Add anomalies tab to user page

[machadoum]

Summary

• Add anomalies tab to user page
• Filter out anomalies by user.name and host.name on the server

Checklist

Delete any items that are not applicable to this PR.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Unit or functional tests were updated or added to match the most common scenarios
• Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
• Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
• This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
• This was checked for cross-browser compatibility

How to test it

• You need real auth data
• enable the feature flag 'usersEnabled'
• Enable auth ML jobs

[machadoum]

@elastic/ml-ui I have to display anomalies related to users. So I only return anomalies where user.name exists. Will it work? Do all anomalies influenced by a user have user.namefield?

[peteharverson]

This will only work if user.name is included as one of the influencer fields for the job. Is user.name included inside the influencers array inside the analysis_config for the job(s)?

[machadoum]

I believe that user.name should be there for all user anomalies.
I checked many auth ml configurations and user.name was there for all of them. For example:

windows_rare_user_runas_event.json

  "analysis_config": {
    "bucket_span": "15m",
    "detectors": [
      {
        "detector_description": "rare by \"user.name\"",
        "function": "rare",
        "by_field_name": "user.name"
      }
    ],
    "influencers": [
      "host.name",
      "process.name",
      "user.name"
    ]
  },

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[machadoum]

@elasticmachine merge upstream

[stephmilovic]

LGTM, nice work @machadoum 🚀

[machadoum]

@elasticmachine merge upstream

[machadoum]

@elasticmachine merge upstream

[kibanamachine]

merge conflict between base and head

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 84a960a
• Storybooks Preview
• Webpack Bundle Analyzer

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	2879	2884	+5

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	4.7MB	4.7MB	+1.6KB

History

• 💔 Build #26549 failed 0929182febbfa262fd835813e0f0da1059867dd6
• 💔 Build #26457 failed 339ed5e407d29d69d5518b71d01af31011a77c35
• 💚 Build #26241 succeeded 1365506c10d773b9c18c322869789ac32fa865a9
• 💚 Build #25904 succeeded bfc9bb04eef3d8ce9ac53e2bad287d83703f0909
• 💛 Build #25469 was flaky adbf0dc478dd3e8f1023a94ea7c435978115086c

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @machadoum

[kibanamachine]

💔 Backport failed

The pull request could not be backported due to the following error:
There are no branches to backport to. Aborting.

How to fix

Re-run the backport manually:

node scripts/backport --pr 126079

Questions ?

Please refer to the Backport tool documentation

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create backports run node scripts/backport --pr 126079 or prevent reminders by adding the backport:skip label.

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create backports run node scripts/backport --pr 126079 or prevent reminders by adding the backport:skip label.

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create backports run node scripts/backport --pr 126079 or prevent reminders by adding the backport:skip label.