-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
* add alert view to hosts page * add defaultHeaders * add alerts table * fix dsl query * add alerts histogram * add i18n for alerts table * fix types error * fix type issue * whitespace cleanup * fix types * fix types * fix types * fix types * fix types * rename params * fix unit test * fix types * revert change on updateHostsSort * remove unused prop * update unit test * pair programming with angela to get filter working * update alerts query * clean up * fix queries * align type for pageFilters * apply page filter for network page * simplify filter props for alerts view * clean up * replace hard coded tab name
- Loading branch information
Showing
61 changed files
with
1,608 additions
and
99 deletions.
There are no files selected for viewing
85 changes: 85 additions & 0 deletions
85
x-pack/legacy/plugins/siem/public/components/alerts_viewer/alerts_table.tsx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import React, { useMemo } from 'react'; | ||
|
|
||
| import { esFilters } from '../../../../../../../src/plugins/data/common/es_query'; | ||
| import { StatefulEventsViewer } from '../events_viewer'; | ||
| import * as i18n from './translations'; | ||
| import { alertsDefaultModel } from './default_headers'; | ||
|
|
||
| export interface OwnProps { | ||
| end: number; | ||
| id: string; | ||
| start: number; | ||
| } | ||
|
|
||
| const ALERTS_TABLE_ID = 'timeline-alerts-table'; | ||
| const defaultAlertsFilters: esFilters.Filter[] = [ | ||
| { | ||
| meta: { | ||
| alias: null, | ||
| negate: false, | ||
| disabled: false, | ||
| type: 'phrase', | ||
| key: 'event.kind', | ||
| params: { | ||
| query: 'alert', | ||
| }, | ||
| }, | ||
| query: { | ||
| bool: { | ||
| filter: [ | ||
| { | ||
| bool: { | ||
| should: [ | ||
| { | ||
| match: { | ||
| 'event.kind': 'alert', | ||
| }, | ||
| }, | ||
| ], | ||
| minimum_should_match: 1, | ||
| }, | ||
| }, | ||
| ], | ||
| }, | ||
| }, | ||
| }, | ||
| ]; | ||
|
|
||
| export const AlertsTable = React.memo( | ||
| ({ | ||
| endDate, | ||
| startDate, | ||
| pageFilters = [], | ||
| }: { | ||
| endDate: number; | ||
| startDate: number; | ||
| pageFilters?: esFilters.Filter[]; | ||
| }) => { | ||
| const alertsFilter = useMemo(() => [...defaultAlertsFilters, ...pageFilters], [pageFilters]); | ||
| return ( | ||
| <StatefulEventsViewer | ||
| defaultFilters={alertsFilter} | ||
| defaultModel={alertsDefaultModel} | ||
| end={endDate} | ||
| id={ALERTS_TABLE_ID} | ||
| start={startDate} | ||
| timelineTypeContext={useMemo( | ||
| () => ({ | ||
| documentType: i18n.ALERTS_DOCUMENT_TYPE, | ||
| footerText: i18n.TOTAL_COUNT_OF_ALERTS, | ||
| showCheckboxes: false, | ||
| showRowRenderers: false, | ||
| title: i18n.ALERTS_TABLE_TITLE, | ||
| }), | ||
| [] | ||
| )} | ||
| /> | ||
| ); | ||
| } | ||
| ); |
68 changes: 68 additions & 0 deletions
68
x-pack/legacy/plugins/siem/public/components/alerts_viewer/default_headers.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import { ColumnHeader } from '../timeline/body/column_headers/column_header'; | ||
| import { defaultColumnHeaderType } from '../timeline/body/column_headers/default_headers'; | ||
| import { DEFAULT_COLUMN_MIN_WIDTH, DEFAULT_DATE_COLUMN_MIN_WIDTH } from '../timeline/body/helpers'; | ||
| import { timelineDefaults, SubsetTimelineModel } from '../../store/timeline/model'; | ||
|
|
||
| export const alertsHeaders: ColumnHeader[] = [ | ||
| { | ||
| columnHeaderType: defaultColumnHeaderType, | ||
| id: '@timestamp', | ||
| width: DEFAULT_DATE_COLUMN_MIN_WIDTH, | ||
| }, | ||
| { | ||
| columnHeaderType: defaultColumnHeaderType, | ||
| id: 'event.module', | ||
| width: DEFAULT_COLUMN_MIN_WIDTH, | ||
| }, | ||
| { | ||
| columnHeaderType: defaultColumnHeaderType, | ||
| id: 'event.dataset', | ||
| width: DEFAULT_COLUMN_MIN_WIDTH, | ||
| }, | ||
| { | ||
| columnHeaderType: defaultColumnHeaderType, | ||
| id: 'event.category', | ||
| width: DEFAULT_COLUMN_MIN_WIDTH, | ||
| }, | ||
| { | ||
| columnHeaderType: defaultColumnHeaderType, | ||
| id: 'event.severity', | ||
| width: DEFAULT_COLUMN_MIN_WIDTH, | ||
| }, | ||
| { | ||
| columnHeaderType: defaultColumnHeaderType, | ||
