[Security Solution] [Detections] Replace 'partial failure' with 'warning' for rule statuses #91167
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@elasticmachine merge upstream |
dhurley14
force-pushed
the
partial-failure-to-warning
branch
from
fb226bc to
a0cbf9e
Compare
…g' status, also adds some logic to be backwards compatible with 'partial failure' statuses
…ch concrete indices
dhurley14
changed the title
dhurley14
added
Feature:Detection Rules
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
|
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
dhurley14
force-pushed
the
partial-failure-to-warning
branch
from
5f0b6bf to
bfade53
Compare
| @@ -311,9 +311,9 @@ export default ({ getService }: FtrProviderContext) => { | |||
| .send({ ids: [bodyId] }) | |||
| .expect(200); | |||
|
|
|||
| // set to "failed" for now. Will update this with a partial failure | |||
| // set to "failed" for now. Will update this with a warning | |||
There was a problem hiding this comment.
this comment appears to be outdated now since the test has been updated with the warning status
There was a problem hiding this comment.
ah good catch on both comments. Thanks!
marshallmain
approved these changes
Feb 16, 2021
dhurley14
added
the
auto-backport
💔 Backport failed❌ 7.11: Commit could not be cherrypicked due to conflicts To backport manually, check out the target branch and run: |
dhurley14
added a commit
to dhurley14/kibana
that referenced
this pull request
Feb 17, 2021
…ing' for rule statuses (elastic#91167) * removes usage of 'partial failure' status and replaces with a 'warning' status, also adds some logic to be backwards compatible with 'partial failure' statuses * update integration tests from 'partial failure' to 'warning' * fix integration test to warn and not error when no index patterns match concrete indices * fix integration test * removes outdated comments from the create_rules e2e test # Conflicts: # x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts
dhurley14
added a commit
to dhurley14/kibana
that referenced
this pull request
Feb 17, 2021
…ing' for rule statuses (elastic#91167) * removes usage of 'partial failure' status and replaces with a 'warning' status, also adds some logic to be backwards compatible with 'partial failure' statuses * update integration tests from 'partial failure' to 'warning' * fix integration test to warn and not error when no index patterns match concrete indices * fix integration test * removes outdated comments from the create_rules e2e test # Conflicts: # x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts
dhurley14
added a commit
that referenced
this pull request
Feb 17, 2021
… 'warning' for rule statuses (#91167) (#91598) * removes usage of 'partial failure' status and replaces with a 'warning' status, also adds some logic to be backwards compatible with 'partial failure' statuses * update integration tests from 'partial failure' to 'warning' * fix integration test to warn and not error when no index patterns match concrete indices * fix integration test * removes outdated comments from the create_rules e2e test # Conflicts: # x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts
dhurley14
added a commit
that referenced
this pull request
Feb 17, 2021
…h 'warning' for rule statuses (#91167) (#91599) * removes usage of 'partial failure' status and replaces with a 'warning' status, also adds some logic to be backwards compatible with 'partial failure' statuses * update integration tests from 'partial failure' to 'warning' * fix integration test to warn and not error when no index patterns match concrete indices * fix integration test * removes outdated comments from the create_rules e2e test # Conflicts: # x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts
gmmorris
added a commit
to gmmorris/kibana
that referenced
this pull request
Feb 17, 2021
* master: (157 commits) [DOCS] Adds machine learning to the security section of alerting (elastic#91501) [Uptime] Ping list step screenshot caption formatting (elastic#91403) [Vislib] Use timestamp on brush event instead of iso dates (elastic#91483) [Application Usage] Remove deprecated & unused legacy.appChanged API (elastic#91464) Migrate logstash, monitoring, url_drilldowns, xpack_legacy to ts projects (elastic#91194) [APM] Wrap Elasticsearch client errors (elastic#91125) [APM] Fix optimize-tsconfig script (elastic#91487) [Discover][docs] Add searchFieldsFromSource description (elastic#90980) Adds support for 'ip' data type (elastic#85087) [Detection Rules] Add updates from 7.11.2 rules (elastic#91553) [SECURITY SOLUTION] Eql in timeline (elastic#90816) [APM] Correlations Beta (elastic#86477) (elastic#89952) [Security Solutions][Detection Engine] Adds a warning banner when the alerts data has not been migrated yet. (elastic#90258) [Security Solution] [Timeline] Endpoint row renderers (2nd batch) (elastic#91446) skip flaky suite (elastic#91450) skip flaky suite (elastic#91592) [Security Solution][Endpoint][Admin] Endpoint Details UX Enhancements (elastic#90870) [ML] Add better UI support for runtime fields Transforms (elastic#90363) [Security Solution] [Detections] Replace 'partial failure' with 'warning' for rule statuses (elastic#91167) [Security Solution][Detections] Adds Indicator path config for indicator match rules (elastic#91260) ...
banderror
reviewed
Feb 17, 2021
Comment on lines
+65
to
+71
| } else if (status != null && status === 'partial failure') { | ||
| // Temporary fix if on upgrade a rule has a status of 'partial failure' we want to display that text as 'warning' | ||
| // On the next subsequent rule run, that 'partial failure' status will be re-written as a 'warning' status | ||
| // and this code will no longer be necessary | ||
| // TODO: remove this code in 8.0.0 | ||
| return 'warning'; | ||
| } |
There was a problem hiding this comment.
Disclaimer: I'm not familiar with Kibana upgrades and migrations, what's supported and not.
What if a user upgrades Kibana from let's say 7.10 (where a rule can have a partial failure status) to 8.1? I mean data-wise. Such a rule will (for a short time) have a status which will not be supported in the API anymore (do I understand the intention right?). But still we'll fetch this partial failure status, return in the API response, and the client will receive it. And it's ok if this "adapter"-like code will still be here, but if not, we might get something we don't want in the UI.
Wouldn't it be simpler to do either of the following:
- render
partial failureas"warning"in the UI layer without modifying the contract between the client and server - add a new
warningstatus and convert all partial failures to it on the server; and support it on the client
I'm also not sure about the current users of our API endpoints. While this is not a breaking change in terms of response structure, it's a change in behaviour. If some code in userland relies on some checks for partial failure, that could be a de-facto breaking change.
So in this regards option num 1 looks better to me until 8.0, where we could in fact "rename" partial failure to warning in the API.
There was a problem hiding this comment.
Considering user-land breaking changes we will have this change reflected in the docs and in the release notes. If a status is 'partial failure' after upgrade it will still be reflected as a 'warning' on the UI so we do take care of option 1.
Option 2 we no longer write 'partial failure' as a status so these statuses will technically be migrated off of 'partial failure' and to 'warning' as the status text on the server side. You bring up a good point though that even with 8.0 allowing breaking changes this code should still be left in there to account for situations like that.
My hope is that by 8.0 we will be completely off of the saved objects used for rule statuses and then this code won't really be relevant anymore.
💛 Build succeeded, but was flaky
Test FailuresKibana Pipeline / general / Chrome X-Pack UI Functional Tests.x-pack/test/functional/apps/ml/data_frame_analytics/classification_creation·ts.machine learning data frame analytics classification creation bank marketing edits the analytics job and displays it correctly in the job listStandard OutStack TraceMetrics [docs]Async chunks
Page load bundle
History
To update your PR or re-run it, just comment with: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
removes usage of 'partial failure' status and replaces with a 'warning' status, also adds some logic to be backwards compatible with 'partial failure' statuses.
Checklist
Delete any items that are not applicable to this PR.
For maintainers