Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution][Expandable flyout] - replace advanced settings with feature flag #184169

Merged
merged 3 commits into from
Jun 4, 2024

Conversation

PhilippeOberti
Copy link
Contributor

@PhilippeOberti PhilippeOberti commented May 23, 2024

Summary

The goal of this PR is to simplify the current expandable flyout advanced settings and feature flag setup. We currently have 1 advanced settings and 5 feature flags around the usage of the expandable flyout in Security Solution. The advanced settings and all the feature flags are true by default.

This PR consolidates the 5 feature flags and the advanced settings into a single feature flag. The new flag is called expandableFlyoutDisabled and is set to false by default. That way customers can turn the usage of the expandable flyout within Security Solution with one change in their kibana.yml file, should the need arise.

Here are the main changes:

  • remove the securitySolution:enableExpandableFlyout advanced settings, so that users cannot revert to the old flyout through the UI
  • combine the expandableEventFlyoutEnabled, expandableFlyoutInCreateRuleEnabled, expandableTimelineFlyoutEnabled, newUserDetailsFlyout and newHostDetailsFlyout feature flags. All these flags were true by default so we're not expecting customers to change these values.

TO DO

  • fix unit test
  • fix e2e tests

https://github.com/elastic/security-team/issues/9360

@PhilippeOberti PhilippeOberti force-pushed the expandable-flyout-ff branch 4 times, most recently from 0635f52 to 83f1baa Compare May 29, 2024 22:48
@PhilippeOberti PhilippeOberti marked this pull request as ready for review May 30, 2024 04:28
@PhilippeOberti PhilippeOberti requested review from a team as code owners May 30, 2024 04:28
@PhilippeOberti PhilippeOberti force-pushed the expandable-flyout-ff branch from 83f1baa to 3dcb99e Compare May 30, 2024 04:29
@PhilippeOberti PhilippeOberti added release_note:skip Skip the PR/issue when compiling release notes Team:Threat Hunting:Investigations Security Solution Investigations Team v8.15.0 labels May 30, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

@PhilippeOberti
Copy link
Contributor Author

Files by Code Owner

elastic/appex-sharedux

  • packages/kbn-management/settings/setting_ids/index.ts

elastic/kibana-core

  • src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
  • src/plugins/kibana_usage_collection/server/collectors/management/types.ts
  • src/plugins/telemetry/schema/oss_plugins.json

elastic/kibana-localization

  • x-pack/plugins/translations/translations/fr-FR.json
  • x-pack/plugins/translations/translations/ja-JP.json
  • x-pack/plugins/translations/translations/zh-CN.json

elastic/kibana-management

  • packages/kbn-management/settings/setting_ids/index.ts
  • packages/serverless/settings/security_project/index.ts

elastic/kibana-telemetry

  • src/plugins/telemetry/schema/oss_plugins.json

elastic/security-defend-workflows

  • x-pack/plugins/security_solution/public/management/cypress/e2e/policy/policy_details.cy.ts
  • x-pack/plugins/security_solution/public/management/cypress/e2e/policy/policy_experimental_features_disabled.cy.ts
  • x-pack/plugins/security_solution/public/management/cypress/e2e/policy/policy_list.cy.ts
  • x-pack/plugins/security_solution/public/management/cypress/e2e/response_actions/isolate.cy.ts
  • x-pack/plugins/security_solution/public/management/cypress/e2e/response_actions/isolate_mocked_data.cy.ts
  • x-pack/plugins/security_solution/public/management/cypress/e2e/sentinelone/isolate.cy.ts
  • x-pack/plugins/security_solution/public/management/cypress/tasks/common.ts

elastic/security-detection-engine

  • x-pack/plugins/security_solution/public/detections/pages/alerts/alert_details_redirect.test.tsx
  • x-pack/plugins/security_solution/public/detections/pages/alerts/alert_details_redirect.tsx
  • x-pack/plugins/security_solution/public/detections/pages/alerts/utils.ts
  • x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/detection_alerts/enrichments/alert_threat_enrichments.cy.ts

