Commit graph

32354 commits

Author SHA1 Message Date
Shahzad
707a637f42
[Synthetics] Fix parsing of response check json expression (#161634) 2023-07-12 12:27:34 +02:00
Shahzad
5fca22a79d
[Synthetics] Refactor e2e tests for silent failures (#161638) 2023-07-12 11:10:03 +02:00
Jordan
47d099e22f
[Cloud Security] Adding vuln filter to the scores index (#161648) 2023-07-12 12:09:41 +03:00
Mario Rodriguez Molins
9a7cc5a1d1
[Fleet] Add support for Runtime Fields (#161129)
## Summary
Closes https://github.com/elastic/kibana/issues/155255
Closes https://github.com/elastic/package-spec/issues/39

Add support in Fleet for Runtime fields, based on these docs:
- Defining runtime fields:
-
https://www.elastic.co/guide/en/elasticsearch/reference/8.8/runtime-mapping-fields.html
-
https://www.elastic.co/guide/en/elasticsearch/reference/8.8/runtime-retrieving-fields.html
- Mapping runtime fields in dynamic templates:
-
https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-templates.html#dynamic-mapping-runtime-fields
- Adding runtime fields under groups

Given these field definitions in packages:
```yaml
- name: bar
  type: boolean
- name: uptime
  type: keyword
- name: runtime_boolean
  type: boolean
  runtime: true
- name: runtime.day
  type: keyword
  runtime: >-
    emit(doc['@timestamp'].value.dayOfWeekEnum.getDisplayName(TextStyle.FULL, Locale.ROOT))
- name: to_be_long
  type: long
  runtime: true
- name: runtime.date
  type: date
  date_format: 'yyyy-MM-dd'
  runtime: >-
    emit(doc['@timestamp'].value.toEpochMilli())
- name: runtime.epoch_milli
  type: long
  runtime: >-
    emit(doc['@timestamp'].value.toEpochMilli())
- name: lowercase
  type: keyword
  runtime: >-
    emit(doc['uppercase'].value.toLowerCase())
- name: labels.*
  type: long
  object_type_mapping_type: double
  runtime: true
- name: responses
  type: group
  fields:
    - name: runtime_group_boolean
      type: boolean
      runtime: true
    - name: foo
      type: boolean
```
and this definition in the manifest
```yaml
elasticsearch:
  index_template:
    mappings:
      runtime:
        day_of_week_two:
          type: keyword
          script:
            source: "emit(doc['@timestamp'].value.dayOfWeekEnum.getDisplayName(TextStyle.FULL, Locale.ROOT))"
```

This PR adds the required fields into the `mappings` key when installing
the package. For this example, the resulting mappings are (just showing
the relevant data for these changes):

```json
{
  ".ds-logs-runtime_fields.foo-default-2023.07.10-000001": {
    "mappings": {
      "dynamic_templates": [
        {
          "labels.*": {
            "path_match": "labels.*",
            "match_mapping_type": "double",
            "runtime": {
              "type": "long"
            }
          }
        }
      ],
      "runtime": {
        "day_of_week_two": {
          "type": "keyword",
          "script": {
            "source": "emit(doc['@timestamp'].value.dayOfWeekEnum.getDisplayName(TextStyle.FULL, Locale.ROOT))",
            "lang": "painless"
          }
        },
        "labels.a": {
          "type": "long"
        },
        "labels.b": {
          "type": "long"
        },
        "lowercase": {
          "type": "keyword",
          "script": {
            "source": "emit(doc['uppercase'].value.toLowerCase())",
            "lang": "painless"
          }
        },
        "responses.runtime_group_boolean": {
          "type": "boolean"
        },
        "runtime.date": {
          "type": "date",
          "script": {
            "source": "emit(doc['@timestamp'].value.toEpochMilli())",
            "lang": "painless"
          },
          "format": "yyyy-MM-dd"
        },
        "runtime.day": {
          "type": "keyword",
          "script": {
            "source": "emit(doc['@timestamp'].value.dayOfWeekEnum.getDisplayName(TextStyle.FULL, Locale.ROOT))",
            "lang": "painless"
          }
        },
        "runtime.epoch_milli": {
          "type": "long",
          "script": {
            "source": "emit(doc['@timestamp'].value.toEpochMilli())",
            "lang": "painless"
          }
        },
        "runtime_boolean": {
          "type": "boolean"
        },
        "to_be_long": {
          "type": "long"
        }
      },
      "properties": {
        "@timestamp": {
          "type": "date",
          "ignore_malformed": false
        },
        "bar": {
          "type": "boolean"
        },
        "data_stream": {
          "properties": {
            "dataset": {
              "type": "constant_keyword"
            },
            "namespace": {
              "type": "constant_keyword"
            },
            "type": {
              "type": "constant_keyword"
            }
          }
        },
        "labels": {
          "type": "object"
        },
        "message": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "responses": {
          "properties": {
            "foo": {
              "type": "boolean"
            }
          }
        },
        "uppercase": {
          "type": "keyword",
          "ignore_above": 1024
        },
        "user": {
          "properties": {
            "id": {
              "type": "keyword",
              "ignore_above": 1024
            }
          }
        }
      }
    }
  }
}
```

