github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 09:48:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

[SecuritySolution] Generic reportEvents for EBT Telemetry (#197079)

Browse source 
## Summary

1. Removing the custom EBT events:
https://github.com/elastic/kibana/pull/197079/files#diff-7beaf4f2d7c25c8913607b5dbc6e1ad0027f6ffacddafe4c675c775c3e7ae903L55
2. Use `reportEvent` for all the Security Solution EBT events.

### Checklist

Delete any items that are not applicable to this PR.


- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
This commit is contained in:
Angela Chuang 2024-11-11 19:08:27 +00:00 • committed by GitHub
parent aeef51f2dd
commit 3b0c3808ef
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
97 changed files with 882 additions and 1222 deletions
Download patch file Download diff file Expand all files Collapse all files

5
x-pack/plugins/security_solution/public/app/actions/telemetry.test.ts
View file

@ -9,6 +9,7 @@ import type { StartServices } from '../../types';
import { enhanceActionWithTelemetry } from './telemetry';
import { createAction } from '@kbn/ui-actions-plugin/public';
import type { CellActionExecutionContext } from '@kbn/cell-actions';
import { AppEventTypes } from '../../common/lib/telemetry';
const actionId = 'test_action_id';
const displayName = 'test-actions';
@ -29,13 +30,13 @@ const context = {
describe('enhanceActionWithTelemetry', () => {
it('calls telemetry report when the action is executed', () => {
const telemetry = { reportCellActionClicked: jest.fn() };
const telemetry = { reportEvent: jest.fn() };
const services = { telemetry } as unknown as StartServices;
const enhancedAction = enhanceActionWithTelemetry(action, services);
enhancedAction.execute(context);
expect(telemetry.reportCellActionClicked).toHaveBeenCalledWith({
expect(telemetry.reportEvent).toHaveBeenCalledWith(AppEventTypes.CellActionClicked, {
displayName,
actionId,
fieldName,

3
x-pack/plugins/security_solution/public/app/actions/telemetry.ts
View file

@ -9,6 +9,7 @@ import type { CellAction, CellActionExecutionContext } from '@kbn/cell-actions';
import type { ActionExecutionContext } from '@kbn/ui-actions-plugin/public';
import type { StartServices } from '../../types';
import type { SecurityCellActionExecutionContext } from './types';
import { AppEventTypes } from '../../common/lib/telemetry';
export const enhanceActionWithTelemetry = (
action: CellAction<CellActionExecutionContext>,
@ -19,7 +20,7 @@ export const enhanceActionWithTelemetry = (
const enhancedExecute = (
context: ActionExecutionContext<SecurityCellActionExecutionContext>
): Promise<void> => {
telemetry.reportCellActionClicked({
telemetry.reportEvent(AppEventTypes.CellActionClicked, {
actionId: rest.id,
displayName: rest.getDisplayName(context),
fieldName: context.data.map(({ field }) => field.name).join(', '),

35
x-pack/plugins/security_solution/public/assistant/use_assistant_telemetry/index.test.tsx
View file

@ -9,6 +9,7 @@ import { renderHook } from '@testing-library/react-hooks';
import { useAssistantTelemetry } from '.';
import { BASE_SECURITY_CONVERSATIONS } from '../content/conversations';
import { createTelemetryServiceMock } from '../../common/lib/telemetry/telemetry_service.mock';
import { AssistantEventTypes } from '../../common/lib/telemetry';
const customId = `My Convo`;
const mockedConversations = {
@ -20,15 +21,9 @@ const mockedConversations = {
messages: [],
},
};
const reportAssistantInvoked = jest.fn();
const reportAssistantMessageSent = jest.fn();
const reportAssistantQuickPrompt = jest.fn();
const mockedTelemetry = {
...createTelemetryServiceMock(),
reportAssistantInvoked,
reportAssistantMessageSent,
reportAssistantQuickPrompt,
reportAssistantSettingToggled: () => {},
};
jest.mock('../../common/lib/kibana', () => {
@ -55,9 +50,9 @@ jest.mock('@kbn/elastic-assistant', () => ({
}));
const trackingFns = [
'reportAssistantInvoked',
'reportAssistantMessageSent',
'reportAssistantQuickPrompt',
{ name: 'reportAssistantInvoked', eventType: AssistantEventTypes.AssistantInvoked },
{ name: 'reportAssistantMessageSent', eventType: AssistantEventTypes.AssistantMessageSent },
{ name: 'reportAssistantQuickPrompt', eventType: AssistantEventTypes.AssistantQuickPrompt },
];
describe('useAssistantTelemetry', () => {
@ -67,7 +62,7 @@ describe('useAssistantTelemetry', () => {
it('should return the expected telemetry object with tracking functions', () => {
const { result } = renderHook(() => useAssistantTelemetry());
trackingFns.forEach((fn) => {
expect(result.current).toHaveProperty(fn);
expect(result.current).toHaveProperty(fn.name);
});
});
@ -76,11 +71,11 @@ describe('useAssistantTelemetry', () => {
const { result } = renderHook(() => useAssistantTelemetry());
const validId = Object.keys(mockedConversations)[0];
// @ts-ignore
const trackingFn = result.current[fn];
const trackingFn = result.current[fn.name];
await trackingFn({ conversationId: validId, invokedBy: 'shortcut' });
// @ts-ignore
const trackingMockedFn = mockedTelemetry[fn];
expect(trackingMockedFn).toHaveBeenCalledWith({
const trackingMockedFn = mockedTelemetry.reportEvent;
expect(trackingMockedFn).toHaveBeenCalledWith(fn.eventType, {
conversationId: validId,
invokedBy: 'shortcut',
});
@ -89,11 +84,11 @@ describe('useAssistantTelemetry', () => {
it('Should call tracking with "Custom" id when tracking is called with an isDefault=false conversation id', async () => {
const { result } = renderHook(() => useAssistantTelemetry());
// @ts-ignore
const trackingFn = result.current[fn];
const trackingFn = result.current[fn.name];
await trackingFn({ conversationId: customId, invokedBy: 'shortcut' });
// @ts-ignore
const trackingMockedFn = mockedTelemetry[fn];
expect(trackingMockedFn).toHaveBeenCalledWith({
const trackingMockedFn = mockedTelemetry.reportEvent;
expect(trackingMockedFn).toHaveBeenCalledWith(fn.eventType, {
conversationId: 'Custom',
invokedBy: 'shortcut',
});
@ -102,11 +97,11 @@ describe('useAssistantTelemetry', () => {
it('Should call tracking with "Custom" id when tracking is called with an unknown conversation id', async () => {
const { result } = renderHook(() => useAssistantTelemetry());
// @ts-ignore
const trackingFn = result.current[fn];
const trackingFn = result.current[fn.name];
await trackingFn({ conversationId: '123', invokedBy: 'shortcut' });
// @ts-ignore
const trackingMockedFn = mockedTelemetry[fn];
expect(trackingMockedFn).toHaveBeenCalledWith({
const trackingMockedFn = mockedTelemetry.reportEvent;
expect(trackingMockedFn).toHaveBeenCalledWith(fn.eventType, {
conversationId: 'Custom',
invokedBy: 'shortcut',
});

41
x-pack/plugins/security_solution/public/assistant/use_assistant_telemetry/index.tsx
View file

@ -9,7 +9,13 @@ import { type AssistantTelemetry } from '@kbn/elastic-assistant';
import { useCallback } from 'react';
import { useKibana } from '../../common/lib/kibana';
import { useBaseConversations } from '../use_conversation_store';
import type {
ReportAssistantInvokedParams,
ReportAssistantMessageSentParams,
ReportAssistantQuickPromptParams,
ReportAssistantSettingToggledParams,
} from '../../common/lib/telemetry';
import { AssistantEventTypes } from '../../common/lib/telemetry';
export const useAssistantTelemetry = (): AssistantTelemetry => {
const {
services: { telemetry },
@ -27,27 +33,30 @@ export const useAssistantTelemetry = (): AssistantTelemetry => {
const reportTelemetry = useCallback(
async ({
fn,
eventType,
params: { conversationId, ...rest },
}: // eslint-disable-next-line @typescript-eslint/no-explicit-any
any): Promise<{
fn: keyof AssistantTelemetry;
params: AssistantTelemetry[keyof AssistantTelemetry];
}> =>
fn({
}: {
eventType: AssistantEventTypes;
params:
| ReportAssistantInvokedParams
| ReportAssistantMessageSentParams
| ReportAssistantQuickPromptParams;
}) =>
telemetry.reportEvent(eventType, {
...rest,
conversationId: await getAnonymizedConversationTitle(conversationId),
}),
[getAnonymizedConversationTitle]
[getAnonymizedConversationTitle, telemetry]
);
return {
reportAssistantInvoked: (params) =>
reportTelemetry({ fn: telemetry.reportAssistantInvoked, params }),
reportAssistantMessageSent: (params) =>
reportTelemetry({ fn: telemetry.reportAssistantMessageSent, params }),
reportAssistantQuickPrompt: (params) =>
reportTelemetry({ fn: telemetry.reportAssistantQuickPrompt, params }),
reportAssistantSettingToggled: (params) => telemetry.reportAssistantSettingToggled(params),
reportAssistantInvoked: (params: ReportAssistantInvokedParams) =>
reportTelemetry({ eventType: AssistantEventTypes.AssistantInvoked, params }),
reportAssistantMessageSent: (params: ReportAssistantMessageSentParams) =>
reportTelemetry({ eventType: AssistantEventTypes.AssistantMessageSent, params }),
reportAssistantQuickPrompt: (params: ReportAssistantQuickPromptParams) =>
reportTelemetry({ eventType: AssistantEventTypes.AssistantQuickPrompt, params }),
reportAssistantSettingToggled: (params: ReportAssistantSettingToggledParams) =>
telemetry.reportEvent(AssistantEventTypes.AssistantSettingToggled, params),
};
};

3
x-pack/plugins/security_solution/public/cases/pages/index.tsx
View file

@ -25,6 +25,7 @@ import * as timelineMarkdownPlugin from '../../common/components/markdown_editor
import { useFetchAlertData } from './use_fetch_alert_data';
import { useUpsellingMessage } from '../../common/hooks/use_upselling';
import { useFetchNotes } from '../../notes/hooks/use_fetch_notes';
import { DocumentEventTypes } from '../../common/lib/telemetry';
const CaseContainerComponent: React.FC = () => {
const { cases, telemetry } = useKibana().services;
@ -47,7 +48,7 @@ const CaseContainerComponent: React.FC = () => {
},
},
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: TimelineId.casePage,
panel: 'right',
});

7
x-pack/plugins/security_solution/public/common/components/control_columns/row_action/index.tsx
View file

@ -24,6 +24,7 @@ import type { ColumnHeaderOptions, OnRowSelected } from '../../../../../common/t
import { useIsExperimentalFeatureEnabled } from '../../../hooks/use_experimental_features';
import { useTourContext } from '../../guided_onboarding_tour';
import { AlertsCasesTourSteps, SecurityStepId } from '../../guided_onboarding_tour/tour_config';
import { NotesEventTypes, DocumentEventTypes } from '../../../lib/telemetry';
import { getMappedNonEcsValue } from '../../../utils/get_mapped_non_ecs_value';
export type RowActionProps = EuiDataGridCellValueElementProps & {
@ -109,7 +110,7 @@ const RowActionComponent = ({
},
},
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: tableId,
panel: 'right',
});
@ -137,10 +138,10 @@ const RowActionComponent = ({
},
},
});
telemetry.reportOpenNoteInExpandableFlyoutClicked({
telemetry.reportEvent(NotesEventTypes.OpenNoteInExpandableFlyoutClicked, {
location: tableId,
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: tableId,
panel: 'left',
});

5
x-pack/plugins/security_solution/public/common/components/links/index.tsx
View file

@ -41,6 +41,7 @@ import {
import type { HostsTableType } from '../../../explore/hosts/store/model';
import type { UsersTableType } from '../../../explore/users/store/model';
import { useGetSecuritySolutionLinkProps, withSecuritySolutionLink } from './link_props';
import { EntityEventTypes } from '../../lib/telemetry';
export { useSecuritySolutionLinkProps, type GetSecuritySolutionLinkProps } from './link_props';
export { LinkButton, LinkAnchor } from './helpers';
@ -94,7 +95,7 @@ const UserDetailsLinkComponent: React.FC<{
const onClick = useCallback(
(e: SyntheticEvent) => {
telemetry.reportEntityDetailsClicked({ entity: 'user' });
telemetry.reportEvent(EntityEventTypes.EntityDetailsClicked, { entity: 'user' });
const callback = onClickParam ?? goToUsersDetails;
callback(e);
},
@ -171,7 +172,7 @@ const HostDetailsLinkComponent: React.FC<HostDetailsLinkProps> = ({
const onClick = useCallback(
(e: SyntheticEvent) => {
telemetry.reportEntityDetailsClicked({ entity: 'host' });
telemetry.reportEvent(EntityEventTypes.EntityDetailsClicked, { entity: 'host' });
const callback = onClickParam ?? goToHostDetails;
callback(e);

14
x-pack/plugins/security_solution/public/common/components/ml_popover/hooks/use_enable_data_feed.test.tsx
View file

@ -11,7 +11,7 @@ import { TestProviders } from '../../../mock';
import type { SecurityJob } from '../types';
import { createTelemetryServiceMock } from '../../../lib/telemetry/telemetry_service.mock';
import { ML_JOB_TELEMETRY_STATUS } from '../../../lib/telemetry';
import { ML_JOB_TELEMETRY_STATUS, EntityEventTypes } from '../../../lib/telemetry';
const wrapper = ({ children }: { children: React.ReactNode }) => (
<TestProviders>{children}</TestProviders>
@ -188,14 +188,14 @@ describe('useSecurityJobsHelpers', () => {
await result.current.enableDatafeed(JOB, TIMESTAMP);
});
expect(mockedTelemetry.reportMLJobUpdate).toHaveBeenCalledWith({
expect(mockedTelemetry.reportEvent).toHaveBeenCalledWith(EntityEventTypes.MLJobUpdate, {
status: ML_JOB_TELEMETRY_STATUS.moduleInstalled,
isElasticJob: true,
jobId,
moduleId,
});
expect(mockedTelemetry.reportMLJobUpdate).toHaveBeenCalledWith({
expect(mockedTelemetry.reportEvent).toHaveBeenCalledWith(EntityEventTypes.MLJobUpdate, {
status: ML_JOB_TELEMETRY_STATUS.started,
isElasticJob: true,
jobId,
@ -211,7 +211,7 @@ describe('useSecurityJobsHelpers', () => {
await result.current.enableDatafeed({ ...JOB, isInstalled: true }, TIMESTAMP);
});
expect(mockedTelemetry.reportMLJobUpdate).toHaveBeenCalledWith({
expect(mockedTelemetry.reportEvent).toHaveBeenCalledWith(EntityEventTypes.MLJobUpdate, {
status: ML_JOB_TELEMETRY_STATUS.startError,
errorMessage: 'Start job failure - test_error',
isElasticJob: true,
@ -228,7 +228,7 @@ describe('useSecurityJobsHelpers', () => {
await result.current.enableDatafeed(JOB, TIMESTAMP);
});
expect(mockedTelemetry.reportMLJobUpdate).toHaveBeenCalledWith({
expect(mockedTelemetry.reportEvent).toHaveBeenCalledWith(EntityEventTypes.MLJobUpdate, {
status: ML_JOB_TELEMETRY_STATUS.installationError,
errorMessage: 'Create job failure - test_error',
isElasticJob: true,
@ -295,7 +295,7 @@ describe('useSecurityJobsHelpers', () => {
await result.current.disableDatafeed({ ...JOB, isInstalled: true });
});
expect(mockedTelemetry.reportMLJobUpdate).toHaveBeenCalledWith({
expect(mockedTelemetry.reportEvent).toHaveBeenCalledWith(EntityEventTypes.MLJobUpdate, {
status: ML_JOB_TELEMETRY_STATUS.stopped,
isElasticJob: true,
jobId,
@ -311,7 +311,7 @@ describe('useSecurityJobsHelpers', () => {
await result.current.disableDatafeed({ ...JOB, isInstalled: true });
});
expect(mockedTelemetry.reportMLJobUpdate).toHaveBeenCalledWith({
expect(mockedTelemetry.reportEvent).toHaveBeenCalledWith(EntityEventTypes.MLJobUpdate, {
status: ML_JOB_TELEMETRY_STATUS.stopError,
errorMessage: 'Stop job failure - test_error',
isElasticJob: true,

13
x-pack/plugins/security_solution/public/common/components/ml_popover/hooks/use_enable_data_feed.ts
View file

@ -13,6 +13,7 @@ import {
METRIC_TYPE,
ML_JOB_TELEMETRY_STATUS,
TELEMETRY_EVENT,
EntityEventTypes,
track,
} from '../../../lib/telemetry';
@ -43,7 +44,7 @@ export const useEnableDataFeed = () => {
jobIdErrorFilter: [job.id],
groups: job.groups,
});
telemetry.reportMLJobUpdate({
telemetry.reportEvent(EntityEventTypes.MLJobUpdate, {
jobId: job.id,
isElasticJob: job.isElasticJob,
moduleId: job.moduleId,
@ -52,7 +53,7 @@ export const useEnableDataFeed = () => {
} catch (error) {
setIsLoading(false);
addError(error, { title: i18n.CREATE_JOB_FAILURE });
telemetry.reportMLJobUpdate({
telemetry.reportEvent(EntityEventTypes.MLJobUpdate, {
jobId: job.id,
isElasticJob: job.isElasticJob,
moduleId: job.moduleId,
@ -82,7 +83,7 @@ export const useEnableDataFeed = () => {
throw new Error(response[datafeedId].error);
}
telemetry.reportMLJobUpdate({
telemetry.reportEvent(EntityEventTypes.MLJobUpdate, {
jobId: job.id,
isElasticJob: job.isElasticJob,
status: ML_JOB_TELEMETRY_STATUS.started,
@ -92,7 +93,7 @@ export const useEnableDataFeed = () => {
} catch (error) {
track(METRIC_TYPE.COUNT, TELEMETRY_EVENT.JOB_ENABLE_FAILURE);
addError(error, { title: i18n.START_JOB_FAILURE });
telemetry.reportMLJobUpdate({
telemetry.reportEvent(EntityEventTypes.MLJobUpdate, {
jobId: job.id,
isElasticJob: job.isElasticJob,
status: ML_JOB_TELEMETRY_STATUS.startError,
@ -124,7 +125,7 @@ export const useEnableDataFeed = () => {
throw new Error(response.error);
}
telemetry.reportMLJobUpdate({
telemetry.reportEvent(EntityEventTypes.MLJobUpdate, {
jobId: job.id,
isElasticJob: job.isElasticJob,
status: ML_JOB_TELEMETRY_STATUS.stopped,
@ -134,7 +135,7 @@ export const useEnableDataFeed = () => {
} catch (error) {
track(METRIC_TYPE.COUNT, TELEMETRY_EVENT.JOB_DISABLE_FAILURE);
addError(error, { title: i18n.STOP_JOB_FAILURE });
telemetry.reportMLJobUpdate({
telemetry.reportEvent(EntityEventTypes.MLJobUpdate, {
jobId: job.id,
isElasticJob: job.isElasticJob,
status: ML_JOB_TELEMETRY_STATUS.stopError,

6
x-pack/plugins/security_solution/public/common/components/navigation/breadcrumbs/use_breadcrumbs_nav.test.ts
View file

@ -137,12 +137,12 @@ describe('useBreadcrumbsNav', () => {
});
it('should create breadcrumbs onClick handler', () => {
const reportBreadcrumbClickedMock = jest.fn();
const reportEventMock = jest.fn();
(kibanaLib.useKibana as jest.Mock).mockImplementation(() => ({
services: {
telemetry: {
reportBreadcrumbClicked: reportBreadcrumbClickedMock,
reportEvent: reportEventMock,
},
},
}));
@ -157,6 +157,6 @@ describe('useBreadcrumbsNav', () => {
expect(event.preventDefault).toHaveBeenCalled();
expect(mockDispatch).toHaveBeenCalled();
expect(reportBreadcrumbClickedMock).toHaveBeenCalled();
expect(reportEventMock).toHaveBeenCalled();
});
});

8
x-pack/plugins/security_solution/public/common/components/navigation/breadcrumbs/use_breadcrumbs_nav.ts
View file

