[Cases] Implement alert details metrics #120982

jonathan-buttner · 2021-12-09T18:08:43Z

This PR implements the alert details metrics for the backend. Specifically how unique users and hosts are represented in the alerts attached to a case. It also returns the top 10 most frequent users and hosts.

High level changes

Implemented a count aggregation for getting the count of unique users or hosts
Implemented a terms aggregation to retrieve the top 10 unique users and hosts represented in the alerts attached to the case
Handlers will only be called once regardless of how many of their features are requested
A new function setupFeatures was added to allow handler to setup their features prior to them being computed

…etails

jonathan-buttner · 2021-12-09T18:48:29Z

x-pack/plugins/cases/server/client/metrics/get_case_metrics.test.ts

+      total: 2,
+      values: [{ name: 'host1', id: '1', count: 1 }],
+    });
+    expect(metrics.alerts?.users).toBeUndefined();


Now that we're implementing the metrics since we only passed alertHosts we shouldn't receive anything regarding users.

jonathan-buttner · 2021-12-09T18:49:46Z

x-pack/plugins/cases/server/client/metrics/types.ts

@@ -10,4 +10,5 @@ import { CaseMetricsResponse } from '../../../common/api';
 export interface MetricsHandler {
  getFeatures(): Set<string>;
  compute(): Promise<CaseMetricsResponse>;
+  setupFeature?(feature: string): void;


Allows the handler to optionally implement a method to do some pre-compute setup for each feature.

jonathan-buttner · 2021-12-09T18:51:52Z

x-pack/plugins/cases/server/services/alerts/index.ts

+    const getName = (bucket: FieldAggregateBucket) => {
+      const unsafeHostName = get(bucket.top_fields.hits.hits[0].fields, 'host.name');
+
+      if (Array.isArray(unsafeHostName) && unsafeHostName.length > 0) {


docvalues returns things as an array

jonathan-buttner · 2021-12-09T18:52:28Z

x-pack/plugins/cases/server/services/alerts/index.ts

-  docs: Alert[];
-}
-
-function isEmptyAlert(alert: AlertInfo): boolean {


Just moved this to a private static function within the class.

jonathan-buttner · 2021-12-09T18:53:37Z

x-pack/test/cases_api_integration/security_and_spaces/tests/common/metrics/get_case_metrics.ts

@@ -66,65 +60,5 @@ export default ({ getService }: FtrProviderContext): void => {
        expect(errorResponse.message).to.contain('invalid features');
      });
    });
-
-    describe('alerts', () => {


Moved to its own file

…etails

jonathan-buttner · 2021-12-09T22:03:27Z

x-pack/plugins/cases/server/client/metrics/get_case_metrics.test.ts

@@ -20,44 +24,8 @@ describe('getMetrics', () => {
    closed_at: '2021-11-23T19:59:44Z',
  };

-  const client = createCasesClientMock();


Just moved these into functions below

jonathan-buttner · 2021-12-09T22:05:13Z

x-pack/plugins/cases/server/client/metrics/get_case_metrics.ts

-  return handlersByFeature;
+  checkAndThrowIfInvalidFeatures(params, handlerFeatures);
+
+  return handlersToExecute;


We now only return the handles that need to be executed, instead of a map of all of them. That way we can avoid looping through the features and accidentally calling the alerts handler twice (once for users and once for hosts).

elasticmachine · 2021-12-09T22:06:16Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

elasticmachine · 2021-12-09T22:06:17Z

Pinging @elastic/security-threat-hunting-cases (Feature:Cases)

cnasikas · 2021-12-15T09:51:38Z

x-pack/plugins/cases/server/services/alerts/index.ts

+
+  private static buildTotalUniqueAggregations(fields: AggregationFields[]) {
+    return fields.reduce<Record<string, estypes.AggregationsAggregationContainer>>((acc, field) => {
+      switch (field) {


I think the AlertingService should be agnostic of the fields. We can build the query dynamically by iterating the fields argument. You may need more information from the AggregationFields.

cnasikas · 2021-12-15T09:52:34Z

x-pack/plugins/cases/server/services/alerts/index.ts

+      const aggs = res.body.aggregations as FieldAggregate;
+
+      return {
+        hosts: AlertService.getMostFrequentHosts(aggs),


Same as before. I think the AlertingService should be agnostic of the fields. The response should the same for all fields.

cnasikas · 2021-12-15T09:53:22Z

x-pack/plugins/cases/server/services/alerts/index.ts

+    };
+  }
+
+  private static buildFieldAggregations(fields: AggregationFields[], size: number) {


Same here :)

x-pack/plugins/cases/server/client/metrics/alert_details.ts

x-pack/plugins/cases/server/client/metrics/get_case_metrics.ts

x-pack/plugins/cases/server/client/metrics/alert_details.ts

…etails

semd · 2021-12-20T15:48:52Z

@elasticmachine merge upstream

cnasikas · 2021-12-22T15:11:42Z

x-pack/plugins/cases/server/client/metrics/alerts/aggregations/hosts.ts

+  }
+}
+
+const hostName = 'host.name';


Hey! I understand the logic of reading from top to bottom but I think variables & interfaces should be on the top of the file. Otherwise is difficult to understand what is going on.

Sounds good, I'll move them to the top 👍

semd · 2022-01-04T10:40:06Z

@elasticmachine merge upstream

semd

LGTM! 🚀

cnasikas · 2022-01-04T15:30:16Z

x-pack/test/cases_api_integration/common/lib/validation.ts

+    return false;
+  }
+
+  for (const item of array1) {


Let's optimize it like this:

const arrayAsSet = new Set(array1) return array2.every((item) => arrayAsSet.has(item))

This will convert the complexity of the code from O(n^2) to O(n). What do you think?

cnasikas · 2022-01-04T15:40:01Z

x-pack/plugins/cases/server/client/metrics/alerts/aggregations/hosts.ts

+    if (Array.isArray(unsafeHostName) && unsafeHostName.length > 0) {
+      return unsafeHostName[0];
+    }
+    return unsafeHostName;


Can this be undefined?

Yep it can be, lodash.get could return undefined. I believe the Array.isArray will guard the .length check and then the metrics response allows name to be undefined https://github.com/elastic/kibana/pull/120982/files/f5932dd75fb55282dfe5d41f2492f250055dc279#diff-ba2d4ac2973bd7be2ba8b3ae85473e6870ce973584970ff68fda4adc64816e21R24

I'll add it in the return type though so it's more clear 👍

Yeah I think is good to define the return type so TS can catch it when we use the function. lodash.get return type is any and we miss the possibility of undefined. Thanks!

cnasikas

LGTM 🚀 !

kibana-ci · 2022-01-04T18:04:10Z

💚 Build Succeeded

Metrics [docs]

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`cases`	81.4KB	81.4KB	+45.0B

History

💚 Build #15634 succeeded 160edde
💛 Build #14274 was flaky f5932dd
💚 Build #14006 succeeded 46379f7
💔 Build #13743 failed 58324f2
💚 Build #13259 succeeded a9d7522
💚 Build #12856 succeeded 3206b53

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

elasticmachine · 2022-01-10T10:36:26Z

Pinging @elastic/response-ops (Team:ResponseOps)

jonathan-buttner added 9 commits December 2, 2021 13:58

Implementing the alert count metrics

4cf7681

Fixing type errors

a0da20a

Fixing tests

877cd05

Building new aggregation function in alert service

bed24f4

Merge branch 'main' of github.com:elastic/kibana into metrics-alert-d…

fbbad7b

…etails

Fleshing out compute for alert details

ad1f0e0

Merge branch 'main' of github.com:elastic/kibana into metrics-alert-d…

cf69d04

…etails

Adding tests for handler

4ae7d1b

Refactoring the types and adding another test

c20abda

jonathan-buttner added release_note:skip Skip the PR/issue when compiling release notes backport:skip This commit does not require backporting Team:Threat Hunting Security Solution Threat Hunting Team Feature:Cases Cases feature v8.1.0 Team:Threat Hunting:Cases labels Dec 9, 2021

jonathan-buttner commented Dec 9, 2021

View reviewed changes

jonathan-buttner added 4 commits December 9, 2021 13:55

Merge branch 'main' of github.com:elastic/kibana into metrics-alert-d…

0d7325b

…etails

Removing dead code

e3e8aac

Removing unused snapshots

2a9691c

Refactoring to only call handlers once

6118920

jonathan-buttner commented Dec 9, 2021

View reviewed changes

jonathan-buttner marked this pull request as ready for review December 9, 2021 22:06

jonathan-buttner requested a review from a team as a code owner December 9, 2021 22:06

jonathan-buttner requested review from cnasikas, semd and jamster10 December 9, 2021 22:06

jonathan-buttner mentioned this pull request Dec 9, 2021

[Cases] KPIs Backend #119496

Closed

9 tasks

Merge branch 'main' into metrics-alert-details

a9d7522

cnasikas reviewed Dec 15, 2021

View reviewed changes

semd reviewed Dec 16, 2021

View reviewed changes

x-pack/plugins/cases/server/client/metrics/alert_details.ts Outdated Show resolved Hide resolved