Tested manually installing a package containing runtime field
definitions as the example above.

Tested also indexing some documents and retrieving the runtime fields:
- Indexing documents:
```json
POST /logs-runtime_fields.foo-default/_doc/
{
  "@timestamp": "2023-07-07T13:32:09.000Z",
  "datastream": {
    "dataset": "logs-runtime_fields.foo",
    "namespace": "default",
    "type": "logs"
  },
  "user": {
    "id": "8a4f500d"
  },
  "message": "Login successful",
  "labels": {
    "a": 1.6,
    "b": 2.5
  },
  "uppercase": "SOMETHING",
  "to_be_long": 1.6,
  "runtime_boolean": true,
  "responses.runtime_group_boolean": false
}
```
- Retrieving runtime fields (`_source` disabled):
```json
GET logs-runtime_fields.foo-default/_search
{
  "fields": [
    "@timestamp",
    "runtime_boolean",
    "responses.runtime_group_boolean",
    "runtime.day",
    "runtime.date",
    "runtime.epoch_milli",
    "labels.*",
    "uppercase",
    "lowercase",
    "to_be_long"
  ],
  "_source": false
}
```
- Output:
```json
...
    "hits": [
      {
        "_index": ".ds-logs-runtime_fields.foo-default-2023.07.10-000001",
        "_id": "_7p1P4kBtEvrlGnsxiFN",
        "_score": 1,
        "fields": {
          "uppercase": [
            "SOMETHING"
          ],
          "runtime.date": [
            "2023-07-10"
          ],
          "@timestamp": [
            "2023-07-10T09:33:09.000Z"
          ],
          "lowercase": [
            "something"
          ],
          "to_be_long": [
            1
          ],
          "runtime_boolean": [
            true
          ],
          "runtime.day": [
            "Monday"
          ],
          "labels.a": [
            1
          ],
          "labels.b": [
            2
          ],
          "responses.runtime_group_boolean": [
            false
          ],
          "runtime.epoch_milli": [
            1688981589000
          ]
        }
      }
    ]
...
```


### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

(https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2023-07-12 09:53:41 +02:00
Garrett Spong
b323923e65
[Security Solution] [Elastic AI Assistant] Consolidates settings into a single modal (#160468)
## Summary

This PR fixes the disjointed settings across the assistant by combining
them all into a single settings modal. It also resolves the Connector
`Model` configuration not being available when using the `OpenAI`
variant of the GenAI Connector.

Additional issues resolved:
- [x] Clearing conversation doesn't restore default system prompt
- [X] Double repeated welcome prompt
- [X] Clicking skip button broken

Resolves: https://github.com/elastic/security-team/issues/7110
Resolves:
https://github.com/elastic/kibana/pull/161039#pullrequestreview-1517129764
Resolves:
https://github.com/elastic/kibana/pull/161027#pullrequestreview-1523018176

#### Conversations

<p align="center">
<img width="500"
src="80e271e8-d12a-4d00-b6eb-d63cda2d8017"
/>
</p> 

#### Quick Prompts

<p align="center">
<img width="500"
src="417c49c0-2029-49f1-a2f3-b9d0ae3690d3"
/>
</p> 

#### System Prompts

<p align="center">
<img width="500"
src="cc2bac93-bfba-49c1-b5b8-6a6efa1c0a92"
/>
</p> 

#### Anonymization

<p align="center">
<img width="500"
src="9a65683a-06cc-4cc7-9397-9db2633b20a3"
/>
</p> 









### Checklist

Delete any items that are not applicable to this PR.

