Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Docs]Timeline and Template UI updates #84

Merged
merged 7 commits into from
Aug 4, 2020

Conversation

benskelker
Copy link
Contributor

@benskelker benskelker commented Aug 3, 2020

Adds all the new 7.9 Timeline and Timeline template features.

Timeline preview
Template preview

@benskelker benskelker added the v7.9.0 Features in the 7.9 Release label Aug 3, 2020
@benskelker benskelker linked an issue Aug 3, 2020 that may be closed by this pull request

. Go to *Security* -> *Timelines*.
. Click the *Templates* tab.
. Click the More actions icon in the relevant row, and then select the action:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could we briefly mention about what the More actions icon looks like and its position as well, many users couldn't find for the first time

TIP: To perform the same action on multiple templates, select templates and
then the required action from the _Bulk actions_ menu.

NOTE: You cannot delete prebuilt templates.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

users cannot favourite it, or edit it either.
I think it would be nice to let them know that if they want to update the elastic prebuilt templates, they can duplicate them first and then they becomes custom templates, and they can do all the changes.

*Bulk actions* -> _Export selected_.

. To import templates, click *Import Timeline* and then select or drap-and-drop
the template `ndjson` file.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could we put a note here to let them know the content of the ndjson has to be in minimised format to import it properly.

e.g.

This is ok

{"savedObjectId":"67664480-d191-11ea-ae67-4f4be8c1847b","version":"WzU1NSwxXQ==","columns":[{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"@timestamp","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"message","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"event.category","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"event.action","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"host.name","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"source.ip","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"destination.ip","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"user.name","searchable":null}],"dataProviders":[],"description":"","eventType":"all","filters":[],"kqlMode":"filter","timelineType":"default","kqlQuery":{"filterQuery":{"serializedQuery":"{\"bool\":{\"should\":[{\"exists\":{\"field\":\"@timestamp\"}}],\"minimum_should_match\":1}}","kuery":{"expression":"@timestamp : * ","kind":"kuery"}}},"title":"x2","sort":{"columnId":"@timestamp","sortDirection":"desc"},"created":1596036895488,"createdBy":"angela","updated":1596491470411,"updatedBy":"angelachuang","templateTimelineId":null,"templateTimelineVersion":null,"dateRange":{"start":"2020-04-10T14:10:58.373Z","end":"2020-05-30T14:16:58.373Z"},"savedQueryId":null,"eventNotes":[{"noteId":"7d875ba0-d5d3-11ea-9899-ebec3d084fe0","version":"WzU1NiwxXQ==","eventId":"8KtMKnIBOS_moQ_K9fAe","note":"hi Xavier","timelineId":"67664480-d191-11ea-ae67-4f4be8c1847b","created":1596491490806,"createdBy":"angelachuang","updated":1596491490806,"updatedBy":"angelachuang"}],"globalNotes":[],"pinnedEventIds":["K99zy3EBDTDlbwBfpf6x","GKpFKnIBOS_moQ_Ke5AO","8KtMKnIBOS_moQ_K9fAe"]}

This will fail

{
  "savedObjectId": "67664480-d191-11ea-ae67-4f4be8c1847b",
  "version": "WzU1NSwxXQ==",
  "columns": [
    {
      "indexes": null,
      "name": null,
      "columnHeaderType": "not-filtered",
      "id": "@timestamp",
      "searchable": null
    },
    {
      "indexes": null,
      "name": null,
      "columnHeaderType": "not-filtered",
      "id": "message",
      "searchable": null
    },
    {
      "indexes": null,
      "name": null,
      "columnHeaderType": "not-filtered",
      "id": "event.category",
      "searchable": null
    },
    {
      "indexes": null,
      "name": null,
      "columnHeaderType": "not-filtered",
      "id": "event.action",
      "searchable": null
    },
    {
      "indexes": null,
      "name": null,
      "columnHeaderType": "not-filtered",
      "id": "host.name",
      "searchable": null
    },
    {
      "indexes": null,
      "name": null,
      "columnHeaderType": "not-filtered",
      "id": "source.ip",
      "searchable": null
    },
    {
      "indexes": null,
      "name": null,
      "columnHeaderType": "not-filtered",
      "id": "destination.ip",
      "searchable": null
    },
    {
      "indexes": null,
      "name": null,
      "columnHeaderType": "not-filtered",
      "id": "user.name",
      "searchable": null
    }
  ],
  "dataProviders": [],
  "description": "",
  "eventType": "all",
  "filters": [],
  "kqlMode": "filter",
  "timelineType": "default",
  "kqlQuery": {
    "filterQuery": {
      "serializedQuery": "{\"bool\":{\"should\":[{\"exists\":{\"field\":\"@timestamp\"}}],\"minimum_should_match\":1}}",
      "kuery": {
        "expression": "@timestamp : * ",
        "kind": "kuery"
      }
    }
  },
  "title": "x2",
  "sort": {
    "columnId": "@timestamp",
    "sortDirection": "desc"
  },
  "created": 1596036895488,
  "createdBy": "angela",
  "updated": 1596491470411,
  "updatedBy": "angelachuang",
  "templateTimelineId": null,
  "templateTimelineVersion": null,
  "dateRange": {
    "start": "2020-04-10T14:10:58.373Z",
    "end": "2020-05-30T14:16:58.373Z"
  },
  "savedQueryId": null,
  "eventNotes": [
    {
      "noteId": "7d875ba0-d5d3-11ea-9899-ebec3d084fe0",
      "version": "WzU1NiwxXQ==",
      "eventId": "8KtMKnIBOS_moQ_K9fAe",
      "note": "hi Xavier",
      "timelineId": "67664480-d191-11ea-ae67-4f4be8c1847b",
      "created": 1596491490806,
      "createdBy": "angelachuang",
      "updated": 1596491490806,
      "updatedBy": "angelachuang"
    }
  ],
  "globalNotes": [],
  "pinnedEventIds": [
    "K99zy3EBDTDlbwBfpf6x",
    "GKpFKnIBOS_moQ_Ke5AO",
    "8KtMKnIBOS_moQ_K9fAe"
  ]
}

@benskelker benskelker merged commit c0feb23 into elastic:master Aug 4, 2020
@benskelker benskelker deleted the 7.9-timeline-ui branch August 4, 2020 16:49
benskelker added a commit to benskelker/security-docs that referenced this pull request Aug 4, 2020
* timeline and template updates

* uncomments out original timeline section in SIEM UI

* removes original timeline IDs to avoid build conflict

* add all actions screenshot

* add all actions screenshot

* corrections

* adds filter explanation and legend
benskelker added a commit to benskelker/security-docs that referenced this pull request Aug 4, 2020
* timeline and template updates

* uncomments out original timeline section in SIEM UI

* removes original timeline IDs to avoid build conflict

* add all actions screenshot

* add all actions screenshot

* corrections

* adds filter explanation and legend
benskelker added a commit that referenced this pull request Aug 4, 2020
* timeline and template updates

* uncomments out original timeline section in SIEM UI

* removes original timeline IDs to avoid build conflict

* add all actions screenshot

* add all actions screenshot

* corrections

* adds filter explanation and legend
benskelker added a commit that referenced this pull request Aug 4, 2020
* timeline and template updates

* uncomments out original timeline section in SIEM UI

* removes original timeline IDs to avoid build conflict

* add all actions screenshot

* add all actions screenshot

* corrections

* adds filter explanation and legend
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
v7.9.0 Features in the 7.9 Release
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[DOCS] Timeline Updates in 7.9
4 participants