[Security Solution][Detections] - Add skeleton exceptions list tab to all rules page #85465

yctercero · 2020-12-09T19:18:26Z

Summary

This PR is the first of 2 to complete the addition of a table displaying all exception lists on the all rules page. This PR focuses on the following:

all exception lists displayed
'number of rules assigned to' displayed
names and links of rules assigned to displayed
refresh action button working
no trusted apps list show
search by name, created_by, list_id
- just searching a word will search by list name
- to search by created_by type created_by:ytercero
- to search by list_id type list_id:some-list-id

TO DO (follow up PR)

add tests
wire up export of exception list
wire up deletion of exception list

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
This was checked for cross-browser compatibility

For maintainers

This was checked for breaking API changes and was labeled appropriately

…referential_int

...on/public/detections/pages/detection_engine/rules/all/exceptions/use_all_exception_lists.tsx

…referential_int

elasticmachine · 2020-12-15T07:52:10Z

Pinging @elastic/siem (Team:SIEM)

..._solution/public/detections/pages/detection_engine/rules/all/exceptions/exceptions_table.tsx

x-pack/plugins/lists/common/utils.ts

..._solution/public/detections/pages/detection_engine/rules/all/exceptions/exceptions_table.tsx

peluja1012 · 2020-12-15T16:54:24Z

..._solution/public/detections/pages/detection_engine/rules/all/exceptions/exceptions_table.tsx

+            const [qualifier, value] = term.split(':');
+
+            if (qualifier == null) {
+              filter.name = search;


I don't think this is working as intended. Typing in a string into the search bar doesn't execute a search. It works for list_id: <id> but not for name searches.

Addressed in #86135

peluja1012 · 2020-12-15T17:02:51Z

..._solution/public/detections/pages/detection_engine/rules/all/exceptions/exceptions_table.tsx

+      );
+    }, []);
+
+    const handleSearch = useCallback((search: string) => {


I think we should only execute the search on enter. I'm seeing this behavior where it will make an API call to re-fetch the entire list when the user deletes the search string up until a colon (:).

Addressing in #86135

peluja1012 · 2020-12-15T20:02:59Z

...urity_solution/public/detections/pages/detection_engine/rules/all/exceptions/translations.ts

+);
+
+export const LIST_DATE_UPDATED_TITLE = i18n.translate(
+  'xpack.securitySolution.detectionEngine.rules.all.exceptions.dateUPdatedTitle',


small camelcase issue with dateUpdatedTitle

Addressed in #86135

.../security_solution/public/detections/pages/detection_engine/rules/all/exceptions/columns.tsx

peluja1012

Works pretty well. It helped me find a bunch of orphaned exception lists I had on my server already! Thanks for the quick turnaround on this one, Yara. Left a few comments on there but they can be addressed in the follow up PR.

madirey · 2020-12-16T00:21:14Z

Pulled and ran through some sanity checks. Looks good!

