Commit graph

97 commits

Author SHA1 Message Date
Khristinin Nikita
35e02bcf64
Add sorting for exceptions cards (#145070)
## Add sorting for shared exceptions

Currently is possible to sort by Name, Created At, Created By


https://user-images.githubusercontent.com/7609147/201640150-dc9d53e4-0d34-4da1-8522-9899d35e7359.mov

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Devin W. Hurley <snowmiser111@gmail.com>
2022-11-15 13:55:38 -07:00
Yara Tercero
6c5d816c01
[Security Solution][Exceptions] - Update add/edit exception flyouts (#143127)
* squashed commit of updates to add/edit flyouts for exception, added cypress tests and unit tests

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Devin W. Hurley <devin.hurley@elastic.co>
2022-10-19 15:13:18 -04:00
Yara Tercero
0149bd063c
[Security Solution][Exceptions] - Common flyout components (#142054)
## Summary

Adds components shared between new add/edit exception flyouts. Does not yet modify the flyouts themselves. Trying to break down what would be an even larger PR into chunks.
2022-10-05 11:38:33 -07:00
Wafaa Nasr
0fcfaec2dd
remove alignCenter to prevent the icon from adjusting (#141365)
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-09-22 18:16:31 +02:00
Davis Plumlee
51699fa21a
[Security Solution] Value list exceptions (#133254) 2022-09-19 22:41:28 +02:00
Yara Tercero
194e0d7144
[Security Solution][Exceptions] - Initial updates to exceptions viewer UX (#138770)
## Summary

**API changes**
- Adds API for determining the list-rule references. 
- Updates the exception items find api to include the `search` param which allows for simple search queries - used with the EUI search bar

**UI updates**
- Moved the exception components into new `rule_exceptions` folder per suggested folder structure updates listed [here](https://github.com/elastic/kibana/issues/138600)
- Updates the rule details tabs to split endpoint and rule exceptions into their own tabs
- Updates the viewer utilities header now that these different exception types are split
- Updates exception item UI to match new designs
- Updates the UI for when there are no items
- Removes `use_exception_list_items` hook as it is no longer in use
- Flyouts (add/edit) remain untouched
2022-09-08 16:41:52 -04:00
Wafaa Nasr
f107c273af
Fix/100018 import value list sorting (#138381)
* add sortField and sortOrder to findLists params

* move tests for list-hooks

* pass sortField and sortOrder from Flyout component + tests + remove obsolete test files

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-08-10 13:07:32 +02:00
Marshall Main
fe97c24de2
[Security Solution][Platform] Only allow wildcard exceptions on string fields (#137129)
* Only allow wildcard exceptions on string fields

* Fix unit tests and move to the right place
2022-07-26 12:41:19 -07:00
Marshall Main
aaa3107dbc
[Security Solution][Alerts] Detection engine wildcard exceptions (#136147)
* Implement wildcard exceptions for detection rules

* Fix index pattern retrieval on edit exceptions flyout

* Fix API integration test logic

* Fix entry_renderer linting

* Remove bad fix idea

* Add 'does not match' operator to UI

* Fix test

* Add unit tests

* Add wildcard exceptions to list of DE exception operators

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-07-19 15:03:47 -07:00
Yara Tercero
ff3853cfa9
[Security Solution][Exceptions] - Fixes exception builder bug that includes matches operator (#136340)
## Summary

Addresses Kibana issue #36224
2022-07-19 08:15:49 -07:00
Yara Tercero
4235294f08
[Security Solution][Exceptions] - Fix exceptions builder validation bug (#131989)
Addresses #86258

The variable tracking state needed to be cleared on operator change. If you didn't change operators, then invalidating and then validating an entry worked as expected, but if you switched operators, the error state was not being cleared causing the builder to read that there was an error state.
2022-05-11 10:49:07 -07:00
Nodir Latipov
7c01257055
[Unified Search] Move autocomplete logic to unified search plugin (#129977)
* feat: move autocomplete logic from data plugin to unified search

* minor fix after comments

* updated Documentation: data.autocomplete -> unifiedSearch.autocomplete

* changed renameFromRoot order for autocomplete

* removed extra renameFromRoot in config deprecations, updated test

* added configPath for unified search plugin

* Update kibana.json

* updated path to autocomplete

* fix conflict

* fix conflict

* [CI] Auto-commit changed files from 'node scripts/eslint --no-cache --fix'

