[Security Solution][Endpoint]Activity Log API/UX changes #114905

ashokaditya · 2021-10-13T19:12:39Z

Summary

In addition to fleet actions and responses in the activity log, this PR enriches the log by showing successful or failed action responses that were completed when the endpoint finishes executing the action request.

finds unique action_ids for each agent from .fleet-actions and .logs-endpoint.actions-default indices, if the new endpoint action index exists. Otherwise, finds action_ids from .fleet-actions index.
finds all matching action_id responses from .fleet-action-results and .logs-endpoint.action.responses-default indices if it exists. Distinguishes each type of record by labeling them fleetResponse or response (for endpoint responses)
Filters out endpoint actions (as they are duplicates of fleet actions) and labels the results as fleetAction. Since we want to continue showing fleet action requests, fleet action responses, and the new endpoint response (as completed response).
shows endpoint actions that have failed to be delivered to fleet with matching endpoint responses that didn't execute.
merges actions and responses as it did earlier to display in the log UI.

with actions/responses that didn't make to fleet:

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios
Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
This was checked for cross-browser compatibility

fixes elastic/security-team/issues/1702

refs /pull/113621

fixes elastic/security-team/issues/1703

ashokaditya · 2021-10-14T16:02:49Z

@elasticmachine merge upstream

fixes elastic/security-team/issues/1702

…ons-default` indices fixes elastic/security-team/issues/1702

elasticmachine · 2021-10-14T19:02:05Z

Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt)

pzl

getActivityLog() is getting pretty big. It's hard to read through the logic top-to-bottom and understand why we're doing any of those operations. Can you refactor and split some of those sections into functions, and then getActivityLog()'s purpose can be described by reading those function names?

x-pack/plugins/security_solution/server/endpoint/services/actions.ts

…t to Fleet review comments

review comments

Simplify `getActivityLog` so it is easier to reason with. review comments

academo · 2021-10-15T14:00:49Z

x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx

@@ -912,6 +932,25 @@ describe('when on the endpoint list page', () => {
        expect(`${logEntries[1]} .euiCommentTimeline__icon--regular`).not.toBe(null);
      });

+      it('should display log accurately with endpoint responses', async () => {
+        const activityLogTab = await renderResult.findByTestId('activity_log');
+        reactTestingLibrary.act(() => {


no need to take action, but just so you know, userEvent is available in kibana and avoids the whole having to wrap this in act https://testing-library.com/docs/ecosystem-user-event/

x-pack/plugins/security_solution/server/endpoint/routes/actions/audit_log.test.ts

review comments fixes elastic/security-team/issues/1703

review fixes

review change

x-pack/plugins/security_solution/common/endpoint/constants.ts

review changes

refs 74a8340

pzl

🐑

ashokaditya · 2021-10-18T14:53:10Z

@elasticmachine merge upstream

kevinlog · 2021-10-18T17:52:28Z

I also checked this our and tried it. After a fix from @ferullo it should work!

With the Endpoint that has the fix to get the activity log working

ashokaditya · 2021-10-18T17:56:44Z

I also checked this our and tried it. After a fix from @ferullo it should work!