Fixing merge conflicts

58324f2

semd reviewed Dec 17, 2021

View reviewed changes

x-pack/plugins/cases/server/client/metrics/get_case_metrics.ts Outdated Show resolved Hide resolved

semd reviewed Dec 17, 2021

View reviewed changes

x-pack/plugins/cases/server/client/metrics/alert_details.ts Outdated Show resolved Hide resolved

semd mentioned this pull request Dec 17, 2021

[Cases] Isolate host action metrics API #121551

Merged

4 tasks

jonathan-buttner added 3 commits December 17, 2021 13:11

Refactoring aggregations

6fb495c

Merge branch 'main' of github.com:elastic/kibana into metrics-alert-d…

7476444

…etails

some code cleanup

46379f7

Merge branch 'main' into metrics-alert-details

f5932dd

cnasikas reviewed Dec 22, 2021

View reviewed changes

Merge branch 'main' into metrics-alert-details

160edde

semd approved these changes Jan 4, 2022

View reviewed changes

cnasikas reviewed Jan 4, 2022

View reviewed changes

cnasikas approved these changes Jan 4, 2022

View reviewed changes

Addressing review feedback

8283bea

jonathan-buttner merged commit 4dcf22b into elastic:main Jan 4, 2022

jonathan-buttner deleted the metrics-alert-details branch January 4, 2022 18:53

cnasikas added Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) and removed Team:Threat Hunting Security Solution Threat Hunting Team labels Jan 10, 2022

jonathan-buttner mentioned this pull request Jan 31, 2022

[Cases] KPIs #117905

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Cases] Implement alert details metrics #120982

[Cases] Implement alert details metrics #120982

jonathan-buttner commented Dec 9, 2021 •

edited

Loading

jonathan-buttner Dec 9, 2021 •

edited

Loading

jonathan-buttner Dec 9, 2021

jonathan-buttner Dec 9, 2021

jonathan-buttner Dec 9, 2021

jonathan-buttner Dec 9, 2021

jonathan-buttner Dec 9, 2021

jonathan-buttner Dec 9, 2021

elasticmachine commented Dec 9, 2021

elasticmachine commented Dec 9, 2021

cnasikas Dec 15, 2021

cnasikas Dec 15, 2021

cnasikas Dec 15, 2021

semd commented Dec 20, 2021

cnasikas Dec 22, 2021

jonathan-buttner Jan 4, 2022

semd commented Jan 4, 2022

semd left a comment

cnasikas Jan 4, 2022 •

edited

Loading

cnasikas Jan 4, 2022

jonathan-buttner Jan 4, 2022

jonathan-buttner Jan 4, 2022

cnasikas Jan 4, 2022 •

edited

Loading

cnasikas left a comment

kibana-ci commented Jan 4, 2022

elasticmachine commented Jan 10, 2022

[Cases] Implement alert details metrics #120982

[Cases] Implement alert details metrics #120982

Conversation

jonathan-buttner commented Dec 9, 2021 • edited Loading

jonathan-buttner Dec 9, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Dec 9, 2021

elasticmachine commented Dec 9, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

semd commented Dec 20, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

semd commented Jan 4, 2022

semd left a comment

Choose a reason for hiding this comment

cnasikas Jan 4, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cnasikas Jan 4, 2022 • edited Loading

Choose a reason for hiding this comment

cnasikas left a comment

Choose a reason for hiding this comment

kibana-ci commented Jan 4, 2022

💚 Build Succeeded

Metrics [docs]

Page load bundle

History

elasticmachine commented Jan 10, 2022

jonathan-buttner commented Dec 9, 2021 •

edited

Loading

jonathan-buttner Dec 9, 2021 •

edited

Loading

cnasikas Jan 4, 2022 •

edited

Loading

cnasikas Jan 4, 2022 •

edited

Loading