* fix Linting

* fix functional_with_es_ssl test
2022-04-22 11:02:56 +05:00
spalger
3730dd0779 fix all violations 2022-04-16 01:37:30 -05:00
David Sánchez
a07c47c652
Set filter to undefined when it's empty on findExceptionLists method (#128455)
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-03-29 12:44:31 +02:00
David Sánchez
968f350989
Create generic get filter method to be used with an array of list id's (#127983)
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-03-24 08:23:21 +01:00
Ashokaditya
0d0ff4e749
[Security Solution][Endpoint] Update warning text for event filter matches operator (#127958)
* Update warning text for event filter matches operator when file path has wildcards

fixes elastic/security-team/issues/3199

* update text

review changes
2022-03-17 13:10:28 -07:00
Ashokaditya
9d53810791
[Security Solution][Endpoint] Adds matches wildcard operator for file.path.text field for Event Filters (#125202)
* labels for wildcard path entries

fixes elastic/security-team/issues/2525

* consistent naming and add missing tests

refs elastic/kibana/pull/120679

* add autocompletion for wildcard

fixes elastic/security-team/issues/2525

* ensure event filter artifacts have correct wildcard type for process.name entry

fixes elastic/security-team/issues/2525
fixes elastic/security-team/issues/2723

* set warning for input values

fixes elastic/security-team/issues/2525

* lift path validations to packages

fixes elastic/security-team/issues/2525

* Add more tests

fixes elastic/security-team/issues/2525

* Add wildcards to event filter generator

* fix merge i18n check

* Remove not match/excluded operator for now

review changes

* add mixed entries for wildcard

review changes

* comparison typo

refs 06c868b6d1

* fix vulnerable regex

review changes

* ignore empty space on input

review changes

* update component

review changes

* use const enum

review changes

* update type imports to use ConditionEntryField, OperatingSystem, TrustedAppEntryTypes
2022-03-02 11:55:58 -07:00
Davis Plumlee
2aafd3be99
[Security Solution] Exceptions Flyout follow-up (#125159) 2022-02-23 18:44:45 -05:00
David Sánchez
d965ba791a
[Security Solution][Endpoint] Event filters ux adjustments for 8.1 (#123853)
* Don't show a default value '-' for emoty descriptions on artifacts list. Also removes empty spaces

* Update copy to say 'event filters' instead of 'exceptions'

* Decrease spacing between avatar and comments textbox

* Adds extra spacing between last exception builder field and the buttons group

* Reduces effect scope togle width to by dynamic depending on translations

* Makes effected policy button group persistent across different artifact forms

* Removes unused import

* Center button group for small devices
2022-01-27 15:30:49 +01:00
Matthew Kime
d4fdd35543
[dataViews] no more IndexPatternBase, IndexPatternFieldBase (#121836)
* remove IndexPatternFieldBase and IndexPatternBase references
2021-12-22 08:46:21 -06:00
Frank Hassanabad
d874c4c798
Removes tech debt from export all (#120170)
## Summary

See: https://github.com/elastic/kibana/issues/110903

This removes the `export *` from:
* lists plugin

This also adds `import type` and `export type` in a few areas and fixes the `LicenseType` by changing it from `server` to using the version from `common` to remove the restricted paths. This extra addition prevents more memory leaks when we run jest.
2021-12-02 09:42:51 -07:00
Frank Hassanabad
e2c916a577
[Security Solutions] Removes plugins/data/public deprecations from security_solutions plugin (#118938)
## Summary

This removes all the areas marked as deprecated from `.../src/plugins/data/public` with their `@kbn/es-query` equivalent or it uses the directly exported version from `.../src/plugins/data/public`. Anywhere else this adds the `import type {` where it can to encourage the build system to do more type erasures.

### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
2021-11-17 19:08:10 -07:00
David Sánchez
9c3c489e48
Hide or button if needed (#116124) 2021-10-26 09:21:58 +02:00
Esteban Beltran
3e6516c986
[Security Solutions] Fix host isolation exception list showing up on the exceptions list (#114987) 2021-10-15 15:30:42 -04:00
Yara Tercero
69a6cf329c
Fixing exceptions export format (#114920)
### Summary