- [X] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [X] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2023-07-12 01:50:10 -06:00
Dzmitry Lemechko
85a99c954f
[ftr] migrate time picker GUI selection to uiSettings API call (#161642)
closes #113998

In order to make FTR functional tests faster and less flaky, we started
migrating time picker selection from UI action to Kibana API call:

```
    await this.kibanaServer.uiSettings.update({
      'timepicker:timeDefaults': `{ "from": <startTime>, "to": <endTime>}`,
    });
```

In this PR I updated most of the tests listed in the meta issue, so we
can close it.

Flaky test runner
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/2606
2023-07-12 09:06:53 +02:00
Yngrid Coello
cef5fd7817
[APM] Overflow buckets doc updated with tilt information (#161640) 2023-07-12 08:11:25 +02:00
Sander Philipse
8ece07a0e9
[Enterprise Search] Add ServiceNow connector (#161651)
## Summary

Add ServiceNow in the right spot.
2023-07-12 05:22:18 +02:00
Luke
ca3146f0ca
[Security Solution] Store last conversation in localstorage #6993 (#161373) 2023-07-11 18:02:11 -07:00
Kevin Delemme
ea0aed276d
feat(slo): handles tab from url in slo details page (#161222) 2023-07-11 20:23:38 -04:00
Chris Cowan
06f7cbf9b6
[SLO] Add indicator to support histogram fields (#161582)
## Summary


This PR add a new indicator to support histogram fields. This will allow
you to either use a `range` aggregation or `value_count` aggregation for
the good and total events; including support for filtering with KQL on
both event types. When using a `range` aggregation, both the `from` and
`to` thresholds are required for the range and events will be to total
number of events within that range.[ Keep in mind, with the `range`
aggregation, the range includes the `from` value and excludes the `to`
value.](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-range-aggregation.html)

This PR also includes support for using the histogram field for a
"Custom Metric" indicator, `sum` is calculated on the values and not the
counts. If you need it calculated on the counts then you have to use the
histogram indicator.

<img width="776" alt="image"
src="1d46b722-df13-417e-bf3b-b3c450933da2">

---------

Co-authored-by: Kevin Delemme <kdelemme@gmail.com>
2023-07-11 16:44:08 -07:00
Rodney Norris
a16f9482e3
[Enterprise Search] rebrand ent-search breadcrumbs to Search (#161586)
## Summary

Updated the enterprise-search base breadcrumbs to `Search` except for
App Search & Workplace Search remain with Enterprise Search.
Additionally fixed a small bug where the Vector Search breadcrumbs was
Search > Vector Search > Vector Search

### Screenshots
<img width="1700" alt="image"
src="b8e2e39f-25fc-4907-892b-2e460ebcb173">
<img width="1700" alt="image"
src="e17a0932-5506-4be0-ab22-e0537cf7a7e1">
<img width="1700" alt="image"
src="04e63218-8a2d-41d6-af8d-b9875fe7e295">
2023-07-11 15:03:25 -07:00
Davis Plumlee
88fc4a6627
[Security Solution][Detection Alerts] Alert tagging follow-up (#160305) 2023-07-11 17:11:23 -04:00
Kevin Delemme
9d711fb944
feat(slo): render dynamic overview section based on indicator type (#161299) 2023-07-11 17:01:42 -04:00
Steph Milovic
6673ffbf18
[Security solution] Elastic Assistant adds beta label (#161682) 2023-07-11 13:52:45 -07:00
Trevor Pierce
e58c455c56
Upgrade EUI to 83.1.0 (#161490)
`eui@83.0.0`  `83.1.0`

---

## [`83.1.0`](https://github.com/elastic/eui/tree/v83.1.0)

- Added `placeholder` prop to `EuiInlineEdit`
([#6883](https://github.com/elastic/eui/pull/6883))
- Added `sparkles` glyph to `EuiIcon`
([#6898](https://github.com/elastic/eui/pull/6898))

**Bug fixes**

- Fixed Safari-only bug for single-line row `EuiDataGrid`s, where cell
actions on hover would overlap instead of pushing content to the left
([#6881](https://github.com/elastic/eui/pull/6881))
- Fixed `EuiButton` not correctly merging in passed `className`s with
its base `.euiButton` class
([#6887](https://github.com/elastic/eui/pull/6887))
- Fixed `EuiIcon` not correctly passing the `style` prop custom `img`
icons ([#6888](https://github.com/elastic/eui/pull/6888))
- Fixed multiple components with child props (e.g. `buttonProps`,
`iconProps`, etc.) unsetting EUI's Emotion styling if custom `css` was
passed to the child props object
([#6896](https://github.com/elastic/eui/pull/6896))

