[SIEM] template timeline UI #64439

angorayc · 2020-04-24T15:44:39Z

Summary

https://www.figma.com/proto/98ayxwvfEtP9q0GcsQqwe7/Timeline?node-id=14%3A935&scaling=min-zoom

Implementation details:

Add tabs for timeline / template timeline
Add filters for timeline / template timeline modal
Add url path for timeline / template timeline
- http://localhost:5601/app/siem#/timelines/default
- http://localhost:5601/app/siem#/timelines/template
Add bread crumbs for timeline / template timeline
Add timelineTypes filter to getAllTimeline's graphQL endpoint
~~Add getAllTimeline's new endpoint~~
~~Replace getAllTimeline's graphQL with new endpoint~~
Unit test

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
~~Documentation was added for features that require explanation or tutorials~~
Unit or functional tests were updated or added to match the most common scenarios
~~This was checked for keyboard-only and screenreader accessibility~~
~~This renders correctly on smaller devices using a responsive layout. (You can test this in your browser~~
~~This was checked for cross-browser compatibility, including a check against IE11~~

For maintainers

This was checked for breaking API changes and was labeled appropriately

angorayc · 2020-05-04T12:15:30Z

Hello @marrasherrier, I have a question for you regarding to tabs for timelines table https://www.figma.com/proto/98ayxwvfEtP9q0GcsQqwe7/Timeline?node-id=14%3A935&scaling=min-zoom
It’s that we have some existing links point to this page like http://localhost:5601/app/siem#/timelines?timeline=(id:'975db7a0-8d6b-11ea-843e-5ff24162d973',isOpen:!t)
but from the url we couldn’t tell whether we should land it on timeline or template timeline’s tab.

Therefore I’m thinking of using filter EuiFilterGroup, so by default it still show all the timelines we have
What do you think?

marrasherrier · 2020-05-04T13:25:14Z

hi @angorayc, I agree, a filter group like the one used in cases is probably a better choice here. I will update the figma mocks

angorayc · 2020-05-04T15:40:41Z

@marrasherrier , after conforming with @XavierM , all the cases we have now are all fine to land at default tab, so we are fine to keep the current design.

elasticmachine · 2020-05-04T17:09:31Z

Pinging @elastic/siem (Team:SIEM)

angorayc · 2020-05-04T17:10:21Z

@elasticmachine merge upstream

patrykkopycinski · 2020-05-05T09:09:07Z

@elasticmachine merge upstream

…ate-timeline-ui

x-pack/plugins/siem/public/components/link_to/link_to.tsx

x-pack/plugins/siem/public/components/open_timeline/index.test.tsx

x-pack/plugins/siem/server/lib/timeline/saved_object.ts

…o template-timeline-ui

angorayc · 2020-05-05T17:54:36Z

x-pack/plugins/siem/public/components/open_timeline/open_timeline.tsx

@@ -98,9 +97,9 @@ export const OpenTimeline = React.memo<OpenTimelineProps>(

    const onRefreshBtnClick = useCallback(() => {
      if (refetch != null) {
-        refetch();
+        refetch(searchResults, totalSearchResultsCount);


This is to fix the flashing timelines' table while refetching data, not a good fix, so I'm opening an issue to follow it up
https://github.com/elastic/siem-team/issues/647

angorayc · 2020-05-05T18:19:06Z

x-pack/plugins/siem/server/lib/timeline/routes/import_timelines_route.ts

                      pinnedEventIds,
                      globalNotes,
                      eventNotes,
                      templateTimelineId,
                      templateTimelineVersion,
                      timelineType,
+                      version = null,
                    } = parsedTimeline;
                    const parsedTimelineObject = omit(
                      timelineSavedObjectOmittedFields,


Omitting the fields that timeline savedObject doesn't take to avoid failure while creating / updating savedObject.

We'll manage globalNotes for template timeline down below on Line 159-161

XavierM · 2020-05-05T21:05:20Z

We have an issue when we tried to update a template timeline with a global note.