Fixing exceptions export format and adding integration tests for it.
2021-10-13 23:32:43 -04:00
Tyler Smalley
4681a80317
[DX] Upgrade prettier to v2.4.0 (#112359)
Signed-off-by: Tyler Smalley <tyler.smalley@elastic.co>
2021-09-19 22:34:30 -07:00
Matthew Kime
02de7cca73
convert deep imports to top level imports (#112203)
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2021-09-15 15:02:39 -05:00
Candace Park
05495a336b
[Security Solution][Endpoint][TrustedApps][EventFilters] Change add button color (#111218) 2021-09-08 12:22:07 -06:00
Dmitry Shevchenko
c6aa4f625c
Fix exceptions page table pagination (#111000) 2021-09-03 21:38:45 +02:00
Spencer
fecdba7eba
[eslint] add rule to prevent export* in plugin index files (#109357)
* [eslint] add rule to prevent export* in plugin index files

* deduplicate export names for types/instances with the same name

* attempt to auto-fix duplicate exports too

* capture exported enums too

* enforce no_export_all for core too

* disable rule by default, allow opting-in for help fixing

* update tests

* reduce yarn.lock duplication

* add rule but no fixes

* disable all existing violations

* update api docs with new line numbers

* revert unnecessary changes to yarn.lock which only had drawbacks

* remove unnecessary eslint-disable

* rework codegen to split type exports and use babel to generate valid code

* check for "export types" deeply

* improve test by using fixtures

* add comments to some helper functions

* disable fix for namespace exports including types

* label all eslint-disable comments with related team-specific issue

* ensure that child exports of `export type` are always tracked as types

Co-authored-by: spalger <spalger@users.noreply.github.com>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2021-09-01 18:05:45 -07:00
David Sánchez
de9d784035
Adds new operatorsList prop in exceptions builder to allow pass a list of operators. Add this prop in event filters form (#108015)
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2021-08-12 12:59:33 +02:00
Thomas Watson
c58148981c
Remove duplicate license comments (#106848) 2021-07-28 08:42:21 -06:00
Frank Hassanabad
5dd68dd7b3
[Security Solutions] Removes deprecated types in kbn-securitysolution-* for newer kbn-es-query types (#106801)
## Summary

Fixes https://github.com/elastic/kibana/issues/105731, by replacing these `any` types:

```json
type IFieldType = any;
type IIndexPattern = any;
type Filter = any;
```

With the types from `es-query` which are:
* IndexPatternFieldBase
* IndexPatternBase
* Filter

Note: I had to do a few creative casting to avoid having to use `FieldSpec` since that is not within the package `es-query` and is not planned to be within that package or another package for at least a while if ever.

### Checklist

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
2021-07-27 09:12:02 -06:00
Frank Hassanabad
cd667d06bc
[Security Solutions][Detection Engine] Creates an autocomplete package and moves duplicate code between lists and security_solution there (#105382)
## Summary

Creates an autocomplete package from `lists` and removes duplicate code between `lists` and `security_solutions`
* Consolidates different PR's where we were changing different parts of autocomplete in different ways.
* Existing Cypress tests should cover any mistakes hopefully

Manual Testing:
* Ensure this bug does not crop up again https://github.com/elastic/kibana/pull/87004
* Make sure that the exception list autocomplete looks alright

### Checklist

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
2021-07-22 12:44:54 -06:00
Frank Hassanabad
bdf1069e56
[Security Solutions][Detection Engine] Removes dead duplicated code and marks other duplicated code (#105374)
## Summary

* Removes dead duplicated code from `security_solution` and  `lists`
* Adds notes and TODO's where we still have duplicated logic
* Adds notes where I saw that the original deviated from the copy from modifications in one file but not the other.
* DOES NOT fix the bugs existing in one copy but not the other. That should be done when the copied chunks are collapsed into a package. Instead see this issue where I marked those areas: https://github.com/elastic/kibana/issues/105378

See these two files where things have deviated from our duplications as an example:
[security_solution/public/common/components/autocomplete/field.tsx](https://github.com/elastic/kibana/blob/master/x-pack/plugins/security_solution/public/common/components/autocomplete/field.tsx
)
[lists/public/exceptions/components/autocomplete/field.tsx](https://github.com/elastic/kibana/blob/master/x-pack/plugins/lists/public/exceptions/components/autocomplete/field.tsx)

Ref PR where fixes are applied to one of the files but not the other (could be other PR's in addition to this one):
https://github.com/elastic/kibana/pull/87004

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
2021-07-13 16:23:58 -06:00
Davis Plumlee
c6916eacc2
[Security Solution][Exceptions] Gets rid of rule exception comma delimiter for "is one of" operator (#104960) 2021-07-08 20:12:04 -04:00
David Sánchez
eb9726987c
[Security Solution][Endpoint] Hide endpoint event filters list in detections tab (#102644)
* Add event filters filter on exception list to hide it in UI

* Fixes unit test and added more tests for showEventFilters

* fixes test adding showEventFilters test cases

* Pass params as js object instead of individual variables

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2021-06-23 16:04:23 +02:00
Davis Plumlee
c52f5edfcc
[Security Solution][Exceptions] Fixes empty exceptions filter bug (#102583) 2021-06-21 18:34:11 -04:00
Ryland Herrick
ac07ebba87
[Security Solution] kbn package for generic hook utils (#101976)
* Adds boilerplate for new hook-utils package

* Move existing, identified utils into our hook-utils package

Updates references, and fixes a few missing config that were preventing
packages from building.