@ -16,7 +16,7 @@ import { timelineActions } from '../../../../timelines/store';
import { TimelineId } from '../../../../../common/types/timeline';
import type { GetSecuritySolutionUrl } from '../../link_to';
import { useGetSecuritySolutionUrl } from '../../link_to';
import type { TelemetryClientStart } from '../../../lib/telemetry';
import { AppEventTypes, type TelemetryServiceStart } from '../../../lib/telemetry';
import { useKibana, useNavigateTo, type NavigateTo } from '../../../lib/kibana';
import { useRouteSpy } from '../../../utils/route/use_route_spy';
import { updateBreadcrumbsNav } from '../../../breadcrumbs';
@ -68,7 +68,7 @@ const addOnClicksHandlers = (
breadcrumbs: ChromeBreadcrumb[],
dispatch: Dispatch,
navigateTo: NavigateTo,
telemetry: TelemetryClientStart
telemetry: TelemetryServiceStart
): ChromeBreadcrumb[] =>
breadcrumbs.map((breadcrumb) => ({
...breadcrumb,
@ -89,13 +89,13 @@ const createOnClickHandler =
href: string,
dispatch: Dispatch,
navigateTo: NavigateTo,
telemetry: TelemetryClientStart,
telemetry: TelemetryServiceStart,
title: React.ReactNode
) =>
(ev: SyntheticEvent) => {
ev.preventDefault();
if (typeof title === 'string') {
telemetry.reportBreadcrumbClicked({ title });
telemetry.reportEvent(AppEventTypes.BreadcrumbClicked, { title });
}
dispatch(timelineActions.showTimeline({ id: TimelineId.active, show: false }));
navigateTo({ url: href });

49
x-pack/plugins/security_solution/public/common/lib/telemetry/constants.ts
View file

@ -52,52 +52,3 @@ export enum TELEMETRY_EVENT {
// AI assistant on rule creation form
OPEN_ASSISTANT_ON_RULE_QUERY_ERROR = 'open_assistant_on_rule_query_error',
}
export enum TelemetryEventTypes {
AlertsGroupingChanged = 'Alerts Grouping Changed',
AlertsGroupingToggled = 'Alerts Grouping Toggled',
AlertsGroupingTakeAction = 'Alerts Grouping Take Action',
BreadcrumbClicked = 'Breadcrumb Clicked',
AssistantInvoked = 'Assistant Invoked',
AssistantMessageSent = 'Assistant Message Sent',
AssistantQuickPrompt = 'Assistant Quick Prompt',
AssistantSettingToggled = 'Assistant Setting Toggled',
AssetCriticalityCsvPreviewGenerated = 'Asset Criticality Csv Preview Generated',
AssetCriticalityFileSelected = 'Asset Criticality File Selected',
AssetCriticalityCsvImported = 'Asset Criticality CSV Imported',
EntityDetailsClicked = 'Entity Details Clicked',
EntityAlertsClicked = 'Entity Alerts Clicked',
EntityRiskFiltered = 'Entity Risk Filtered',
EntityStoreEnablementToggleClicked = 'Entity Store Enablement Toggle Clicked',
EntityStoreDashboardInitButtonClicked = 'Entity Store Initialization Button Clicked',
MLJobUpdate = 'ML Job Update',
AddRiskInputToTimelineClicked = 'Add Risk Input To Timeline Clicked',
ToggleRiskSummaryClicked = 'Toggle Risk Summary Clicked',
RiskInputsExpandedFlyoutOpened = 'Risk Inputs Expanded Flyout Opened',
CellActionClicked = 'Cell Action Clicked',
AnomaliesCountClicked = 'Anomalies Count Clicked',
DataQualityIndexChecked = 'Data Quality Index Checked',
DataQualityCheckAllCompleted = 'Data Quality Check All Completed',
DetailsFlyoutOpened = 'Details Flyout Opened',
DetailsFlyoutTabClicked = 'Details Flyout Tabs Clicked',
OnboardingHubStepOpen = 'Onboarding Hub Step Open',
OnboardingHubStepFinished = 'Onboarding Hub Step Finished',
OnboardingHubStepLinkClicked = 'Onboarding Hub Step Link Clicked',
ManualRuleRunOpenModal = 'Manual Rule Run Open Modal',
ManualRuleRunExecute = 'Manual Rule Run Execute',
ManualRuleRunCancelJob = 'Manual Rule Run Cancel Job',
EventLogFilterByRunType = 'Event Log Filter By Run Type',
EventLogShowSourceEventDateRange = 'Event Log -> Show Source -> Event Date Range',
OpenNoteInExpandableFlyoutClicked = 'Open Note In Expandable Flyout Clicked',
AddNoteFromExpandableFlyoutClicked = 'Add Note From Expandable Flyout Clicked',
PreviewRule = 'Preview rule',
}
export enum ML_JOB_TELEMETRY_STATUS {
started = 'started',
startError = 'start_error',
stopped = 'stopped',
stopError = 'stop_error',
moduleInstalled = 'module_installed',
installationError = 'installationError',
}

27
x-pack/plugins/security_solution/public/common/lib/telemetry/events/ai_assistant/index.ts
View file

@ -5,11 +5,11 @@
* 2.0.
*/
import type { TelemetryEvent } from '../../types';
import { TelemetryEventTypes } from '../../constants';
import type { AssistantTelemetryEvent } from './types';
import { AssistantEventTypes } from './types';
export const assistantInvokedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.AssistantInvoked,
export const assistantInvokedEvent: AssistantTelemetryEvent = {
eventType: AssistantEventTypes.AssistantInvoked,
schema: {
conversationId: {
type: 'keyword',
@ -28,8 +28,8 @@ export const assistantInvokedEvent: TelemetryEvent = {
},
};
export const assistantMessageSentEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.AssistantMessageSent,
export const assistantMessageSentEvent: AssistantTelemetryEvent = {
eventType: AssistantEventTypes.AssistantMessageSent,
schema: {
conversationId: {
type: 'keyword',
@ -75,8 +75,8 @@ export const assistantMessageSentEvent: TelemetryEvent = {
},
};
export const assistantQuickPrompt: TelemetryEvent = {
eventType: TelemetryEventTypes.AssistantQuickPrompt,
export const assistantQuickPrompt: AssistantTelemetryEvent = {
eventType: AssistantEventTypes.AssistantQuickPrompt,
schema: {
conversationId: {
type: 'keyword',
@ -95,8 +95,8 @@ export const assistantQuickPrompt: TelemetryEvent = {
},
};
export const assistantSettingToggledEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.AssistantSettingToggled,
export const assistantSettingToggledEvent: AssistantTelemetryEvent = {
eventType: AssistantEventTypes.AssistantSettingToggled,
schema: {
alertsCountUpdated: {
type: 'boolean',
@ -114,3 +114,10 @@ export const assistantSettingToggledEvent: TelemetryEvent = {
},
},
};
export const assistantTelemetryEvents = [
assistantInvokedEvent,
assistantMessageSentEvent,
assistantQuickPrompt,
assistantSettingToggledEvent,
];

40
x-pack/plugins/security_solution/public/common/lib/telemetry/events/ai_assistant/types.ts
View file

@ -6,7 +6,13 @@
*/
import type { RootSchema } from '@kbn/core/public';
import type { TelemetryEventTypes } from '../../constants';
export enum AssistantEventTypes {
AssistantInvoked = 'Assistant Invoked',
AssistantMessageSent = 'Assistant Message Sent',
AssistantQuickPrompt = 'Assistant Quick Prompt',
AssistantSettingToggled = 'Assistant Setting Toggled',
}
export interface ReportAssistantInvokedParams {
conversationId: string;
@ -32,26 +38,14 @@ export interface ReportAssistantSettingToggledParams {
assistantStreamingEnabled?: boolean;
}
export type ReportAssistantTelemetryEventParams =
| ReportAssistantInvokedParams
| ReportAssistantMessageSentParams
| ReportAssistantSettingToggledParams
| ReportAssistantQuickPromptParams;
export interface AssistantTelemetryEventsMap {
[AssistantEventTypes.AssistantInvoked]: ReportAssistantInvokedParams;
[AssistantEventTypes.AssistantMessageSent]: ReportAssistantMessageSentParams;
[AssistantEventTypes.AssistantQuickPrompt]: ReportAssistantQuickPromptParams;
[AssistantEventTypes.AssistantSettingToggled]: ReportAssistantSettingToggledParams;
}
export type AssistantTelemetryEvent =
| {
eventType: TelemetryEventTypes.AssistantInvoked;
schema: RootSchema<ReportAssistantInvokedParams>;
}
| {
eventType: TelemetryEventTypes.AssistantSettingToggled;
schema: RootSchema<ReportAssistantSettingToggledParams>;
}
| {
eventType: TelemetryEventTypes.AssistantMessageSent;
schema: RootSchema<ReportAssistantMessageSentParams>;
}
| {
eventType: TelemetryEventTypes.AssistantQuickPrompt;
schema: RootSchema<ReportAssistantQuickPromptParams>;
};
export interface AssistantTelemetryEvent {
eventType: AssistantEventTypes;
schema: RootSchema<AssistantTelemetryEventsMap[AssistantEventTypes]>;
}

22
x-pack/plugins/security_solution/public/common/lib/telemetry/events/alerts_grouping/index.ts
View file

@ -5,11 +5,11 @@
* 2.0.
*/
import type { TelemetryEvent } from '../../types';
import { TelemetryEventTypes } from '../../constants';
import type { AlertsGroupingTelemetryEvent } from './types';
import { AlertsEventTypes } from './types';
export const alertsGroupingToggledEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.AlertsGroupingToggled,
export const alertsGroupingToggledEvent: AlertsGroupingTelemetryEvent = {
eventType: AlertsEventTypes.AlertsGroupingToggled,
schema: {
isOpen: {
type: 'boolean',
@ -35,8 +35,8 @@ export const alertsGroupingToggledEvent: TelemetryEvent = {
},
};
export const alertsGroupingChangedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.AlertsGroupingChanged,
export const alertsGroupingChangedEvent: AlertsGroupingTelemetryEvent = {
eventType: AlertsEventTypes.AlertsGroupingChanged,
schema: {
tableId: {
type: 'keyword',
@ -55,8 +55,8 @@ export const alertsGroupingChangedEvent: TelemetryEvent = {
},
};
export const alertsGroupingTakeActionEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.AlertsGroupingTakeAction,
export const alertsGroupingTakeActionEvent: AlertsGroupingTelemetryEvent = {
eventType: AlertsEventTypes.AlertsGroupingTakeAction,
schema: {
tableId: {
type: 'keyword',
@ -88,3 +88,9 @@ export const alertsGroupingTakeActionEvent: TelemetryEvent = {
},
},
};
export const alertsTelemetryEvents = [
alertsGroupingToggledEvent,
alertsGroupingChangedEvent,
alertsGroupingTakeActionEvent,
];

39
x-pack/plugins/security_solution/public/common/lib/telemetry/events/alerts_grouping/types.ts
View file

@ -6,41 +6,38 @@
*/
import type { RootSchema } from '@kbn/core/public';
import type { TelemetryEventTypes } from '../../constants';
export interface ReportAlertsGroupingChangedParams {
export enum AlertsEventTypes {
AlertsGroupingChanged = 'Alerts Grouping Changed',
AlertsGroupingToggled = 'Alerts Grouping Toggled',
AlertsGroupingTakeAction = 'Alerts Grouping Take Action',
}
interface ReportAlertsGroupingChangedParams {
tableId: string;
groupByField: string;
}
export interface ReportAlertsGroupingToggledParams {
interface ReportAlertsGroupingToggledParams {
isOpen: boolean;
tableId: string;
groupNumber: number;
}
export interface ReportAlertsTakeActionParams {
interface ReportAlertsTakeActionParams {
tableId: string;
groupNumber: number;
status: 'open' | 'closed' | 'acknowledged';
groupByField: string;
}
export type ReportAlertsGroupingTelemetryEventParams =
| ReportAlertsGroupingChangedParams
| ReportAlertsGroupingToggledParams
| ReportAlertsTakeActionParams;
export interface AlertsGroupingTelemetryEventsMap {
[AlertsEventTypes.AlertsGroupingChanged]: ReportAlertsGroupingChangedParams;
[AlertsEventTypes.AlertsGroupingToggled]: ReportAlertsGroupingToggledParams;
[AlertsEventTypes.AlertsGroupingTakeAction]: ReportAlertsTakeActionParams;
}
export type AlertsGroupingTelemetryEvent =
| {
eventType: TelemetryEventTypes.AlertsGroupingToggled;
schema: RootSchema<ReportAlertsGroupingToggledParams>;
}
| {
eventType: TelemetryEventTypes.AlertsGroupingChanged;
schema: RootSchema<ReportAlertsGroupingChangedParams>;
}
| {
eventType: TelemetryEventTypes.AlertsGroupingTakeAction;
schema: RootSchema<ReportAlertsTakeActionParams>;
};
export interface AlertsGroupingTelemetryEvent {
eventType: AlertsEventTypes;
schema: RootSchema<AlertsGroupingTelemetryEventsMap[AlertsEventTypes]>;
}

58
x-pack/plugins/security_solution/public/common/lib/telemetry/events/app/index.ts Normal file
View file

@ -0,0 +1,58 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import type { AppTelemetryEvent } from './types';
import { AppEventTypes } from './types';
const cellActionClickedEvent: AppTelemetryEvent = {
eventType: AppEventTypes.CellActionClicked,
schema: {
fieldName: {
type: 'keyword',
_meta: {
description: 'Field Name',
optional: false,
},
},
actionId: {
type: 'keyword',
_meta: {
description: 'Action id',
optional: false,
},
},
displayName: {
type: 'keyword',
_meta: {
description: 'User friendly action name',
optional: false,
},
},
metadata: {
type: 'pass_through',
_meta: {
description: 'Action metadata',
optional: true,
},
},
},
};
const breadCrumbClickedEvent: AppTelemetryEvent = {
eventType: AppEventTypes.BreadcrumbClicked,
schema: {
title: {
type: 'keyword',
_meta: {
description: 'Breadcrumb title',
optional: false,
},
},
},
};
export const appTelemetryEvents = [cellActionClickedEvent, breadCrumbClickedEvent];

34
x-pack/plugins/security_solution/public/common/lib/telemetry/events/app/types.ts Normal file
View file

@ -0,0 +1,34 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import type { RootSchema } from '@kbn/core/public';
import type { SecurityCellActionMetadata } from '../../../../../app/actions/types';
export enum AppEventTypes {
CellActionClicked = 'Cell Action Clicked',
BreadcrumbClicked = 'Breadcrumb Clicked',
}
interface ReportCellActionClickedParams {
metadata: SecurityCellActionMetadata | undefined;
displayName: string;
actionId: string;
fieldName: string;
}
interface ReportBreadcrumbClickedParams {
title: string;
}
export interface AppTelemetryEventsMap {
[AppEventTypes.CellActionClicked]: ReportCellActionClickedParams;
[AppEventTypes.BreadcrumbClicked]: ReportBreadcrumbClickedParams;
}
export interface AppTelemetryEvent {
eventType: AppEventTypes;
schema: RootSchema<AppTelemetryEventsMap[AppEventTypes]>;
}

19
x-pack/plugins/security_solution/public/common/lib/telemetry/events/data_quality/index.ts
View file

@ -5,14 +5,10 @@
* 2.0.
*/
import { TelemetryEventTypes } from '../../constants';
import type {
DataQualityTelemetryCheckAllCompletedEvent,
DataQualityTelemetryIndexCheckedEvent,
} from '../../types';
import { DataQualityEventTypes, type DataQualityTelemetryEvents } from './types';
export const dataQualityIndexCheckedEvent: DataQualityTelemetryIndexCheckedEvent = {
eventType: TelemetryEventTypes.DataQualityIndexChecked,
export const dataQualityIndexCheckedEvent: DataQualityTelemetryEvents = {
eventType: DataQualityEventTypes.DataQualityIndexChecked,
schema: {
batchId: {
type: 'keyword',
@ -163,8 +159,8 @@ export const dataQualityIndexCheckedEvent: DataQualityTelemetryIndexCheckedEvent
},
};
export const dataQualityCheckAllClickedEvent: DataQualityTelemetryCheckAllCompletedEvent = {
eventType: TelemetryEventTypes.DataQualityCheckAllCompleted,
export const dataQualityCheckAllClickedEvent: DataQualityTelemetryEvents = {
eventType: DataQualityEventTypes.DataQualityCheckAllCompleted,
schema: {
batchId: {
type: 'keyword',
@ -259,3 +255,8 @@ export const dataQualityCheckAllClickedEvent: DataQualityTelemetryCheckAllComple
},
},
};
export const dataQualityTelemetryEvents = [
dataQualityIndexCheckedEvent,
dataQualityCheckAllClickedEvent,
];

22
x-pack/plugins/security_solution/public/common/lib/telemetry/events/data_quality/types.ts
View file

@ -6,7 +6,11 @@
*/
import type { RootSchema } from '@kbn/core/public';
import type { TelemetryEventTypes } from '../../constants';
export enum DataQualityEventTypes {
DataQualityIndexChecked = 'Data Quality Index Checked',
DataQualityCheckAllCompleted = 'Data Quality Check All Completed',
}
export type ReportDataQualityIndexCheckedParams = ReportDataQualityCheckAllCompletedParams & {
errorCount?: number;
@ -34,16 +38,12 @@ export interface ReportDataQualityCheckAllCompletedParams {
timeConsumedMs?: number;
}
export interface DataQualityTelemetryIndexCheckedEvent {
eventType: TelemetryEventTypes.DataQualityIndexChecked;
schema: RootSchema<ReportDataQualityIndexCheckedParams>;
export interface DataQualityTelemetryEventsMap {
[DataQualityEventTypes.DataQualityIndexChecked]: ReportDataQualityIndexCheckedParams;
[DataQualityEventTypes.DataQualityCheckAllCompleted]: ReportDataQualityCheckAllCompletedParams;
}
export interface DataQualityTelemetryCheckAllCompletedEvent {
eventType: TelemetryEventTypes.DataQualityCheckAllCompleted;
schema: RootSchema<ReportDataQualityCheckAllCompletedParams>;
export interface DataQualityTelemetryEvents {
eventType: DataQualityEventTypes;
schema: RootSchema<DataQualityTelemetryEventsMap[DataQualityEventTypes]>;
}
export type DataQualityTelemetryEvents =
| DataQualityTelemetryIndexCheckedEvent
| DataQualityTelemetryCheckAllCompletedEvent;

17
x-pack/plugins/security_solution/public/common/lib/telemetry/events/document_details/index.ts
View file

@ -5,11 +5,11 @@
* 2.0.
*/
import type { TelemetryEvent } from '../../types';
import { TelemetryEventTypes } from '../../constants';
import type { DocumentDetailsTelemetryEvent } from './types';
import { DocumentEventTypes } from './types';
export const DocumentDetailsFlyoutOpenedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.DetailsFlyoutOpened,
export const DocumentDetailsFlyoutOpenedEvent: DocumentDetailsTelemetryEvent = {
eventType: DocumentEventTypes.DetailsFlyoutOpened,
schema: {
location: {
type: 'text',
@ -28,8 +28,8 @@ export const DocumentDetailsFlyoutOpenedEvent: TelemetryEvent = {
},
};
export const DocumentDetailsTabClickedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.DetailsFlyoutTabClicked,
export const DocumentDetailsTabClickedEvent: DocumentDetailsTelemetryEvent = {
eventType: DocumentEventTypes.DetailsFlyoutTabClicked,
schema: {
location: {
type: 'text',
@ -54,3 +54,8 @@ export const DocumentDetailsTabClickedEvent: TelemetryEvent = {
},
},
};
export const documentTelemetryEvents = [
DocumentDetailsFlyoutOpenedEvent,
DocumentDetailsTabClickedEvent,
];

30
x-pack/plugins/security_solution/public/common/lib/telemetry/events/document_details/types.ts
View file

@ -6,29 +6,29 @@
*/
import type { RootSchema } from '@kbn/core/public';
import type { TelemetryEventTypes } from '../../constants';
export interface ReportDetailsFlyoutOpenedParams {
export enum DocumentEventTypes {
DetailsFlyoutOpened = 'Details Flyout Opened',
DetailsFlyoutTabClicked = 'Details Flyout Tabs Clicked',
}
interface ReportDetailsFlyoutOpenedParams {
location: string;
panel: 'left' | 'right' | 'preview';
}
export interface ReportDetailsFlyoutTabClickedParams {
interface ReportDetailsFlyoutTabClickedParams {
location: string;
panel: 'left' | 'right';
tabId: string;
}
export type ReportDocumentDetailsTelemetryEventParams =
| ReportDetailsFlyoutOpenedParams
| ReportDetailsFlyoutTabClickedParams;
export interface DocumentDetailsTelemetryEventsMap {
[DocumentEventTypes.DetailsFlyoutOpened]: ReportDetailsFlyoutOpenedParams;
[DocumentEventTypes.DetailsFlyoutTabClicked]: ReportDetailsFlyoutTabClickedParams;
}
export type DocumentDetailsTelemetryEvents =
| {
eventType: TelemetryEventTypes.DetailsFlyoutOpened;
schema: RootSchema<ReportDetailsFlyoutOpenedParams>;
}
| {
eventType: TelemetryEventTypes.DetailsFlyoutTabClicked;
schema: RootSchema<ReportDetailsFlyoutTabClickedParams>;
};
export interface DocumentDetailsTelemetryEvent {
eventType: DocumentEventTypes;
schema: RootSchema<DocumentDetailsTelemetryEventsMap[DocumentEventTypes]>;
}