With the Endpoint that has the fix to get the activity log working

Fantastic @kevinlog 🎉

ashokaditya · 2021-10-18T19:25:52Z

@elasticmachine merge upstream

kevinlog · 2021-10-18T23:31:22Z

@elasticmachine merge upstream

kevinlog · 2021-10-19T01:05:03Z

@elasticmachine merge upstream

kevinlog · 2021-10-19T01:10:47Z

@elasticmachine merge upstream

kibanamachine · 2021-10-19T03:27:10Z

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	4.6MB	4.6MB	+2.6KB

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @ashokaditya

) * rename legacy actions/responses fixes elastic/security-team/issues/1702 * use correct name for responses index refs elastic/pull/113621 * extract helper method to utils * append endpoint responses docs to activity log * Show completed responses on activity log fixes elastic/security-team/issues/1703 * remove width restriction on date picker * add a simple test to verify endpoint responses fixes elastic/security-team/issues/1702 * find unique action_ids from `.fleet-actions` and `.logs-endpoint.actions-default` indices fixes elastic/security-team/issues/1702 * do not filter out endpoint only actions/responses that did not make it to Fleet review comments * use a constant to manage various doc types review comments * refactor `getActivityLog` Simplify `getActivityLog` so it is easier to reason with. review comments * skip this for now will mock this better in a new PR * improve types * display endpoint actions similar to fleet actions, but with success icon color * Correctly do mocks for tests * Include only errored endpoint actions, remove successful duplicates fixes elastic/security-team/issues/1703 * Update tests to use non duplicate action_ids review comments fixes elastic/security-team/issues/1703 * show correct action title review fixes * statusCode constant review change * rename review changes * Update translations.ts refs elastic@74a8340 Co-authored-by: Kibana Machine <[email protected]>

kibanamachine · 2021-10-19T03:30:27Z

💚 Backport successful

Status	Branch	Result
✅	7.x

This backport PR will be merged automatically after passing CI.

…115492) * rename legacy actions/responses fixes elastic/security-team/issues/1702 * use correct name for responses index refs /pull/113621 * extract helper method to utils * append endpoint responses docs to activity log * Show completed responses on activity log fixes elastic/security-team/issues/1703 * remove width restriction on date picker * add a simple test to verify endpoint responses fixes elastic/security-team/issues/1702 * find unique action_ids from `.fleet-actions` and `.logs-endpoint.actions-default` indices fixes elastic/security-team/issues/1702 * do not filter out endpoint only actions/responses that did not make it to Fleet review comments * use a constant to manage various doc types review comments * refactor `getActivityLog` Simplify `getActivityLog` so it is easier to reason with. review comments * skip this for now will mock this better in a new PR * improve types * display endpoint actions similar to fleet actions, but with success icon color * Correctly do mocks for tests * Include only errored endpoint actions, remove successful duplicates fixes elastic/security-team/issues/1703 * Update tests to use non duplicate action_ids review comments fixes elastic/security-team/issues/1703 * show correct action title review fixes * statusCode constant review change * rename review changes * Update translations.ts refs 74a8340 Co-authored-by: Kibana Machine <[email protected]> Co-authored-by: Ashokaditya <[email protected]>

ashokaditya self-assigned this Oct 13, 2021

ashokaditya added auto-backport Deprecated - use backport:version if exact versions are needed v7.16.0 v8.0.0 release_note:feature Makes this part of the condensed release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution labels Oct 13, 2021

ashokaditya added 6 commits October 14, 2021 16:47

rename legacy actions/responses

59ed20c

fixes elastic/security-team/issues/1702

use correct name for responses index

e32e958

refs /pull/113621

extract helper method to utils

94b2fe0

append endpoint responses docs to activity log

e4fda32

Show completed responses on activity log

e12f48a

fixes elastic/security-team/issues/1703

remove width restriction on date picker

ce74a8e

kibanamachine and others added 3 commits October 14, 2021 12:02

Merge branch 'master' into feat/olm-activity_log_API_UX-1702

45153a4

add a simple test to verify endpoint responses

6867573

fixes elastic/security-team/issues/1702

find unique action_ids from .fleet-actions and `.logs-endpoint.acti…

e0c62ad

…ons-default` indices fixes elastic/security-team/issues/1702

ashokaditya marked this pull request as ready for review October 14, 2021 19:01

ashokaditya requested review from a team as code owners October 14, 2021 19:01

ashokaditya requested review from academo and paul-tavares October 14, 2021 19:01

ashokaditya requested a review from pzl October 14, 2021 19:02

pzl reviewed Oct 14, 2021

View reviewed changes

ashokaditya added 2 commits October 15, 2021 10:04

do not filter out endpoint only actions/responses that did not make i…

7e6d091

…t to Fleet review comments

use a constant to manage various doc types

fca0757

review comments

pzl approved these changes Oct 15, 2021

View reviewed changes

refactor getActivityLog

59df284

Simplify `getActivityLog` so it is easier to reason with. review comments

academo reviewed Oct 15, 2021

View reviewed changes

x-pack/plugins/security_solution/server/endpoint/routes/actions/audit_log.test.ts Outdated Show resolved Hide resolved