* Extracts a common type and adds a little more JSdoc for clarity

* Adds new useObservable hook

Similar to useAsync (a nearly identical interface), this is meant to
wrap a thunk returning an observable, allowing conditional invocation
and progressive updates as the observable continues to emit.

* Remove orphaned test

This function (and its tests) were moved to the hook-utils package; this
was simply missed.

* Remove optional chaining from kbn package

The build system does not currently support these typescript features.
While a valid fix would also have been to build separate browser and
node targets a la #99390, the use here was very minimal and so changing
to a supported syntax was the most pragmatic fix.

* Update old reference in test file

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2021-06-17 12:09:17 -05:00
Frank Hassanabad
aa2f5b535d
[Security Solution] Utilizes constants package and deletes duplicate code (#100513)
## Summary

Utilizes constants package and deletes duplicate code

* Renames the `securitysolution-constants` to be `securitysolution-list-constants` to be specific
* Deletes duplicated code found during cleanup
* Moves more tests into the packages found along the way with the duplicated code
* Moves `parseScheduleDates` from `@kbn/securitysolution-io-ts-types` to `@kbn/securitysolution-io-ts-utils`

### Checklist

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
2021-05-24 18:38:14 -06:00
Frank Hassanabad
192c8ba743
Adds two more packages and moves files into the packages (#100375)
## Summary

* Adds package `kbn-securitysolution-list-api`
* Adds package `kbn-securitysolution-list-hooks`
* Moves files into the packages
* Moves a few additional types into the other packages such as the `kbn-securitysolution-io-ts-types` package to remove more things from the shard_export/shared_import between lists and security solution
* Removes more duplicated code

### Checklist

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
2021-05-20 12:36:07 -06:00
Frank Hassanabad
9bf488e826
[Security Solutions] Re-arranges and adds more packages to remove copied code (#100310)
## Summary

* Creates a `securitysolution-list-utils` packaged and moves the first set of utilities into there
* Fixes a slight bug with `kbn-securitysolution-io-ts-list-types` where the wrong name was used
* Moves _all_ of the lists schemas and types into the package `kbn-securitysolution-io-ts-list-types`
* Removes copied code found in a few places

## Tech debt
* Some spots I have to use an `any` in the package as Kibana kbn packages don't have the types I need
* Some spots I copy constants until we can straighten out those pieces.
* I keep copied mock files until we figure out how to share mocks from these packages without adding weight or we create dedicated mock packages for all of this. 


### Checklist

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
2021-05-19 15:59:52 -06:00
Frank Hassanabad
e15b887e43
[Security Solutions] Replaces most deprecated io-ts alerting and list types (#100234)
## Summary

Replaces most of the deprecated io-ts alerting and list types within securitysolution as part of Phase 3 of 4 phases outlined in earlier PR's such as https://github.com/elastic/kibana/pull/99260

### Checklist

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
2021-05-17 23:28:06 -06:00
Frank Hassanabad
bfe08d25c5
[Security Solutions] Removes deprecation and more copied code between security solutions and lists plugin (#100150)
## Summary

* Removes deprecations 
* Removes duplicated code

### Checklist

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
2021-05-14 16:56:08 -06:00
Frank Hassanabad
7dd29a56ad
[Security Solutions] Breaks down the io-ts packages to decrease plugin size (#100058)
## Summary

The io-ts package was too large and needed to broken down more by domain to decrease the lists plugin size and any other plugin wanting to use the packages will not incur big hits as well.