**CSS-in-JS conversions**

- Converted `EuiHeader` and `EuiHeaderLogo` to Emotion
([#6878](https://github.com/elastic/eui/pull/6878))
- Removed Sass variables `$euiHeaderDarkBackgroundColor`,
`$euiHeaderBorderColor`, and `$euiHeaderBreadcrumbColor`
([#6878](https://github.com/elastic/eui/pull/6878))
- Removed Sass mixin `@euiHeaderDarkTheme`
([#6878](https://github.com/elastic/eui/pull/6878))
2023-07-11 15:51:06 -05:00
Shahzad
7f8310982d
[Synthetics] Configure rules auto for status/tls (#161578)
## Summary

Fixes https://github.com/elastic/kibana/issues/161197

<img width="1906" alt="image"
src="37942f97-c44e-473a-9753-e6dcd4694d3c">
2023-07-11 22:47:43 +02:00
Chris Cowan
7035adb4cc
[SLO] Add preview chart to custom metric indicator (#161597)
## Summary

This PR adds a preview chart to the custom metric indicator.

<img width="691" alt="image"
src="9c2c5fa0-d6b0-4d93-86cd-eee38052db16">
2023-07-11 13:53:11 -06:00
Ersin Erdal
cb853a1d9a
Skip tasks with invalid params (#158022)
Resolves: #155766 
Resolves: #159302

With this PR we aim to skip a task that has invalid direct and indirect
params.

In order to do that, 
1- We validate the task params before calling the subtask's run method
and skip if if the task params are invalid.
2- We skip execution of a subtask (rule, action etc) when the run method
of it returns a `SkipError`

Therefore, validations in the run methods needs to be moved to top of
the run method and executed before anything else to return skip if the
data is invalid.

We also added a config to enable/disable the skip feature, and define
the delay duration of task reschedule.

As this may become an infinitive loop, we are supposed to limit the
attempts.
Follow on issue to implement that: #159302

---------

Co-authored-by: Patryk Kopycinski <contact@patrykkopycinski.com>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2023-07-11 21:47:23 +02:00
Rodney Norris
5935c4312e
[Enterprise Search] rebrand ent-search Kibana nav category to Search (#161593)
## Summary

Updated the Kibana collapsible nav Enterprise Search category to Search.
Updated the App Search & Workplace Search app navLinkStatuses to
`hidden` to remove them from the Kibana nav.

### Screenshots
<img width="270" alt="image"
src="1397e701-ca87-46f2-8c15-565bc3a9202c">
2023-07-11 13:59:46 -05:00
Luke
26334b5111
[Security Solution] Close the assistant dialog on add to case #6973 (#161686) 2023-07-11 12:57:43 -06:00
Yara Tercero
fc53c18fa4
[Detection Engine] - Unskip flakey test after running through test runner (#161566)
## Summary

Resolving 155122 . Unskipping
after running through flakey test runner 100 times.
2023-07-11 11:48:19 -07:00
Jatin Kathuria
091b5c133b
[Security Solution][Security Assistant] Investigate in timeline control should be visible only on eligible queries. (#161240)
## Summary

Handles elastic/security-team#6971

This PR mainly resolved below 3 issues:

### Rename to `Add To Timeline` control in conversation code blocks to
`Investigate in Timeline`
 
- `Add to Timeline` according to existing Security Solution actions
means, adding a condition to the timeline with an `OR` clause without
affecting the existing Timeline.

- But the `Add to Timeline` control in the Security Assistant, creates a
new timeline on each action by the user, which contradicts the above
workflow. Hence, it might confuse user.

- `Investigate in Timeline` already means that a new timeline will be
created.

### `Add To Timeline` control was visible on types of codeblock. For
example, it does not make sense for a `Query DSL` to have an `Add to
Timeline` control.

- This PR adds the list of eligible types of queries/code blocks on
which `Add To Timeline` action can be added.

- Currently, that list only contains `kql`, `dsl` and `eql`. Below is
the complete list of types of query that can occur in code blocks.

- Please feel free to suggest a change.
    ```
    'eql' | 'kql' | 'dsl' | 'json' | 'no-type';
    ```

### Lazy calculation of CodeBlockPortals and CodeBlock Action container

- To add controls to the conversation code blocks, we need to follow
below 2 steps.
    1. get the codeBlock containers on which the controls can be added.
2. create portals in the HTML container with our `Add to Timeline`
control.
  
- Below are issues these steps sometime created.
1. We get codeBlock container in the `useLayoutEffect` but at the time,
all conversations might not have loaded because of which containers are
returns as the undefined.
2. Then, we try to create portal in the `undefined` container, which
fails and hence, `Add to Timeline` controls are not visible.
 