…out increase

mistic

Changes on files under operations team code owners LGTM

@jmikell821

…when deleting value lists (#85925) ## Summary Resolves #77324, #77325, resolves #77325, and resolves #81302 This PR addresses referential integrity issues when deleting value lists. Previously when deleting value lists, any references in Exception Lists/Items would be left behind. This PR introduces a new confirmation modal when deleting value lists that are referenced in either space aware (`simple`) or space `agnostic` exception lists. Also includes: * Fixed Lists plugin `quick_start.sh` as it was using endpoint exception list + value lists (unsupported) * Adds `quick_start_value_list_references.sh` to create exception lists/items, value lists, and references to easily test * Add support to `findExceptionList` for searching for both `simple` and `agnostic` list types * Two new query params have been added to the `deleteListRoute` * `ignoreReferences` (default:false) when true, maintains pre-7.11 behavior of deleting value list without performing any additional checks. * NOTE: As written, this becomes an API breaking change as existing existing calls to the same API will `409` conflict if references exist. cc @jmikell821 @Donnater * `deleteReferences` (default:false) to perform dry run and identify referenced exception lists/items ## Testing To test, run `quick_start_value_list_references.sh` and it will create all the necessary resources/references to easily exercise the above functionality. The below diagram details the resources created and how the references are wired up. > Creates three different exception lists and value lists, and associates as > below to test referential integrity functionality. > > NOTE: Endpoint lists don't support value lists, and are not tested here > > EL: Exception list > ELI Exception list Item > VL: Value list > > EL1 EL2 (Agnostic) EL3 > | | | > ELI1 ELI2 ELI3 > |\ /| | > | \ / | | > | \ / | | > | \ / | | > | \/ | | > | /\ | | > | / \ | | > | / \ | | > | / \ | | > |/ \| | > VL1 VL2 VL3 VL4 > ips.txt ip_range.txt text.txt hosts.txt > Corner cases to be aware of: * An exception item may have multiple value list entries -- only referenced value list entries should be removed * There is no API for removing individual entries. If all entries are references the entire item is deleted. If only some entries are references, the item is updated via a `PUT` (no `PATCH` support for exception items) * It's not possible via the UI to create a space agnostic list that has value list exception items (only agnostic endpoint exception lists can be created and they do not support value lists). Please use above script to exercise this behavior. Additional notes: * Once the Exception List table is introduced (#85465), we can add an enhancement for deeplinking to exception lists from the reference error modal. * The `deleteListRoute` response has been updated to include the responses from the reference checks to provide maximum flexibility * There is no bulk API for deleting exception list items, and so they are iterated over via the `deleteExceptionListItem` API. ##### Reference error modal <img width="500" src="https://user-images.githubusercontent.com/2946766/102199153-813e1e80-3e80-11eb-8a9b-af116ca13df9.gif" /> ##### Overflow example <img width="500" src="https://user-images.githubusercontent.com/2946766/102199032-5784f780-3e80-11eb-81c7-17283d002ce4.gif" /> ### Checklist Delete any items that are not applicable to this PR. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md) - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] Any UI touched in this PR is usable by keyboard only (learn more about [keyboard accessibility](https://webaim.org/techniques/keyboard/)) ### For maintainers - [X] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

…referential_int

@jmikell821

…when deleting value lists (#85925) (#86075) ## Summary Resolves #77324, #77325, resolves #77325, and resolves #81302 This PR addresses referential integrity issues when deleting value lists. Previously when deleting value lists, any references in Exception Lists/Items would be left behind. This PR introduces a new confirmation modal when deleting value lists that are referenced in either space aware (`simple`) or space `agnostic` exception lists. Also includes: * Fixed Lists plugin `quick_start.sh` as it was using endpoint exception list + value lists (unsupported) * Adds `quick_start_value_list_references.sh` to create exception lists/items, value lists, and references to easily test * Add support to `findExceptionList` for searching for both `simple` and `agnostic` list types * Two new query params have been added to the `deleteListRoute` * `ignoreReferences` (default:false) when true, maintains pre-7.11 behavior of deleting value list without performing any additional checks. * NOTE: As written, this becomes an API breaking change as existing existing calls to the same API will `409` conflict if references exist. cc @jmikell821 @Donnater * `deleteReferences` (default:false) to perform dry run and identify referenced exception lists/items ## Testing To test, run `quick_start_value_list_references.sh` and it will create all the necessary resources/references to easily exercise the above functionality. The below diagram details the resources created and how the references are wired up. > Creates three different exception lists and value lists, and associates as > below to test referential integrity functionality. > > NOTE: Endpoint lists don't support value lists, and are not tested here > > EL: Exception list > ELI Exception list Item > VL: Value list > > EL1 EL2 (Agnostic) EL3 > | | | > ELI1 ELI2 ELI3 > |\ /| | > | \ / | | > | \ / | | > | \ / | | > | \/ | | > | /\ | | > | / \ | | > | / \ | | > | / \ | | > |/ \| | > VL1 VL2 VL3 VL4 > ips.txt ip_range.txt text.txt hosts.txt > Corner cases to be aware of: * An exception item may have multiple value list entries -- only referenced value list entries should be removed * There is no API for removing individual entries. If all entries are references the entire item is deleted. If only some entries are references, the item is updated via a `PUT` (no `PATCH` support for exception items) * It's not possible via the UI to create a space agnostic list that has value list exception items (only agnostic endpoint exception lists can be created and they do not support value lists). Please use above script to exercise this behavior. Additional notes: * Once the Exception List table is introduced (#85465), we can add an enhancement for deeplinking to exception lists from the reference error modal. * The `deleteListRoute` response has been updated to include the responses from the reference checks to provide maximum flexibility * There is no bulk API for deleting exception list items, and so they are iterated over via the `deleteExceptionListItem` API. ##### Reference error modal <img width="500" src="https://user-images.githubusercontent.com/2946766/102199153-813e1e80-3e80-11eb-8a9b-af116ca13df9.gif" /> ##### Overflow example <img width="500" src="https://user-images.githubusercontent.com/2946766/102199032-5784f780-3e80-11eb-81c7-17283d002ce4.gif" /> ### Checklist Delete any items that are not applicable to this PR. - [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md) - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [X] Any UI touched in this PR is usable by keyboard only (learn more about [keyboard accessibility](https://webaim.org/techniques/keyboard/)) ### For maintainers - [X] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