125
x-pack/plugins/security_solution/public/common/lib/telemetry/events/entity_analytics/index.ts
View file

@ -5,11 +5,11 @@
* 2.0.
*/
import type { TelemetryEvent } from '../../types';
import { TelemetryEventTypes } from '../../constants';
import type { EntityAnalyticsTelemetryEvent } from './types';
import { EntityEventTypes } from './types';
export const entityClickedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.EntityDetailsClicked,
export const entityClickedEvent: EntityAnalyticsTelemetryEvent = {
eventType: EntityEventTypes.EntityDetailsClicked,
schema: {
entity: {
type: 'keyword',
@ -21,8 +21,8 @@ export const entityClickedEvent: TelemetryEvent = {
},
};
export const entityAlertsClickedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.EntityAlertsClicked,
export const entityAlertsClickedEvent: EntityAnalyticsTelemetryEvent = {
eventType: EntityEventTypes.EntityAlertsClicked,
schema: {
entity: {
type: 'keyword',
@ -34,8 +34,8 @@ export const entityAlertsClickedEvent: TelemetryEvent = {
},
};
export const entityRiskFilteredEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.EntityRiskFiltered,
export const entityRiskFilteredEvent: EntityAnalyticsTelemetryEvent = {
eventType: EntityEventTypes.EntityRiskFiltered,
schema: {
entity: {
type: 'keyword',
@ -54,8 +54,8 @@ export const entityRiskFilteredEvent: TelemetryEvent = {
},
};
export const toggleRiskSummaryClickedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.ToggleRiskSummaryClicked,
export const toggleRiskSummaryClickedEvent: EntityAnalyticsTelemetryEvent = {
eventType: EntityEventTypes.ToggleRiskSummaryClicked,
schema: {
entity: {
type: 'keyword',
@ -74,8 +74,8 @@ export const toggleRiskSummaryClickedEvent: TelemetryEvent = {
},
};
export const RiskInputsExpandedFlyoutOpenedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.RiskInputsExpandedFlyoutOpened,
export const RiskInputsExpandedFlyoutOpenedEvent: EntityAnalyticsTelemetryEvent = {
eventType: EntityEventTypes.RiskInputsExpandedFlyoutOpened,
schema: {
entity: {
type: 'keyword',
@ -87,8 +87,8 @@ export const RiskInputsExpandedFlyoutOpenedEvent: TelemetryEvent = {
},
};
export const addRiskInputToTimelineClickedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.AddRiskInputToTimelineClicked,
export const addRiskInputToTimelineClickedEvent: EntityAnalyticsTelemetryEvent = {
eventType: EntityEventTypes.AddRiskInputToTimelineClicked,
schema: {
quantity: {
type: 'integer',
@ -100,8 +100,8 @@ export const addRiskInputToTimelineClickedEvent: TelemetryEvent = {
},
};
export const assetCriticalityFileSelectedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.AssetCriticalityFileSelected,
export const assetCriticalityFileSelectedEvent: EntityAnalyticsTelemetryEvent = {
eventType: EntityEventTypes.AssetCriticalityFileSelected,
schema: {
valid: {
type: 'boolean',
@ -131,8 +131,8 @@ export const assetCriticalityFileSelectedEvent: TelemetryEvent = {
},
};
export const assetCriticalityCsvPreviewGeneratedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.AssetCriticalityCsvPreviewGenerated,
export const assetCriticalityCsvPreviewGeneratedEvent: EntityAnalyticsTelemetryEvent = {
eventType: EntityEventTypes.AssetCriticalityCsvPreviewGenerated,
schema: {
file: {
properties: {
@ -198,8 +198,8 @@ export const assetCriticalityCsvPreviewGeneratedEvent: TelemetryEvent = {
},
};
export const assetCriticalityCsvImportedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.AssetCriticalityCsvImported,
export const assetCriticalityCsvImportedEvent: EntityAnalyticsTelemetryEvent = {
eventType: EntityEventTypes.AssetCriticalityCsvImported,
schema: {
file: {
properties: {
@ -215,8 +215,8 @@ export const assetCriticalityCsvImportedEvent: TelemetryEvent = {
},
};
export const entityStoreInitEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.EntityStoreDashboardInitButtonClicked,
export const entityStoreInitEvent: EntityAnalyticsTelemetryEvent = {
eventType: EntityEventTypes.EntityStoreDashboardInitButtonClicked,
schema: {
timestamp: {
type: 'date',
@ -228,8 +228,8 @@ export const entityStoreInitEvent: TelemetryEvent = {
},
};
export const entityStoreEnablementEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.EntityStoreEnablementToggleClicked,
export const entityStoreEnablementEvent: EntityAnalyticsTelemetryEvent = {
eventType: EntityEventTypes.EntityStoreEnablementToggleClicked,
schema: {
timestamp: {
type: 'date',
@ -247,3 +247,80 @@ export const entityStoreEnablementEvent: TelemetryEvent = {
},
},
};
const mlJobUpdateEvent: EntityAnalyticsTelemetryEvent = {
eventType: EntityEventTypes.MLJobUpdate,
schema: {
jobId: {
type: 'keyword',
_meta: {
description: 'Job id',
optional: false,
},
},
isElasticJob: {
type: 'boolean',
_meta: {
description: 'If true the job is one of the pre-configure security solution modules',
optional: false,
},
},
moduleId: {
type: 'keyword',
_meta: {
description: 'Module id',
optional: true,
},
},
status: {
type: 'keyword',
_meta: {
description: 'It describes what has changed in the job.',
optional: false,
},
},
errorMessage: {
type: 'text',
_meta: {
description: 'Error message',
optional: true,
},
},
},
};
const anomaliesCountClickedEvent: EntityAnalyticsTelemetryEvent = {
eventType: EntityEventTypes.AnomaliesCountClicked,
schema: {
jobId: {
type: 'keyword',
_meta: {
description: 'Job id',
optional: false,
},
},
count: {
type: 'integer',
_meta: {
description: 'Number of anomalies',
optional: false,
},
},
},
};
export const entityTelemetryEvents = [
entityClickedEvent,
entityAlertsClickedEvent,
entityRiskFilteredEvent,
assetCriticalityCsvPreviewGeneratedEvent,
assetCriticalityFileSelectedEvent,
assetCriticalityCsvImportedEvent,
entityStoreEnablementEvent,
entityStoreInitEvent,
toggleRiskSummaryClickedEvent,
RiskInputsExpandedFlyoutOpenedEvent,
addRiskInputToTimelineClickedEvent,
mlJobUpdateEvent,
anomaliesCountClickedEvent,
];

136
x-pack/plugins/security_solution/public/common/lib/telemetry/events/entity_analytics/types.ts
View file

@ -7,29 +7,52 @@
import type { RootSchema } from '@kbn/core/public';
import type { RiskSeverity } from '../../../../../../common/search_strategy';
import type { TelemetryEventTypes } from '../../constants';
export enum EntityEventTypes {
EntityDetailsClicked = 'Entity Details Clicked',
EntityAlertsClicked = 'Entity Alerts Clicked',
EntityRiskFiltered = 'Entity Risk Filtered',
EntityStoreEnablementToggleClicked = 'Entity Store Enablement Toggle Clicked',
EntityStoreDashboardInitButtonClicked = 'Entity Store Initialization Button Clicked',
ToggleRiskSummaryClicked = 'Toggle Risk Summary Clicked',
AddRiskInputToTimelineClicked = 'Add Risk Input To Timeline Clicked',
RiskInputsExpandedFlyoutOpened = 'Risk Inputs Expanded Flyout Opened',
AssetCriticalityCsvPreviewGenerated = 'Asset Criticality Csv Preview Generated',
AssetCriticalityFileSelected = 'Asset Criticality File Selected',
AssetCriticalityCsvImported = 'Asset Criticality CSV Imported',
AnomaliesCountClicked = 'Anomalies Count Clicked',
MLJobUpdate = 'ML Job Update',
}
export enum ML_JOB_TELEMETRY_STATUS {
started = 'started',
startError = 'start_error',
stopped = 'stopped',
stopError = 'stop_error',
moduleInstalled = 'module_installed',
installationError = 'installationError',
}
interface EntityParam {
entity: 'host' | 'user';
}
export type ReportEntityDetailsClickedParams = EntityParam;
export type ReportEntityAlertsClickedParams = EntityParam;
export interface ReportEntityRiskFilteredParams extends Partial<EntityParam> {
type ReportEntityDetailsClickedParams = EntityParam;
type ReportEntityAlertsClickedParams = EntityParam;
interface ReportEntityRiskFilteredParams extends Partial<EntityParam> {
selectedSeverity: RiskSeverity;
}
export interface ReportToggleRiskSummaryClickedParams extends EntityParam {
interface ReportToggleRiskSummaryClickedParams extends EntityParam {
action: 'show' | 'hide';
}
export type ReportRiskInputsExpandedFlyoutOpenedParams = EntityParam;
type ReportRiskInputsExpandedFlyoutOpenedParams = EntityParam;
export interface ReportAddRiskInputToTimelineClickedParams {
interface ReportAddRiskInputToTimelineClickedParams {
quantity: number;
}
export interface ReportAssetCriticalityFileSelectedParams {
interface ReportAssetCriticalityFileSelectedParams {
valid: boolean;
errorCode?: string;
file: {
@ -37,7 +60,7 @@ export interface ReportAssetCriticalityFileSelectedParams {
};
}
export interface ReportAssetCriticalityCsvPreviewGeneratedParams {
interface ReportAssetCriticalityCsvPreviewGeneratedParams {
file: {
size: number;
};
@ -53,76 +76,51 @@ export interface ReportAssetCriticalityCsvPreviewGeneratedParams {
};
}
export interface ReportAssetCriticalityCsvImportedParams {
interface ReportAssetCriticalityCsvImportedParams {
file: {
size: number;
};
}
export interface ReportEntityStoreEnablementParams {
interface ReportAnomaliesCountClickedParams {
jobId: string;
count: number;
}
interface ReportEntityStoreEnablementParams {
timestamp: string;
action: 'start' | 'stop';
}
export interface ReportEntityStoreInitParams {
interface ReportEntityStoreInitParams {
timestamp: string;
}
export type ReportEntityAnalyticsTelemetryEventParams =
| ReportEntityDetailsClickedParams
| ReportEntityAlertsClickedParams
| ReportEntityRiskFilteredParams
| ReportToggleRiskSummaryClickedParams
| ReportRiskInputsExpandedFlyoutOpenedParams
| ReportAddRiskInputToTimelineClickedParams
| ReportAssetCriticalityCsvPreviewGeneratedParams
| ReportAssetCriticalityFileSelectedParams
| ReportAssetCriticalityCsvImportedParams
| ReportEntityStoreEnablementParams
| ReportEntityStoreInitParams;
interface ReportMLJobUpdateParams {
jobId: string;
isElasticJob: boolean;
status: ML_JOB_TELEMETRY_STATUS;
moduleId?: string;
errorMessage?: string;
}
export type EntityAnalyticsTelemetryEvent =
| {
eventType: TelemetryEventTypes.EntityDetailsClicked;
schema: RootSchema<ReportEntityDetailsClickedParams>;
}
| {
eventType: TelemetryEventTypes.EntityAlertsClicked;
schema: RootSchema<ReportEntityAlertsClickedParams>;
}
| {
eventType: TelemetryEventTypes.EntityRiskFiltered;
schema: RootSchema<ReportEntityRiskFilteredParams>;
}
| {
eventType: TelemetryEventTypes.AddRiskInputToTimelineClicked;
schema: RootSchema<ReportAddRiskInputToTimelineClickedParams>;
}
| {
eventType: TelemetryEventTypes.ToggleRiskSummaryClicked;
schema: RootSchema<ReportToggleRiskSummaryClickedParams>;
}
| {
eventType: TelemetryEventTypes.RiskInputsExpandedFlyoutOpened;
schema: RootSchema<ReportRiskInputsExpandedFlyoutOpenedParams>;
}
| {
eventType: TelemetryEventTypes.AssetCriticalityCsvPreviewGenerated;
schema: RootSchema<ReportAssetCriticalityCsvPreviewGeneratedParams>;
}
| {
eventType: TelemetryEventTypes.AssetCriticalityFileSelected;
schema: RootSchema<ReportAssetCriticalityFileSelectedParams>;
}
| {
eventType: TelemetryEventTypes.AssetCriticalityCsvImported;
schema: RootSchema<ReportAssetCriticalityCsvImportedParams>;
}
| {
eventType: TelemetryEventTypes.EntityStoreEnablementToggleClicked;
schema: RootSchema<ReportEntityStoreEnablementParams>;
}
| {
eventType: TelemetryEventTypes.EntityStoreDashboardInitButtonClicked;
schema: RootSchema<ReportEntityStoreInitParams>;
};
export interface EntityAnalyticsTelemetryEventsMap {
[EntityEventTypes.EntityDetailsClicked]: ReportEntityDetailsClickedParams;
[EntityEventTypes.EntityAlertsClicked]: ReportEntityAlertsClickedParams;
[EntityEventTypes.EntityRiskFiltered]: ReportEntityRiskFilteredParams;
[EntityEventTypes.EntityStoreEnablementToggleClicked]: ReportEntityStoreEnablementParams;
[EntityEventTypes.EntityStoreDashboardInitButtonClicked]: ReportEntityStoreInitParams;
[EntityEventTypes.ToggleRiskSummaryClicked]: ReportToggleRiskSummaryClickedParams;
[EntityEventTypes.AddRiskInputToTimelineClicked]: ReportAddRiskInputToTimelineClickedParams;
[EntityEventTypes.RiskInputsExpandedFlyoutOpened]: ReportRiskInputsExpandedFlyoutOpenedParams;
[EntityEventTypes.AssetCriticalityCsvPreviewGenerated]: ReportAssetCriticalityCsvPreviewGeneratedParams;
[EntityEventTypes.AssetCriticalityFileSelected]: ReportAssetCriticalityFileSelectedParams;
[EntityEventTypes.AssetCriticalityCsvImported]: ReportAssetCriticalityCsvImportedParams;
[EntityEventTypes.AnomaliesCountClicked]: ReportAnomaliesCountClickedParams;
[EntityEventTypes.MLJobUpdate]: ReportMLJobUpdateParams;
}
export interface EntityAnalyticsTelemetryEvent {
eventType: EntityEventTypes;
schema: RootSchema<EntityAnalyticsTelemetryEventsMap[EntityEventTypes]>;
}

11
x-pack/plugins/security_solution/public/common/lib/telemetry/events/event_log/index.ts
View file

@ -6,10 +6,10 @@
*/
import type { EventLogTelemetryEvent } from './types';
import { TelemetryEventTypes } from '../../constants';
import { EventLogEventTypes } from './types';
export const eventLogFilterByRunTypeEvent: EventLogTelemetryEvent = {
eventType: TelemetryEventTypes.EventLogFilterByRunType,
eventType: EventLogEventTypes.EventLogFilterByRunType,
schema: {
runType: {
type: 'array',
@ -24,7 +24,7 @@ export const eventLogFilterByRunTypeEvent: EventLogTelemetryEvent = {
};
export const eventLogShowSourceEventDateRangeEvent: EventLogTelemetryEvent = {
eventType: TelemetryEventTypes.EventLogShowSourceEventDateRange,
eventType: EventLogEventTypes.EventLogShowSourceEventDateRange,
schema: {
isVisible: {
type: 'boolean',
@ -35,3 +35,8 @@ export const eventLogShowSourceEventDateRangeEvent: EventLogTelemetryEvent = {
},
},
};
export const eventLogTelemetryEvents = [
eventLogFilterByRunTypeEvent,
eventLogShowSourceEventDateRangeEvent,
];

29
x-pack/plugins/security_solution/public/common/lib/telemetry/events/event_log/types.ts
View file

@ -5,25 +5,24 @@
* 2.0.
*/
import type { RootSchema } from '@kbn/core/public';
import type { TelemetryEventTypes } from '../../constants';
export interface ReportEventLogFilterByRunTypeParams {
export enum EventLogEventTypes {
EventLogFilterByRunType = 'Event Log Filter By Run Type',
EventLogShowSourceEventDateRange = 'Event Log -> Show Source -> Event Date Range',
}
interface ReportEventLogFilterByRunTypeParams {
runType: string[];
}
export interface ReportEventLogShowSourceEventDateRangeParams {
interface ReportEventLogShowSourceEventDateRangeParams {
isVisible: boolean;
}
export type ReportEventLogTelemetryEventParams =
| ReportEventLogFilterByRunTypeParams
| ReportEventLogShowSourceEventDateRangeParams;
export interface EventLogTelemetryEventsMap {
[EventLogEventTypes.EventLogFilterByRunType]: ReportEventLogFilterByRunTypeParams;
[EventLogEventTypes.EventLogShowSourceEventDateRange]: ReportEventLogShowSourceEventDateRangeParams;
}
export type EventLogTelemetryEvent =
| {
eventType: TelemetryEventTypes.EventLogFilterByRunType;
schema: RootSchema<ReportEventLogFilterByRunTypeParams>;
}
| {
eventType: TelemetryEventTypes.EventLogShowSourceEventDateRange;
schema: RootSchema<ReportEventLogShowSourceEventDateRangeParams>;
};
export interface EventLogTelemetryEvent {
eventType: EventLogEventTypes;
schema: RootSchema<EventLogTelemetryEventsMap[EventLogEventTypes]>;
}

22
x-pack/plugins/security_solution/public/common/lib/telemetry/events/manual_rule_run/index.ts
View file

@ -5,11 +5,11 @@
* 2.0.
*/
import type { TelemetryEvent } from '../../types';
import { TelemetryEventTypes } from '../../constants';
import type { ManualRuleRunTelemetryEvent } from './types';
import { ManualRuleRunEventTypes } from './types';
export const manualRuleRunOpenModalEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.ManualRuleRunOpenModal,
export const manualRuleRunOpenModalEvent: ManualRuleRunTelemetryEvent = {
eventType: ManualRuleRunEventTypes.ManualRuleRunOpenModal,
schema: {
type: {
type: 'keyword',
@ -21,8 +21,8 @@ export const manualRuleRunOpenModalEvent: TelemetryEvent = {
},
};
export const manualRuleRunExecuteEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.ManualRuleRunExecute,
export const manualRuleRunExecuteEvent: ManualRuleRunTelemetryEvent = {
eventType: ManualRuleRunEventTypes.ManualRuleRunExecute,
schema: {
rangeInMs: {
type: 'integer',
@ -50,8 +50,8 @@ export const manualRuleRunExecuteEvent: TelemetryEvent = {
},
};
export const manualRuleRunCancelJobEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.ManualRuleRunCancelJob,
export const manualRuleRunCancelJobEvent: ManualRuleRunTelemetryEvent = {
eventType: ManualRuleRunEventTypes.ManualRuleRunCancelJob,
schema: {
totalTasks: {
type: 'integer',
@ -77,3 +77,9 @@ export const manualRuleRunCancelJobEvent: TelemetryEvent = {
},
},
};
export const manualRuleRunTelemetryEvents = [
manualRuleRunCancelJobEvent,
manualRuleRunExecuteEvent,
manualRuleRunOpenModalEvent,
];

38
x-pack/plugins/security_solution/public/common/lib/telemetry/events/manual_rule_run/types.ts
View file

@ -5,39 +5,35 @@
* 2.0.
*/
import type { RootSchema } from '@kbn/core/public';
import type { TelemetryEventTypes } from '../../constants';
export interface ReportManualRuleRunOpenModalParams {
export enum ManualRuleRunEventTypes {
ManualRuleRunOpenModal = 'Manual Rule Run Open Modal',
ManualRuleRunExecute = 'Manual Rule Run Execute',
ManualRuleRunCancelJob = 'Manual Rule Run Cancel Job',
}
interface ReportManualRuleRunOpenModalParams {
type: 'single' | 'bulk';
}
export interface ReportManualRuleRunExecuteParams {
interface ReportManualRuleRunExecuteParams {
rangeInMs: number;
rulesCount: number;
status: 'success' | 'error';
}
export interface ReportManualRuleRunCancelJobParams {
interface ReportManualRuleRunCancelJobParams {
totalTasks: number;
completedTasks: number;
errorTasks: number;
}
export type ReportManualRuleRunTelemetryEventParams =
| ReportManualRuleRunOpenModalParams
| ReportManualRuleRunExecuteParams
| ReportManualRuleRunCancelJobParams;
export interface ManualRuleRunTelemetryEventsMap {
[ManualRuleRunEventTypes.ManualRuleRunOpenModal]: ReportManualRuleRunOpenModalParams;
[ManualRuleRunEventTypes.ManualRuleRunExecute]: ReportManualRuleRunExecuteParams;
[ManualRuleRunEventTypes.ManualRuleRunCancelJob]: ReportManualRuleRunCancelJobParams;
}
export type ManualRuleRunTelemetryEvent =
| {
eventType: TelemetryEventTypes.ManualRuleRunOpenModal;
schema: RootSchema<ReportManualRuleRunOpenModalParams>;
}
| {
eventType: TelemetryEventTypes.ManualRuleRunExecute;
schema: RootSchema<ReportManualRuleRunExecuteParams>;
}
| {
eventType: TelemetryEventTypes.ManualRuleRunCancelJob;
schema: RootSchema<ReportManualRuleRunCancelJobParams>;
};
export interface ManualRuleRunTelemetryEvent {
eventType: ManualRuleRunEventTypes;
schema: RootSchema<ManualRuleRunTelemetryEventsMap[ManualRuleRunEventTypes]>;
}