elastic/security-engineering-productivity

  • x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/detection_alerts/enrichments/alert_threat_enrichments.cy.ts
  • x-pack/test/security_solution_cypress/cypress/e2e/entity_analytics/enrichments.cy.ts
  • x-pack/test/security_solution_cypress/cypress/e2e/explore/guided_onboarding/tour.cy.ts
  • x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/alerts_details.cy.ts
  • x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/investigate_in_timeline.cy.ts
  • x-pack/test/security_solution_cypress/cypress/screens/alerts_details.ts
  • x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_right_panel_table_tab.ts
  • x-pack/test/security_solution_cypress/cypress/tasks/alerts_details.ts
  • x-pack/test/security_solution_cypress/cypress/tasks/api_calls/kibana_advanced_settings.ts

elastic/security-entity-analytics

  • x-pack/test/security_solution_cypress/cypress/e2e/entity_analytics/enrichments.cy.ts

elastic/security-solution

  • packages/serverless/settings/security_project/index.ts
  • x-pack/plugins/security_solution/common/constants.ts
  • x-pack/plugins/security_solution/common/experimental_features.ts
  • x-pack/plugins/security_solution/public/cases/pages/index.tsx
  • x-pack/plugins/security_solution/public/common/components/control_columns/row_action/index.test.tsx
  • x-pack/plugins/security_solution/public/common/components/control_columns/row_action/index.tsx
  • x-pack/plugins/security_solution/public/common/hooks/flyout/use_init_flyout_url_param.ts
  • x-pack/plugins/security_solution/public/common/hooks/flyout/use_sync_flyout_url_param.ts
  • x-pack/plugins/security_solution/public/detections/pages/alerts/alert_details_redirect.test.tsx
  • x-pack/plugins/security_solution/public/detections/pages/alerts/alert_details_redirect.tsx
  • x-pack/plugins/security_solution/public/detections/pages/alerts/utils.ts
  • x-pack/plugins/security_solution/public/explore/users/containers/users/observed_details/index.tsx
  • x-pack/plugins/security_solution/public/flyout/document_details/right/hooks/use_flyout_is_expandable.ts
  • x-pack/plugins/security_solution/public/management/cypress/e2e/policy/policy_details.cy.ts
  • x-pack/plugins/security_solution/public/management/cypress/e2e/policy/policy_experimental_features_disabled.cy.ts
  • x-pack/plugins/security_solution/public/management/cypress/e2e/policy/policy_list.cy.ts
  • x-pack/plugins/security_solution/public/management/cypress/e2e/response_actions/isolate.cy.ts
  • x-pack/plugins/security_solution/public/management/cypress/e2e/response_actions/isolate_mocked_data.cy.ts
  • x-pack/plugins/security_solution/public/management/cypress/e2e/sentinelone/isolate.cy.ts
  • x-pack/plugins/security_solution/public/management/cypress/tasks/common.ts
  • x-pack/plugins/security_solution/public/timelines/components/open_timeline/note_previews/index.tsx
  • x-pack/plugins/security_solution/public/timelines/components/side_panel/hooks/use_detail_panel.test.tsx
  • x-pack/plugins/security_solution/public/timelines/components/side_panel/hooks/use_detail_panel.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/host_name.test.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/host_name.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/user_name.test.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/user_name.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/data_table/index.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/hooks/use_unified_timeline_expandable_flyout.test.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/hooks/use_unified_timeline_expandable_flyout.tsx
  • x-pack/plugins/security_solution/server/ui_settings.ts

elastic/security-threat-hunting-explore

  • x-pack/plugins/security_solution/public/cases/pages/index.tsx
  • x-pack/plugins/security_solution/public/explore/users/containers/users/observed_details/index.tsx
  • x-pack/test/security_solution_cypress/cypress/e2e/explore/guided_onboarding/tour.cy.ts