that's the json

{"savedObjectId":null,"version":"WzM5LDFd","timelineType":"template","templateTimelineId":"49188240-6530-11ea-90dd-7d87cXavier","templateTimelineVersion":4,"columns":[{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"@timestamp","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"message","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"event.category","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"event.action","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"host.name","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"source.ip","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"destination.ip","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"user.name","searchable":null}],"dataProviders":[],"description":"is Super","eventType":"all","filters":[],"kqlMode":"filter","kqlQuery":{"filterQuery":{"serializedQuery":"{\"bool\":{\"should\":[{\"exists\":{\"field\":\"host.name\"}}],\"minimum_should_match\":1}}","kuery":{"expression":"host.name: *","kind":"kuery"}}},"title":"My template timeline updated","dateRange":{"start":1584020448645,"end":1584106848645},"savedQueryId":null,"sort":{"columnId":"@timestamp","sortDirection":"desc"},"favorite":[{"favoriteDate":1584480703444,"keySearch":"WGF2aWVyTQ==","fullName":"xavier mouligneau","userName":"XavierM"}],"created":1588693289719,"createdBy":"XavierM","updated":1588693315060,"updatedBy":"XavierM","eventNotes":[{"noteId":"e3cf0900-8ee6-11ea-bff9-5be90e832634","version":"WzM0LDFd","eventId":"Cfwg1HABO74GafNORxyF","note":"pinned and event note","timelineId":"e37d8da0-8ee6-11ea-bff9-5be90e832634","created":1588693290295,"createdBy":"XavierM","updated":1588693290295,"updatedBy":"XavierM"},{"noteId":"e3cfcc50-8ee6-11ea-bff9-5be90e832634","version":"WzM1LDFd","eventId":"Cvwg1HABO74GafNORxyF","note":"event note 1","timelineId":"e37d8da0-8ee6-11ea-bff9-5be90e832634","created":1588693290295,"createdBy":"XavierM","updated":1588693290295,"updatedBy":"XavierM"}],"globalNotes":[{"noteId":"e3cebae0-8ee6-11ea-bff9-5be90e832634","version":"WzI2LDFd","note":"Global","timelineId":"e37d8da0-8ee6-11ea-bff9-5be90e832634","created":1588693290295,"createdBy":"XavierM","updated":1588693290295,"updatedBy":"XavierM"},{"noteId":"e3cf3010-8ee6-11ea-bff9-5be90e832634","version":"WzM2LDFd","note":"Note","timelineId":"e37d8da0-8ee6-11ea-bff9-5be90e832634","created":1588693290295,"createdBy":"XavierM","updated":1588693290295,"updatedBy":"XavierM"}],"pinnedEventIds":["Yfwg1HABO74GafNObyFv","Cfwg1HABO74GafNORxyF","Cvwg1HABO74GafNORxyF"]}

XavierM

The code looks good to me, but I found some bugs about the importing timeline template and I think we do not cover all the use cases in this PR.

I think that we can move forward since we won't have the full story yet. But we will need a follow-up PR to get all the corner cases resolved.

I can see this implementation has been done thoughtfully, I did appreciate to read this PR and the code in it. Please merge when you got a green light.

angorayc · 2020-05-05T22:10:04Z

@elasticmachine merge upstream

kibanamachine · 2020-05-06T00:05:03Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 8ef2860

History

💔 Build #45666 failed c42f1d7
💔 Build #45640 failed 0090d22
💔 Build #45646 failed 929ad24
💔 Build #45628 failed daf6441
💔 Build #45603 failed 1dd31e8

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* init template timeline's tab * add template filter * add routes for timelines tabs * add tabs hook * add filter type * fix unit test * add breadcrumbs * fix types error * fix flashing table * fix types * fix flashing table * fix filter * add comments for filters * review X * review x * fix create note for template timeline * rename timelineTypes to timelineType * update unit test * fix types * update filter for timeline savedObject * fix lint error Co-authored-by: Elastic Machine <[email protected]> Co-authored-by: Patryk Kopycinski <[email protected]> Co-authored-by: Xavier Mouligneau <[email protected]>

* init template timeline's tab * add template filter * add routes for timelines tabs * add tabs hook * add filter type * fix unit test * add breadcrumbs * fix types error * fix flashing table * fix types * fix flashing table * fix filter * add comments for filters * review X * review x * fix create note for template timeline * rename timelineTypes to timelineType * update unit test * fix types * update filter for timeline savedObject * fix lint error Co-authored-by: Elastic Machine <[email protected]> Co-authored-by: Patryk Kopycinski <[email protected]> Co-authored-by: Xavier Mouligneau <[email protected]> Co-authored-by: Elastic Machine <[email protected]> Co-authored-by: Patryk Kopycinski <[email protected]> Co-authored-by: Xavier Mouligneau <[email protected]>

* master: (72 commits) add tsvb tests to Firefox suite (elastic#65425) Fix flaky ServerMetricsCollector integration test (elastic#65420) [APM] Custom links section inside the Actions menu is showing outside of the menu (elastic#65428) [ML] Adds docs_per_second to transform edit form. (elastic#65365) update apm index pattern (elastic#65424) add direct build command (elastic#65431) [ML] Adding daily_model_snapshot_retention_after_days to types and schemas (elastic#65417) [chore] Improve request cancelation handling in vis embeddable (elastic#65057) [Alerting] migrates acceptance and functional test fixtures to KP (elastic#64888) [ML] Fixes reordering in view by selection when overall cell selected (elastic#65290) Additional branding updates (elastic#64712) Remove redundant formatting of percentage column (elastic#64948) [SIEM][CASE] Configuration pages UI redesign (elastic#65355) New nav (elastic#64018) [Ingest pipelines] Address copy feedback (elastic#65175) bug fixing (elastic#65387) skip whole suite blocking snapshots (elastic#65377) add related event generation to ancestor nodes (fixes a bug) (elastic#64950) [Canvas] move files from legacy/plugins to plugins (elastic#65283) [SIEM] template timeline UI (elastic#64439) ...