17
x-pack/plugins/security_solution/public/common/lib/telemetry/events/notes/index.ts
View file

@ -5,11 +5,11 @@
* 2.0.
*/
import type { TelemetryEvent } from '../../types';
import { TelemetryEventTypes } from '../../constants';
import type { NotesTelemetryEvent } from './types';
import { NotesEventTypes } from './types';
export const openNoteInExpandableFlyoutClickedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.OpenNoteInExpandableFlyoutClicked,
export const openNoteInExpandableFlyoutClickedEvent: NotesTelemetryEvent = {
eventType: NotesEventTypes.OpenNoteInExpandableFlyoutClicked,
schema: {
location: {
type: 'text',
@ -21,8 +21,8 @@ export const openNoteInExpandableFlyoutClickedEvent: TelemetryEvent = {
},
};
export const addNoteFromExpandableFlyoutClickedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.AddNoteFromExpandableFlyoutClicked,
export const addNoteFromExpandableFlyoutClickedEvent: NotesTelemetryEvent = {
eventType: NotesEventTypes.AddNoteFromExpandableFlyoutClicked,
schema: {
isRelatedToATimeline: {
type: 'boolean',
@ -33,3 +33,8 @@ export const addNoteFromExpandableFlyoutClickedEvent: TelemetryEvent = {
},
},
};
export const notesTelemetryEvents = [
openNoteInExpandableFlyoutClickedEvent,
addNoteFromExpandableFlyoutClickedEvent,
];

30
x-pack/plugins/security_solution/public/common/lib/telemetry/events/notes/types.ts
View file

@ -6,26 +6,26 @@
*/
import type { RootSchema } from '@kbn/core/public';
import type { TelemetryEventTypes } from '../../constants';
export interface OpenNoteInExpandableFlyoutClickedParams {
interface OpenNoteInExpandableFlyoutClickedParams {
location: string;
}
export interface AddNoteFromExpandableFlyoutClickedParams {
interface AddNoteFromExpandableFlyoutClickedParams {
isRelatedToATimeline: boolean;
}
export type NotesTelemetryEventParams =
| OpenNoteInExpandableFlyoutClickedParams
| AddNoteFromExpandableFlyoutClickedParams;
export enum NotesEventTypes {
OpenNoteInExpandableFlyoutClicked = 'Open Note In Expandable Flyout Clicked',
AddNoteFromExpandableFlyoutClicked = 'Add Note From Expandable Flyout Clicked',
}
export type NotesTelemetryEvents =
| {
eventType: TelemetryEventTypes.OpenNoteInExpandableFlyoutClicked;
schema: RootSchema<OpenNoteInExpandableFlyoutClickedParams>;
}
| {
eventType: TelemetryEventTypes.AddNoteFromExpandableFlyoutClicked;
schema: RootSchema<AddNoteFromExpandableFlyoutClickedParams>;
};
export interface NotesTelemetryEventsMap {
[NotesEventTypes.OpenNoteInExpandableFlyoutClicked]: OpenNoteInExpandableFlyoutClickedParams;
[NotesEventTypes.AddNoteFromExpandableFlyoutClicked]: AddNoteFromExpandableFlyoutClickedParams;
}
export interface NotesTelemetryEvent {
eventType: NotesEventTypes;
schema: RootSchema<NotesTelemetryEventsMap[NotesEventTypes]>;
}

22
x-pack/plugins/security_solution/public/common/lib/telemetry/events/onboarding/index.ts
View file

@ -5,11 +5,11 @@
* 2.0.
*/
import type { TelemetryEvent } from '../../types';
import { TelemetryEventTypes } from '../../constants';
import type { OnboardingHubTelemetryEvent } from './types';
import { OnboardingHubEventTypes } from './types';
export const onboardingHubStepOpenEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.OnboardingHubStepOpen,
export const onboardingHubStepOpenEvent: OnboardingHubTelemetryEvent = {
eventType: OnboardingHubEventTypes.OnboardingHubStepOpen,
schema: {
stepId: {
type: 'keyword',
@ -28,8 +28,8 @@ export const onboardingHubStepOpenEvent: TelemetryEvent = {
},
};
export const onboardingHubStepLinkClickedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.OnboardingHubStepLinkClicked,
export const onboardingHubStepLinkClickedEvent: OnboardingHubTelemetryEvent = {
eventType: OnboardingHubEventTypes.OnboardingHubStepLinkClicked,
schema: {
originStepId: {
type: 'keyword',
@ -48,8 +48,8 @@ export const onboardingHubStepLinkClickedEvent: TelemetryEvent = {
},
};
export const onboardingHubStepFinishedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.OnboardingHubStepFinished,
export const onboardingHubStepFinishedEvent: OnboardingHubTelemetryEvent = {
eventType: OnboardingHubEventTypes.OnboardingHubStepFinished,
schema: {
stepId: {
type: 'keyword',
@ -74,3 +74,9 @@ export const onboardingHubStepFinishedEvent: TelemetryEvent = {
},
},
};
export const onboardingHubTelemetryEvents = [
onboardingHubStepOpenEvent,
onboardingHubStepLinkClickedEvent,
onboardingHubStepFinishedEvent,
];

38
x-pack/plugins/security_solution/public/common/lib/telemetry/events/onboarding/types.ts
View file

@ -5,18 +5,18 @@
* 2.0.
*/
import type { RootSchema } from '@kbn/core/public';
import type { TelemetryEventTypes } from '../../constants';
export type OnboardingHubStepOpenTrigger = 'navigation' | 'click';
export interface OnboardingHubStepOpenParams {
stepId: string;
trigger: OnboardingHubStepOpenTrigger;
export enum OnboardingHubEventTypes {
OnboardingHubStepOpen = 'Onboarding Hub Step Open',
OnboardingHubStepFinished = 'Onboarding Hub Step Finished',
OnboardingHubStepLinkClicked = 'Onboarding Hub Step Link Clicked',
}
export interface OnboardingHubStepOpen {
eventType: TelemetryEventTypes.OnboardingHubStepOpen;
schema: RootSchema<OnboardingHubStepOpenParams>;
type OnboardingHubStepOpenTrigger = 'navigation' | 'click';
interface OnboardingHubStepOpenParams {
stepId: string;
trigger: OnboardingHubStepOpenTrigger;
}
export interface OnboardingHubStepLinkClickedParams {
@ -24,11 +24,6 @@ export interface OnboardingHubStepLinkClickedParams {
stepLinkId: string;
}
export interface OnboardingHubStepLinkClicked {
eventType: TelemetryEventTypes.OnboardingHubStepLinkClicked;
schema: RootSchema<OnboardingHubStepLinkClickedParams>;
}
export type OnboardingHubStepFinishedTrigger = 'auto_check' | 'click';
export interface OnboardingHubStepFinishedParams {
@ -37,12 +32,13 @@ export interface OnboardingHubStepFinishedParams {
trigger: OnboardingHubStepFinishedTrigger;
}
export interface OnboardingHubStepFinished {
eventType: TelemetryEventTypes.OnboardingHubStepFinished;
schema: RootSchema<OnboardingHubStepFinishedParams>;
export interface OnboardingHubTelemetryEventsMap {
[OnboardingHubEventTypes.OnboardingHubStepOpen]: OnboardingHubStepOpenParams;
[OnboardingHubEventTypes.OnboardingHubStepFinished]: OnboardingHubStepFinishedParams;
[OnboardingHubEventTypes.OnboardingHubStepLinkClicked]: OnboardingHubStepLinkClickedParams;
}
export type OnboardingHubTelemetryEvent =
| OnboardingHubStepOpen
| OnboardingHubStepFinished
| OnboardingHubStepLinkClicked;
export interface OnboardingHubTelemetryEvent {
eventType: OnboardingHubEventTypes;
schema: RootSchema<OnboardingHubTelemetryEventsMap[OnboardingHubEventTypes]>;
}

10
x-pack/plugins/security_solution/public/common/lib/telemetry/events/preview_rule/index.ts
View file

@ -5,11 +5,11 @@
* 2.0.
*/
import type { TelemetryEvent } from '../../types';
import { TelemetryEventTypes } from '../../constants';
import type { PreviewRuleTelemetryEvent } from './types';
import { PreviewRuleEventTypes } from './types';
export const previewRuleEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.PreviewRule,
export const previewRuleEvent: PreviewRuleTelemetryEvent = {
eventType: PreviewRuleEventTypes.PreviewRule,
schema: {
ruleType: {
type: 'keyword',
@ -27,3 +27,5 @@ export const previewRuleEvent: TelemetryEvent = {
},
},
};
export const previewRuleTelemetryEvents = [previewRuleEvent];

17
x-pack/plugins/security_solution/public/common/lib/telemetry/events/preview_rule/types.ts
View file

@ -7,14 +7,21 @@
import type { Type } from '@kbn/securitysolution-io-ts-alerting-types';
import type { RootSchema } from '@kbn/core/public';
import type { TelemetryEventTypes } from '../../constants';
export interface PreviewRuleParams {
interface PreviewRuleParams {
ruleType: Type;
loggedRequestsEnabled: boolean;
}
export interface PreviewRuleTelemetryEvent {
eventType: TelemetryEventTypes.PreviewRule;
schema: RootSchema<PreviewRuleParams>;
export enum PreviewRuleEventTypes {
PreviewRule = 'Preview rule',
}
export interface PreviewRuleTelemetryEventsMap {
[PreviewRuleEventTypes.PreviewRule]: PreviewRuleParams;
}
export interface PreviewRuleTelemetryEvent {
eventType: PreviewRuleEventTypes;
schema: RootSchema<PreviewRuleTelemetryEventsMap[PreviewRuleEventTypes]>;
}

214
x-pack/plugins/security_solution/public/common/lib/telemetry/events/telemetry_events.ts
View file

@ -4,198 +4,28 @@
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import type { TelemetryEvent } from '../types';
import { TelemetryEventTypes } from '../constants';
import {
alertsGroupingChangedEvent,
alertsGroupingTakeActionEvent,
alertsGroupingToggledEvent,
} from './alerts_grouping';
import {
entityAlertsClickedEvent,
entityClickedEvent,
entityRiskFilteredEvent,
addRiskInputToTimelineClickedEvent,
RiskInputsExpandedFlyoutOpenedEvent,
toggleRiskSummaryClickedEvent,
assetCriticalityCsvPreviewGeneratedEvent,
assetCriticalityFileSelectedEvent,
assetCriticalityCsvImportedEvent,
entityStoreEnablementEvent,
entityStoreInitEvent,
} from './entity_analytics';
import {
assistantInvokedEvent,
assistantSettingToggledEvent,
assistantMessageSentEvent,
assistantQuickPrompt,
} from './ai_assistant';
import { dataQualityIndexCheckedEvent, dataQualityCheckAllClickedEvent } from './data_quality';
import {
DocumentDetailsFlyoutOpenedEvent,
DocumentDetailsTabClickedEvent,
} from './document_details';
import {
onboardingHubStepFinishedEvent,
onboardingHubStepLinkClickedEvent,
onboardingHubStepOpenEvent,
} from './onboarding';
import {
manualRuleRunCancelJobEvent,
manualRuleRunExecuteEvent,
manualRuleRunOpenModalEvent,
} from './manual_rule_run';
import { eventLogFilterByRunTypeEvent, eventLogShowSourceEventDateRangeEvent } from './event_log';
import {
addNoteFromExpandableFlyoutClickedEvent,
openNoteInExpandableFlyoutClickedEvent,
} from './notes';
import { previewRuleEvent } from './preview_rule';
const mlJobUpdateEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.MLJobUpdate,
schema: {
jobId: {
type: 'keyword',
_meta: {
description: 'Job id',
optional: false,
},
},
isElasticJob: {
type: 'boolean',
_meta: {
description: 'If true the job is one of the pre-configure security solution modules',
optional: false,
},
},
moduleId: {
type: 'keyword',
_meta: {
description: 'Module id',
optional: true,
},
},
status: {
type: 'keyword',
_meta: {
description: 'It describes what has changed in the job.',
optional: false,
},
},
errorMessage: {
type: 'text',
_meta: {
description: 'Error message',
optional: true,
},
},
},
};
const cellActionClickedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.CellActionClicked,
schema: {
fieldName: {
type: 'keyword',
_meta: {
description: 'Field Name',
optional: false,
},
},
actionId: {
type: 'keyword',
_meta: {
description: 'Action id',
optional: false,
},
},
displayName: {
type: 'keyword',
_meta: {
description: 'User friendly action name',
optional: false,
},
},
metadata: {
type: 'pass_through',
_meta: {
description: 'Action metadata',
optional: true,
},
},
},
};
const anomaliesCountClickedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.AnomaliesCountClicked,
schema: {
jobId: {
type: 'keyword',
_meta: {
description: 'Job id',
optional: false,
},
},
count: {
type: 'integer',
_meta: {
description: 'Number of anomalies',
optional: false,
},
},
},
};
const breadCrumbClickedEvent: TelemetryEvent = {
eventType: TelemetryEventTypes.BreadcrumbClicked,
schema: {
title: {
type: 'keyword',
_meta: {
description: 'Breadcrumb title',
optional: false,
},
},
},
};
import { assistantTelemetryEvents } from './ai_assistant';
import { alertsTelemetryEvents } from './alerts_grouping';
import { appTelemetryEvents } from './app';
import { dataQualityTelemetryEvents } from './data_quality';
import { documentTelemetryEvents } from './document_details';
import { entityTelemetryEvents } from './entity_analytics';
import { eventLogTelemetryEvents } from './event_log';
import { manualRuleRunTelemetryEvents } from './manual_rule_run';
import { notesTelemetryEvents } from './notes';
import { onboardingHubTelemetryEvents } from './onboarding';
import { previewRuleTelemetryEvents } from './preview_rule';
export const telemetryEvents = [
alertsGroupingToggledEvent,
alertsGroupingChangedEvent,
alertsGroupingTakeActionEvent,
assistantInvokedEvent,
assistantMessageSentEvent,
assistantQuickPrompt,
assistantSettingToggledEvent,
entityClickedEvent,
entityAlertsClickedEvent,
entityRiskFilteredEvent,
assetCriticalityCsvPreviewGeneratedEvent,
assetCriticalityFileSelectedEvent,
assetCriticalityCsvImportedEvent,
entityStoreEnablementEvent,
entityStoreInitEvent,
toggleRiskSummaryClickedEvent,
RiskInputsExpandedFlyoutOpenedEvent,
addRiskInputToTimelineClickedEvent,
mlJobUpdateEvent,
cellActionClickedEvent,
anomaliesCountClickedEvent,
dataQualityIndexCheckedEvent,
dataQualityCheckAllClickedEvent,
breadCrumbClickedEvent,
DocumentDetailsFlyoutOpenedEvent,
DocumentDetailsTabClickedEvent,
onboardingHubStepOpenEvent,
onboardingHubStepLinkClickedEvent,
onboardingHubStepFinishedEvent,
manualRuleRunCancelJobEvent,
manualRuleRunExecuteEvent,
manualRuleRunOpenModalEvent,
eventLogFilterByRunTypeEvent,
eventLogShowSourceEventDateRangeEvent,
openNoteInExpandableFlyoutClickedEvent,
addNoteFromExpandableFlyoutClickedEvent,
previewRuleEvent,
...assistantTelemetryEvents,
...alertsTelemetryEvents,
...previewRuleTelemetryEvents,
...entityTelemetryEvents,
...dataQualityTelemetryEvents,
...documentTelemetryEvents,
...onboardingHubTelemetryEvents,
...manualRuleRunTelemetryEvents,
...eventLogTelemetryEvents,
...notesTelemetryEvents,
...appTelemetryEvents,
];

14
x-pack/plugins/security_solution/public/common/lib/telemetry/index.ts
View file

@ -5,23 +5,9 @@
* 2.0.
*/
import type { AlertWorkflowStatus } from '../../types';
export { telemetryMiddleware } from './middleware';
export * from './constants';
export * from './telemetry_client';
export * from './telemetry_service';
export * from './track';
export * from './types';
export const getTelemetryEvent = {
groupedAlertsTakeAction: ({
tableId,
groupNumber,
status,
}: {
tableId: string;
groupNumber: number;
status: AlertWorkflowStatus;
}) => `alerts_table_${tableId}_group-${groupNumber}_mark-${status}`,
};

48
x-pack/plugins/security_solution/public/common/lib/telemetry/telemetry_client.mock.ts
View file

@ -1,48 +0,0 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import type { TelemetryClientStart } from './types';
export const createTelemetryClientMock = (): jest.Mocked<TelemetryClientStart> => ({
reportAlertsGroupingChanged: jest.fn(),
reportAlertsGroupingToggled: jest.fn(),
reportAlertsGroupingTakeAction: jest.fn(),
reportAssistantInvoked: jest.fn(),
reportAssistantMessageSent: jest.fn(),
reportAssistantQuickPrompt: jest.fn(),
reportAssistantSettingToggled: jest.fn(),
reportEntityDetailsClicked: jest.fn(),
reportEntityAlertsClicked: jest.fn(),
reportEntityRiskFiltered: jest.fn(),
reportMLJobUpdate: jest.fn(),
reportCellActionClicked: jest.fn(),
reportAnomaliesCountClicked: jest.fn(),
reportDataQualityIndexChecked: jest.fn(),
reportDataQualityCheckAllCompleted: jest.fn(),
reportBreadcrumbClicked: jest.fn(),
reportToggleRiskSummaryClicked: jest.fn(),
reportRiskInputsExpandedFlyoutOpened: jest.fn(),
reportAddRiskInputToTimelineClicked: jest.fn(),
reportDetailsFlyoutOpened: jest.fn(),
reportDetailsFlyoutTabClicked: jest.fn(),
reportOnboardingHubStepOpen: jest.fn(),
reportOnboardingHubStepLinkClicked: jest.fn(),
reportOnboardingHubStepFinished: jest.fn(),
reportAssetCriticalityCsvPreviewGenerated: jest.fn(),
reportAssetCriticalityFileSelected: jest.fn(),
reportAssetCriticalityCsvImported: jest.fn(),
reportEventLogFilterByRunType: jest.fn(),
reportEventLogShowSourceEventDateRange: jest.fn(),
reportManualRuleRunCancelJob: jest.fn(),
reportManualRuleRunExecute: jest.fn(),
reportManualRuleRunOpenModal: jest.fn(),
reportOpenNoteInExpandableFlyoutClicked: jest.fn(),
reportAddNoteFromExpandableFlyoutClicked: jest.fn(),
reportPreviewRule: jest.fn(),
reportEntityStoreEnablement: jest.fn(),
reportEntityStoreInit: jest.fn(),
});

229
x-pack/plugins/security_solution/public/common/lib/telemetry/telemetry_client.ts
View file