elastic/security-threat-hunting-investigations

  • x-pack/plugins/security_solution/public/flyout/document_details/right/hooks/use_flyout_is_expandable.ts
  • x-pack/plugins/security_solution/public/timelines/components/open_timeline/note_previews/index.tsx
  • x-pack/plugins/security_solution/public/timelines/components/side_panel/hooks/use_detail_panel.test.tsx
  • x-pack/plugins/security_solution/public/timelines/components/side_panel/hooks/use_detail_panel.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/host_name.test.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/host_name.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/user_name.test.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/user_name.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/data_table/index.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/hooks/use_unified_timeline_expandable_flyout.test.tsx
  • x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/hooks/use_unified_timeline_expandable_flyout.tsx
  • x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/alerts_details.cy.ts
  • x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/investigate_in_timeline.cy.ts
  • x-pack/test/security_solution_cypress/cypress/screens/expandable_flyout/alert_details_right_panel_table_tab.ts

@elastic elastic deleted a comment from kibana-ci May 30, 2024
Copy link
Contributor

@rylnd rylnd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Detection engine changes overall LGTM.

I had one question about a perceived loss in test coverage, but I'm approving on the assumption that it was a conscious decision. If not, it should be easy to add back the removed test.

@@ -71,39 +69,37 @@ describe('Threat Match Enrichment', { tags: ['@ess', '@serverless', '@skipInServ
});
});

it('Displays persisted enrichments on the JSON view', () => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The addition of the Table tab test is good, but could you explain why the JSON view coverage was removed from cypress?

Copy link
Contributor Author

@PhilippeOberti PhilippeOberti May 30, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hey @rylnd, I can explain for sure!

I tried for 2+ hours to fix the JSON test, but the issue is the new flyout uses the JsonCodeEditor from the unified_doc_viewer which is different from the old flyout that was using a simple EuiCodeBlock. The code block was allowing us to easily retrieve the content and test against it. The JsonCodeEditor does not allow to do that.
The only way I kinda found to get it to work was to Cypress scroll to the correct position and select the row, but this is extremely flaky and we should never do that.

My thought was, for this test we don't really care if the value is showing in the JSON tab. The purpose of this test is not to verify that the flyout JSON tab shows the correct value. We should trust that the JSON tab and its components are rendering the document correctly (and we already have tests for that on the expandable flyout section). What we care about if the fact that the document has the correct value. The easiest way I found to do this was by filtering the table and verifying that the expected value was there.

Is that a wrong assumption?

Copy link
Contributor

@christineweng christineweng left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Desk tested with the flag on and off and LGTM! Thanks for cleaning up all the cypress tests!

@@ -25,43 +24,34 @@ jest.mock('@kbn/expandable-flyout');
const onFlyoutCloseMock = jest.fn();

describe('useUnifiedTimelineExpandableFlyout', () => {
beforeEach(() => {
it('should have expandable flyout disabled when expandable flyout is disabled in Experimental Features', () => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit for readability, consider rephrasing it to "should disable expandable flyout when expandableFlyoutDisabled flag is true"

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

much better, fixed in 7f60145 thanks!

@@ -30,12 +29,12 @@ import { visit } from '../../../tasks/navigation';
import { startAlertsCasesTour } from '../../../tasks/api_calls/tour';
import { deleteAlertsAndRules } from '../../../tasks/api_calls/common';

describe('Guided onboarding tour', { tags: ['@ess'] }, () => {
// re-enable this when https://github.com/elastic/kibana/pull/181442 is merged
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#181442 is now merged! :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good point, reverted the change in 7f60145

ftrConfig: {
kbnServerArgs: [
`--xpack.securitySolution.enableExperimental=${JSON.stringify([
'expandableFlyoutDisabled',
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for backlog: we should have some cypress tests for flyout in timeline - an expandable flyout equivalent of this file

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, I was being lazy... I added some basic tests (here 7f60145) that we should probably improve a bit when we remove this entire old flyout codebase!

