Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[SIEM][Detection Engine] REST API Additions #50514

Merged
merged 6 commits into from
Nov 14, 2019
Merged

[SIEM][Detection Engine] REST API Additions #50514

merged 6 commits into from
Nov 14, 2019

Conversation

FrankHassanabad
Copy link
Contributor

@FrankHassanabad FrankHassanabad commented Nov 13, 2019 •
edited
Loading

Summary

Added these to the create and update API:

  • tags - Array string type (default [])
  • False positives - Array string type (default [])
  • immutable - boolean (default -- false)

Added these instructions to the READM.md

  • Added "brew install jq" for all the scripts to work in the scripts folder in README.md
  • Added tip for debug logging

Changed these shell scripts:

  • Removed the delete all api keys from the hard_reset script
  • Changed the script for converting to rules to use the new immutable flag.

Testing

  • Added unit tests for new schema types
  • Added ad-hoc test for scripts
  • Test ran through the saved searches

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

- [ ] This was checked for cross-browser compatibility, including a check against IE11

- [ ] Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support

- [ ] Documentation was added for features that require explanation or tutorials

- [ ] This was checked for keyboard-only and screenreader accessibility

For maintainers

- [ ] This was checked for breaking API changes and was labeled appropriately

- [ ] This includes a feature addition or change that requires a release note and was labeled appropriately

@FrankHassanabad
* Added jq install instructions to README.md
cf35573 
* Added "brew install jq" for all the scripts to work in the scripts folder in README.md
* Removed the delete all api keys from the hard_reset script
@FrankHassanabad
Added types and tests for the schema and the new types
b4c43a2
@FrankHassanabad FrankHassanabad self-assigned this Nov 13, 2019
@elasticmachine
Copy link
Contributor

Pinging @elastic/siem (Team:SIEM)

@elasticmachine
Copy link
Contributor

💔 Build Failed

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

spong
spong reviewed Nov 13, 2019
View reviewed changes
x-pack/legacy/plugins/siem/server/lib/detection_engine/README.md
Comment on lines +143 to +150
logging.verbose: true
logging.events:
{
log: ['siem', 'info', 'warning', 'error', 'fatal'],
request: ['info', 'warning', 'error', 'fatal'],
error: '*',
ops: __no-ops__,
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for adding this -- has been very helpful in development! 🙂

spong
spong approved these changes Nov 13, 2019
View reviewed changes
Copy link
Member

@spong spong left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One comment about types, but if no change necessary LGTM! 👍

Thanks for these quick and timely additions @FrankHassanabad -- will start making using of these new fields as soon as it gets merged! 😁

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

@FrankHassanabad FrankHassanabad merged commit 6f7ca4a into elastic:master Nov 14, 2019
@FrankHassanabad FrankHassanabad deleted the api-updates branch November 14, 2019 00:13
@FrankHassanabad FrankHassanabad mentioned this pull request Nov 14, 2019
Merged
FrankHassanabad added a commit to FrankHassanabad/kibana that referenced this pull request Nov 14, 2019
@FrankHassanabad
[SIEM][Detection Engine] REST API Additions (elastic#50514)
86c2cf8 
## Summary

Added these to the create and update API:
* tags - Array string type (default [])
* False positives - Array string type (default [])
* immutable - boolean (default -- false)

Added these instructions to the READM.md
* Added "brew install jq" for all the scripts to work in the scripts folder in README.md
* Added tip for debug logging

Changed these shell scripts: 
* Removed the delete all api keys from the hard_reset script
* Changed the script for converting to rules to use the new immutable flag.

Testing
* Added unit tests for new schema types
* Added ad-hoc test for scripts
* Test ran through the saved searches 

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

~~- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~~

~~- [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~~

~~- [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~~

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios

~~- [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~~

### For maintainers

~~- [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~

~~- [ ] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~
FrankHassanabad added a commit that referenced this pull request Nov 14, 2019
@FrankHassanabad
[SIEM][Detection Engine] REST API Additions (#50514) (#50584)
f115dfa 
## Summary

Added these to the create and update API:
* tags - Array string type (default [])
* False positives - Array string type (default [])
* immutable - boolean (default -- false)

Added these instructions to the READM.md
* Added "brew install jq" for all the scripts to work in the scripts folder in README.md
* Added tip for debug logging

Changed these shell scripts: 
* Removed the delete all api keys from the hard_reset script
* Changed the script for converting to rules to use the new immutable flag.

Testing
* Added unit tests for new schema types
* Added ad-hoc test for scripts
* Test ran through the saved searches 

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

~~- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~~

~~- [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~~

~~- [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~~

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios

~~- [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~~

### For maintainers

~~- [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~

~~- [ ] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~
jloleysens added a commit to jloleysens/kibana that referenced this pull request Nov 14, 2019
@jloleysens
Merge branch 'master' of github.com:elastic/kibana into np-migration/ua
6982fac 
* 'master' of github.com:elastic/kibana: (27 commits)
  [Rollup] Fix for clone job workflow (elastic#50501)
  Empty message "No data available" for Labels and User metadata sections missing (elastic#49846)
  [APM] Duration by Country map doesn't take `transactionName` into account (elastic#50315)
  Remove react references from core `Notifications` apis (elastic#49573)
  Updated APM Indices endpoints to use the SavedObjectsClient from the legacy request context, and set the apm-indices schema object to be namspace-agnostic
  [Metrics UI] Calculate interval based on the dataset's period (elastic#50194)
  chore(NA): add new platform discovered plugins as entry points to check for dependencies on clean dll tasks (elastic#50610)
  [Telemetry] change of optin status telemetry (elastic#50158)
  [SIEM][Detection Engine] REST API Additions (elastic#50514)
  [DOCS] Removes dashboard-only mode doc (elastic#50441)
  [Filters] Fix operator overflowing out popover (elastic#50030)
  Change telemetry optIn to default to true (elastic#50490)
  [Maps] make grid rectangles the default symbolization for geo grid source (elastic#50169)
  Allow registered applications to hide Kibana chrome (elastic#49795)
  Upgrade EUI to v14.9.0 (elastic#49678)
  [Metrics UI] Convert layouts to use React components (elastic#49134)
  [Search service] Add support for ES request preference (elastic#49424)
  [Newsfeed/Lint] fix chained fn lint (elastic#50515)
  [Monitoring] Fix logstash pipelines page in multi-cluster environment (elastic#50166)
  [SIEM] Events viewer fixes (elastic#50175)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@spong spong spong approved these changes

Assignees

@FrankHassanabad FrankHassanabad

Labels
release_note:enhancement Team:SIEM v7.6.0 v8.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@FrankHassanabad @elasticmachine @spong