@ -1,229 +0,0 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import type { AnalyticsServiceSetup } from '@kbn/core-analytics-server';
import type {
AddNoteFromExpandableFlyoutClickedParams,
OpenNoteInExpandableFlyoutClickedParams,
} from './events/notes/types';
import type {
TelemetryClientStart,
ReportAlertsGroupingChangedParams,
ReportAlertsGroupingToggledParams,
ReportAlertsTakeActionParams,
ReportEntityDetailsClickedParams,
ReportEntityAlertsClickedParams,
ReportEntityRiskFilteredParams,
ReportMLJobUpdateParams,
ReportCellActionClickedParams,
ReportAnomaliesCountClickedParams,
ReportDataQualityIndexCheckedParams,
ReportDataQualityCheckAllCompletedParams,
ReportBreadcrumbClickedParams,
ReportAssistantInvokedParams,
ReportAssistantMessageSentParams,
ReportAssistantQuickPromptParams,
ReportAssistantSettingToggledParams,
ReportRiskInputsExpandedFlyoutOpenedParams,
ReportToggleRiskSummaryClickedParams,
ReportDetailsFlyoutOpenedParams,
ReportDetailsFlyoutTabClickedParams,
ReportAssetCriticalityCsvPreviewGeneratedParams,
ReportAssetCriticalityFileSelectedParams,
ReportAssetCriticalityCsvImportedParams,
ReportAddRiskInputToTimelineClickedParams,
OnboardingHubStepLinkClickedParams,
OnboardingHubStepOpenParams,
OnboardingHubStepFinishedParams,
ReportManualRuleRunCancelJobParams,
ReportManualRuleRunExecuteParams,
ReportManualRuleRunOpenModalParams,
ReportEventLogShowSourceEventDateRangeParams,
ReportEventLogFilterByRunTypeParams,
PreviewRuleParams,
ReportEntityStoreEnablementParams,
ReportEntityStoreInitParams,
} from './types';
import { TelemetryEventTypes } from './constants';
/**
* Client which aggregate all the available telemetry tracking functions
* for the plugin
*/
export class TelemetryClient implements TelemetryClientStart {
constructor(private analytics: AnalyticsServiceSetup) {}
public reportAlertsGroupingChanged = (params: ReportAlertsGroupingChangedParams) => {
this.analytics.reportEvent(TelemetryEventTypes.AlertsGroupingChanged, params);
};
public reportAlertsGroupingToggled = (params: ReportAlertsGroupingToggledParams) => {
this.analytics.reportEvent(TelemetryEventTypes.AlertsGroupingToggled, params);
};
public reportAlertsGroupingTakeAction = (params: ReportAlertsTakeActionParams) => {
this.analytics.reportEvent(TelemetryEventTypes.AlertsGroupingTakeAction, params);
};
public reportAssistantInvoked = (params: ReportAssistantInvokedParams) => {
this.analytics.reportEvent(TelemetryEventTypes.AssistantInvoked, params);
};
public reportAssistantMessageSent = (params: ReportAssistantMessageSentParams) => {
this.analytics.reportEvent(TelemetryEventTypes.AssistantMessageSent, params);
};
public reportAssistantQuickPrompt = (params: ReportAssistantQuickPromptParams) => {
this.analytics.reportEvent(TelemetryEventTypes.AssistantQuickPrompt, params);
};
public reportAssistantSettingToggled = (params: ReportAssistantSettingToggledParams) => {
this.analytics.reportEvent(TelemetryEventTypes.AssistantSettingToggled, params);
};
public reportEntityDetailsClicked = ({ entity }: ReportEntityDetailsClickedParams) => {
this.analytics.reportEvent(TelemetryEventTypes.EntityDetailsClicked, {
entity,
});
};
public reportEntityAlertsClicked = ({ entity }: ReportEntityAlertsClickedParams) => {
this.analytics.reportEvent(TelemetryEventTypes.EntityAlertsClicked, {
entity,
});
};
public reportEntityRiskFiltered = ({
entity,
selectedSeverity,
}: ReportEntityRiskFilteredParams) => {
this.analytics.reportEvent(TelemetryEventTypes.EntityRiskFiltered, {
entity,
selectedSeverity,
});
};
public reportAssetCriticalityCsvPreviewGenerated = (
params: ReportAssetCriticalityCsvPreviewGeneratedParams
) => {
this.analytics.reportEvent(TelemetryEventTypes.AssetCriticalityCsvPreviewGenerated, params);
};
public reportAssetCriticalityFileSelected = (
params: ReportAssetCriticalityFileSelectedParams
) => {
this.analytics.reportEvent(TelemetryEventTypes.AssetCriticalityFileSelected, params);
};
public reportAssetCriticalityCsvImported = (params: ReportAssetCriticalityCsvImportedParams) => {
this.analytics.reportEvent(TelemetryEventTypes.AssetCriticalityCsvImported, params);
};
public reportMLJobUpdate = (params: ReportMLJobUpdateParams) => {
this.analytics.reportEvent(TelemetryEventTypes.MLJobUpdate, params);
};
reportToggleRiskSummaryClicked(params: ReportToggleRiskSummaryClickedParams): void {
this.analytics.reportEvent(TelemetryEventTypes.ToggleRiskSummaryClicked, params);
}
reportRiskInputsExpandedFlyoutOpened(params: ReportRiskInputsExpandedFlyoutOpenedParams): void {
this.analytics.reportEvent(TelemetryEventTypes.RiskInputsExpandedFlyoutOpened, params);
}
reportAddRiskInputToTimelineClicked(params: ReportAddRiskInputToTimelineClickedParams): void {
this.analytics.reportEvent(TelemetryEventTypes.AddRiskInputToTimelineClicked, params);
}
public reportCellActionClicked = (params: ReportCellActionClickedParams) => {
this.analytics.reportEvent(TelemetryEventTypes.CellActionClicked, params);
};
public reportAnomaliesCountClicked = (params: ReportAnomaliesCountClickedParams) => {
this.analytics.reportEvent(TelemetryEventTypes.AnomaliesCountClicked, params);
};
public reportDataQualityIndexChecked = (params: ReportDataQualityIndexCheckedParams) => {
this.analytics.reportEvent(TelemetryEventTypes.DataQualityIndexChecked, params);
};
public reportDataQualityCheckAllCompleted = (
params: ReportDataQualityCheckAllCompletedParams
) => {
this.analytics.reportEvent(TelemetryEventTypes.DataQualityCheckAllCompleted, params);
};
public reportBreadcrumbClicked = ({ title }: ReportBreadcrumbClickedParams) => {
this.analytics.reportEvent(TelemetryEventTypes.BreadcrumbClicked, {
title,
});
};
public reportDetailsFlyoutOpened = (params: ReportDetailsFlyoutOpenedParams) => {
this.analytics.reportEvent(TelemetryEventTypes.DetailsFlyoutOpened, params);
};
public reportDetailsFlyoutTabClicked = (params: ReportDetailsFlyoutTabClickedParams) => {
this.analytics.reportEvent(TelemetryEventTypes.DetailsFlyoutTabClicked, params);
};
public reportOnboardingHubStepOpen = (params: OnboardingHubStepOpenParams) => {
this.analytics.reportEvent(TelemetryEventTypes.OnboardingHubStepOpen, params);
};
public reportOnboardingHubStepFinished = (params: OnboardingHubStepFinishedParams) => {
this.analytics.reportEvent(TelemetryEventTypes.OnboardingHubStepFinished, params);
};
public reportOnboardingHubStepLinkClicked = (params: OnboardingHubStepLinkClickedParams) => {
this.analytics.reportEvent(TelemetryEventTypes.OnboardingHubStepLinkClicked, params);
};
public reportManualRuleRunOpenModal = (params: ReportManualRuleRunOpenModalParams) => {
this.analytics.reportEvent(TelemetryEventTypes.ManualRuleRunOpenModal, params);
};
public reportManualRuleRunExecute = (params: ReportManualRuleRunExecuteParams) => {
this.analytics.reportEvent(TelemetryEventTypes.ManualRuleRunExecute, params);
};
public reportManualRuleRunCancelJob = (params: ReportManualRuleRunCancelJobParams) => {
this.analytics.reportEvent(TelemetryEventTypes.ManualRuleRunCancelJob, params);
};
public reportEventLogFilterByRunType = (params: ReportEventLogFilterByRunTypeParams) => {
this.analytics.reportEvent(TelemetryEventTypes.EventLogFilterByRunType, params);
};
public reportEventLogShowSourceEventDateRange(
params: ReportEventLogShowSourceEventDateRangeParams
): void {
this.analytics.reportEvent(TelemetryEventTypes.EventLogShowSourceEventDateRange, params);
}
public reportOpenNoteInExpandableFlyoutClicked = (
params: OpenNoteInExpandableFlyoutClickedParams
) => {
this.analytics.reportEvent(TelemetryEventTypes.OpenNoteInExpandableFlyoutClicked, params);
};
public reportAddNoteFromExpandableFlyoutClicked = (
params: AddNoteFromExpandableFlyoutClickedParams
) => {
this.analytics.reportEvent(TelemetryEventTypes.AddNoteFromExpandableFlyoutClicked, params);
};
public reportPreviewRule = (params: PreviewRuleParams) => {
this.analytics.reportEvent(TelemetryEventTypes.PreviewRule, params);
};
public reportEntityStoreEnablement = (params: ReportEntityStoreEnablementParams) => {
this.analytics.reportEvent(TelemetryEventTypes.EntityStoreEnablementToggleClicked, params);
};
public reportEntityStoreInit = (params: ReportEntityStoreInitParams) => {
this.analytics.reportEvent(TelemetryEventTypes.EntityStoreDashboardInitButtonClicked, params);
};
}

4
x-pack/plugins/security_solution/public/common/lib/telemetry/telemetry_service.mock.ts
View file

@ -5,6 +5,4 @@
* 2.0.
*/
import { createTelemetryClientMock } from './telemetry_client.mock';
export const createTelemetryServiceMock = () => createTelemetryClientMock();
export const createTelemetryServiceMock = () => ({ reportEvent: jest.fn() });

15
x-pack/plugins/security_solution/public/common/lib/telemetry/telemetry_service.test.ts
View file

@ -8,7 +8,7 @@ import { coreMock } from '@kbn/core/server/mocks';
import { telemetryEvents } from './events/telemetry_events';
import { TelemetryService } from './telemetry_service';
import { TelemetryEventTypes } from './constants';
import { AlertsEventTypes } from './types';
describe('TelemetryService', () => {
let service: TelemetryService;
@ -41,17 +41,12 @@ describe('TelemetryService', () => {
});
describe('#start()', () => {
it('should return all the available tracking methods', () => {
it('should return the tracking method', () => {
const setupParams = getSetupParams();
service.setup(setupParams);
const telemetry = service.start();
expect(telemetry).toHaveProperty('reportAlertsGroupingChanged');
expect(telemetry).toHaveProperty('reportAlertsGroupingToggled');
expect(telemetry).toHaveProperty('reportAlertsGroupingTakeAction');
expect(telemetry).toHaveProperty('reportDetailsFlyoutOpened');
expect(telemetry).toHaveProperty('reportDetailsFlyoutTabClicked');
expect(telemetry).toHaveProperty('reportEvent');
});
});
@ -61,7 +56,7 @@ describe('TelemetryService', () => {
service.setup(setupParams);
const telemetry = service.start();
telemetry.reportAlertsGroupingTakeAction({
telemetry.reportEvent(AlertsEventTypes.AlertsGroupingTakeAction, {
tableId: 'test-groupingId',
groupNumber: 0,
status: 'closed',
@ -70,7 +65,7 @@ describe('TelemetryService', () => {
expect(setupParams.analytics.reportEvent).toHaveBeenCalledTimes(1);
expect(setupParams.analytics.reportEvent).toHaveBeenCalledWith(
TelemetryEventTypes.AlertsGroupingTakeAction,
AlertsEventTypes.AlertsGroupingTakeAction,
{
tableId: 'test-groupingId',
groupNumber: 0,

21
x-pack/plugins/security_solution/public/common/lib/telemetry/telemetry_service.ts
View file

@ -8,13 +8,18 @@ import type { AnalyticsServiceSetup } from '@kbn/core-analytics-server';
import { of } from 'rxjs';
import type {
TelemetryEventTypeData,
TelemetryEventTypes,
TelemetryServiceSetupParams,
TelemetryClientStart,
TelemetryEventParams,
} from './types';
import { telemetryEvents } from './events/telemetry_events';
import { TelemetryClient } from './telemetry_client';
export interface TelemetryServiceStart {
reportEvent: <T extends TelemetryEventTypes>(
eventType: T,
eventData: TelemetryEventTypeData<T>
) => void;
}
/**
* Service that interacts with the Core's analytics module
* to trigger custom event for Security Solution plugin features
@ -41,17 +46,19 @@ export class TelemetryService {
});
}
telemetryEvents.forEach((eventConfig) =>
analytics.registerEventType<TelemetryEventParams>(eventConfig)
analytics.registerEventType<TelemetryEventTypeData<TelemetryEventTypes>>(eventConfig)
);
}
public start(): TelemetryClientStart {
if (!this.analytics) {
public start(): TelemetryServiceStart {
const reportEvent = this.analytics?.reportEvent.bind(this.analytics);
if (!this.analytics || !reportEvent) {
throw new Error(
'The TelemetryService.setup() method has not been invoked, be sure to call it during the plugin setup.'
);
}
return new TelemetryClient(this.analytics);
return { reportEvent };
}
}

248
x-pack/plugins/security_solution/public/common/lib/telemetry/types.ts
View file

@ -5,77 +5,41 @@
* 2.0.
*/
import type { AnalyticsServiceSetup, RootSchema } from '@kbn/core/public';
import type { SecurityCellActionMetadata } from '../../../app/actions/types';
import type { ML_JOB_TELEMETRY_STATUS, TelemetryEventTypes } from './constants';
import type { AnalyticsServiceSetup } from '@kbn/core/public';
import type {
AlertsGroupingTelemetryEvent,
ReportAlertsGroupingChangedParams,
ReportAlertsGroupingTelemetryEventParams,
ReportAlertsGroupingToggledParams,
ReportAlertsTakeActionParams,
AlertsEventTypes,
AlertsGroupingTelemetryEventsMap,
} from './events/alerts_grouping/types';
import type {
ReportDataQualityCheckAllCompletedParams,
ReportDataQualityIndexCheckedParams,
DataQualityTelemetryEvents,
DataQualityEventTypes,
DataQualityTelemetryEventsMap,
} from './events/data_quality/types';
import type {
EntityAnalyticsTelemetryEvent,
ReportAddRiskInputToTimelineClickedParams,
ReportEntityAlertsClickedParams,
ReportEntityAnalyticsTelemetryEventParams,
ReportEntityDetailsClickedParams,
ReportEntityRiskFilteredParams,
ReportRiskInputsExpandedFlyoutOpenedParams,
ReportToggleRiskSummaryClickedParams,
ReportAssetCriticalityCsvPreviewGeneratedParams,
ReportAssetCriticalityFileSelectedParams,
ReportAssetCriticalityCsvImportedParams,
ReportEntityStoreEnablementParams,
ReportEntityStoreInitParams,
EntityAnalyticsTelemetryEventsMap,
EntityEventTypes,
} from './events/entity_analytics/types';
import type { AssistantEventTypes, AssistantTelemetryEventsMap } from './events/ai_assistant/types';
import type {
AssistantTelemetryEvent,
ReportAssistantTelemetryEventParams,
ReportAssistantInvokedParams,
ReportAssistantQuickPromptParams,
ReportAssistantMessageSentParams,
ReportAssistantSettingToggledParams,
} from './events/ai_assistant/types';
import type {
DocumentDetailsTelemetryEvents,
ReportDocumentDetailsTelemetryEventParams,
ReportDetailsFlyoutOpenedParams,
ReportDetailsFlyoutTabClickedParams,
DocumentDetailsTelemetryEventsMap,
DocumentEventTypes,
} from './events/document_details/types';
import type {
OnboardingHubStepFinishedParams,
OnboardingHubStepLinkClickedParams,
OnboardingHubStepOpenParams,
OnboardingHubTelemetryEvent,
OnboardingHubEventTypes,
OnboardingHubTelemetryEventsMap,
} from './events/onboarding/types';
import type {
ManualRuleRunTelemetryEvent,
ReportManualRuleRunOpenModalParams,
ReportManualRuleRunExecuteParams,
ReportManualRuleRunCancelJobParams,
ReportManualRuleRunTelemetryEventParams,
ManualRuleRunEventTypes,
ManualRuleRunTelemetryEventsMap,
} from './events/manual_rule_run/types';
import type { EventLogEventTypes, EventLogTelemetryEventsMap } from './events/event_log/types';
import type { NotesEventTypes, NotesTelemetryEventsMap } from './events/notes/types';
import type {
EventLogTelemetryEvent,
ReportEventLogFilterByRunTypeParams,
ReportEventLogShowSourceEventDateRangeParams,
ReportEventLogTelemetryEventParams,
} from './events/event_log/types';
import type {
AddNoteFromExpandableFlyoutClickedParams,
NotesTelemetryEventParams,
NotesTelemetryEvents,
OpenNoteInExpandableFlyoutClickedParams,
} from './events/notes/types';
import type { PreviewRuleParams, PreviewRuleTelemetryEvent } from './events/preview_rule/types';
PreviewRuleEventTypes,
PreviewRuleTelemetryEventsMap,
} from './events/preview_rule/types';
import type { AppEventTypes, AppTelemetryEventsMap } from './events/app/types';
export * from './events/app/types';
export * from './events/ai_assistant/types';
export * from './events/alerts_grouping/types';
export * from './events/data_quality/types';
@ -85,142 +49,46 @@ export * from './events/document_details/types';
export * from './events/manual_rule_run/types';
export * from './events/event_log/types';
export * from './events/preview_rule/types';
export * from './events/notes/types';
export interface TelemetryServiceSetupParams {
analytics: AnalyticsServiceSetup;
}
export interface ReportMLJobUpdateParams {
jobId: string;
isElasticJob: boolean;
status: ML_JOB_TELEMETRY_STATUS;
moduleId?: string;
errorMessage?: string;
}
// Combine all event type data
export type TelemetryEventTypeData<T extends TelemetryEventTypes> = T extends AssistantEventTypes
? AssistantTelemetryEventsMap[T]
: T extends AlertsEventTypes
? AlertsGroupingTelemetryEventsMap[T]
: T extends PreviewRuleEventTypes
? PreviewRuleTelemetryEventsMap[T]
: T extends EntityEventTypes
? EntityAnalyticsTelemetryEventsMap[T]
: T extends DataQualityEventTypes
? DataQualityTelemetryEventsMap[T]
: T extends DocumentEventTypes
? DocumentDetailsTelemetryEventsMap[T]
: T extends OnboardingHubEventTypes
? OnboardingHubTelemetryEventsMap[T]
: T extends ManualRuleRunEventTypes
? ManualRuleRunTelemetryEventsMap[T]
: T extends EventLogEventTypes
? EventLogTelemetryEventsMap[T]
: T extends NotesEventTypes
? NotesTelemetryEventsMap[T]
: T extends AppEventTypes
? AppTelemetryEventsMap[T]
: never;
export interface ReportCellActionClickedParams {
metadata: SecurityCellActionMetadata | undefined;
displayName: string;
actionId: string;
fieldName: string;
}
export interface ReportAnomaliesCountClickedParams {
jobId: string;
count: number;
}
export interface ReportBreadcrumbClickedParams {
title: string;
}
export type TelemetryEventParams =
| ReportAlertsGroupingTelemetryEventParams
| ReportAssistantTelemetryEventParams
| ReportEntityAnalyticsTelemetryEventParams
| ReportMLJobUpdateParams
| ReportCellActionClickedParams
| ReportAnomaliesCountClickedParams
| ReportDataQualityIndexCheckedParams
| ReportDataQualityCheckAllCompletedParams
| ReportBreadcrumbClickedParams
| ReportDocumentDetailsTelemetryEventParams
| OnboardingHubStepOpenParams
| OnboardingHubStepFinishedParams
| OnboardingHubStepLinkClickedParams
| ReportManualRuleRunTelemetryEventParams
| ReportEventLogTelemetryEventParams
| PreviewRuleParams
| NotesTelemetryEventParams;
export interface TelemetryClientStart {
reportAlertsGroupingChanged(params: ReportAlertsGroupingChangedParams): void;
reportAlertsGroupingToggled(params: ReportAlertsGroupingToggledParams): void;
reportAlertsGroupingTakeAction(params: ReportAlertsTakeActionParams): void;
// Assistant
reportAssistantInvoked(params: ReportAssistantInvokedParams): void;
reportAssistantMessageSent(params: ReportAssistantMessageSentParams): void;
reportAssistantQuickPrompt(params: ReportAssistantQuickPromptParams): void;
reportAssistantSettingToggled(params: ReportAssistantSettingToggledParams): void;
// Entity Analytics
reportEntityDetailsClicked(params: ReportEntityDetailsClickedParams): void;
reportEntityAlertsClicked(params: ReportEntityAlertsClickedParams): void;
reportEntityRiskFiltered(params: ReportEntityRiskFilteredParams): void;
reportMLJobUpdate(params: ReportMLJobUpdateParams): void;
// Entity Analytics inside Entity Flyout
reportToggleRiskSummaryClicked(params: ReportToggleRiskSummaryClickedParams): void;
reportRiskInputsExpandedFlyoutOpened(params: ReportRiskInputsExpandedFlyoutOpenedParams): void;
reportAddRiskInputToTimelineClicked(params: ReportAddRiskInputToTimelineClickedParams): void;
// Entity Analytics Asset Criticality
reportAssetCriticalityFileSelected(params: ReportAssetCriticalityFileSelectedParams): void;
reportAssetCriticalityCsvPreviewGenerated(
params: ReportAssetCriticalityCsvPreviewGeneratedParams
): void;
reportAssetCriticalityCsvImported(params: ReportAssetCriticalityCsvImportedParams): void;
reportCellActionClicked(params: ReportCellActionClickedParams): void;
// Entity Analytics Entity Store
reportEntityStoreEnablement(params: ReportEntityStoreEnablementParams): void;
reportEntityStoreInit(params: ReportEntityStoreInitParams): void;
reportAnomaliesCountClicked(params: ReportAnomaliesCountClickedParams): void;
reportDataQualityIndexChecked(params: ReportDataQualityIndexCheckedParams): void;
reportDataQualityCheckAllCompleted(params: ReportDataQualityCheckAllCompletedParams): void;
reportBreadcrumbClicked(params: ReportBreadcrumbClickedParams): void;
// document details flyout
reportDetailsFlyoutOpened(params: ReportDetailsFlyoutOpenedParams): void;
reportDetailsFlyoutTabClicked(params: ReportDetailsFlyoutTabClickedParams): void;
// onboarding hub
reportOnboardingHubStepOpen(params: OnboardingHubStepOpenParams): void;
reportOnboardingHubStepFinished(params: OnboardingHubStepFinishedParams): void;
reportOnboardingHubStepLinkClicked(params: OnboardingHubStepLinkClickedParams): void;
// manual rule run
reportManualRuleRunOpenModal(params: ReportManualRuleRunOpenModalParams): void;
reportManualRuleRunExecute(params: ReportManualRuleRunExecuteParams): void;
reportManualRuleRunCancelJob(params: ReportManualRuleRunCancelJobParams): void;
// event log
reportEventLogFilterByRunType(params: ReportEventLogFilterByRunTypeParams): void;
reportEventLogShowSourceEventDateRange(
params: ReportEventLogShowSourceEventDateRangeParams
): void;
// new notes
reportOpenNoteInExpandableFlyoutClicked(params: OpenNoteInExpandableFlyoutClickedParams): void;
reportAddNoteFromExpandableFlyoutClicked(params: AddNoteFromExpandableFlyoutClickedParams): void;
// preview rule
reportPreviewRule(params: PreviewRuleParams): void;
}
export type TelemetryEvent =
| AssistantTelemetryEvent
| AlertsGroupingTelemetryEvent
| EntityAnalyticsTelemetryEvent
| DataQualityTelemetryEvents
| DocumentDetailsTelemetryEvents
| {
eventType: TelemetryEventTypes.MLJobUpdate;
schema: RootSchema<ReportMLJobUpdateParams>;
}
| {
eventType: TelemetryEventTypes.CellActionClicked;
schema: RootSchema<ReportCellActionClickedParams>;
}
| {
eventType: TelemetryEventTypes.AnomaliesCountClicked;
schema: RootSchema<ReportAnomaliesCountClickedParams>;
}
| {
eventType: TelemetryEventTypes.BreadcrumbClicked;
schema: RootSchema<ReportBreadcrumbClickedParams>;
}
| OnboardingHubTelemetryEvent
| ManualRuleRunTelemetryEvent
| EventLogTelemetryEvent
| PreviewRuleTelemetryEvent
| NotesTelemetryEvents;
export type TelemetryEventTypes =
| AssistantEventTypes
| AlertsEventTypes
| PreviewRuleEventTypes
| EntityEventTypes
| DataQualityEventTypes
| DocumentEventTypes
| OnboardingHubEventTypes
| ManualRuleRunEventTypes
| EventLogEventTypes
| NotesEventTypes
| AppEventTypes;

