github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-06-27 18:51:07 -04:00
Code Issues Projects Releases Packages Wiki Activity

[Security Solution][Detection Engine] log ES requests when running rule preview (#191107)

Browse source 
## Summary

**Status:** works only for **ES|QL and EQL** rule types

When clicking on "Show Elasticsearch requests, ran during rule
executions" preview would return logged Elasticsearch queries that can
be used to debug/explore rule execution.
Each rule execution accordion has time rule execution started and its
duration.
Upon opening accordion: it will display ES requests with their
description and duration.

**NOTE**: Only search requests are returned, not the requests that
create actual alerts

Feature flag: **loggingRequestsEnabled**

On week Demo([internal
link](https://drive.google.com/drive/folders/1l-cDhbiMxykNH6BzIxFAnLeibmV9a4Cz))

### Video demo (older UI)


https://github.com/user-attachments/assets/26f963da-c528-447c-9efd-350b4d42b52c

### Up to date UI

#### UI control
<img width="733" alt="Screenshot 2024-09-11 at 12 39 07"
src="https://github.com/user-attachments/assets/c2b1304d-6f93-4e8e-92f9-a6a0b53cefc7">

#### List of executions and code blocks
<img width="770" alt="Screenshot 2024-09-11 at 12 38 23"
src="https://github.com/user-attachments/assets/48b5aa12-174c-46f5-b0bc-a141833b225b">




### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

🎉 All tests passed! -
[kibana-flaky-test-suite-runner#6909](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/6909)
[✅] [Serverless] Security Solution Detection Engine - Cypress: 100/100
tests passed.
[✅] Security Solution Detection Engine - Cypress: 100/100 tests passed.

FTR tests -
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/6918

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
Vitalii Dmyterko 2024-09-19 14:45:41 +01:00 • committed by GitHub
parent e524ed6a1a
commit 60176bcffd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
46 changed files with 1281 additions and 178 deletions
Download patch file Download diff file Expand all files Collapse all files

9
x-pack/test/api_integration/services/security_solution_api.gen.ts
View file

@ -116,7 +116,10 @@ import { PreviewRiskScoreRequestBodyInput } from '@kbn/security-solution-plugin/
import { ReadAlertsMigrationStatusRequestQueryInput } from '@kbn/security-solution-plugin/common/api/detection_engine/signals_migration/read_signals_migration_status/read_signals_migration_status.gen';
import { ReadRuleRequestQueryInput } from '@kbn/security-solution-plugin/common/api/detection_engine/rule_management/crud/read_rule/read_rule_route.gen';
import { ResolveTimelineRequestQueryInput } from '@kbn/security-solution-plugin/common/api/timeline/resolve_timeline/resolve_timeline_route.gen';
import { RulePreviewRequestBodyInput } from '@kbn/security-solution-plugin/common/api/detection_engine/rule_preview/rule_preview.gen';
import {
RulePreviewRequestQueryInput,
RulePreviewRequestBodyInput,
} from '@kbn/security-solution-plugin/common/api/detection_engine/rule_preview/rule_preview.gen';
import { SearchAlertsRequestBodyInput } from '@kbn/security-solution-plugin/common/api/detection_engine/signals/query_signals/query_signals_route.gen';
import { SetAlertAssigneesRequestBodyInput } from '@kbn/security-solution-plugin/common/api/detection_engine/alert_assignees/set_alert_assignees_route.gen';
import { SetAlertsStatusRequestBodyInput } from '@kbn/security-solution-plugin/common/api/detection_engine/signals/set_signal_status/set_signals_status_route.gen';
@ -1058,7 +1061,8 @@ detection engine rules.
.set('kbn-xsrf', 'true')
.set(ELASTIC_HTTP_VERSION_HEADER, '2023-10-31')
.set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana')
.send(props.body as object);
.send(props.body as object)
.query(props.query);
},
scheduleRiskEngineNow() {
return supertest
@ -1394,6 +1398,7 @@ export interface ResolveTimelineProps {
query: ResolveTimelineRequestQueryInput;
}
export interface RulePreviewProps {
query: RulePreviewRequestQueryInput;
body: RulePreviewRequestBodyInput;
}
export interface SearchAlertsProps {