@PhilippeOberti PhilippeOberti force-pushed the expandable-flyout-ff branch from 3dcb99e to f4f61bc Compare May 30, 2024 21:53
@@ -201,7 +197,8 @@ describe('Isolate command', { tags: ['@ess', '@serverless', '@brokenInServerless
}
);

describe('from Cases', () => {
// TODO re-enable when https://github.com/elastic/security-team/issues/9625 is merged
describe.skip('from Cases', () => {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this test highlighted a bug with how the expandable flyout is set up to work in Cases. As the expandable flyout has been enabled since 8.10, this PR doesn't introduce any new issues, but just reveals the fact that the Cypress tests were behind, by still using the old flyout.

We'll take a look at the ticket to fix the issue shortly, and will re-enable the tests!

@@ -92,9 +92,6 @@ describe('Isolate command', { tags: ['@ess', '@serverless', '@brokenInServerless
describe.skip(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just fyi, created ticket for our team to re-enable this: https://github.com/elastic/security-team/issues/9626

Copy link
Contributor

@gergoabraham gergoabraham left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@elastic/security-defend-workflows related changes look good! thanks for cleaning up the tests! 👐

@@ -30,12 +29,12 @@ import { visit } from '../../../tasks/navigation';
import { startAlertsCasesTour } from '../../../tasks/api_calls/tour';
import { deleteAlertsAndRules } from '../../../tasks/api_calls/common';

describe('Guided onboarding tour', { tags: ['@ess'] }, () => {
// re-enable this when https://github.com/elastic/kibana/pull/181442 is merged
describe.skip('Guided onboarding tour', { tags: ['@ess'] }, () => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this test failing?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no, I had skipped it because my branch was opened at the time it was failing and you were working on the fix. It's unskipped in my local, and working!
I'm fixing a couple of other comments then will push a commit. No changes to this file anymore!

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@angorayc the change was reverted in this last commit 7f60145!

@PhilippeOberti PhilippeOberti force-pushed the expandable-flyout-ff branch from f4f61bc to 7f60145 Compare May 31, 2024 13:45
Copy link
Member

@machadoum machadoum left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

EA changes LGTM!

- unskip tour cypress test
- update investigate in timeline cypress test
- fix test title
@PhilippeOberti PhilippeOberti force-pushed the expandable-flyout-ff branch from 5276ab1 to 36ae0a0 Compare June 4, 2024 13:22
@kibana-ci
Copy link
Collaborator

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 15.3MB 15.3MB -716.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
securitySolution 84.0KB 83.8KB -207.0B
Unknown metric groups

API count

id before after diff
@kbn/management-settings-ids 139 138 -1

History

  • 💛 Build #213390 was flaky 5276ab1e480c990d2352e8c77a78a22fe68f58e2
  • 💔 Build #213307 failed 7f601451a5169cdb9b502089502369f426c12b5a
  • 💚 Build #213184 succeeded f4f61bc6e717816812fefa99e55aad31b3b838ae
  • 💔 Build #212990 failed 3dcb99e48b87ea6c44675541686df0053b686340

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@PhilippeOberti PhilippeOberti merged commit 506ff4c into elastic:main Jun 4, 2024
35 checks passed
@kibanamachine kibanamachine added the backport:skip This commit does not require backporting label Jun 4, 2024
@PhilippeOberti PhilippeOberti deleted the expandable-flyout-ff branch June 4, 2024 15:04
machadoum added a commit that referenced this pull request Jun 12, 2024
## Summary

MKI environment does not support feature flags.
The test needs the old flyout to work, but the new flyout is now
rendered by default.

PR Athat introduced the issue:
#184169

### Checklist


- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport:skip This commit does not require backporting release_note:enhancement Team:Threat Hunting:Investigations Security Solution Investigations Team v8.15.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.