixes most of our layout woes with more flexbox! * Conditional rendering of indicator details based on data * tests * Make indicator reference field an external link Leverages the existing FormattedFieldValue component, with one minor tweak to add this field to the URL allowlist. * Back to consistent horizontal spacing, here The draggable badges are a little odd in that their full box isn't indicated until hover, making the visual weight a little off. * Add hr as a visual separator between each match "row" of the row renderer * Fix tests broken due to addition of a new row renderer These tests are all implicitly testing the list of row renderers. * Full-width hr At certain container widths, a half-width hr is not sufficient. * More descriptive constant Obviates the need for the accompanying comments. * More realistic data Also ensures less traffic to urlhaus ;) * Remove useless comment * Add threat_match row renderer type to GQL client Gennin' beanz * Ensure contextId is unique for each CTI subrow We need to add the row index to our contextId to ensure that our draggables work correctly for multiple rows, since each row will necessarily have the same eventId and timelineId. Co-authored-by: Kibana Machine <[email protected]>

kibanamachine · 2021-04-16T01:31:07Z

💚 Backport successful

Status	Branch	Result
✅	7.x

This backport PR will be merged automatically after passing CI.

…#97347) * Move alert-specific mocks to more declarative mock file * Add placeholder interface for ECS threat fields * Test and implement CTI row renderer The display details are not yet implemented, but those will be fleshed out in the ThreatMatchRow component. * Pass full fields data to our row renderers This data is not used by any existing row renderers and so this commit is mostly just plumbing that data through. This is necessary, however, for our new threat match row renderer as it requires nested fields, which cannot be retrieved through the mechanism that retrieves the existing row renderer data. However, these nested fields are available, if requested, through this other data structure, hence this plumbing. For now to minimize changes I'm marking this as an optional field; however in reality a value will always be present. * Rewrite existing row renderer in terms of flattened data Updates logic, tests and mocks accordingly. * Moving logic into discrete files * helpers * explicit fields file, which will hopefully be part of the renderer API at some point * parent component to split data into "rows" as defined by our renderer * row component for stateless presentation of a single match * Register threat match row rendere Adds tentative copy, example row, and accompanying mock data. * WIP: Rendering draggable fields but hit the data loss issue with nested fields being flattened * WIP: implementing row renderer against new data format I haven't yet deleted the old (new?) unused path yet. Cleanup to come. * Updating based on new data * Rewrites isInstance logic for new data as helper, hasThreatMatchValue * Updating types and tests * Adds to the previously empty ThreatEcs * Revert "Pass full fields data to our row renderers" This reverts commit 19c93ee. We ended up extending the existing data (albeit from the fields response!). * Fix draggables * adds contextId and eventId to pass to draggable * We don't have a order-independent key for each individual ThreatMatchRow, due to matched.id not being mapped/returned in the fields response * Fixes up a few things related to using the new data format * Move indicator field strings to constants * Fix example data for CTI row renderer * Adds missing Threat ECS types * Move CTI field constants to common folder In order to use these in both the row renderer and the server request, we need to move them to common/ * Remove redundant CTI fields from client request These are currently hardcoded on the backend of the events/all query (via TIMELINE_EVENTS_FIELDS); declaring them on both ends is arguably confusing, and we're going with YAGNI for now. * Add missing graphQL type This was causing type errors as this enum exists both here and in common/, and I had only updated one of them. * Updates tests One is still failing due to an outdated test subject, but I expect this to change after an upcoming meeting so leaving it for now. * Split ThreatMatchRow into subcomponents One for displaying match details, and another for indicator details The indicator details will be sparse, so there's going to be some conditional rendering in there. * Make CTI row renderer look nice * Adds translations for copy * Fixes most of our layout woes with more flexbox! * Conditional rendering of indicator details based on data * tests * Make indicator reference field an external link Leverages the existing FormattedFieldValue component, with one minor tweak to add this field to the URL allowlist. * Back to consistent horizontal spacing, here The draggable badges are a little odd in that their full box isn't indicated until hover, making the visual weight a little off. * Add hr as a visual separator between each match "row" of the row renderer * Fix tests broken due to addition of a new row renderer These tests are all implicitly testing the list of row renderers. * Full-width hr At certain container widths, a half-width hr is not sufficient. * More descriptive constant Obviates the need for the accompanying comments. * More realistic data Also ensures less traffic to urlhaus ;) * Remove useless comment * Add threat_match row renderer type to GQL client Gennin' beanz * Ensure contextId is unique for each CTI subrow We need to add the row index to our contextId to ensure that our draggables work correctly for multiple rows, since each row will necessarily have the same eventId and timelineId. Co-authored-by: Kibana Machine <[email protected]> Co-authored-by: Ryland Herrick <[email protected]>