3
x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/rule_preview/use_preview_rule.ts
View file

@ -18,6 +18,7 @@ import { transformOutput } from '../../../../detections/containers/detection_eng
import type { TimeframePreviewOptions } from '../../../../detections/pages/detection_engine/rules/types';
import { usePreviewInvocationCount } from './use_preview_invocation_count';
import * as i18n from './translations';
import { PreviewRuleEventTypes } from '../../../../common/lib/telemetry';
const emptyPreviewRule: RulePreviewResponse = {
previewId: undefined,
@ -58,7 +59,7 @@ export const usePreviewRule = ({
const createPreviewId = async () => {
if (rule != null) {
try {
telemetry.reportPreviewRule({
telemetry.reportEvent(PreviewRuleEventTypes.PreviewRule, {
loggedRequestsEnabled: enableLoggedRequests ?? false,
ruleType: rule.type,
});

4
x-pack/plugins/security_solution/public/detection_engine/rule_details_ui/pages/rule_details/execution_log_table/execution_log_table.test.tsx
View file

@ -32,7 +32,7 @@ jest.mock('../../../../../common/hooks/use_experimental_features', () => {
});
const mockTelemetry = {
reportEventLogShowSourceEventDateRange: jest.fn(),
reportEvent: jest.fn(),
};
const mockedUseKibana = {
@ -91,6 +91,6 @@ describe('ExecutionLogTable', () => {
fireEvent.click(switchButton);
expect(mockTelemetry.reportEventLogShowSourceEventDateRange).toHaveBeenCalled();
expect(mockTelemetry.reportEvent).toHaveBeenCalled();
});
});

3
x-pack/plugins/security_solution/public/detection_engine/rule_details_ui/pages/rule_details/execution_log_table/execution_log_table.tsx
View file

@ -85,6 +85,7 @@ import {
getSourceEventTimeRangeColumns,
} from './execution_log_columns';
import { ExecutionLogSearchBar } from './execution_log_search_bar';
import { EventLogEventTypes } from '../../../../../common/lib/telemetry';
const EXECUTION_UUID_FIELD_NAME = 'kibana.alert.rule.execution.uuid';
@ -470,7 +471,7 @@ const ExecutionLogTableComponent: React.FC<ExecutionLogTableProps> = ({
(e: EuiSwitchEvent) => {
const isVisible = e.target.checked;
onShowSourceEventTimeRange(isVisible);
telemetry.reportEventLogShowSourceEventDateRange({
telemetry.reportEvent(EventLogEventTypes.EventLogShowSourceEventDateRange, {
isVisible,
});
},

16
x-pack/plugins/security_solution/public/detection_engine/rule_gaps/components/rule_backfills_info/stop_backfill.test.tsx
View file

@ -14,6 +14,7 @@ import { TestProviders } from '../../../../common/mock';
import { useKibana } from '../../../../common/lib/kibana';
import * as i18n from '../../translations';
import type { BackfillRow } from '../../types';
import { ManualRuleRunEventTypes } from '../../../../common/lib/telemetry';
jest.mock('../../../../common/hooks/use_app_toasts');
jest.mock('../../api/hooks/use_delete_backfill');
@ -25,7 +26,7 @@ const mockUseKibana = useKibana as jest.Mock;
describe('StopBackfill', () => {
const mockTelemetry = {
reportManualRuleRunCancelJob: jest.fn(),
reportEvent: jest.fn(),
};
const addSuccess = jest.fn();
@ -90,11 +91,14 @@ describe('StopBackfill', () => {
fireEvent.click(getByTestId('confirmModalConfirmButton'));
await waitFor(() => {
expect(mockTelemetry.reportManualRuleRunCancelJob).toHaveBeenCalledWith({
totalTasks: backfill.total,
completedTasks: backfill.complete,
errorTasks: backfill.error,
});
expect(mockTelemetry.reportEvent).toHaveBeenCalledWith(
ManualRuleRunEventTypes.ManualRuleRunCancelJob,
{
totalTasks: backfill.total,
completedTasks: backfill.complete,
errorTasks: backfill.error,
}
);
});
expect(addSuccess).toHaveBeenCalledWith(i18n.BACKFILLS_TABLE_STOP_CONFIRMATION_SUCCESS);

3
x-pack/plugins/security_solution/public/detection_engine/rule_gaps/components/rule_backfills_info/stop_backfill.tsx
View file

@ -12,6 +12,7 @@ import { useDeleteBackfill } from '../../api/hooks/use_delete_backfill';
import * as i18n from '../../translations';
import type { BackfillRow } from '../../types';
import { useKibana } from '../../../../common/lib/kibana';
import { ManualRuleRunEventTypes } from '../../../../common/lib/telemetry';
export const StopBackfill = ({ backfill }: { backfill: BackfillRow }) => {
const { telemetry } = useKibana().services;
@ -19,7 +20,7 @@ export const StopBackfill = ({ backfill }: { backfill: BackfillRow }) => {
const deleteBackfillMutation = useDeleteBackfill({
onSuccess: () => {
closeModal();
telemetry.reportManualRuleRunCancelJob({
telemetry.reportEvent(ManualRuleRunEventTypes.ManualRuleRunCancelJob, {
totalTasks: backfill.total,
completedTasks: backfill.complete,
errorTasks: backfill.error,

33
x-pack/plugins/security_solution/public/detection_engine/rule_gaps/logic/use_schedule_rule_run.test.tsx
View file

@ -11,6 +11,7 @@ import { useKibana } from '../../../common/lib/kibana';
import { useKibana as mockUseKibana } from '../../../common/lib/kibana/__mocks__';
import { TestProviders } from '../../../common/mock';
import { useScheduleRuleRun } from './use_schedule_rule_run';
import { ManualRuleRunEventTypes } from '../../../common/lib/telemetry';
const mockUseScheduleRuleRunMutation = jest.fn();
@ -28,7 +29,7 @@ const mockedUseKibana = {
services: {
...mockUseKibana().services,
telemetry: {
reportManualRuleRunExecute: jest.fn(),
reportEvent: jest.fn(),
},
},
};
@ -61,7 +62,7 @@ describe('When using the `useScheduleRuleRun()` hook', () => {
);
});
it('should call reportManualRuleRunExecute with success status on success', async () => {
it('should call reportEvent with success status on success', async () => {
const { result, waitFor } = renderHook(() => useScheduleRuleRun(), {
wrapper: TestProviders,
});
@ -77,14 +78,17 @@ describe('When using the `useScheduleRuleRun()` hook', () => {
return mockUseScheduleRuleRunMutation.mock.calls.length > 0;
});
expect(mockedUseKibana.services.telemetry.reportManualRuleRunExecute).toHaveBeenCalledWith({
rangeInMs: timeRange.endDate.diff(timeRange.startDate),
status: 'success',
rulesCount: 1,
});
expect(mockedUseKibana.services.telemetry.reportEvent).toHaveBeenCalledWith(
ManualRuleRunEventTypes.ManualRuleRunExecute,
{
rangeInMs: timeRange.endDate.diff(timeRange.startDate),
status: 'success',
rulesCount: 1,
}
);
});
it('should call reportManualRuleRunExecute with error status on failure', async () => {
it('should call reportEvent with error status on failure', async () => {
const { result, waitFor } = renderHook(() => useScheduleRuleRun(), {
wrapper: TestProviders,
});
@ -100,10 +104,13 @@ describe('When using the `useScheduleRuleRun()` hook', () => {
return mockUseScheduleRuleRunMutation.mock.calls.length > 0;
});
expect(mockedUseKibana.services.telemetry.reportManualRuleRunExecute).toHaveBeenCalledWith({
rangeInMs: timeRange.endDate.diff(timeRange.startDate),
status: 'error',
rulesCount: 1,
});
expect(mockedUseKibana.services.telemetry.reportEvent).toHaveBeenCalledWith(
ManualRuleRunEventTypes.ManualRuleRunExecute,
{
rangeInMs: timeRange.endDate.diff(timeRange.startDate),
status: 'error',
rulesCount: 1,
}
);
});
});

5
x-pack/plugins/security_solution/public/detection_engine/rule_gaps/logic/use_schedule_rule_run.ts
View file

@ -12,6 +12,7 @@ import { useScheduleRuleRunMutation } from '../api/hooks/use_schedule_rule_run_m
import type { ScheduleBackfillProps } from '../types';
import * as i18n from '../translations';
import { ManualRuleRunEventTypes } from '../../../common/lib/telemetry';
export function useScheduleRuleRun() {
const { mutateAsync } = useScheduleRuleRunMutation();
@ -22,7 +23,7 @@ export function useScheduleRuleRun() {
async (options: ScheduleBackfillProps) => {
try {
const results = await mutateAsync(options);
telemetry.reportManualRuleRunExecute({
telemetry.reportEvent(ManualRuleRunEventTypes.ManualRuleRunExecute, {
rangeInMs: options.timeRange.endDate.diff(options.timeRange.startDate),
status: 'success',
rulesCount: options.ruleIds.length,
@ -31,7 +32,7 @@ export function useScheduleRuleRun() {
return results;
} catch (error) {
addError(error, { title: i18n.BACKFILL_SCHEDULE_ERROR_TITLE });
telemetry.reportManualRuleRunExecute({
telemetry.reportEvent(ManualRuleRunEventTypes.ManualRuleRunExecute, {
rangeInMs: options.timeRange.endDate.diff(options.timeRange.startDate),
status: 'error',
rulesCount: options.ruleIds.length,

5
x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/bulk_actions/use_bulk_actions.tsx
View file

@ -45,6 +45,7 @@ import type { ExecuteBulkActionsDryRun } from './use_bulk_actions_dry_run';
import { computeDryRunEditPayload } from './utils/compute_dry_run_edit_payload';
import { transformExportDetailsToDryRunResult } from './utils/dry_run_result';
import { prepareSearchParams } from './utils/prepare_search_params';
import { ManualRuleRunEventTypes } from '../../../../../common/lib/telemetry';
interface UseBulkActionsArgs {
filterOptions: FilterOptions;
@ -234,7 +235,7 @@ export const useBulkActions = ({
}
const modalManualRuleRunConfirmationResult = await showManualRuleRunConfirmation();
startServices.telemetry.reportManualRuleRunOpenModal({
startServices.telemetry.reportEvent(ManualRuleRunEventTypes.ManualRuleRunOpenModal, {
type: 'bulk',
});
if (modalManualRuleRunConfirmationResult === null) {
@ -252,7 +253,7 @@ export const useBulkActions = ({
},
});
startServices.telemetry.reportManualRuleRunExecute({
startServices.telemetry.reportEvent(ManualRuleRunEventTypes.ManualRuleRunExecute, {
rangeInMs: modalManualRuleRunConfirmationResult.endDate.diff(
modalManualRuleRunConfirmationResult.startDate
),

3
x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/use_rules_table_actions.tsx
View file

@ -25,6 +25,7 @@ import { useDownloadExportedRules } from '../../../rule_management/logic/bulk_ac
import { useHasActionsPrivileges } from './use_has_actions_privileges';
import type { TimeRange } from '../../../rule_gaps/types';
import { useScheduleRuleRun } from '../../../rule_gaps/logic/use_schedule_rule_run';
import { ManualRuleRunEventTypes } from '../../../../common/lib/telemetry';
export const useRulesTableActions = ({
showExceptionsDuplicateConfirmation,
@ -126,7 +127,7 @@ export const useRulesTableActions = ({
onClick: async (rule: Rule) => {
startTransaction({ name: SINGLE_RULE_ACTIONS.MANUAL_RULE_RUN });
const modalManualRuleRunConfirmationResult = await showManualRuleRunConfirmation();
telemetry.reportManualRuleRunOpenModal({
telemetry.reportEvent(ManualRuleRunEventTypes.ManualRuleRunOpenModal, {
type: 'single',
});
if (modalManualRuleRunConfirmationResult === null) {

14
x-pack/plugins/security_solution/public/detection_engine/rule_monitoring/components/basic/filters/execution_run_type_filter/index.test.tsx
View file

@ -10,11 +10,12 @@ import { render, screen, fireEvent } from '@testing-library/react';
import { ExecutionRunTypeFilter } from '.';
import { RuleRunTypeEnum } from '../../../../../../../common/api/detection_engine/rule_monitoring';
import { useKibana } from '../../../../../../common/lib/kibana';
import { EventLogEventTypes } from '../../../../../../common/lib/telemetry';
jest.mock('../../../../../../common/lib/kibana');
const mockTelemetry = {
reportEventLogFilterByRunType: jest.fn(),
reportEvent: jest.fn(),
};
const mockUseKibana = useKibana as jest.Mock;
@ -28,7 +29,7 @@ mockUseKibana.mockReturnValue({
const items = [RuleRunTypeEnum.backfill, RuleRunTypeEnum.standard];
describe('ExecutionRunTypeFilter', () => {
it('calls telemetry.reportEventLogFilterByRunType on selection change', () => {
it('calls telemetry.reportEvent on selection change', () => {
const handleChange = jest.fn();
render(<ExecutionRunTypeFilter items={items} selectedItems={[]} onChange={handleChange} />);
@ -40,8 +41,11 @@ describe('ExecutionRunTypeFilter', () => {
fireEvent.click(manualRun);
expect(handleChange).toHaveBeenCalledWith([RuleRunTypeEnum.backfill]);
expect(mockTelemetry.reportEventLogFilterByRunType).toHaveBeenCalledWith({
runType: [RuleRunTypeEnum.backfill],
});
expect(mockTelemetry.reportEvent).toHaveBeenCalledWith(
EventLogEventTypes.EventLogFilterByRunType,
{
runType: [RuleRunTypeEnum.backfill],
}
);
});
});

5
x-pack/plugins/security_solution/public/detection_engine/rule_monitoring/components/basic/filters/execution_run_type_filter/index.tsx
View file

@ -15,6 +15,7 @@ import {
RULE_EXECUTION_TYPE_STANDARD,
} from '../../../../../../common/translations';
import { useKibana } from '../../../../../../common/lib/kibana';
import { EventLogEventTypes } from '../../../../../../common/lib/telemetry';
interface ExecutionRunTypeFilterProps {
items: RuleRunType[];
@ -42,7 +43,9 @@ const ExecutionRunTypeFilterComponent: React.FC<ExecutionRunTypeFilterProps> = (
const handleSelectionChange = useCallback(
(types: RuleRunType[]) => {
onChange(types);
telemetry.reportEventLogFilterByRunType({ runType: types });
telemetry.reportEvent(EventLogEventTypes.EventLogFilterByRunType, {
runType: types,
});
},
[onChange, telemetry]
);

23
x-pack/plugins/security_solution/public/detections/components/alerts_table/alerts_grouping.test.tsx
View file

@ -20,6 +20,7 @@ import { useKibana as mockUseKibana } from '../../../common/lib/kibana/__mocks__
import { createTelemetryServiceMock } from '../../../common/lib/telemetry/telemetry_service.mock';
import { useQueryAlerts } from '../../containers/detection_engine/alerts/use_query';
import { getQuery, groupingSearchResponse } from './grouping_settings/mock';
import { AlertsEventTypes } from '../../../common/lib/telemetry';
jest.mock('../../containers/detection_engine/alerts/use_query');
jest.mock('../../../sourcerer/containers');
@ -553,17 +554,23 @@ describe('GroupedAlertsTable', () => {
fireEvent.click(getByTestId('group-selector-dropdown'));
fireEvent.click(getByTestId('panel-user.name'));
expect(mockedTelemetry.reportAlertsGroupingChanged).toHaveBeenCalledWith({
groupByField: 'user.name',
tableId: testProps.tableId,
});
expect(mockedTelemetry.reportEvent).toHaveBeenCalledWith(
AlertsEventTypes.AlertsGroupingChanged,
{
groupByField: 'user.name',
tableId: testProps.tableId,
}
);
fireEvent.click(getByTestId('group-selector-dropdown'));
fireEvent.click(getByTestId('panel-host.name'));
expect(mockedTelemetry.reportAlertsGroupingChanged).toHaveBeenCalledWith({
groupByField: 'host.name',
tableId: testProps.tableId,
});
expect(mockedTelemetry.reportEvent).toHaveBeenCalledWith(
AlertsEventTypes.AlertsGroupingChanged,
{
groupByField: 'host.name',
tableId: testProps.tableId,
}
);
});
});

10
x-pack/plugins/security_solution/public/detections/components/alerts_table/alerts_grouping.tsx
View file

@ -25,7 +25,7 @@ import type { RunTimeMappings } from '../../../sourcerer/store/model';
import { renderGroupPanel, getStats } from './grouping_settings';
import { useKibana } from '../../../common/lib/kibana';
import { GroupedSubLevel } from './alerts_sub_grouping';
import { track } from '../../../common/lib/telemetry';
import { AlertsEventTypes, track } from '../../../common/lib/telemetry';
export interface AlertsTableComponentProps {
currentAlertStatusFilterValue?: Status[];
@ -80,14 +80,18 @@ const GroupedAlertsTableComponent: React.FC<AlertsTableComponentProps> = (props)
const { onGroupChange, onGroupToggle } = useMemo(
() => ({
onGroupChange: ({ groupByField, tableId }: { groupByField: string; tableId: string }) => {
telemetry.reportAlertsGroupingChanged({ groupByField, tableId });
telemetry.reportEvent(AlertsEventTypes.AlertsGroupingChanged, { groupByField, tableId });
},
onGroupToggle: (param: {
isOpen: boolean;
groupName?: string | undefined;
groupNumber: number;
groupingId: string;
}) => telemetry.reportAlertsGroupingToggled({ ...param, tableId: param.groupingId }),
}) =>
telemetry.reportEvent(AlertsEventTypes.AlertsGroupingToggled, {
...param,
tableId: param.groupingId,
}),
}),
[telemetry]
);

