Code

[SIEM] Create ML Rules#58053

Code

Merged

rylnd merged 66 commits intoelastic:masterelastic/kibana:masterfrom rylnd:ml_signals_spikerylnd/kibana:ml_signals_spikeCopy head branch name to clipboardMar 19, 2020

+1,297-273

Commits

Commits on Mar 14, 2020

• Remove unnecessary linter exceptions

  Show description for a61dd5e
  rylnd

  committed
  a61dd5e

• WIP: Simple form to test creation of ML rules

  Show description for 5843a9a
  rylnd

  committed
  5843a9a

• WIP: Adds POST to backend, and type/payload changes necessary to make that work

  rylnd

  committed
  34bf432

• Simplify logic with Math.min

  rylnd

  committed
  56a0766

• WIP: Failed spike of making an http call

  rylnd

  committed
  0b19ddc

• WIP: Hacking together an ML client

  Show description for 28ede95
  rylnd

  committed
  28ede95

• Threading through our new ML Rule params

  Show description for bec1a90
  rylnd

  committed
  bec1a90

• Retrieve our anomalies during rule execution

  Show description for d9639af
  rylnd

  committed
  d9639af

• WIP: Generate ECS-compatible ML Signals

  Show description for 190c7bb
  rylnd

  committed
  190c7bb

• Extract setting of rule failure to helper function

  Show description for 919dfef
  rylnd

  committed
  919dfef

• Remove unused import

  rylnd

  committed
  051f638

• Define a field for our Rule Type selection

  Show description for 7ae29bf
  rylnd

  committed
  7ae29bf

• Hide Query Fields when ML is selected

  Show description for 6b25593
  rylnd

  committed
  6b25593

• Add input field for anomaly threshold

  rylnd

  committed
  d5b03a2

• Display numberic values in the readonly view of a step

  Show description for 82093ce
  rylnd

  committed
  82093ce

• Add field for selecting an ML job

  Show description for bb8abc2
  rylnd

  committed
  bb8abc2

• Format our new ML Fields when sending them to the server

  Show description for 526e8a3
  rylnd

  committed
  526e8a3

• Put back code that respects a rule's schedule

  Show description for a5d05e0
  rylnd

  committed
  a5d05e0

• ML fields are optional in our creation step

  Show description for 75eaa12
  rylnd

  committed
  75eaa12

• Only send along type-specific Rule fields from form

  Show description for 68cbf21
  rylnd

  committed
  68cbf21

• Rename anomalies query

  Show description for 7a62dba
  rylnd

  committed
  7a62dba

• Remove spike page with simple form

  rylnd

  committed
  31ac415

• Remove unneeded ES option

  Show description for 26822eb
  rylnd

  committed
  26822eb

• Fix bulk create logic

  Show description for 7434bcb
  rylnd

  committed
  7434bcb

• Rename argument

  Show description for fb7c5f1
  rylnd

  committed
  fb7c5f1

• Create Rule form stores all values, but filters by type for use

  Show description for cec8075
  rylnd

  committed
  cec8075

• Fix editing of ML fields on Rule Create

  Show description for b80d5d0
  rylnd

  committed
  b80d5d0

Commits on Mar 15, 2020

• Clear form errors when switching between rule types

  Show description for 05d4dda
  rylnd

  committed
  05d4dda

• Validate the selection of an ML Job

  rylnd

  committed
  79d9cb4

• Fix type errors on frontend

  Show description for 5424746
  rylnd

  committed
  5424746

• Don't set defaults for query-specific rules

  Show description for a689d33
  rylnd

  committed
  a689d33

• Return ML Fields in Rule responses

  Show description for 9cb88c7
  rylnd

  committed
  9cb88c7

Commits on Mar 16, 2020

• Fix editing of ML rules by changing who controls the field values

  Show description for 85678cb
  rylnd

  committed
  85678cb

• Merge branch 'master' into ml_signals_spike

  Show description for 316a720
  rylnd

  committed
  316a720

Commits on Mar 17, 2020

• Fix type errors related to new ML fields

  Show description for 2cd97f1
  rylnd

  committed
  2cd97f1

• Fix failing route tests

  Show description for 23532ab
  rylnd

  committed
  23532ab

• Fix integration tests

  Show description for 41e5af1
  rylnd

  committed
  41e5af1

• Fix non-ML Rule creation

  Show description for 0a8caf0
  rylnd

  committed
  0a8caf0

• More informative logging during ML signal generation

  Show description for 9aca40c
  rylnd

  committed
  9aca40c

• Merge branch 'master' into ml_signals_spike

  Show description for 330cc0c
  rylnd

  committed
  330cc0c

• Prefer keyof for string union types

  rylnd

  committed
  92f9c57

• Tidy up our new form components

  Show description for addc6ac
  rylnd

  committed
  addc6ac

• Prefer destructuring to lodash's omit

  rylnd

  committed
  0ca3858

• Fix mock params for helper functions

  Show description for 190600c
  rylnd

  committed
  190600c

• Remove any type

  Show description for a683ef5
  rylnd

  committed
  a683ef5

• Fix mock types

  rylnd

  committed
  94c1774

• Update outdated tests

  Show description for 327a877
  rylnd

  committed
  327a877

• Add some tests around our helper function

  Show description for e85feb5
  rylnd

  committed
  e85feb5

• Remove uses of any in favor of actual types

  Show description for e80dd2c
  rylnd

  committed
  e80dd2c

• Annotate our anomalies with @timestamp field

  Show description for 5e85c7e
  rylnd

  committed
  5e85c7e

Commits on Mar 18, 2020

• ml_job_id -> machine_learning_job_id

  rylnd

  committed
  eed90df

• PR Feedback

  Show description for abfcfc1
  rylnd

  committed
  abfcfc1

• Cleaning up our new ML types

  Show description for f0a1f0f
  rylnd

  committed
  f0a1f0f

• Use implicit type to avoid the need for a ts-ignore

  Show description for e703568
  rylnd

  committed
  e703568

• New ML params are not nullable

  Show description for 8ff89b0
  rylnd

  committed
  8ff89b0

• Query and language are conditional based on rule type

  Show description for edf354e
  rylnd

  committed
  edf354e

• Remove defaulted parameter in API test

  Show description for a949ce5
  rylnd

  committed
  a949ce5

• Merge branch 'master' into ml_signals_spike

  rylnd

  committed
  1f1b9e9

• Use explicit types over implicit ones

  Show description for cf8d8c3
  rylnd

  committed
  cf8d8c3

• Add integration test for creation of ML Rule

  rylnd

  committed
  f692e01

• Add ML fields to route schemae

  Show description for 1aa4321
  rylnd

  committed
  1aa4321

• Fix router test for creating an ML rule

  Show description for 8ff01e9
  rylnd

  committed
  8ff01e9

• Remove null check against index for query rules

  Show description for 16b25d1
  rylnd

  committed
  16b25d1

• Add regression test for API compatibility

  Show description for b4fd572
  rylnd

  committed
  b4fd572

• Respect the index pattern determined at runtime when performing search_after

  Show description for 462d410
  rylnd

  committed
  462d410

• Fix type errors in our bulk create tests

  Show description for 9f9f324
  rylnd

  committed
  9f9f324