- Solution:
1. Instead of getting the codeblock container in useLayoutEffect, we get
the function which will eventually return that container, whenever we
are creating the portal.
2. Converted codeBlock Portal to a callback such that callback can be
called during the rendering which makes sure that all needed
conversations are available and using above step we can easily get the
portal containers.
Feel free to let me know if there are any issues with above strategy. 

### Better Pattern matching.

- Currently, when we are trying to identify the type of codeblock it
might result in unexpected output because of below reason.
1. Let say, we are trying to identify KQL Query and for that we use
below phrases to match in the `OpenAI` response.
        `'Kibana Query Language', 'KQL Query'`
2. Because of this, if the `OpenAI` response contains the phrase `KQL
query` or `kql query`, that fails because of case senstivity when
searching the above phrases.
    3. This PR makes that part of pattern matching case insensitive


### Before



b472178a-0145-42d8-8fb9-ab107915086a



### After


b499f099-a7a1-435f-99b2-ab27ee1f5680



### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
2023-07-11 12:09:33 -06:00
Kurt
323b0477e3
Changing where CodeEditor fields get useDarkMode value (#159638)
## Summary

Closes https://github.com/elastic/kibana/issues/157203
Closes https://github.com/elastic/kibana/issues/158051
Closes https://github.com/elastic/kibana/issues/158049

With the addition of Per User Dark Mode, components can no longer rely
on `uiSettings` as the source of truth for theme.

CodeEditor fields used to call `uiSettings` to determine if Dark Mode
was enabled, which had been provided in each callers Kibana React
Context.

The new source of truth for theme is the `CoreStart >
ThemeServiceStart`.

Currently, not all callers of CodeEditor provide the `theme` service in
their Kibana Context in a similar way and some callers don't provide it
at all.

This PR updates CodeEditor to get theme values from the Kibana Context
using a new `useKibanaTheme` react hook.

It also attempts audit the callers of CodeEditor to see if their Kibana
Context contains the theme service at the top level (Where I could add
theme to a caller's Context without major changes, I did. Some cases
will require CodeOwner guidance).

The new `useKibanaTheme` react hook will throw a TypeError if theme
isn't found in the top level of the Kibana Context, this will help with
testing as the component will not render. I will remove this after
testing so as not to introduce breaking changes.

## Testing

Please review files for which you are CODEOWNER.

I've attempted to tag all usages of `CodeEditor`/`CodeEditorFIeld` with
a TODO comment with one of the following scenarios:

1) a note where theme was provided already/where I made changes to
provide it in the appropriate context
2) I've asked for CODEOWNER guidance

For scenario 1, please pull and test that CodeEditor locally:

1. Enable Dark Mode from Edit User Profiles by clicking on the Profile
Icon on the top right, and updating your profile.
2. Navigate to the CodeEditors in the plugins you own. If they render
and display in Dark Mode - add a green check to the table below - and
you're done!
3. If it is not rendering, please help me figure out where the theme
service should be provided in the context.

For scenario 2, we will need to figure out where to make changes so your
context is providing theme. Some of the more complex usages may need to
addressed in separate issues.


