[7.16] [Security Solution] Fixes issues with the Raw events Top N view (#121562) #121587
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…tic#121562) ## [Security Solution] Fixes issues with the Raw events Top N view This PR fixes the following issues with the Raw events Top N view: - Fixes an issue <elastic#121168> where the Sourcerer context included detection alerts in the Raw events view, per the before screenshot below: ### Before  _Above: Before - the Raw events view includes detection alerts_ ### After  _Above: After - The Raw events view does NOT include detection alerts_ - Fixes an issue <elastic#121381> where when inspecting Raw events, `Sorry about that, something went wrong` is displayed when the Sourcerer context does not match the current selection: ### Before  _Above: Before - When users `Inspect` the Raw events view, `Sorry about that, something went wrong` is displayed_ ### After  _Above: After - When users `Inspect` the raw events view, the expected Index pattern reflects the current Sourcerer selection_ - Fixes an issue where the following filters in the `Security > Alerts` and `Security > Rule > Details` views: - `kibana.alert.building_block_type`: an "Additional filters" option on the alerts table - `kibana.alert.rule.rule_id`: filters alerts to a single rule on the `Security > Rules > Details` views - `kibana.alert.rule.name`: not a built-in view filter, but frequently applied via the `Filter In` and `Filter Out` actions - `kibana.alert.rule.threat_mapping`: an "Additional filters" option on the alerts table - `kibana.alert.workflow_status`: The `open | acknowledged | closed` status filter were incorrectly applied to the Raw events view, per the screenshots below: ### Before Inspecting the Raw events query reveals the alert filters are applied as filter criteria, per the screenshot below:  _Above: Before - The alert filters are applied to the Raw events view_ ### After After the fix, the alert filters are NOT applied to the raw events view, per the screenshot below:  _Above: After - The alert filters are NOT applied to the Raw events view_ # Conflicts: # x-pack/plugins/security_solution/public/common/components/top_n/top_n.tsx
…y_solution/public/common/components/top_n/helpers.ts` to include legacy alert fields: - `signal.rule.building_block_type` - `signal.rule.id` - `signal.rule.name` - `signal.rule.threat_mapping` - `signal.status`
…op_n/helpers.test.tsx` to use legacy `signal.rule.building_block_type`
|
Closing this because main/8.0 have been reverted |
|
The PR this backport was based on, #121562 passed CI (and was merged), but a (CI) race condition from #121135 deleted the following constants from The (CI) race condition required #121562 to be reverted. A new PR that doesn't depend on the constants deleted from |
💚 Build Succeeded
Metrics [docs]Module Count
Async chunks
History
To update your PR or re-run it, just comment with: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backports the following commits to 7.16: