github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 17:59:23 -04:00
Code Issues Projects Releases Packages Wiki Activity

[Security Solution] Show rule.description when displaying an alert view flyout (#110221)

Browse source
This commit is contained in:
Esteban Beltran 2021-08-26 17:05:18 +02:00 • committed by GitHub
parent bb8ee0ce05
commit 0069faf8dd
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
7 changed files with 846 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
x-pack/plugins/security_solution/common/ecs/event/index.ts
View file

@ -54,4 +54,6 @@ export enum EventCode {
MEMORY_SIGNATURE = 'memory_signature',
// Memory Protection alert
MALICIOUS_THREAD = 'malicious_thread',
// behavior
BEHAVIOR = 'behavior',
}

1
x-pack/plugins/security_solution/common/endpoint/generate_data.ts
View file

@ -829,6 +829,7 @@ export class EndpointDocGenerator extends BaseDataGenerator {
},
rule: {
id: this.randomUUID(),
description: 'Behavior rule description',
},
event: {
action: 'rule_detection',

1
x-pack/plugins/security_solution/common/endpoint/types/index.ts
View file

@ -376,6 +376,7 @@ export type AlertEvent = Partial<{
}>;
rule: Partial<{
id: ECSField<string>;
description: ECSField<string>;
}>;
file: Partial<{
owner: ECSField<string>;

805
x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap generated
View file

@ -1,5 +1,810 @@
// Jest Snapshot v1, https://goo.gl/fbAQLP
exports[`AlertSummaryView Behavior event code renders additional summary rows 1`] = `
.c1 {
line-height: 1.7rem;
}
.c0 .euiTableHeaderCell,
.c0 .euiTableRowCell {
border: none;
}
.c0 .euiTableHeaderCell .euiTableCellContent {
padding: 0;
}
.c0 .flyoutOverviewDescription .hoverActions-active .timelines__hoverActionButton,
.c0 .flyoutOverviewDescription .hoverActions-active .securitySolution__hoverActionButton {
opacity: 1;
}
.c0 .flyoutOverviewDescription:hover .timelines__hoverActionButton,
.c0 .flyoutOverviewDescription:hover .securitySolution__hoverActionButton {
opacity: 1;
}
.c2 {
min-width: 138px;
padding: 0 8px;
display: -webkit-box;
display: -webkit-flex;
display: -ms-flexbox;
display: flex;
}
.c2:focus-within .timelines__hoverActionButton,
.c2:focus-within .securitySolution__hoverActionButton {
opacity: 1;
}
.c2:hover .timelines__hoverActionButton,
.c2:hover .securitySolution__hoverActionButton {
opacity: 1;
}
.c2 .timelines__hoverActionButton,
.c2 .securitySolution__hoverActionButton {
opacity: 0;
}
.c2 .timelines__hoverActionButton:focus,
.c2 .securitySolution__hoverActionButton:focus {
opacity: 1;
}
.c3 {
padding: 4px 0;
}
<div
class="euiBasicTable c0"
data-test-subj="summary-view"
>
<div>
<div
class="euiTableHeaderMobile"
>
<div
class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsBaseline euiFlexGroup--justifyContentSpaceBetween euiFlexGroup--directionRow"
>
<div
class="euiFlexItem euiFlexItem--flexGrowZero"
/>
<div
class="euiFlexItem euiFlexItem--flexGrowZero"
/>
</div>
</div>
<table
class="euiTable euiTable--compressed euiTable--responsive"
id="__table_generated-id"
tabindex="-1"
>
<caption
class="euiScreenReaderOnly euiTableCaption"
/>
<thead>
<tr>
<td
class="euiTableHeaderCell"
data-test-subj="tableHeaderCell_title_0"
role="columnheader"
scope="col"
style="width: 220px;"
>
<span
class="euiTableCellContent"
>
<span
class="euiTableCellContent__text"
/>
</span>
</td>
<td
class="euiTableHeaderCell"
data-test-subj="tableHeaderCell_description_1"
role="columnheader"
scope="col"
>
<span
class="euiTableCellContent"
>
<span
class="euiTableCellContent__text"
/>
</span>
</td>
</tr>
</thead>
<tbody>
<tr
class="euiTableRow"
>
<td
class="euiTableRowCell"
style="width: 220px;"
>
<div
class="euiTableCellContent euiTableCellContent--overflowingContent"
>
<h5
class="c1 euiTitle euiTitle--xxxsmall"
>
Status
</h5>
</div>
</td>
<td
class="euiTableRowCell"
>
<div
class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
>
<div>
<div
class="euiText euiText--extraSmall"
>
open
</div>
</div>
<div
data-eui="EuiFocusTrap"
>
<div
class="c2"
>
<p
class="euiScreenReaderOnly"
>
You are in a dialog, containing options for field signal.status. Press tab to navigate options. Press escape to exit.
</p>
<div
data-test-subj="hover-actions-filter-for"
>
Filter button
</div>
<div
data-test-subj="hover-actions-filter-out"
>
Filter out button
</div>
<div
data-test-subj="more-actions-signal.status"
field="signal.status"
items="[object Object],[object Object]"
value="open"
>
Overflow button
</div>
</div>
</div>
</div>
</td>
</tr>
<tr
class="euiTableRow"
>
<td
class="euiTableRowCell"
style="width: 220px;"
>
<div
class="euiTableCellContent euiTableCellContent--overflowingContent"
>
<h5
class="c1 euiTitle euiTitle--xxxsmall"
>
Timestamp
</h5>
</div>
</td>
<td
class="euiTableRowCell"
>
<div
class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
>
<div>
<div
class="eventFieldsTable__fieldValue"
>
<span
class="euiToolTipAnchor"
>
Nov 25, 2020 @ 15:42:39.417
</span>
</div>
</div>
<div
data-eui="EuiFocusTrap"
>
<div
class="c2"
>
<p
class="euiScreenReaderOnly"
>
You are in a dialog, containing options for field @timestamp. Press tab to navigate options. Press escape to exit.
</p>
<div
data-test-subj="hover-actions-filter-for"
>
Filter button
</div>
<div
data-test-subj="hover-actions-filter-out"
>
Filter out button
</div>
<div
data-test-subj="more-actions-@timestamp"
field="@timestamp"
items="[object Object],[object Object]"
value="2020-11-25T15:42:39.417Z"
>
Overflow button
</div>
</div>
</div>
</div>
</td>
</tr>
<tr
class="euiTableRow"
>
<td
class="euiTableRowCell"
style="width: 220px;"
>
<div
class="euiTableCellContent euiTableCellContent--overflowingContent"
>
<h5
class="c1 euiTitle euiTitle--xxxsmall"
>
Rule
</h5>
</div>
</td>
<td
class="euiTableRowCell"
>
<div
class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
>
<div>
<div
class="euiText euiText--extraSmall"
>
xxx
</div>
</div>
<div
data-eui="EuiFocusTrap"
>
<div
class="c2"
>
<p
class="euiScreenReaderOnly"
>
You are in a dialog, containing options for field signal.rule.name. Press tab to navigate options. Press escape to exit.
</p>
<div
data-test-subj="hover-actions-filter-for"
>
Filter button
</div>
<div
data-test-subj="hover-actions-filter-out"
>
Filter out button
</div>
<div
data-test-subj="more-actions-signal.rule.name"
field="signal.rule.name"
items="[object Object],[object Object]"
value="xxx"
>
Overflow button
</div>
</div>
</div>
</div>
</td>
</tr>
<tr
class="euiTableRow"
>
<td
class="euiTableRowCell"
style="width: 220px;"
>
<div
class="euiTableCellContent euiTableCellContent--overflowingContent"
>
<h5
class="c1 euiTitle euiTitle--xxxsmall"
>
Severity
</h5>
</div>
</td>
<td
class="euiTableRowCell"
>
<div
class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
>
<div>
<div
class="euiText euiText--extraSmall"
>
low
</div>
</div>
<div
data-eui="EuiFocusTrap"
>
<div
class="c2"
>
<p
class="euiScreenReaderOnly"
>
You are in a dialog, containing options for field signal.rule.severity. Press tab to navigate options. Press escape to exit.
</p>
<div
data-test-subj="hover-actions-filter-for"
>
Filter button
</div>
<div
data-test-subj="hover-actions-filter-out"
>
Filter out button
</div>
<div
data-test-subj="more-actions-signal.rule.severity"
field="signal.rule.severity"