## Tracking
| Team | Plugin | Theme in Context ? | Verified Working |
| - | - | - | - |
| apm-ui | apm | APM Storybook broken | ? |
| kibana-presentation | presentation_util | Yes. | Yes |
| response-ops | trigger_actions_ui | Yes | Yes |
| response-ops | stack_alerts | Yes | Yes |
| kibana-security | security  | Yes | Yes |
| security-defend-workflows | osquery | Yes | Yes |
| kibana-app-services | examples/expression_explorer | Yes | Yes |
| ml-ui | transform | Yes | Yes |
| ml-ui | ml | Yes | Yes |
| uptime | synthetics | Yes | Yes |
| kibana-gis | maps | Yes | Yes |
| kibana-gis | file_upload | Yes | Yes |
| platform-deployment-management | watcher | Yes | [AG] Yes |
| platform-deployment-management | snapshot_restore | Yes | [AG] Yes |
| platform-deployment-management | runtime_fields | Yes | [AG] Yes |
| platform-deployment-management | painless_lab | Yes | [AG] Yes |
| platform-deployment-management | ingest_pipelines | Yes | [AG] Yes |
| platform-deployment-management | index_management | Yes | [AG] Yes |
| platform-deployment-management | grokdebugger | Yes | [AG] Yes |
| platform-deployment-management | es_ui_shared | Yes | [AG] Yes |
| fleet | fleet | Yes | Yes |
| enterprise-search-frontend | enterprise_search | Yes | [AG] Yes |
| kibana-cloud-security-posture | cloud-security-posture | Yes | yes |
| sec-cloudnative-integrations | cloud_defend | Yes | Yes |
| kibana-visualizations/kibana-data-discovery | data | Yes | Yes |
| kibana-visualizations | examples/testing_embedded_lens | Yes | Yes |
| kibana-visualizations | vis_types | Yes | Yes |
| kibana-visualizations | vis_default_editor | Yes | Yes |
| kibana-visualizations | unified_search | Yes | Yes |
| kibana-visualizations | packages/kbn-text-based-editor | Yes | Yes |
| kibana-visualizatons | lens | Yes | Yes|
| kibana-core | saved_objects_management | Yes | Yes |
| kibana-presentation | inspector | Yes | Yes |
| kibana-presentation | canvas | Yes | Yes |
| kibana-data-discovery | discover | Yes | Yes |
| kibana-data-discovery | data_view_management | Yes | Yes |
| kibana-data-discovery | data_view_field_editor | Yes | Yes |
| appex-sharedux | advanced_settings | Yes | Yes |
| enterprise-search-frontend | serverless_search | Yes | [AG] Yes |
| - | - | - | - |

## Unit tests

Currently, many tests are failing since they are probably not providing
`theme` in the context. Once CODEOWNERs have weighed in on CodeEditors
usages that require discussion, I will update the accompanying tests.

## Release note
- Fixes theming of CodeEditors

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Alison Goryachev <alisonmllr20@gmail.com>
Co-authored-by: Dima Arnautov <dmitrii.arnautov@elastic.co>
Co-authored-by: Dima Arnautov <arnautov.dima@gmail.com>
2023-07-11 14:02:42 -04:00
Xavier Mouligneau
dd292b70b7
[RAM] Remove allow slack channels (#161674)
## Summary

Remove allow slack channels feature for 8.9 until we have a better way
to deal with channels


### Checklist

- [X] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2023-07-11 10:25:20 -07:00
Kibana Machine
f4e9cd15d5 skip failing test suite (#157711) 2023-07-11 12:35:49 -04:00
Alexi Doak
b83f47560f
[Response Ops][Alerting] Allow runtime fields to be selected for Elasticsearch query rule type group by or aggregate over options (#160319)
Resolves https://github.com/elastic/kibana/issues/157258

## Summary

Gets the runtime_mappings from the es query, and includes them in the
query to retrieve the fields.
Also gets runtime mappings from data views.


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios


### To verify

- Create a new Es Query rule using DSL
- Include runtime mappings in your query and verify that the runtime
fields are listed in the group by or aggregate over options below the
query
- Create a dataview and include runtime fields
- Create a new Es Query rule using KQL
- Verify that the runtime fields are listed in the group by or aggregate
over options below the query
2023-07-11 12:31:30 -04:00
Kevin Delemme
586e8db0d2
chore(slo): update open api spec (#161670) 2023-07-11 12:26:00 -04:00
christineweng
08a57b9e3a
[Security Solution] Add validations for insight form in timeline and rules (#161034)
## Summary

Currently user can add a note in timeline with invalid markdown syntax
in insight forms. Same goes to the investigation guide in rule creation
-> About.

### Before
**In timeline -> Notes**

![image](33b05592-f97a-41d8-a394-fc111f4cc039)


**On rules -> about**

![image](ca09ac1a-7798-4b13-820b-85e5cf0f61c7)


### After
**Timeline -> Notes**
Add note button should be disabled if markdown is invalid

![image](d34b0ab1-c39b-443a-a309-00aba251731e)

**On rules -> about**
Field is red if markdown is invalid

![image](850f9f4a-71a7-44f8-a9e1-bbfbdb07b0dd)

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2023-07-11 11:13:02 -05:00
Shahzad
70ed200434
[Synthetics] De-dupe overview status request on load (#161627) 2023-07-11 17:55:49 +02:00
Tim Sullivan
787491e2bb
[Reporting] Allow Chromium to work by default in Docker (#149080)
## Summary

Closes https://github.com/elastic/kibana/issues/129148


### Checklist

Delete any items that are not applicable to this PR.

