Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution][RAC] Fixes Threshold Rule functionality for post-rule-migration 8.0 #117571

Merged
merged 13 commits into from
Nov 9, 2021
Merged

[Security Solution][RAC] Fixes Threshold Rule functionality for post-rule-migration 8.0 #117571

merged 13 commits into from
Nov 9, 2021

Conversation

madirey
Copy link
Contributor

@madirey madirey commented Nov 4, 2021 •
edited
Loading

Summary

Threshold rules were broken after merging #112113 because the UI was referencing the signal.* fields, whereas new alerts are generated using the AAD schema. Additionally, threshold alerts were being generated incorrectly, placing threshold.result at the top level of the document instead of under kibana.alert.threshold_result where it belongs.

This PR:

  • Adjusts post-migration Threshold Rules to generate correct documents (using kibana.alert.threshold_result)
  • Reenables Threshold Rule tests
  • Removes unused code (nonEcsData, getFilterAndRuleBounds)
  • Changes threshold field references in UI to use new AAD fields and fall back to legacy signal.* fields

Screen Shot 2021-11-04 at 2 57 13 PM

Checklist

Delete any items that are not applicable to this PR.

Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to identify risks that should be tested prior to the change/feature release.

When forming the risk matrix, consider some of the following examples and how they may potentially impact the change:

Risk Probability Severity Mitigation/Notes
Multiple Spaces—unexpected behavior in non-default Kibana Space. Low High Integration tests will verify that all features are still supported in non-default Kibana Space and when user switches between spaces.
Multiple nodes—Elasticsearch polling might have race conditions when multiple Kibana nodes are polling for the same tasks. High Low Tasks are idempotent, so executing them multiple times will not result in logical error, but will degrade performance. To test for this case we add plenty of unit tests around this logic and document manual testing procedure.
Code should gracefully handle cases when feature X or plugin Y are disabled. Medium High Unit tests will verify that any feature flag or plugin combination still results in our service operational.
See more potential risk examples

For maintainers

@madirey madirey added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:Detection Alerts Security Detection Alerts Area Team labels Nov 4, 2021
@madirey madirey requested a review from a team as a code owner November 4, 2021 17:34
@madirey madirey added the auto-backport Deprecated - use backport:version if exact versions are needed label Nov 4, 2021
@madirey madirey enabled auto-merge (squash) November 5, 2021 09:57
@madirey
Copy link
Contributor Author

madirey commented Nov 8, 2021

@elasticmachine merge upstream

@kibanamachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 4.5MB 4.5MB -90.0B

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@madirey madirey added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Nov 9, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@madirey madirey added the v8.1.0 label Nov 9, 2021
marshallmain
marshallmain approved these changes Nov 9, 2021
View reviewed changes
Copy link
Contributor

@marshallmain marshallmain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code changes LGTM! Can you add a couple more sentences to the PR to add some details about what's being fixed here and how it behaves before and after the fix?

@madirey madirey merged commit c44dd6e into elastic:main Nov 9, 2021
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Nov 9, 2021
@madirey @kibanamachine
[Security Solution][RAC] Threshold Rule Fixes (elastic#117571)
81d82c5 
* Remove unused code

* Fix threshold field refs

* Fix import

* UI fixes for Rules

* Threshold Cypress test fixes

* Type fixes

* Threshold signal test fixes

* Handle legacy schema optionally

* Fix threshold integration test

* More test fixes
@kibanamachine kibanamachine mentioned this pull request Nov 9, 2021
Merged
@kibanamachine
Copy link
Contributor

💚 Backport successful

Status Branch Result
✅ 8.0

This backport PR will be merged automatically after passing CI.

@madirey madirey deleted the threshold-aad-fixes branch November 9, 2021 17:08
@madirey
Copy link
Contributor Author

madirey commented Nov 9, 2021

Thanks @marshallmain ... done!

@madirey madirey mentioned this pull request Nov 9, 2021
Closed
20 tasks
@madirey madirey changed the title [Security Solution][RAC] Threshold Rule Fixes [Security Solution][RAC] Fixes Threshold Rule functionality for post-rule-migration 8.0 Nov 9, 2021
kibanamachine added a commit that referenced this pull request Nov 9, 2021
@kibanamachine @madirey
[Security Solution][RAC] Threshold Rule Fixes (#117571) (#118045)
e80e837 
* Remove unused code

* Fix threshold field refs

* Fix import

* UI fixes for Rules

* Threshold Cypress test fixes

* Type fixes

* Threshold signal test fixes

* Handle legacy schema optionally

* Fix threshold integration test

* More test fixes

Co-authored-by: Madison Caldwell <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@marshallmain marshallmain marshallmain approved these changes

@MadameSheema MadameSheema Awaiting requested review from MadameSheema

@dplumlee dplumlee Awaiting requested review from dplumlee

Assignees
No one assigned
Labels
auto-backport Deprecated - use backport:version if exact versions are needed release_note:skip Skip the PR/issue when compiling release notes Team:Detection Alerts Security Detection Alerts Area Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.0.0 v8.1.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@madirey @kibanamachine @elasticmachine @marshallmain