elasticmachine · 2021-09-23T14:35:21Z

Pinging @elastic/security-solution (Team: SecuritySolution)

angorayc added 15 commits April 14, 2020 16:08

init template timeline's tab

21c18f0

Merge remote-tracking branch 'upstream/master' into template-timeline-ui

898ebd5

Merge remote-tracking branch 'upstream/master' into template-timeline-ui

63846b8

add template filter

9612b5c

add routes for timelines tabs

dfef1e6

add tabs hook

159244d

Merge remote-tracking branch 'upstream/master' into template-timeline-ui

2adf4e0

Merge remote-tracking branch 'upstream/master' into template-timeline-ui

bc763e2

add filter type

c7b9c84

fix unit test

2365287

add breadcrumbs

6a1495e

fix types error

6afc706

fix flashing table

2865708

fix types

0f6b679

fix flashing table

88dbd74

angorayc marked this pull request as ready for review May 4, 2020 16:12

angorayc requested review from a team as code owners May 4, 2020 16:12

angorayc added Team:SIEM v7.8.0 v8.0.0 labels May 4, 2020

Merge branch 'master' into template-timeline-ui

73a4b59

angorayc added the release_note:enhancement label May 4, 2020

Merge branch 'master' into template-timeline-ui

fd4ad0d

angorayc added 2 commits May 5, 2020 13:51

Merge remote-tracking branch 'upstream/master' into template-timeline-ui

99250b2

Merge remote-tracking branch 'origin/template-timeline-ui' into templ…

5bd15e8

…ate-timeline-ui

XavierM reviewed May 5, 2020

View reviewed changes

x-pack/plugins/siem/public/components/link_to/link_to.tsx Show resolved Hide resolved

XavierM reviewed May 5, 2020

View reviewed changes

x-pack/plugins/siem/public/components/open_timeline/index.test.tsx Show resolved Hide resolved

XavierM reviewed May 5, 2020

View reviewed changes

x-pack/plugins/siem/server/lib/timeline/saved_object.ts Outdated Show resolved Hide resolved

XavierM added 2 commits May 5, 2020 11:22

review X

7a6f237

review x

467bdde

XavierM force-pushed the template-timeline-ui branch from 7a6f237 to 467bdde Compare May 5, 2020 16:15

angorayc added 4 commits May 5, 2020 17:51

fix create note for template timeline

faed495

rename timelineTypes to timelineType

1b506c7

Merge branch 'template-timeline-ui' of github.com:angorayc/kibana int…

1dd31e8

…o template-timeline-ui

update unit test

daf6441

angorayc commented May 5, 2020

View reviewed changes

angorayc added 2 commits May 5, 2020 19:05

fix types

0090d22

update filter for timeline savedObject

929ad24

angorayc commented May 5, 2020

View reviewed changes

fix lint error

c42f1d7

XavierM approved these changes May 5, 2020

View reviewed changes

Merge branch 'master' into template-timeline-ui

8ef2860

XavierM merged commit a5fe3ce into elastic:master May 6, 2020

angorayc mentioned this pull request May 6, 2020

[7.x] [SIEM] template timeline UI (#64439) #65402

Merged

angorayc mentioned this pull request May 6, 2020

[SIEM] Import timeline fix #65448

Merged

7 tasks

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SIEM] template timeline UI #64439

[SIEM] template timeline UI #64439

angorayc commented Apr 24, 2020 •

edited

Loading

angorayc commented May 4, 2020 •

edited

Loading

marrasherrier commented May 4, 2020

angorayc commented May 4, 2020

elasticmachine commented May 4, 2020

angorayc commented May 4, 2020

patrykkopycinski commented May 5, 2020

angorayc May 5, 2020 •

edited

Loading

angorayc May 5, 2020

angorayc May 5, 2020

XavierM commented May 5, 2020

XavierM left a comment

angorayc commented May 5, 2020

kibanamachine commented May 6, 2020

elasticmachine commented Sep 23, 2021

[SIEM] template timeline UI #64439

[SIEM] template timeline UI #64439

Conversation

angorayc commented Apr 24, 2020 • edited Loading

Summary

Checklist

For maintainers

angorayc commented May 4, 2020 • edited Loading

marrasherrier commented May 4, 2020

angorayc commented May 4, 2020

elasticmachine commented May 4, 2020

angorayc commented May 4, 2020

patrykkopycinski commented May 5, 2020

angorayc May 5, 2020 • edited Loading

Choose a reason for hiding this comment

angorayc May 5, 2020

Choose a reason for hiding this comment

angorayc May 5, 2020

Choose a reason for hiding this comment

XavierM commented May 5, 2020

XavierM left a comment

Choose a reason for hiding this comment

angorayc commented May 5, 2020

kibanamachine commented May 6, 2020

💚 Build Succeeded

History

elasticmachine commented Sep 23, 2021

angorayc commented Apr 24, 2020 •

edited

Loading

angorayc commented May 4, 2020 •

edited

Loading

angorayc May 5, 2020 •

edited

Loading