items="[object Object],[object Object]"
value="low"
>
Overflow button
</div>
</div>
</div>
</div>
</td>
</tr>
<tr
class="euiTableRow"
>
<td
class="euiTableRowCell"
style="width: 220px;"
>
<div
class="euiTableCellContent euiTableCellContent--overflowingContent"
>
<h5
class="c1 euiTitle euiTitle--xxxsmall"
>
Risk Score
</h5>
</div>
</td>
<td
class="euiTableRowCell"
>
<div
class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
>
<div>
<div
class="euiText euiText--extraSmall"
>
21
</div>
</div>
<div
data-eui="EuiFocusTrap"
>
<div
class="c2"
>
<p
class="euiScreenReaderOnly"
>
You are in a dialog, containing options for field signal.rule.risk_score. Press tab to navigate options. Press escape to exit.
</p>
<div
data-test-subj="hover-actions-filter-for"
>
Filter button
</div>
<div
data-test-subj="hover-actions-filter-out"
>
Filter out button
</div>
<div
data-test-subj="more-actions-signal.rule.risk_score"
field="signal.rule.risk_score"
items="[object Object],[object Object]"
value="21"
>
Overflow button
</div>
</div>
</div>
</div>
</td>
</tr>
<tr
class="euiTableRow"
>
<td
class="euiTableRowCell"
style="width: 220px;"
>
<div
class="euiTableCellContent euiTableCellContent--overflowingContent"
>
<h5
class="c1 euiTitle euiTitle--xxxsmall"
>
host.name
</h5>
</div>
</td>
<td
class="euiTableRowCell"
>
<div
class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
>
<div>
<div
class="euiText euiText--extraSmall"
>
windows-native
</div>
</div>
<div
data-eui="EuiFocusTrap"
>
<div
class="c2"
>
<p
class="euiScreenReaderOnly"
>
You are in a dialog, containing options for field host.name. Press tab to navigate options. Press escape to exit.
</p>
<div
data-test-subj="hover-actions-filter-for"
>
Filter button
</div>
<div
data-test-subj="hover-actions-filter-out"
>
Filter out button
</div>
<div
data-test-subj="more-actions-host.name"
field="host.name"
items="[object Object]"
value="windows-native"
>
Overflow button
</div>
</div>
</div>
</div>
</td>
</tr>
<tr
class="euiTableRow"
>
<td
class="euiTableRowCell"
style="width: 220px;"
>
<div
class="euiTableCellContent euiTableCellContent--overflowingContent"
>
<h5
class="c1 euiTitle euiTitle--xxxsmall"
>
user.name
</h5>
</div>
</td>
<td
class="euiTableRowCell"
>
<div
class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
>
<div>
<div
class="euiText euiText--extraSmall"
>
administrator
</div>
</div>
<div
data-eui="EuiFocusTrap"
>
<div
class="c2"
>
<p
class="euiScreenReaderOnly"
>
You are in a dialog, containing options for field user.name. Press tab to navigate options. Press escape to exit.
</p>
<div
data-test-subj="hover-actions-filter-for"
>
Filter button
</div>
<div
data-test-subj="hover-actions-filter-out"
>
Filter out button
</div>
<div
data-test-subj="more-actions-user.name"
field="user.name"
items="[object Object]"
value="administrator"
>
Overflow button
</div>
</div>
</div>
</div>
</td>
</tr>
<tr
class="euiTableRow"
>
<td
class="euiTableRowCell"
style="width: 220px;"
>
<div
class="euiTableCellContent euiTableCellContent--overflowingContent"
>
<h5
class="c1 euiTitle euiTitle--xxxsmall"
>
source.ip
</h5>
</div>
</td>
<td
class="euiTableRowCell"
>
<div
class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
>
<div>
<div
class="eventFieldsTable__fieldValue"
>
<span
class="euiToolTipAnchor"
>
<button
class="euiLink euiLink--primary"
data-test-subj="network-details"
type="button"
>
185.156.74.3
</button>
</span>
</div>
</div>
<div
data-eui="EuiFocusTrap"
>
<div
class="c2"
>
<p
class="euiScreenReaderOnly"
>
You are in a dialog, containing options for field source.ip. Press tab to navigate options. Press escape to exit.
</p>
<div
data-test-subj="hover-actions-filter-for"
>
Filter button
</div>
<div
data-test-subj="hover-actions-filter-out"
>
Filter out button
</div>
<div
data-test-subj="more-actions-source.ip"
field="source.ip"
items="[object Object]"
value="185.156.74.3"
>
Overflow button
</div>
</div>
</div>
</div>
</td>
</tr>
<tr
class="euiTableRow"
>
<td
class="euiTableRowCell"
style="width: 220px;"
>
<div
class="euiTableCellContent euiTableCellContent--overflowingContent"
>
<h5
class="c1 euiTitle euiTitle--xxxsmall"
>
destination.ip
</h5>
</div>
</td>
<td
class="euiTableRowCell"
>
<div
class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
>
<div
class="c3"
>
—
</div>
</div>
</td>
</tr>
<tr
class="euiTableRow"
>
<td
class="euiTableRowCell"
style="width: 220px;"
>
<div
class="euiTableCellContent euiTableCellContent--overflowingContent"
>
<h5
class="c1 euiTitle euiTitle--xxxsmall"
>
Threshold Count
</h5>
</div>
</td>
<td
class="euiTableRowCell"
>
<div
class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
>
<div
class="c3"
>
—
</div>
</div>
</td>
</tr>
<tr
class="euiTableRow"
>
<td
class="euiTableRowCell"
style="width: 220px;"
>
<div
class="euiTableCellContent euiTableCellContent--overflowingContent"
>
<h5
class="c1 euiTitle euiTitle--xxxsmall"
>
Threshold Terms
</h5>
</div>
</td>
<td
class="euiTableRowCell"
>
<div
class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
>
<div
class="c3"
>
—
</div>
</div>
</td>
</tr>
<tr
class="euiTableRow"
>
<td
class="euiTableRowCell"
style="width: 220px;"
>
<div
class="euiTableCellContent euiTableCellContent--overflowingContent"
>
<h5
class="c1 euiTitle euiTitle--xxxsmall"
>
Threshold Cardinality
</h5>
</div>
</td>
<td
class="euiTableRowCell"
>
<div
class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
>
<div
class="c3"
>
—
</div>
</div>
</td>
</tr>
<tr
class="euiTableRow"
>
<td
class="euiTableRowCell"
style="width: 220px;"
>
<div
class="euiTableCellContent euiTableCellContent--overflowingContent"
>
<h5
class="c1 euiTitle euiTitle--xxxsmall"
>
Rule description
</h5>
</div>
</td>
<td
class="euiTableRowCell"
>
<div
class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
>
<div
class="c3"
>
—
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
`;
exports[`AlertSummaryView Memory event code renders additional summary rows 1`] = `
.c1 {
line-height: 1.7rem;