ashokaditya added 3 commits October 18, 2021 16:11

Update tests to use non duplicate action_ids

bc80259

review comments fixes elastic/security-team/issues/1703

show correct action title

74a8340

review fixes

statusCode constant

ba8b5b4

review change

pzl reviewed Oct 18, 2021

View reviewed changes

x-pack/plugins/security_solution/common/endpoint/constants.ts Outdated Show resolved Hide resolved

ashokaditya added 2 commits October 18, 2021 16:43

rename

4fea956

review changes

Update translations.ts

faa6759

refs 74a8340

pzl approved these changes Oct 18, 2021

View reviewed changes

ashokaditya enabled auto-merge (squash) October 18, 2021 14:51

kibanamachine and others added 2 commits October 18, 2021 10:53

Merge branch 'master' into feat/olm-activity_log_API_UX-1702

d4a0819

fix type

859ca57

kevinlog approved these changes Oct 18, 2021

View reviewed changes

Merge branch 'master' into feat/olm-activity_log_API_UX-1702

03ec833

Merge branch 'master' into feat/olm-activity_log_API_UX-1702

aa89075

Merge branch 'master' into feat/olm-activity_log_API_UX-1702

f5ac130

Merge branch 'master' into feat/olm-activity_log_API_UX-1702

1b1196c

ashokaditya merged commit d0bc10f into elastic:master Oct 19, 2021

kibanamachine mentioned this pull request Oct 19, 2021

[7.x] [Security Solution][Endpoint]Activity Log API/UX changes (#114905) #115492

Merged

ashokaditya deleted the feat/olm-activity_log_API_UX-1702 branch October 19, 2021 06:55

muskangulati-qasource mentioned this pull request Dec 13, 2021

[BUG] Host Isolation Activity logs are updated to show the success or unsuccessful message and coloured ticks are also added now. Need to update the screenshot and add text for the colour information. elastic/security-docs#1335

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Endpoint]Activity Log API/UX changes #114905

[Security Solution][Endpoint]Activity Log API/UX changes #114905

ashokaditya commented Oct 13, 2021 •

edited

Loading

ashokaditya commented Oct 14, 2021

elasticmachine commented Oct 14, 2021

pzl left a comment

academo Oct 15, 2021

pzl left a comment

ashokaditya commented Oct 18, 2021

kevinlog commented Oct 18, 2021

ashokaditya commented Oct 18, 2021

ashokaditya commented Oct 18, 2021

kevinlog commented Oct 18, 2021

kevinlog commented Oct 19, 2021

kevinlog commented Oct 19, 2021

kibanamachine commented Oct 19, 2021

kibanamachine commented Oct 19, 2021

[Security Solution][Endpoint]Activity Log API/UX changes #114905

[Security Solution][Endpoint]Activity Log API/UX changes #114905

Conversation

ashokaditya commented Oct 13, 2021 • edited Loading

Summary

Checklist

ashokaditya commented Oct 14, 2021

elasticmachine commented Oct 14, 2021

pzl left a comment

Choose a reason for hiding this comment

academo Oct 15, 2021

Choose a reason for hiding this comment

pzl left a comment

Choose a reason for hiding this comment

ashokaditya commented Oct 18, 2021

kevinlog commented Oct 18, 2021

ashokaditya commented Oct 18, 2021

ashokaditya commented Oct 18, 2021

kevinlog commented Oct 18, 2021

kevinlog commented Oct 19, 2021

kevinlog commented Oct 19, 2021

kibanamachine commented Oct 19, 2021

💚 Build Succeeded

Metrics [docs]

Async chunks

History

kibanamachine commented Oct 19, 2021

💚 Backport successful

ashokaditya commented Oct 13, 2021 •

edited

Loading