kibanamachine · 2020-12-16T05:44:24Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 7ba47e8

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`lists`	127	129	+2
`securitySolution`	2151	2156	+5
total			+7

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	8.3MB	8.4MB	+22.7KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`lists`	174.6KB	183.7KB	+9.1KB

History

💚 Build #94790 succeeded 8059320
💔 Build #94760 failed f957f55
💔 Build #94478 failed bd7e210
💔 Build #94448 failed a4c906a
💔 Build #94360 failed 3c0715b

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

… all rules page (#85465) (#86079) ## Summary This PR is the first of 2 to complete the addition of a table displaying all exception lists on the all rules page. This PR focuses on the following: - all exception lists displayed - 'number of rules assigned to' displayed - names and links of rules assigned to displayed - refresh action button working - no trusted apps list show - search by `name`, `created_by`, `list_id` - just searching a word will search by list name - to search by `created_by` type `created_by:ytercero` - to search by `list_id` type `list_id:some-list-id` #### TO DO (follow up PR) - [ ] add tests - [ ] wire up export of exception list - [ ] wire up deletion of exception list <img width="1121" alt="Screen Shot 2020-12-09 at 2 10 59 PM" src="https://user-images.githubusercontent.com/10927944/101676548-50498e00-3a29-11eb-90cb-5f56fc8c0a1b.png"> ### Checklist - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] Any UI touched in this PR is usable by keyboard only (learn more about [keyboard accessibility](https://webaim.org/techniques/keyboard/)) - [ ] Any UI touched in this PR does not create any new axe failures (run axe in browser: [FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/), [Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US)) - [ ] This renders correctly on smaller devices using a responsive layout. (You can test this [in your browser](https://www.browserstack.com/guide/responsive-testing-on-local-server)) - [ ] This was checked for [cross-browser compatibility](https://www.elastic.co/support/matrix#matrix_browsers) ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) Co-authored-by: Yara Tercero <[email protected]>

yctercero added 6 commits December 9, 2020 10:10

wip - mvp working

90da2cf

Merge branch 'master' of github.com:yctercero/kibana into exceptions_…

a45f6f5

…referential_int

cleaned up, need to do a few more fixes

872f6b2

cleaned up, need to do a few more fixes

ce21b4e

Merge branch 'master' of github.com:yctercero/kibana into exceptions_…

146c006

…referential_int

needs some cleanup

3a6a196

yctercero self-assigned this Dec 9, 2020

This comment has been minimized.