- [x]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

## Release Note
Fixed a bug where Kibana Reporting would not work in Elastic Docker
without adding a special setting in kibana.yml.
2023-07-11 08:16:03 -07:00
Kibana Machine
32b06938be skip failing test suite (#161514) 2023-07-11 10:41:32 -04:00
Ievgen Sorokopud
9b6ad7280d
[Security Solution] Rule is created when the conditional logic "If alert matches a query" is left blank (#159690)
## Summary

Original ticket: https://github.com/elastic/kibana/issues/156706

These changes prevent user from creating/updating the rule when alert
filter is selected and query left blank on the rule's action page. We
gonna show an error saying "A custom query is required." in this case.

<img width="1739" alt="Screenshot 2023-06-14 at 14 36 35"
src="0456f211-603c-44d9-9271-9cfdf59f12b6">

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2023-07-11 16:27:24 +02:00
Adam Demjen
8f01d85966
[8.10] [ESRE] Filter already attached pipelines (#161590)
## Summary

Filter out pipelines from the existing pipeline selection dropdown that
are already attached to the current index. This also updates the
evaluation of the "Existing pipeline" option in the configuration panel.

Example: 2 pipelines that are already attached are filtered from the
dropdown; when attaching the 3rd one, the existing pipelines option is
disabled.

![filter_attached_pipelines](b401fcc4-e72a-4f62-ac37-a20dfab106f6)

### Checklist
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2023-07-11 07:23:37 -07:00
Marta Bondyra
7e7293a520
[Lens] Fix a11y issues & small styling issues (#161073)
## Summary

Fixes the following issues:

1. Suggestions are not reachable by keyboard navigation (it was actually
broken when fixing the [accesibility axe
warning](https://github.com/elastic/kibana/issues/154787), I ran it now
and it doesn't show now)


46c9eb70-4df7-462b-a878-b7d190aaf8c9

2. Dimension removal button is not reachable by keyboard navigation

before:


5011679b-b05a-48ca-a877-bbc940607b56

after:


9d056512-a622-4c1c-aa5b-242e2762e9ae

3. The padding for the reordering groups got a distance between the
empty dimension button (btw I have more little fixes for drag and drop
look but want to submit it in a separate PR to not ping here Discover
team):
 
<img width="421" alt="Screenshot 2023-07-03 at 17 42 41"
src="a1d22267-07b6-4179-89f9-b4c7ec5da030">
<img width="459" alt="Screenshot 2023-07-03 at 17 39 11"
src="a7b697ca-4ff3-4c18-bf96-a8710615a9df">

4. The focus outline for dataview selector and layer chart selector got
a nicer rectangular shape

before:
<img width="343" alt="Screenshot 2023-07-03 at 10 50 52"
src="0ca305b8-cdbf-4c43-b73d-0058046ab919">
<img width="360" alt="Screenshot 2023-07-03 at 17 41 18"
src="54e61646-5d4e-4512-b6e1-6d758e2b7498">

after:
<img width="350" alt="Screenshot 2023-07-03 at 11 11 01"
src="8ddd81dd-8072-4cf8-a98b-ae5eb9998add">
<img width="415" alt="Screenshot 2023-07-03 at 17 39 51"
src="1c36b3bd-cb15-4cb8-858e-92fc19e3181f">

5. The focus outline was corrected for dimension buttons. I also
refactored code here to make margins, paddings and gaps the property of
the containers and not the items themselves. I think this way it's more
correct.

before:

<img width="418" alt="Screenshot 2023-07-03 at 17 40 54"
src="b8ce4a22-dc69-44a7-8689-70928340ac24">

after:


712e2ac8-f81d-4896-b384-164fc2854766
2023-07-11 15:51:58 +02:00
Ashokaditya
f6f5986376
[Security Solution][Endpoint] Unskip mocked response actions history cypress test (#161533)
## Summary

Unskip test that was timing out at indexing test hosts. The timeout has
since been increased in elastic/kibana/pull/159518

It was added in elastic/kibana/pull/157777 and skipped in
elastic/kibana/pull/156933 thus should be backported to `8.8.1` and
`8.9.0`
2023-07-11 06:41:35 -07:00
Matthew Kime
d9d1404119
[saved search] Remove saved object client from data views plugin for saved search usage (#159109)
## Summary

Previously the data plugin relied on the data view plugin to load saved
searches since the saved searches depend upon the data plugin and
circular dependencies needed to be avoided. This is innovative and
perhaps a bit crazy.