16
x-pack/plugins/security_solution/public/detections/components/alerts_table/grouping_settings/group_take_action_items.tsx
View file

@ -28,7 +28,7 @@ import {
import { FILTER_ACKNOWLEDGED, FILTER_CLOSED, FILTER_OPEN } from '../../../../../common/types';
import { useDeepEqualSelector } from '../../../../common/hooks/use_selector';
import * as i18n from '../translations';
import { getTelemetryEvent, METRIC_TYPE, track } from '../../../../common/lib/telemetry';
import { AlertsEventTypes, METRIC_TYPE, track } from '../../../../common/lib/telemetry';
import type { StartServices } from '../../../../types';
export interface TakeActionsProps {
@ -36,6 +36,18 @@ export interface TakeActionsProps {
showAlertStatusActions?: boolean;
}
const getTelemetryEvent = {
groupedAlertsTakeAction: ({
tableId,
groupNumber,
status,
}: {
tableId: string;
groupNumber: number;
status: AlertWorkflowStatus;
}) => `alerts_table_${tableId}_group-${groupNumber}_mark-${status}`,
};
export const useGroupTakeActionsItems = ({
currentStatus,
showAlertStatusActions = true,
@ -58,7 +70,7 @@ export const useGroupTakeActionsItems = ({
status: 'open' | 'closed' | 'acknowledged';
groupByField: string;
}) => {
telemetry.reportAlertsGroupingTakeAction(params);
telemetry.reportEvent(AlertsEventTypes.AlertsGroupingTakeAction, params);
},
[telemetry]
);

18
x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_overflow/index.test.tsx
View file

@ -16,6 +16,7 @@ import { RuleActionsOverflow } from '.';
import { mockRule } from '../../../../detection_engine/rule_management_ui/components/rules_table/__mocks__/mock';
import { TestProviders } from '../../../../common/mock';
import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
import { ManualRuleRunEventTypes } from '../../../../common/lib/telemetry';
const showBulkDuplicateExceptionsConfirmation = () => Promise.resolve(null);
const showManualRuleRunConfirmation = () => Promise.resolve(null);
@ -28,7 +29,7 @@ jest.mock('../../../../detection_engine/rule_management/logic/bulk_actions/use_b
jest.mock('../../../../detection_engine/rule_gaps/logic/use_schedule_rule_run');
jest.mock('../../../../common/lib/apm/use_start_transaction');
jest.mock('../../../../common/hooks/use_app_toasts');
const mockReportManualRuleRunOpenModal = jest.fn();
const mockReportEvent = jest.fn();
jest.mock('../../../../common/lib/kibana', () => {
const actual = jest.requireActual('../../../../common/lib/kibana');
return {
@ -36,8 +37,8 @@ jest.mock('../../../../common/lib/kibana', () => {
useKibana: jest.fn().mockReturnValue({
services: {
telemetry: {
reportManualRuleRunOpenModal: (params: { type: 'single' | 'bulk' }) =>
mockReportManualRuleRunOpenModal(params),
reportEvent: (eventType: ManualRuleRunEventTypes, params: { type: 'single' | 'bulk' }) =>
mockReportEvent(eventType, params),
},
application: {
navigateToApp: jest.fn(),
@ -274,7 +275,7 @@ describe('RuleActionsOverflow', () => {
expect(getByTestId('rules-details-popover')).not.toHaveTextContent(/.+/);
});
test('it calls telemetry.reportManualRuleRunOpenModal when rules-details-manual-rule-run is clicked', async () => {
test('it calls telemetry.reportEvent when rules-details-manual-rule-run is clicked', async () => {
const { getByTestId } = render(
<RuleActionsOverflow
showBulkDuplicateExceptionsConfirmation={showBulkDuplicateExceptionsConfirmation}
@ -290,9 +291,12 @@ describe('RuleActionsOverflow', () => {
fireEvent.click(getByTestId('rules-details-manual-rule-run'));
await waitFor(() => {
expect(mockReportManualRuleRunOpenModal).toHaveBeenCalledWith({
type: 'single',
});
expect(mockReportEvent).toHaveBeenCalledWith(
ManualRuleRunEventTypes.ManualRuleRunOpenModal,
{
type: 'single',
}
);
});
});
});

3
x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_overflow/index.tsx
View file

@ -34,6 +34,7 @@ import {
import { useDownloadExportedRules } from '../../../../detection_engine/rule_management/logic/bulk_actions/use_download_exported_rules';
import * as i18nActions from '../../../pages/detection_engine/rules/translations';
import * as i18n from './translations';
import { ManualRuleRunEventTypes } from '../../../../common/lib/telemetry';
const MyEuiButtonIcon = styled(EuiButtonIcon)`
&.euiButtonIcon {
@ -161,7 +162,7 @@ const RuleActionsOverflowComponent = ({
startTransaction({ name: SINGLE_RULE_ACTIONS.MANUAL_RULE_RUN });
closePopover();
const modalManualRuleRunConfirmationResult = await showManualRuleRunConfirmation();
telemetry.reportManualRuleRunOpenModal({
telemetry.reportEvent(ManualRuleRunEventTypes.ManualRuleRunOpenModal, {
type: 'single',
});
if (modalManualRuleRunConfirmationResult === null) {

7
x-pack/plugins/security_solution/public/detections/hooks/trigger_actions_alert_table/use_persistent_controls.tsx
View file

@ -20,7 +20,7 @@ import { useSourcererDataView } from '../../../sourcerer/containers';
import { SourcererScopeName } from '../../../sourcerer/store/model';
import { updateGroups } from '../../../common/store/grouping/actions';
import { useKibana } from '../../../common/lib/kibana';
import { METRIC_TYPE, track } from '../../../common/lib/telemetry';
import { METRIC_TYPE, AlertsEventTypes, track } from '../../../common/lib/telemetry';
import { useDataTableFilters } from '../../../common/hooks/use_data_table_filters';
import { useDeepEqualSelector, useShallowEqualSelector } from '../../../common/hooks/use_selector';
import { RightTopMenu } from '../../../common/components/events_viewer/right_top_menu';
@ -47,7 +47,10 @@ export const getPersistentControlsHook = (tableId: TableId) => {
METRIC_TYPE.CLICK,
getTelemetryEvent.groupChanged({ groupingId: tableId, selected: groupSelection })
);
telemetry.reportAlertsGroupingChanged({ groupByField: groupSelection, tableId });
telemetry.reportEvent(AlertsEventTypes.AlertsGroupingChanged, {
groupByField: groupSelection,
tableId,
});
},
[telemetry]
);

3
x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/asset_criticality_file_uploader.tsx
View file

@ -16,6 +16,7 @@ import { AssetCriticalityResultStep } from './components/result_step';
import { useEntityAnalyticsRoutes } from '../../api/api';
import { useFileValidation, useNavigationSteps } from './hooks';
import type { OnCompleteParams } from './types';
import { EntityEventTypes } from '../../../common/lib/telemetry';
export const AssetCriticalityFileUploader: React.FC = () => {
const [state, dispatch] = useReducer(reducer, INITIAL_STATE);
@ -24,7 +25,7 @@ export const AssetCriticalityFileUploader: React.FC = () => {
const onValidationComplete = useCallback(
({ validatedFile, processingStartTime, processingEndTime, tookMs }: OnCompleteParams) => {
telemetry.reportAssetCriticalityCsvPreviewGenerated({
telemetry.reportEvent(EntityEventTypes.AssetCriticalityCsvPreviewGenerated, {
file: {
size: validatedFile.size,
},

2
x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/components/validation_step.test.tsx
View file

@ -20,7 +20,7 @@ jest.mock('../../../../common/lib/kibana/kibana_react', () => ({
useKibana: () => ({
services: {
telemetry: {
reportAssetCriticalityCsvImported: jest.fn(),
reportEvent: jest.fn(),
},
},
}),

3
x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/components/validation_step.tsx
View file

@ -23,6 +23,7 @@ import { downloadBlob } from '../../../../common/utils/download_blob';
import { useKibana } from '../../../../common/lib/kibana/kibana_react';
import type { ValidatedFile } from '../types';
import { buildAnnotationsFromError } from '../helpers';
import { EntityEventTypes } from '../../../../common/lib/telemetry';
export interface AssetCriticalityValidationStepProps {
validatedFile: ValidatedFile;
@ -42,7 +43,7 @@ export const AssetCriticalityValidationStep: React.FC<AssetCriticalityValidation
const annotations = buildAnnotationsFromError(invalidLines.errors);
const onConfirmClick = () => {
telemetry.reportAssetCriticalityCsvImported({
telemetry.reportEvent(EntityEventTypes.AssetCriticalityCsvImported, {
file: {
size: fileSize,
},

5
x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/hooks.ts
View file

@ -17,6 +17,7 @@ import { useKibana } from '../../../common/lib/kibana';
import type { OnCompleteParams } from './types';
import type { ReducerState } from './reducer';
import { getStepStatus, isValidationStep } from './helpers';
import { EntityEventTypes } from '../../../common/lib/telemetry';
interface UseFileChangeCbParams {
onError: (errorMessage: string, file: File) => void;
@ -35,7 +36,7 @@ export const useFileValidation = ({ onError, onComplete }: UseFileChangeCbParams
},
file: File
) => {
telemetry.reportAssetCriticalityFileSelected({
telemetry.reportEvent(EntityEventTypes.AssetCriticalityFileSelected, {
valid: false,
errorCode: error.code,
file: {
@ -62,7 +63,7 @@ export const useFileValidation = ({ onError, onComplete }: UseFileChangeCbParams
return;
}
telemetry.reportAssetCriticalityFileSelected({
telemetry.reportEvent(EntityEventTypes.AssetCriticalityFileSelected, {
valid: true,
file: {
size: file.size,

6
x-pack/plugins/security_solution/public/entity_analytics/components/entity_analytics_anomalies/anomalies_count_link.test.tsx
View file

@ -10,6 +10,7 @@ import { AnomalyEntity } from '../../../common/components/ml/anomaly/use_anomali
import { createTelemetryServiceMock } from '../../../common/lib/telemetry/telemetry_service.mock';
import { TestProviders } from '../../../common/mock';
import { AnomaliesCountLink } from './anomalies_count_link';
import { EntityEventTypes } from '../../../common/lib/telemetry';
const mockedTelemetry = createTelemetryServiceMock();
jest.mock('../../../common/lib/kibana', () => {
@ -37,6 +38,9 @@ describe('AnomaliesCountLink', () => {
fireEvent.click(getByRole('button'));
expect(mockedTelemetry.reportAnomaliesCountClicked).toHaveBeenLastCalledWith({ jobId, count });
expect(mockedTelemetry.reportEvent).toHaveBeenLastCalledWith(
EntityEventTypes.AnomaliesCountClicked,
{ jobId, count }
);
});
});

3
x-pack/plugins/security_solution/public/entity_analytics/components/entity_analytics_anomalies/anomalies_count_link.tsx
View file

@ -15,6 +15,7 @@ import { HostsType } from '../../../explore/hosts/store/model';
import { UsersType } from '../../../explore/users/store/model';
import { useKibana } from '../../../common/lib/kibana';
import { EntityEventTypes } from '../../../common/lib/telemetry';
export const AnomaliesCountLink = ({
count,
@ -36,7 +37,7 @@ export const AnomaliesCountLink = ({
const onClick = useCallback(() => {
if (!jobId) return;
telemetry.reportAnomaliesCountClicked({
telemetry.reportEvent(EntityEventTypes.AnomaliesCountClicked, {
jobId,
count,
});

3
x-pack/plugins/security_solution/public/entity_analytics/components/entity_analytics_risk_score/index.tsx
View file

@ -38,6 +38,7 @@ import { useRiskScore } from '../../api/hooks/use_risk_score';
import { UserPanelKey } from '../../../flyout/entity_details/user_right';
import { RiskEnginePrivilegesCallOut } from '../risk_engine_privileges_callout';
import { useMissingRiskEnginePrivileges } from '../../hooks/use_missing_risk_engine_privileges';
import { EntityEventTypes } from '../../../common/lib/telemetry';
export const ENTITY_RISK_SCORE_TABLE_ID = 'entity-risk-score-table';
@ -51,7 +52,7 @@ const EntityAnalyticsRiskScoresComponent = ({ riskEntity }: { riskEntity: RiskSc
const openEntityOnAlertsPage = useCallback(
(entityName: string) => {
telemetry.reportEntityAlertsClicked({ entity: riskEntity });
telemetry.reportEvent(EntityEventTypes.EntityAlertsClicked, { entity: riskEntity });
openAlertsPageWithFilters([
{
title: getRiskEntityTranslation(riskEntity),

3
x-pack/plugins/security_solution/public/entity_analytics/components/entity_details_flyout/hooks/use_risk_input_actions.ts
View file

@ -17,6 +17,7 @@ import { SourcererScopeName } from '../../../../sourcerer/store/model';
import { useAddBulkToTimelineAction } from '../../../../detections/components/alerts_table/timeline_actions/use_add_bulk_to_timeline';
import { useKibana } from '../../../../common/lib/kibana/kibana_react';
import type { InputAlert } from '../../../hooks/use_risk_contributing_alerts';
import { EntityEventTypes } from '../../../../common/lib/telemetry';
/**
* The returned actions only support alerts risk inputs.
@ -61,7 +62,7 @@ export const useRiskInputActions = (inputs: InputAlert[], closePopover: () => vo
},
addToNewTimeline: () => {
telemetry.reportAddRiskInputToTimelineClicked({
telemetry.reportEvent(EntityEventTypes.AddRiskInputToTimelineClicked, {
quantity: inputs.length,
});

7
x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/hooks/use_entity_store.ts
View file

@ -17,6 +17,7 @@ import type {
} from '../../../../../common/api/entity_analytics';
import { useEntityStoreRoutes } from '../../../api/entity_store';
import { ENTITY_STORE_ENGINE_STATUS, useEntityEngineStatus } from './use_entity_engine_status';
import { EntityEventTypes } from '../../../../common/lib/telemetry';
const ENTITY_STORE_ENABLEMENT_INIT = 'ENTITY_STORE_ENABLEMENT_INIT';
@ -49,7 +50,7 @@ export const useEntityStoreEnablement = () => {
});
const enable = useCallback(() => {
telemetry?.reportEntityStoreInit({
telemetry?.reportEvent(EntityEventTypes.EntityStoreDashboardInitButtonClicked, {
timestamp: new Date().toISOString(),
});
return initialize().then(() => setPolling(true));
@ -76,7 +77,7 @@ export const useInitEntityEngineMutation = (options?: UseMutationOptions<{}>) =>
const { initEntityStore } = useEntityStoreRoutes();
return useMutation<InitEntityEngineResponse[]>(
() => {
telemetry?.reportEntityStoreEnablement({
telemetry?.reportEvent(EntityEventTypes.EntityStoreEnablementToggleClicked, {
timestamp: new Date().toISOString(),
action: 'start',
});
@ -106,7 +107,7 @@ export const useStopEntityEngineMutation = (options?: UseMutationOptions<{}>) =>
const { stopEntityStore } = useEntityStoreRoutes();
return useMutation<StopEntityEngineResponse[]>(
() => {
telemetry?.reportEntityStoreEnablement({
telemetry?.reportEvent(EntityEventTypes.EntityStoreEnablementToggleClicked, {
timestamp: new Date().toISOString(),
action: 'stop',
});

3
x-pack/plugins/security_solution/public/entity_analytics/components/risk_summary_flyout/risk_summary.tsx
View file

@ -43,6 +43,7 @@ import {
LENS_VISUALIZATION_MIN_WIDTH,
SUMMARY_TABLE_MIN_WIDTH,
} from './common';
import { EntityEventTypes } from '../../../common/lib/telemetry';
export interface RiskSummaryProps<T extends RiskScoreEntity> {
riskScoreData: RiskScoreState<T>;
@ -84,7 +85,7 @@ const FlyoutRiskSummaryComponent = <T extends RiskScoreEntity>({
(isOpen: boolean) => {
const entity = isUserRiskData(riskData) ? 'user' : 'host';
telemetry.reportToggleRiskSummaryClicked({
telemetry.reportEvent(EntityEventTypes.ToggleRiskSummaryClicked, {
entity,
action: isOpen ? 'show' : 'hide',
});

6
x-pack/plugins/security_solution/public/entity_analytics/components/severity/severity_filter.test.tsx
View file

@ -24,7 +24,7 @@ jest.mock('../../../common/lib/kibana', () => {
describe('SeverityFilter', () => {
beforeEach(() => {
mockedTelemetry.reportEntityRiskFiltered.mockClear();
mockedTelemetry.reportEvent.mockClear();
});
it('sends telemetry when selecting a classification', () => {
@ -38,7 +38,7 @@ describe('SeverityFilter', () => {
fireEvent.click(getByTestId('risk-filter-item-Unknown'));
expect(mockedTelemetry.reportEntityRiskFiltered).toHaveBeenCalledTimes(1);
expect(mockedTelemetry.reportEvent).toHaveBeenCalledTimes(1);
});
it('does not send telemetry when deselecting a classification', () => {
@ -61,6 +61,6 @@ describe('SeverityFilter', () => {
fireEvent.click(getByTestId('risk-filter-popoverButton'));
fireEvent.click(getByTestId('risk-filter-item-Unknown'));
expect(mockedTelemetry.reportEntityRiskFiltered).toHaveBeenCalledTimes(0);
expect(mockedTelemetry.reportEvent).toHaveBeenCalledTimes(0);
});
});

3
x-pack/plugins/security_solution/public/entity_analytics/components/severity/severity_filter.tsx
View file

@ -13,6 +13,7 @@ import type { RiskScoreEntity, RiskSeverity } from '../../../../common/search_st
import { RiskScoreLevel } from './common';
import { ENTITY_RISK_LEVEL } from '../risk_score/translations';
import { useKibana } from '../../../common/lib/kibana';
import { EntityEventTypes } from '../../../common/lib/telemetry';
export interface SeverityFilterProps {
riskEntity?: RiskScoreEntity;
@ -35,7 +36,7 @@ export const SeverityFilter: React.FC<SeverityFilterProps> = ({
>(
(newSelection, changedSeverity, changedStatus) => {
if (changedStatus === 'on') {
telemetry.reportEntityRiskFiltered({
telemetry.reportEvent(EntityEventTypes.EntityRiskFiltered, {
entity: riskEntity,
selectedSeverity: changedSeverity,
});

3
x-pack/plugins/security_solution/public/flyout/document_details/left/components/host_details.tsx
View file

@ -71,6 +71,7 @@ import type { NarrowDateRange } from '../../../../common/components/ml/types';
import { MisconfigurationsInsight } from '../../shared/components/misconfiguration_insight';
import { VulnerabilitiesInsight } from '../../shared/components/vulnerabilities_insight';
import { AlertCountInsight } from '../../shared/components/alert_count_insight';
import { DocumentEventTypes } from '../../../../common/lib/telemetry';
const HOST_DETAILS_ID = 'entities-hosts-details';
const RELATED_USERS_ID = 'entities-hosts-related-users';
@ -134,7 +135,7 @@ export const HostDetails: React.FC<HostDetailsProps> = ({ hostName, timestamp, s
banner: HOST_PREVIEW_BANNER,
},
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: scopeId,
panel: 'preview',
});

3
x-pack/plugins/security_solution/public/flyout/document_details/left/components/session_view.tsx
View file

@ -28,6 +28,7 @@ import { ALERT_PREVIEW_BANNER } from '../../preview/constants';
import { useLicense } from '../../../../common/hooks/use_license';
import { useSessionPreview } from '../../right/hooks/use_session_preview';
import { SessionViewNoDataMessage } from '../../shared/components/session_view_no_data_message';
import { DocumentEventTypes } from '../../../../common/lib/telemetry';
export const SESSION_VIEW_ID = 'session-view';
@ -74,7 +75,7 @@ export const SessionView: FC = () => {
isPreviewMode: true,
},
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: scopeId,
panel: 'preview',
});

3
x-pack/plugins/security_solution/public/flyout/document_details/left/components/user_details.tsx
View file

@ -69,6 +69,7 @@ import { PreviewLink } from '../../../shared/components/preview_link';
import type { NarrowDateRange } from '../../../../common/components/ml/types';
import { MisconfigurationsInsight } from '../../shared/components/misconfiguration_insight';
import { AlertCountInsight } from '../../shared/components/alert_count_insight';
import { DocumentEventTypes } from '../../../../common/lib/telemetry';
const USER_DETAILS_ID = 'entities-users-details';
const RELATED_HOSTS_ID = 'entities-users-related-hosts';
@ -133,7 +134,7 @@ export const UserDetails: React.FC<UserDetailsProps> = ({ userName, timestamp, s
banner: USER_PREVIEW_BANNER,
},
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: scopeId,
panel: 'preview',
});

3
x-pack/plugins/security_solution/public/flyout/document_details/left/index.tsx
View file