Sign in to view

spong reviewed Dec 10, 2020

View reviewed changes

...on/public/detections/pages/detection_engine/rules/all/exceptions/use_all_exception_lists.tsx Show resolved Hide resolved

yctercero added 5 commits December 14, 2020 10:08

wip

c938bdd

added some unit tests and cleanup, still wip

84c0b4f

wip

23425fa

Merge branch 'master' of github.com:yctercero/kibana into exceptions_…

37f3892

…referential_int

cleaned up, needs additional unit tests

3c0715b

yctercero marked this pull request as ready for review December 15, 2020 07:52

yctercero requested review from a team as code owners December 15, 2020 07:52

spong mentioned this pull request Dec 15, 2020

[SecuritySolution][Detections] Resolves referential integrity issues when deleting value lists #85925

Merged

4 tasks

peluja1012 reviewed Dec 15, 2020

View reviewed changes

..._solution/public/detections/pages/detection_engine/rules/all/exceptions/exceptions_table.tsx Show resolved Hide resolved

peluja1012 reviewed Dec 15, 2020

View reviewed changes

x-pack/plugins/lists/common/utils.ts Outdated Show resolved Hide resolved

peluja1012 reviewed Dec 15, 2020

View reviewed changes

..._solution/public/detections/pages/detection_engine/rules/all/exceptions/exceptions_table.tsx Show resolved Hide resolved

updated refs, missed pushing code in last commit

a4c906a

cleanup

bd7e210

peluja1012 reviewed Dec 15, 2020

View reviewed changes

.../security_solution/public/detections/pages/detection_engine/rules/all/exceptions/columns.tsx Show resolved Hide resolved

peluja1012 approved these changes Dec 15, 2020

View reviewed changes

trying do decrease load bundle size

f957f55

madirey approved these changes Dec 16, 2020

View reviewed changes

increasing lists bundle limit - TEMPORARY - need more time to figure …

8059320

…out increase

mistic approved these changes Dec 16, 2020

View reviewed changes

Merge branch 'master' of github.com:yctercero/kibana into exceptions_…

7ba47e8

…referential_int

yctercero requested a review from a team as a code owner December 16, 2020 03:30

mistic approved these changes Dec 16, 2020

View reviewed changes

spong merged commit be055b8 into elastic:master Dec 16, 2020

spong mentioned this pull request Dec 16, 2020

[7.x] [Security Solution][Detections] - Add skeleton exceptions list tab to all rules page (#85465) #86079

Merged

yctercero deleted the exceptions_referential_int branch December 16, 2020 05:59

jmikell821 mentioned this pull request Jan 6, 2021

[DOCS] Exception list features elastic/security-docs#431

Closed

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Detections] - Add skeleton exceptions list tab to all rules page #85465

[Security Solution][Detections] - Add skeleton exceptions list tab to all rules page #85465

yctercero commented Dec 9, 2020 •

edited

Loading

This comment has been minimized.

elasticmachine commented Dec 15, 2020

peluja1012 Dec 15, 2020

yctercero Dec 16, 2020

peluja1012 Dec 15, 2020

yctercero Dec 16, 2020

peluja1012 Dec 15, 2020

yctercero Dec 16, 2020

peluja1012 left a comment

madirey commented Dec 16, 2020

mistic left a comment

kibanamachine commented Dec 16, 2020

[Security Solution][Detections] - Add skeleton exceptions list tab to all rules page #85465

[Security Solution][Detections] - Add skeleton exceptions list tab to all rules page #85465

Conversation

yctercero commented Dec 9, 2020 • edited Loading

Summary

TO DO (follow up PR)

Checklist

For maintainers

This comment has been minimized.

elasticmachine commented Dec 15, 2020

peluja1012 Dec 15, 2020

Choose a reason for hiding this comment

yctercero Dec 16, 2020

Choose a reason for hiding this comment

peluja1012 Dec 15, 2020

Choose a reason for hiding this comment

yctercero Dec 16, 2020

Choose a reason for hiding this comment

peluja1012 Dec 15, 2020

Choose a reason for hiding this comment

yctercero Dec 16, 2020

Choose a reason for hiding this comment

peluja1012 left a comment

Choose a reason for hiding this comment

madirey commented Dec 16, 2020

mistic left a comment

Choose a reason for hiding this comment

kibanamachine commented Dec 16, 2020

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

Page load bundle

History

yctercero commented Dec 9, 2020 •

edited

Loading