22
x-pack/plugins/security_solution/public/common/components/event_details/alert_summary_view.test.tsx
View file

@ -100,4 +100,26 @@ describe('AlertSummaryView', () => {
);
expect(wrapper.find('div[data-test-subj="summary-view"]').render()).toMatchSnapshot();
});
test('Behavior event code renders additional summary rows', () => {
const renderProps = {
...props,
data: mockAlertDetailsData.map((item) => {
if (item.category === 'event' && item.field === 'event.code') {
return {
category: 'event',
field: 'event.code',
values: ['behavior'],
originalValue: ['behavior'],
};
}
return item;
}) as TimelineEventsDetailsItem[],
};
const wrapper = mount(
<TestProvidersComponent>
<AlertSummaryView {...renderProps} />
</TestProvidersComponent>
);
expect(wrapper.find('div[data-test-subj="summary-view"]').render()).toMatchSnapshot();
});
});

8
x-pack/plugins/security_solution/public/common/components/event_details/alert_summary_view.tsx
View file

@ -23,6 +23,7 @@ import {
SIGNAL_STATUS,
ALERTS_HEADERS_TARGET_IMPORT_HASH,
TIMESTAMP,
ALERTS_HEADERS_RULE_DESCRIPTION,
} from '../../../detections/components/alerts_table/translations';
import {
AGENT_STATUS_FIELD_NAME,
@ -102,6 +103,11 @@ const memoryShellCodeAlertFields: EventSummaryField[] = [
},
];
const behaviorAlertFields: EventSummaryField[] = [
...defaultDisplayFields,
{ id: 'rule.description', label: ALERTS_HEADERS_RULE_DESCRIPTION },
];
const memorySignatureAlertFields: EventSummaryField[] = [
...defaultDisplayFields,
{ id: 'rule.name', label: ALERTS_HEADERS_RULE_NAME },
@ -155,6 +161,8 @@ function getEventFieldsToDisplay({
return memoryShellCodeAlertFields;
case EventCode.MEMORY_SIGNATURE:
return memorySignatureAlertFields;
case EventCode.BEHAVIOR:
return behaviorAlertFields;
}
switch (eventCategory) {

7
x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts
View file

@ -73,6 +73,13 @@ export const ALERTS_HEADERS_RULE_NAME = i18n.translate(
}
);
export const ALERTS_HEADERS_RULE_DESCRIPTION = i18n.translate(
'xpack.securitySolution.eventsViewer.alerts.defaultHeaders.ruleDescriptionTitle',
{
defaultMessage: 'Rule description',
}
);
export const ALERTS_HEADERS_VERSION = i18n.translate(
'xpack.securitySolution.eventsViewer.alerts.defaultHeaders.versionTitle',
{