…#96275) * Move alert-specific mocks to more declarative mock file * Add placeholder interface for ECS threat fields * Test and implement CTI row renderer The display details are not yet implemented, but those will be fleshed out in the ThreatMatchRow component. * Pass full fields data to our row renderers This data is not used by any existing row renderers and so this commit is mostly just plumbing that data through. This is necessary, however, for our new threat match row renderer as it requires nested fields, which cannot be retrieved through the mechanism that retrieves the existing row renderer data. However, these nested fields are available, if requested, through this other data structure, hence this plumbing. For now to minimize changes I'm marking this as an optional field; however in reality a value will always be present. * Rewrite existing row renderer in terms of flattened data Updates logic, tests and mocks accordingly. * Moving logic into discrete files * helpers * explicit fields file, which will hopefully be part of the renderer API at some point * parent component to split data into "rows" as defined by our renderer * row component for stateless presentation of a single match * Register threat match row rendere Adds tentative copy, example row, and accompanying mock data. * WIP: Rendering draggable fields but hit the data loss issue with nested fields being flattened * WIP: implementing row renderer against new data format I haven't yet deleted the old (new?) unused path yet. Cleanup to come. * Updating based on new data * Rewrites isInstance logic for new data as helper, hasThreatMatchValue * Updating types and tests * Adds to the previously empty ThreatEcs * Revert "Pass full fields data to our row renderers" This reverts commit 19c93ee. We ended up extending the existing data (albeit from the fields response!). * Fix draggables * adds contextId and eventId to pass to draggable * We don't have a order-independent key for each individual ThreatMatchRow, due to matched.id not being mapped/returned in the fields response * Fixes up a few things related to using the new data format * Move indicator field strings to constants * Fix example data for CTI row renderer * Adds missing Threat ECS types * Move CTI field constants to common folder In order to use these in both the row renderer and the server request, we need to move them to common/ * Remove redundant CTI fields from client request These are currently hardcoded on the backend of the events/all query (via TIMELINE_EVENTS_FIELDS); declaring them on both ends is arguably confusing, and we're going with YAGNI for now. * Add missing graphQL type This was causing type errors as this enum exists both here and in common/, and I had only updated one of them. * Updates tests One is still failing due to an outdated test subject, but I expect this to change after an upcoming meeting so leaving it for now. * Split ThreatMatchRow into subcomponents One for displaying match details, and another for indicator details The indicator details will be sparse, so there's going to be some conditional rendering in there. * Make CTI row renderer look nice * Adds translations for copy * Fixes most of our layout woes with more flexbox! * Conditional rendering of indicator details based on data * tests * Make indicator reference field an external link Leverages the existing FormattedFieldValue component, with one minor tweak to add this field to the URL allowlist. * Back to consistent horizontal spacing, here The draggable badges are a little odd in that their full box isn't indicated until hover, making the visual weight a little off. * Add hr as a visual separator between each match "row" of the row renderer * Fix tests broken due to addition of a new row renderer These tests are all implicitly testing the list of row renderers. * Full-width hr At certain container widths, a half-width hr is not sufficient. * More descriptive constant Obviates the need for the accompanying comments. * More realistic data Also ensures less traffic to urlhaus ;) * Remove useless comment * Add threat_match row renderer type to GQL client Gennin' beanz * Ensure contextId is unique for each CTI subrow We need to add the row index to our contextId to ensure that our draggables work correctly for multiple rows, since each row will necessarily have the same eventId and timelineId. Co-authored-by: Kibana Machine <[email protected]>