@ -22,6 +22,7 @@ import { getField } from '../shared/utils';
import { EventKind } from '../shared/constants/event_kinds';
import { useDocumentDetailsContext } from '../shared/context';
import type { DocumentDetailsProps } from '../shared/types';
import { DocumentEventTypes } from '../../../common/lib/telemetry/types';
export type LeftPanelPaths = 'visualize' | 'insights' | 'investigation' | 'response' | 'notes';
export const LeftPanelVisualizeTab: LeftPanelPaths = 'visualize';
@ -75,7 +76,7 @@ export const LeftPanel: FC<Partial<DocumentDetailsProps>> = memo(({ path }) => {
scopeId,
},
});
telemetry.reportDetailsFlyoutTabClicked({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutTabClicked, {
location: scopeId,
panel: 'left',
tabId,

3
x-pack/plugins/security_solution/public/flyout/document_details/left/tabs/insights_tab.tsx
View file

@ -31,6 +31,7 @@ import { PREVALENCE_TAB_ID, PrevalenceDetails } from '../components/prevalence_d
import { CORRELATIONS_TAB_ID, CorrelationsDetails } from '../components/correlations_details';
import { getField } from '../../shared/utils';
import { EventKind } from '../../shared/constants/event_kinds';
import { DocumentEventTypes } from '../../../../common/lib/telemetry';
const ENTITIES_TAB_ID = 'entity';
@ -113,7 +114,7 @@ export const InsightsTab = memo(() => {
scopeId,
},
});
telemetry.reportDetailsFlyoutTabClicked({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutTabClicked, {
location: scopeId,
panel: 'left',
tabId: optionId,

3
x-pack/plugins/security_solution/public/flyout/document_details/preview/footer.tsx
View file

@ -16,6 +16,7 @@ import { DocumentDetailsRightPanelKey } from '../shared/constants/panel_keys';
import { useDocumentDetailsContext } from '../shared/context';
import { PREVIEW_FOOTER_TEST_ID, PREVIEW_FOOTER_LINK_TEST_ID } from './test_ids';
import { useKibana } from '../../../common/lib/kibana';
import { DocumentEventTypes } from '../../../common/lib/telemetry';
/**
* Footer at the bottom of preview panel with a link to open document details flyout
@ -41,7 +42,7 @@ export const PreviewPanelFooter = () => {
},
},
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: scopeId,
panel: 'right',
});

3
x-pack/plugins/security_solution/public/flyout/document_details/right/components/alert_description.tsx
View file

@ -22,6 +22,7 @@ import {
RULE_SUMMARY_BUTTON_TEST_ID,
} from './test_ids';
import { RULE_PREVIEW_BANNER, RulePreviewPanelKey } from '../../../rule_details/right';
import { DocumentEventTypes } from '../../../../common/lib/telemetry';
/**
* Displays the rule description of a signal document.
@ -42,7 +43,7 @@ export const AlertDescription: FC = () => {
isPreviewMode: true,
},
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: scopeId,
panel: 'preview',
});

3
x-pack/plugins/security_solution/public/flyout/document_details/right/components/reason.tsx
View file

@ -22,6 +22,7 @@ import {
} from './test_ids';
import { useBasicDataFromDetailsData } from '../../shared/hooks/use_basic_data_from_details_data';
import { useDocumentDetailsContext } from '../../shared/context';
import { DocumentEventTypes } from '../../../../common/lib/telemetry';
export const ALERT_REASON_BANNER = {
title: i18n.translate(
@ -55,7 +56,7 @@ export const Reason: FC = () => {
banner: ALERT_REASON_BANNER,
},
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: scopeId,
panel: 'preview',
});

3
x-pack/plugins/security_solution/public/flyout/document_details/right/index.tsx
View file

@ -20,6 +20,7 @@ import { PanelContent } from './content';
import type { RightPanelTabType } from './tabs';
import { PanelFooter } from './footer';
import { useFlyoutIsExpandable } from './hooks/use_flyout_is_expandable';
import { DocumentEventTypes } from '../../../common/lib/telemetry';
export type RightPanelPaths = 'overview' | 'table' | 'json';
@ -53,7 +54,7 @@ export const RightPanel: FC<Partial<DocumentDetailsProps>> = memo(({ path }) =>
// saving which tab is currently selected in the right panel in local storage
storage.set(FLYOUT_STORAGE_KEYS.RIGHT_PANEL_SELECTED_TABS, tabId);
telemetry.reportDetailsFlyoutTabClicked({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutTabClicked, {
location: scopeId,
panel: 'right',
tabId,

3
x-pack/plugins/security_solution/public/flyout/document_details/right/navigation.tsx
View file

@ -13,6 +13,7 @@ import { HeaderActions } from './components/header_actions';
import { FlyoutNavigation } from '../../shared/components/flyout_navigation';
import { DocumentDetailsLeftPanelKey } from '../shared/constants/panel_keys';
import { useDocumentDetailsContext } from '../shared/context';
import { DocumentEventTypes } from '../../../common/lib/telemetry';
interface PanelNavigationProps {
/**
@ -35,7 +36,7 @@ export const PanelNavigation: FC<PanelNavigationProps> = memo(({ flyoutIsExpanda
scopeId,
},
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: scopeId,
panel: 'left',
});

5
x-pack/plugins/security_solution/public/flyout/document_details/shared/hooks/use_navigate_to_analyzer.tsx
View file

@ -19,6 +19,7 @@ import {
} from '../constants/panel_keys';
import { Flyouts } from '../constants/flyouts';
import { isTimelineScope } from '../../../../helpers';
import { DocumentEventTypes } from '../../../../common/lib/telemetry';
export interface UseNavigateToAnalyzerParams {
/**
@ -107,7 +108,7 @@ export const useNavigateToAnalyzer = ({
if (isFlyoutOpen) {
openLeftPanel(left);
openPreviewPanel(preview);
telemetry.reportDetailsFlyoutTabClicked({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutTabClicked, {
location: scopeId,
panel: 'left',
tabId: 'visualize',
@ -118,7 +119,7 @@ export const useNavigateToAnalyzer = ({
left,
preview,
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: scopeId,
panel: 'left',
});

5
x-pack/plugins/security_solution/public/flyout/document_details/shared/hooks/use_navigate_to_session_view.tsx
View file

@ -12,6 +12,7 @@ import type { Maybe } from '@kbn/timelines-plugin/common/search_strategy/common'
import { useKibana } from '../../../../common/lib/kibana';
import { SESSION_VIEW_ID } from '../../left/components/session_view';
import { DocumentDetailsLeftPanelKey, DocumentDetailsRightPanelKey } from '../constants/panel_keys';
import { DocumentEventTypes } from '../../../../common/lib/telemetry';
export interface UseNavigateToSessionViewParams {
/**
@ -83,7 +84,7 @@ export const useNavigateToSessionView = ({
const navigateToSessionView = useCallback(() => {
if (isFlyoutOpen) {
openLeftPanel(left);
telemetry.reportDetailsFlyoutTabClicked({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutTabClicked, {
location: scopeId,
panel: 'left',
tabId: 'visualize',
@ -93,7 +94,7 @@ export const useNavigateToSessionView = ({
right,
left,
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: scopeId,
panel: 'left',
});

3
x-pack/plugins/security_solution/public/flyout/entity_details/host_right/index.tsx
View file

@ -35,6 +35,7 @@ import { useObservedHost } from './hooks/use_observed_host';
import { HostDetailsPanelKey } from '../host_details_left';
import { EntityDetailsLeftPanelTab } from '../shared/components/left_panel/left_panel_header';
import { HostPreviewPanelFooter } from '../host_preview/footer';
import { EntityEventTypes } from '../../../common/lib/telemetry';
export interface HostPanelProps extends Record<string, unknown> {
contextID: string;
@ -130,7 +131,7 @@ export const HostPanel = ({
const openTabPanel = useCallback(
(tab?: EntityDetailsLeftPanelTab) => {
telemetry.reportRiskInputsExpandedFlyoutOpened({
telemetry.reportEvent(EntityEventTypes.RiskInputsExpandedFlyoutOpened, {
entity: 'host',
});

3
x-pack/plugins/security_solution/public/flyout/entity_details/user_right/index.tsx
View file

@ -33,6 +33,7 @@ import { UserDetailsPanelKey } from '../user_details_left';
import { useObservedUser } from './hooks/use_observed_user';
import { EntityDetailsLeftPanelTab } from '../shared/components/left_panel/left_panel_header';
import { UserPreviewPanelFooter } from '../user_preview/footer';
import { EntityEventTypes } from '../../../common/lib/telemetry';
export interface UserPanelProps extends Record<string, unknown> {
contextID: string;
@ -123,7 +124,7 @@ export const UserPanel = ({
const { openLeftPanel } = useExpandableFlyoutApi();
const openPanelTab = useCallback(
(tab?: EntityDetailsLeftPanelTab) => {
telemetry.reportRiskInputsExpandedFlyoutOpened({
telemetry.reportEvent(EntityEventTypes.RiskInputsExpandedFlyoutOpened, {
entity: 'user',
});

3
x-pack/plugins/security_solution/public/flyout/shared/components/preview_link.tsx
View file

@ -24,6 +24,7 @@ import { UserPreviewPanelKey } from '../../entity_details/user_right';
import { USER_PREVIEW_BANNER } from '../../document_details/right/components/user_entity_overview';
import { NetworkPanelKey, NETWORK_PREVIEW_BANNER } from '../../network_details';
import { RulePreviewPanelKey, RULE_PREVIEW_BANNER } from '../../rule_details/right';
import { DocumentEventTypes } from '../../../common/lib/telemetry';
const PREVIEW_FIELDS = [HOST_NAME_FIELD_NAME, USER_NAME_FIELD_NAME, SIGNAL_RULE_NAME_FIELD_NAME];
@ -133,7 +134,7 @@ export const PreviewLink: FC<PreviewLinkProps> = ({
id: previewParams.id,
params: previewParams.params,
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: scopeId,
panel: 'preview',
});

3
x-pack/plugins/security_solution/public/notes/components/add_note.tsx
View file

@ -28,6 +28,7 @@ import {
userClosedCreateErrorToast,
} from '../store/notes.slice';
import { MarkdownEditor } from '../../common/components/markdown_editor';
import { NotesEventTypes } from '../../common/lib/telemetry';
export const MARKDOWN_ARIA_LABEL = i18n.translate(
'xpack.securitySolution.notes.addNote.markdownAriaLabel',
@ -96,7 +97,7 @@ export const AddNote = memo(
if (onNoteAdd) {
onNoteAdd();
}
telemetry.reportAddNoteFromExpandableFlyoutClicked({
telemetry.reportEvent(NotesEventTypes.AddNoteFromExpandableFlyoutClicked, {
isRelatedToATimeline: timelineId != null,
});
setEditorValue('');

3
x-pack/plugins/security_solution/public/notes/components/open_flyout_button.tsx
View file

@ -16,6 +16,7 @@ import { useSourcererDataView } from '../../sourcerer/containers';
import { SourcererScopeName } from '../../sourcerer/store/model';
import { useKibana } from '../../common/lib/kibana';
import { DocumentDetailsRightPanelKey } from '../../flyout/document_details/shared/constants/panel_keys';
import { DocumentEventTypes } from '../../common/lib/telemetry';
export const OPEN_FLYOUT_BUTTON = i18n.translate(
'xpack.securitySolution.notes.openFlyoutButtonLabel',
@ -61,7 +62,7 @@ export const OpenFlyoutButtonIcon = memo(
},
},
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: timelineId,
panel: 'right',
});

7
x-pack/plugins/security_solution/public/onboarding/components/onboarding_context.tsx
View file

@ -9,6 +9,7 @@ import type { PropsWithChildren } from 'react';
import React, { createContext, useContext, useMemo } from 'react';
import { useKibana } from '../../common/lib/kibana/kibana_react';
import type { OnboardingCardId } from '../constants';
import { OnboardingHubEventTypes } from '../../common/lib/telemetry';
export interface OnboardingContextValue {
spaceId: string;
@ -26,19 +27,19 @@ export const OnboardingContextProvider: React.FC<PropsWithChildren<{ spaceId: st
() => ({
spaceId,
reportCardOpen: (cardId, { auto = false } = {}) => {
telemetry.reportOnboardingHubStepOpen({
telemetry.reportEvent(OnboardingHubEventTypes.OnboardingHubStepOpen, {
stepId: cardId,
trigger: auto ? 'navigation' : 'click',
});
},
reportCardComplete: (cardId, { auto = false } = {}) => {
telemetry.reportOnboardingHubStepFinished({
telemetry.reportEvent(OnboardingHubEventTypes.OnboardingHubStepFinished, {
stepId: cardId,
trigger: auto ? 'auto_check' : 'click',
});
},
reportCardLinkClicked: (cardId, linkId: string) => {
telemetry.reportOnboardingHubStepLinkClicked({
telemetry.reportEvent(OnboardingHubEventTypes.OnboardingHubStepLinkClicked, {
originStepId: cardId,
stepLinkId: linkId,
});

11
x-pack/plugins/security_solution/public/overview/pages/data_quality.tsx
View file

@ -28,9 +28,10 @@ import { KibanaServices, useKibana, useToasts, useUiSetting$ } from '../../commo
import { SpyRoute } from '../../common/utils/route/spy_routes';
import { useSignalIndex } from '../../detections/containers/detection_engine/alerts/use_signal_index';
import * as i18n from './translations';
import type {
ReportDataQualityCheckAllCompletedParams,
ReportDataQualityIndexCheckedParams,
import {
type ReportDataQualityCheckAllCompletedParams,
type ReportDataQualityIndexCheckedParams,
DataQualityEventTypes,
} from '../../common/lib/telemetry';
const LOCAL_STORAGE_KEY = 'dataQualityDashboardLastChecked';
@ -118,14 +119,14 @@ const DataQualityComponent: React.FC = () => {
const reportDataQualityIndexChecked = useCallback(
(params: ReportDataQualityIndexCheckedParams) => {
telemetry.reportDataQualityIndexChecked(params);
telemetry.reportEvent(DataQualityEventTypes.DataQualityIndexChecked, params);
},
[telemetry]
);
const reportDataQualityCheckAllCompleted = useCallback(
(params: ReportDataQualityCheckAllCompletedParams) => {
telemetry.reportDataQualityCheckAllCompleted(params);
telemetry.reportEvent(DataQualityEventTypes.DataQualityCheckAllCompleted, params);
},
[telemetry]
);

3
x-pack/plugins/security_solution/public/timelines/components/open_timeline/note_previews/index.tsx
View file

@ -34,6 +34,7 @@ import { SourcererScopeName } from '../../../../sourcerer/store/model';
import { useSourcererDataView } from '../../../../sourcerer/containers';
import { useDeleteNote } from './hooks/use_delete_note';
import { getTimelineNoteSelector } from '../../timeline/tabs/notes/selectors';
import { DocumentEventTypes } from '../../../../common/lib/telemetry';
export const NotePreviewsContainer = styled.section`
padding-top: ${({ theme }) => `${theme.eui.euiSizeS}`};
@ -66,7 +67,7 @@ const ToggleEventDetailsButtonComponent: React.FC<ToggleEventDetailsButtonProps>
},
},
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: timelineId,
panel: 'right',
});

5
x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/eql/index.tsx
View file

@ -46,6 +46,7 @@ import { useTimelineControlColumn } from '../shared/use_timeline_control_columns
import { LeftPanelNotesTab } from '../../../../../flyout/document_details/left';
import { useNotesInFlyout } from '../../properties/use_notes_in_flyout';
import { NotesFlyout } from '../../properties/notes_flyout';
import { NotesEventTypes, DocumentEventTypes } from '../../../../../common/lib/telemetry';
import { TimelineRefetch } from '../../refetch_timeline';
export type Props = TimelineTabCommonProps & PropsFromRedux;
@ -161,10 +162,10 @@ export const EqlTabContentComponent: React.FC<Props> = ({
},
},
});
telemetry.reportOpenNoteInExpandableFlyoutClicked({
telemetry.reportEvent(NotesEventTypes.OpenNoteInExpandableFlyoutClicked, {
location: timelineId,
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: timelineId,
panel: 'left',
});

5
x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/pinned/index.tsx
View file

@ -36,6 +36,7 @@ import { useTimelineControlColumn } from '../shared/use_timeline_control_columns
import { LeftPanelNotesTab } from '../../../../../flyout/document_details/left';
import { useNotesInFlyout } from '../../properties/use_notes_in_flyout';
import { NotesFlyout } from '../../properties/notes_flyout';
import { NotesEventTypes, DocumentEventTypes } from '../../../../../common/lib/telemetry';
import { defaultUdtHeaders } from '../../body/column_headers/default_headers';
interface PinnedFilter {
@ -190,10 +191,10 @@ export const PinnedTabContentComponent: React.FC<Props> = ({
},
},
});
telemetry.reportOpenNoteInExpandableFlyoutClicked({
telemetry.reportEvent(NotesEventTypes.OpenNoteInExpandableFlyoutClicked, {
location: timelineId,
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: timelineId,
panel: 'left',
});

5
x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/query/index.tsx
View file

@ -49,6 +49,7 @@ import { useTimelineColumns } from '../shared/use_timeline_columns';
import { useTimelineControlColumn } from '../shared/use_timeline_control_columns';
import { NotesFlyout } from '../../properties/notes_flyout';
import { useNotesInFlyout } from '../../properties/use_notes_in_flyout';
import { DocumentEventTypes, NotesEventTypes } from '../../../../../common/lib/telemetry';
const compareQueryProps = (prevProps: Props, nextProps: Props) =>
prevProps.kqlMode === nextProps.kqlMode &&
@ -228,10 +229,10 @@ export const QueryTabContentComponent: React.FC<Props> = ({
},
},
});
telemetry.reportOpenNoteInExpandableFlyoutClicked({
telemetry.reportEvent(NotesEventTypes.OpenNoteInExpandableFlyoutClicked, {
location: timelineId,
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: timelineId,
panel: 'left',
});

3
x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/session/use_session_view.tsx
View file

@ -34,6 +34,7 @@ import { useUserPrivileges } from '../../../../../common/components/user_privile
import { timelineActions, timelineSelectors } from '../../../../store';
import { timelineDefaults } from '../../../../store/defaults';
import { useDeepEqualSelector } from '../../../../../common/hooks/use_selector';
import { DocumentEventTypes } from '../../../../../common/lib/telemetry';
import { isFullScreen } from '../../helpers';
const FullScreenButtonIcon = styled(EuiButtonIcon)`
@ -287,7 +288,7 @@ export const useSessionView = ({ scopeId, height }: { scopeId: string; height?:
},
},
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: scopeId,
panel: 'right',
});

3
x-pack/plugins/security_solution/public/timelines/components/timeline/unified_components/data_table/index.tsx
View file

@ -48,6 +48,7 @@ import { transformTimelineItemToUnifiedRows } from '../utils';
import { TimelineEventDetailRow } from './timeline_event_detail_row';
import { CustomTimelineDataGridBody } from './custom_timeline_data_grid_body';
import { TIMELINE_EVENT_DETAIL_ROW_ID } from '../../body/constants';
import { DocumentEventTypes } from '../../../../../common/lib/telemetry/types';
export const SAMPLE_SIZE_SETTING = 500;
const DataGridMemoized = React.memo(UnifiedDataTable);
@ -165,7 +166,7 @@ export const TimelineDataTableComponent: React.FC<DataTableProps> = memo(
},
},
});
telemetry.reportDetailsFlyoutOpened({
telemetry.reportEvent(DocumentEventTypes.DetailsFlyoutOpened, {
location: timelineId,
panel: 'right',
});

4
x-pack/plugins/security_solution/public/types.ts
View file

@ -84,7 +84,6 @@ import type { Assets } from './assets';
import type { Investigations } from './investigations';
import type { MachineLearning } from './machine_learning';
import type { TelemetryClientStart } from './common/lib/telemetry';
import type { Dashboards } from './dashboards';
import type { BreadcrumbsNav } from './common/breadcrumbs/types';
import type { TopValuesPopoverService } from './app/components/top_values_popover/top_values_popover_service';
@ -93,6 +92,7 @@ import type { SetComponents, GetComponents$ } from './contract_components';
import type { ConfigSettings } from '../common/config_settings';
import type { OnboardingService } from './onboarding/service';
import type { SolutionNavigation } from './app/solution_navigation/solution_navigation';
import type { TelemetryServiceStart } from './common/lib/telemetry';
export interface SetupPlugins {
cloud?: CloudSetup;
@ -188,7 +188,7 @@ export type StartServices = CoreStart &
getPluginWrapper: () => typeof SecuritySolutionTemplateWrapper;
};
contentManagement: ContentManagementPublicStart;
telemetry: TelemetryClientStart;
telemetry: TelemetryServiceStart;
customDataService: DataPublicPluginStart;
topValuesPopover: TopValuesPopoverService;
timelineDataService: DataPublicPluginStart;