Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Defend Workflows] Live queries with parameters on timelines' events #151317

Merged
merged 6 commits into from
Feb 20, 2023
Merged

[Defend Workflows] Live queries with parameters on timelines' events #151317

merged 6 commits into from
Feb 20, 2023

Conversation

szwarckonrad
Copy link
Contributor

@szwarckonrad szwarckonrad commented Feb 15, 2023 •
edited by kibanamachine
Loading

Closes https://github.com/elastic/security-team/issues/5999

test

BUG*
"Take action" > "Run osquery" on timeline event that is not an alert won't substitute params.
CAUSE
Lack of context connection in the component that carries alertData

@szwarckonrad szwarckonrad added bug Fixes for quality problems that affect the customer experience release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.7.0 v8.8.0 labels Feb 15, 2023
@szwarckonrad szwarckonrad marked this pull request as ready for review February 16, 2023 10:26
@szwarckonrad szwarckonrad requested a review from a team as a code owner February 16, 2023 10:26
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

@kibana-ci
Copy link
Collaborator

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
osquery 1.1MB 1.1MB +119.0B

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

tomsonpl
tomsonpl approved these changes Feb 16, 2023
View reviewed changes
Copy link
Contributor

@tomsonpl tomsonpl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for adding the comment 👍

@szwarckonrad szwarckonrad self-assigned this Feb 16, 2023
@szwarckonrad szwarckonrad merged commit 9109fd5 into elastic:main Feb 20, 2023
@kibanamachine
Copy link
Contributor

💔 All backports failed

Status Branch Result
❌ 8.7 Could not create pull request: You have exceeded a secondary rate limit and have been temporarily blocked from content creation. Please retry your request again later.

Manual backport

To create the backport manually run:

node scripts/backport --pr 151317

Questions ?

Please refer to the Backport tool documentation

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 20, 2023
@szwarckonrad
[Defend Workflows] Live queries with parameters on timelines' events (e…
e6d9000 
…lastic#151317)

Closes elastic/security-team#5999

![test](https://user-images.githubusercontent.com/29123534/219058689-f2c423b8-b239-4ec0-b946-7b2e350749e3.gif)

**BUG***
"Take action" > "Run osquery" on timeline event that is not an alert
won't substitute params.
**CAUSE**
Lack of context connection in the component that carries `alertData`

(cherry picked from commit 9109fd5)
@szwarckonrad szwarckonrad mentioned this pull request Feb 20, 2023
Merged
@szwarckonrad
Copy link
Contributor Author

💚 All backports created successfully

Status Branch Result
✅ 8.7

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

szwarckonrad added a commit to szwarckonrad/kibana that referenced this pull request Feb 20, 2023
@szwarckonrad
[Defend Workflows] Live queries with parameters on timelines' events (e…
fe80572 
…lastic#151317)

Closes elastic/security-team#5999

![test](https://user-images.githubusercontent.com/29123534/219058689-f2c423b8-b239-4ec0-b946-7b2e350749e3.gif)

**BUG***
"Take action" > "Run osquery" on timeline event that is not an alert
won't substitute params.
**CAUSE**
Lack of context connection in the component that carries `alertData`

(cherry picked from commit 9109fd5)
szwarckonrad added a commit that referenced this pull request Feb 20, 2023
@szwarckonrad
[8.7] [Defend Workflows] Live queries with parameters on timelines' e…
456476b 
…vents (#151317) (#151610)

# Backport

This will backport the following commits from `main` to `8.7`:
- [[Defend Workflows] Live queries with parameters on timelines' events
(#151317)](#151317)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Konrad
Szwarc","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-02-20T11:22:28Z","message":"[Defend
Workflows] Live queries with parameters on timelines' events
(#151317)\n\nCloses
https://github.com/elastic/security-team/issues/5999\r\n\r\n\r\n![test](https://user-images.githubusercontent.com/29123534/219058689-f2c423b8-b239-4ec0-b946-7b2e350749e3.gif)\r\n\r\n**BUG***\r\n\"Take
action\" > \"Run osquery\" on timeline event that is not an
alert\r\nwon't substitute params.\r\n**CAUSE**\r\nLack of context
connection in the component that carries
`alertData`","sha":"9109fd5afed8197b328a8b21d1c8e241873c4b68","branchLabelMapping":{"^v8.8.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","Team:Defend
Workflows","v8.7.0","v8.8.0"],"number":151317,"url":"https://github.com/elastic/kibana/pull/151317","mergeCommit":{"message":"[Defend
Workflows] Live queries with parameters on timelines' events
(#151317)\n\nCloses
https://github.com/elastic/security-team/issues/5999\r\n\r\n\r\n![test](https://user-images.githubusercontent.com/29123534/219058689-f2c423b8-b239-4ec0-b946-7b2e350749e3.gif)\r\n\r\n**BUG***\r\n\"Take
action\" > \"Run osquery\" on timeline event that is not an
alert\r\nwon't substitute params.\r\n**CAUSE**\r\nLack of context
connection in the component that carries
`alertData`","sha":"9109fd5afed8197b328a8b21d1c8e241873c4b68"}},"sourceBranch":"main","suggestedTargetBranches":["8.7"],"targetPullRequestStates":[{"branch":"8.7","label":"v8.7.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.8.0","labelRegex":"^v8.8.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/151317","number":151317,"mergeCommit":{"message":"[Defend
Workflows] Live queries with parameters on timelines' events
(#151317)\n\nCloses
https://github.com/elastic/security-team/issues/5999\r\n\r\n\r\n![test](https://user-images.githubusercontent.com/29123534/219058689-f2c423b8-b239-4ec0-b946-7b2e350749e3.gif)\r\n\r\n**BUG***\r\n\"Take
action\" > \"Run osquery\" on timeline event that is not an
alert\r\nwon't substitute params.\r\n**CAUSE**\r\nLack of context
connection in the component that carries
`alertData`","sha":"9109fd5afed8197b328a8b21d1c8e241873c4b68"}}]}]
BACKPORT-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tomsonpl tomsonpl tomsonpl approved these changes

@ashokaditya ashokaditya ashokaditya approved these changes

@patrykkopycinski patrykkopycinski Awaiting requested review from patrykkopycinski

Assignees

@szwarckonrad szwarckonrad

Labels
bug Fixes for quality problems that affect the customer experience release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.7.0 v8.8.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@szwarckonrad @elasticmachine @kibana-ci @kibanamachine @ashokaditya @tomsonpl @patrykkopycinski