rylnd added release_note:enhancement v8.0.0 v7.13.0 Team: CTI labels Apr 6, 2021

rylnd self-assigned this Apr 6, 2021

ecezalp reviewed Apr 7, 2021

View reviewed changes

ecezalp mentioned this pull request Apr 7, 2021

[Security Solution][Timeline] Rebuild nested fields structure from fields response #96187

Merged

5 tasks

rylnd force-pushed the nested_row_renderer branch from 2520646 to adc2993 Compare April 12, 2021 02:00

rylnd added 18 commits April 12, 2021 20:30

Move alert-specific mocks to more declarative mock file

20dd329

Add placeholder interface for ECS threat fields

6a1a613

Test and implement CTI row renderer

9b12c87

The display details are not yet implemented, but those will be fleshed out in the ThreatMatchRow component.

Rewrite existing row renderer in terms of flattened data

f42ba60

Updates logic, tests and mocks accordingly.

Moving logic into discrete files

10a53f8

* helpers * explicit fields file, which will hopefully be part of the renderer API at some point * parent component to split data into "rows" as defined by our renderer * row component for stateless presentation of a single match

Register threat match row rendere

9d7afd0

Adds tentative copy, example row, and accompanying mock data.

WIP: Rendering draggable fields but hit the data loss issue with nest…

adf7067

…ed fields being flattened

WIP: implementing row renderer against new data format

6fc1d90

I haven't yet deleted the old (new?) unused path yet. Cleanup to come.

Updating based on new data

c2eb905

* Rewrites isInstance logic for new data as helper, hasThreatMatchValue * Updating types and tests * Adds to the previously empty ThreatEcs

Revert "Pass full fields data to our row renderers"

b20b71b

This reverts commit 19c93ee. We ended up extending the existing data (albeit from the fields response!).

Fix draggables

39f1880

* adds contextId and eventId to pass to draggable * We don't have a order-independent key for each individual ThreatMatchRow, due to matched.id not being mapped/returned in the fields response * Fixes up a few things related to using the new data format

Move indicator field strings to constants

3477d27

Fix example data for CTI row renderer

0a6f6fd

* Adds missing Threat ECS types

Move CTI field constants to common folder

f6f887c

In order to use these in both the row renderer and the server request, we need to move them to common/

Remove redundant CTI fields from client request

72b5b3f

These are currently hardcoded on the backend of the events/all query (via TIMELINE_EVENTS_FIELDS); declaring them on both ends is arguably confusing, and we're going with YAGNI for now.

Add missing graphQL type

f95f8e3

This was causing type errors as this enum exists both here and in common/, and I had only updated one of them.

Updates tests

838e548

One is still failing due to an outdated test subject, but I expect this to change after an upcoming meeting so leaving it for now.

rylnd force-pushed the nested_row_renderer branch from 80ac95e to 838e548 Compare April 13, 2021 01:38

rylnd added 3 commits April 14, 2021 12:50

Merge branch 'master' into nested_row_renderer

73a3d1d

Split ThreatMatchRow into subcomponents

90f6004

One for displaying match details, and another for indicator details The indicator details will be sparse, so there's going to be some conditional rendering in there.

Make CTI row renderer look nice

d625b2c

* Adds translations for copy * Fixes most of our layout woes with more flexbox! * Conditional rendering of indicator details based on data * tests

rylnd added 3 commits April 14, 2021 19:44

Add hr as a visual separator between each match "row" of the row rend…

d7cce75

…erer

Fix tests broken due to addition of a new row renderer

5a04c28

These tests are all implicitly testing the list of row renderers.

Full-width hr

d8bf839

At certain container widths, a half-width hr is not sufficient.

rylnd marked this pull request as ready for review April 15, 2021 03:08

rylnd requested a review from a team as a code owner April 15, 2021 03:08

rylnd added the Team:Threat Hunting Security Solution Threat Hunting Team label Apr 15, 2021

ecezalp approved these changes Apr 15, 2021

View reviewed changes

andrew-goldstein approved these changes Apr 15, 2021

View reviewed changes

rylnd added 5 commits April 15, 2021 13:29

More descriptive constant

2f7433f

Obviates the need for the accompanying comments.

More realistic data

d49d692

Also ensures less traffic to urlhaus ;)

Remove useless comment

542052b

Add threat_match row renderer type to GQL client

9295afc

Gennin' beanz

Ensure contextId is unique for each CTI subrow

b115dfe

We need to add the row index to our contextId to ensure that our draggables work correctly for multiple rows, since each row will necessarily have the same eventId and timelineId.

Merge branch 'master' into nested_row_renderer

8f667c7

rylnd added the auto-backport Deprecated - use backport:version if exact versions are needed label Apr 15, 2021

rylnd enabled auto-merge (squash) April 15, 2021 22:41

Merge branch 'master' into nested_row_renderer

37d737b

rylnd merged commit 540924b into elastic:master Apr 16, 2021

rylnd deleted the nested_row_renderer branch April 16, 2021 01:28

kibanamachine mentioned this pull request Apr 16, 2021

[7.x] [Security Solution][Detections] Adds Nested CTI row renderer (#96275) #97347

Merged

ghost mentioned this pull request May 31, 2021

[BUG] "Threat Indicator Match" Row Renderers information is not available in doc under the new features for 7.13 elastic/security-docs#730

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Detections] Adds Nested CTI row renderer #96275

[Security Solution][Detections] Adds Nested CTI row renderer #96275

rylnd commented Apr 6, 2021 •

edited

Loading

ecezalp left a comment •

edited

Loading

ecezalp Apr 7, 2021

rylnd Apr 12, 2021

ecezalp Apr 7, 2021

rylnd Apr 12, 2021

ecezalp Apr 7, 2021

elasticmachine commented Apr 15, 2021

ecezalp left a comment

ecezalp Apr 15, 2021 •

edited

Loading

rylnd Apr 15, 2021

ecezalp Apr 15, 2021

rylnd Apr 15, 2021 •

edited

Loading

ecezalp Apr 15, 2021

rylnd Apr 15, 2021

ecezalp Apr 15, 2021

rylnd Apr 15, 2021

ecezalp Apr 15, 2021

rylnd Apr 15, 2021

ecezalp Apr 15, 2021

rylnd Apr 15, 2021

andrew-goldstein Apr 15, 2021

andrew-goldstein commented Apr 15, 2021

andrew-goldstein left a comment

rylnd commented Apr 15, 2021

rylnd commented Apr 15, 2021

kibanamachine commented Apr 16, 2021

kibanamachine commented Apr 16, 2021

[Security Solution][Detections] Adds Nested CTI row renderer #96275

[Security Solution][Detections] Adds Nested CTI row renderer #96275

Conversation

rylnd commented Apr 6, 2021 • edited Loading

Summary

TODO

Checklist

For maintainers

ecezalp left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Apr 15, 2021

ecezalp left a comment

Choose a reason for hiding this comment

ecezalp Apr 15, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rylnd Apr 15, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

andrew-goldstein commented Apr 15, 2021

andrew-goldstein left a comment

Choose a reason for hiding this comment

rylnd commented Apr 15, 2021

rylnd commented Apr 15, 2021

kibanamachine commented Apr 16, 2021

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

History

kibanamachine commented Apr 16, 2021

💚 Backport successful

rylnd commented Apr 6, 2021 •

edited

Loading

ecezalp left a comment •

edited

Loading

ecezalp Apr 15, 2021 •

edited

Loading

rylnd Apr 15, 2021 •

edited

Loading