Before we had one large io-ts package:

```
@kbn/securitysolution-io-ts-utils
```

Now we have these broken down 4 packages:

```
@kbn/securitysolution-io-ts-utils
@kbn/securitysolution-io-ts-types
@kbn/securitysolution-io-ts-alerting-types
@kbn/securitysolution-io-ts-list-types   
```

Deps between these packages are:

```
@kbn/securitysolution-io-ts-utils (none)
@kbn/securitysolution-io-ts-types -> @kbn/securitysolution-io-ts-utils
@kbn/securitysolution-io-ts-alerting-types -> @kbn/securitysolution-io-ts-types, @kbn/securitysolution-io-ts-utils
@kbn/securitysolution-io-ts-list-types  -> @kbn/securitysolution-io-ts-types, @kbn/securitysolution-io-ts-utils
```

Short description and function of each (Also in each of their README.md):

```
@kbn/securitysolution-io-ts-utils, Smallest amount of utilities such as format, validate, etc...
@kbn/securitysolution-io-ts-types, Base types such as to_number, to_string, etc...
@kbn/securitysolution-io-ts-alerting-types, Alerting specific types such as severity, from, to, etc...
@kbn/securitysolution-io-ts-list-types, list specific types such as exception lists, exception list types, etc...
```

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
2021-05-13 15:36:06 -06:00
Frank Hassanabad
f492feee6e
[Security Solutions][Lists] Trims down list plugin size by breaking out the exception builder into chunks by using react lazy loading (#99989)
## Summary

Trims down the list plugin size by breaking out the exception builder into a dedicated chunk by using React Suspense and React lazy loading.

Before this PR the page load bundle size was `260503`, after the page load bundle size will be `194132`:

You can calculate this through:
```ts
node ./scripts/build_kibana_platform_plugins --dist --focus lists
cat ./x-pack/plugins/lists/target/public/metrics.json
```

Before
```json
[
  {
    "group": "@kbn/optimizer bundle module count",
    "id": "lists",
    "value": 227
  },
  {
    "group": "page load bundle size",
    "id": "lists",
    "value": 260503, <--- Very large load bundle size
    "limit": 280504,
    "limitConfigPath": "packages/kbn-optimizer/limits.yml"
  },
  {
    "group": "async chunks size",
    "id": "lists",
    "value": 0
  },
  {
    "group": "async chunk count",
    "id": "lists",
    "value": 0
  },
  {
    "group": "miscellaneous assets size",
    "id": "lists",
    "value": 0
  }
]
```

After:
```json
[
  {
    "group": "@kbn/optimizer bundle module count",
    "id": "lists",
    "value": 227
  },
  {
    "group": "page load bundle size",
    "id": "lists",
    "value": 194132, <--- Not as large bundle size
    "limit": 280504,
    "limitConfigPath": "packages/kbn-optimizer/limits.yml"
  },
  {
    "group": "async chunks size",
    "id": "lists",
    "value": 70000
  },
  {
    "group": "async chunk count",
    "id": "lists",
    "value": 1
  },
  {
    "group": "miscellaneous assets size",
    "id": "lists",
    "value": 0
  }
]
```

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
2021-05-13 14:05:02 -06:00
Frank Hassanabad
c092fbfe1a
[Security Solutions] (Phase 3, part 1) Removes dependency on security_solution plugin from lists (#99431)
## Summary

Removes the dependency of security_solution from the lists plugin

* Removes some of the deprecated types in favor of the new kbn package
* Adds a workaround in the kbn packages of removing the ?? and `a?.b?.c` typescript since kbn packages cannot transpile it
* Exposes the test_utils from the kbn package 

### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
2021-05-10 10:16:19 -06:00
Yara Tercero
ebe85665a9
[Security Solution][Exceptions] - Fix operator logic for large value lists (#99490)
### Summary
Logic for operators was off, this fix adds unit tests to ensure this bug is not hit again and updates logic
2021-05-10 01:14:24 -04:00
David Sánchez
35f4be4387
[Security Solution][Endpoint] User can edit existing event filters from the list (#98898)
* Makes width 100% to allow multilang

* Removes state/index types and move those types into the parent types file

* Allows fill form from existing exception by id. Adds unit tests. Fixes wrong comments display when there is more than one comment.

* Allows user update an existing event filter. Adds unit tests. Fixes some wrong behaviours when opening the flyout after create/update action

* Fixes typo

* Fixes wrong entry type

* Uses selectors when it's possible instead of accessing directly to state object

* Fixes typechecks

* Allows edit from the card edit button. Removes unused imports and fixes some types

* Reverts type name

* Changes reducer to don't add entry to the list manually after creation, list will be reloaded with api call. Also check always if data exists to display the add new entry button at the first time
2021-05-06 18:13:55 +02:00
Kevin Logan
5203859cf9
[Security Solution][Detections] Make Endpoint Exception field options aware of OS, introduce OS selection to Endpoint Exceptions flow (#95014) 2021-04-30 16:18:40 -04:00