| id: 'observer.name', | ||
| width: DEFAULT_COLUMN_MIN_WIDTH, | ||
| }, | ||
| { | ||
| columnHeaderType: defaultColumnHeaderType, | ||
| id: 'host.name', | ||
| width: DEFAULT_COLUMN_MIN_WIDTH, | ||
| }, | ||
| { | ||
| columnHeaderType: defaultColumnHeaderType, | ||
| id: 'message', | ||
| width: DEFAULT_COLUMN_MIN_WIDTH, | ||
| }, | ||
| { | ||
| columnHeaderType: defaultColumnHeaderType, | ||
| id: 'agent.id', | ||
| width: DEFAULT_COLUMN_MIN_WIDTH, | ||
| }, | ||
| { | ||
| columnHeaderType: defaultColumnHeaderType, | ||
| id: 'agent.type', | ||
| width: DEFAULT_COLUMN_MIN_WIDTH, | ||
| }, | ||
| ]; | ||
|
|
||
| export const alertsDefaultModel: SubsetTimelineModel = { | ||
| ...timelineDefaults, | ||
| columns: alertsHeaders, | ||
| }; |
59 changes: 59 additions & 0 deletions
59
x-pack/legacy/plugins/siem/public/components/alerts_viewer/index.tsx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import { noop } from 'lodash/fp'; | ||
| import React from 'react'; | ||
|
|
||
| import { EuiSpacer } from '@elastic/eui'; | ||
| import { manageQuery } from '../page/manage_query'; | ||
| import { AlertsOverTimeHistogram } from '../page/hosts/alerts_over_time'; | ||
| import { AlertsComponentsQueryProps } from './types'; | ||
| import { AlertsOverTimeQuery } from '../../containers/alerts/alerts_over_time'; | ||
| import { hostsModel } from '../../store/model'; | ||
| import { AlertsTable } from './alerts_table'; | ||
|
|
||
| const AlertsOverTimeManage = manageQuery(AlertsOverTimeHistogram); | ||
| export const AlertsView = ({ | ||
| defaultFilters, | ||
| deleteQuery, | ||
| endDate, | ||
| filterQuery, | ||
| pageFilters, | ||
| skip, | ||
| setQuery, | ||
| startDate, | ||
| type, | ||
| updateDateRange = noop, | ||
| }: AlertsComponentsQueryProps) => ( | ||
| <> | ||
| <AlertsOverTimeQuery | ||
| endDate={endDate} | ||
| filterQuery={filterQuery} | ||
| sourceId="default" | ||
| startDate={startDate} | ||
| type={hostsModel.HostsType.page} | ||
| > | ||
| {({ alertsOverTime, loading, id, inspect, refetch, totalCount }) => ( | ||
| <AlertsOverTimeManage | ||
| data={alertsOverTime!} | ||
| endDate={endDate} | ||
| id={id} | ||
| inspect={inspect} | ||
| loading={loading} | ||
| refetch={refetch} | ||
| setQuery={setQuery} | ||
| startDate={startDate} | ||
| totalCount={totalCount} | ||
| updateDateRange={updateDateRange} | ||
| /> | ||
| )} | ||
| </AlertsOverTimeQuery> | ||
| <EuiSpacer size="l" /> | ||
| <AlertsTable endDate={endDate} startDate={startDate} pageFilters={pageFilters} /> | ||
| </> | ||
| ); | ||
|
|
||
| AlertsView.displayName = 'AlertsView'; |
19 changes: 19 additions & 0 deletions
19
x-pack/legacy/plugins/siem/public/components/alerts_viewer/translations.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import { i18n } from '@kbn/i18n'; | ||
|
|
||
| export const ALERTS_DOCUMENT_TYPE = i18n.translate('xpack.siem.hosts.alertsDocumentType', { | ||
| defaultMessage: 'Alerts', | ||
| }); | ||
|
|
||
| export const TOTAL_COUNT_OF_ALERTS = i18n.translate('xpack.siem.hosts.totalCountOfAlerts', { | ||
| defaultMessage: 'alerts match the search criteria', | ||
| }); | ||
|
|
||
| export const ALERTS_TABLE_TITLE = i18n.translate('xpack.siem.hosts.alertsDocumentType', { | ||
| defaultMessage: 'Alerts', | ||
| }); |
26 changes: 26 additions & 0 deletions
26
x-pack/legacy/plugins/siem/public/components/alerts_viewer/types.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import { esFilters } from '../../../../../../../src/plugins/data/common'; | ||
| import { HostsComponentsQueryProps } from '../../pages/hosts/navigation/types'; | ||
| import { NetworkComponentQueryProps } from '../../pages/network/navigation/types'; | ||
|
|
||
| type CommonQueryProps = HostsComponentsQueryProps | NetworkComponentQueryProps; | ||
| export interface AlertsComponentsQueryProps | ||
| extends Pick< | ||
| CommonQueryProps, | ||
| | 'deleteQuery' | ||
| | 'endDate' | ||
| | 'filterQuery' | ||
| | 'skip' | ||
| | 'setQuery' | ||
| | 'startDate' | ||
| | 'type' | ||
| | 'updateDateRange' | ||
| > { | ||
| pageFilters: esFilters.Filter[]; | ||
| defaultFilters?: esFilters.Filter[]; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.