What this PR does
- Data view api no longer loads saved searches, removing browser saved
object client usage
- Moves `kibana_context` expression and getKibanaContext function from
data plugin to saved search plugin since it loads saved searches
- Rename data views `SavedObjectsClientCommon` to `PersistenceAPI` -
this is the abstraction around saved object loading that no longer is
exclusive to the saved objects api.
- Adds saved search server api (plugin contract) for loading saved
searches.
- Functional tests on browser and server for kibana_context expression
when loading saved searches

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2023-07-11 08:23:46 -05:00
Dmitrii Shevchenko
a5627bec57
[Security Solution] Fix endpoint permissions for rule installation and update (#161641)
**Related to: https://github.com/elastic/kibana/issues/161443,
https://github.com/elastic/kibana/pull/161454**

## Summary

The `access:securitySolution-all` access level prevents a properly
configured role from installing or updating detection rules. This PR
aligns the access level for the `installation/_perform` and
`upgrade/_perform` endpoints with the rest of the detection engine APIs.

### Test instructions

Configure a role with the following permissions:

```json
{
  "test": {
    "cluster": [],
    "indices": [
      {
        "names": [
          ".alerts-security.alerts-default",
          ".lists-default",
          ".items-default"
        ],
        "privileges": [
          "read",
          "write",
          "view_index_metadata",
          "maintenance"
        ],
        "field_security": {
          "grant": [
            "*"
          ]
        },
        "allow_restricted_indices": false
      }
    ],
    "applications": [
      {
        "application": "kibana-.kibana",
        "privileges": [
          "feature_siem.all"
        ],
        "resources": [
          "*"
        ]
      }
    ],
    "run_as": [],
    "metadata": {},
    "transient_metadata": {
      "enabled": true
    }
  }
}
```

Call the upgrade/install APIs on behalf of that role to see that no 403
is returned:

```sh
curl --location 'http://localhost:5601/kbn/internal/detection_engine/prebuilt_rules/installation/_perform' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data '{
    "mode": "ALL_RULES"
}'

curl --location 'http://localhost:5601/kbn/internal/detection_engine/prebuilt_rules/upgrade/_perform' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data '{
    "mode": "ALL_RULES"
}'
```
2023-07-11 15:07:35 +02:00
Marta Bondyra
95e50875e1
[Lens] Remove <NativeRenderer /> (#161521)
## Summary

The NativeRenderer component is currently used to mount another
component in a separate mounting point. As far as I recall, we
introduced <NativeRenderer/> to allow users to create visualizations in
non-React frameworks. The idea was that users could write their own Lens
visualizations or datasources code and integrate it with our system.
However, it seems that this concept hasn't gained traction and we don’t
have it prioritized. Even if users express interest in writing their
visualizations outside of React, it is still possible to do so with some
additional boilerplate code (which we could provide as an example
non-React visualization).
Pros:

1. Simplifies and shortens the code:
1.1. Testing and debugging become easier as we no longer need to check
separate React trees when integrating frame, data source, and
visualization components.
1.2. Components communicate using standard React patterns, making
maintenance and comprehension simpler.
1.3. Context providers no longer need to be passed to each separate
component since they are already within the context.
1.4. Easier propagation of events or any other form of inter-component
communication.

2. Greatly improves performance and facilitates maintenance:
2.1. Directly accessing context inside the DatasourcePanel eliminates
the need for context passing, resulting in better performance.
2.2. Removing the requirement for a separate React root also contributes
to improved performance.

3. The render method will be removed when we upgrade to React 18. While
we could replace it with the new createRoot method, it makes sense to
perform some cleanup ;)

Cons:
1. Setting up non-React visualization or data source code might become
slightly more complex.

Performance improvement for drag and drop action with these changes:

before:

<img width="1110" alt="Screenshot 2023-07-10 at 07 14 39"
src="45a1b09b-5189-46f5-af2b-7781fcf4e774">

after:

<img width="1117" alt="Screenshot 2023-07-10 at 07 16 24"
src="0e704da1-3220-4eb9-8fa0-cc3584a90090">

## Single render when dragging:

(the first image is 3 screenshots from 3 different react roots as they
have separate mounting point. The complete render time is ~380ms)
<img width="1117" alt="Screenshot 2023-07-10 at 07 16 24"
src="6d7f2d9f-a758-476e-8efb-38693ae90097">

After we have one common render tree. Because we don't have to pass
context down as a prop, we greatly reduced the number of components
rerendered. (I will be working on reducing the render time for workspace
panel as this seems to still be a bottleneck point)
<img width="732" alt="Screenshot 2023-07-10 at 14 52 41"
src="03ec97b3-8225-490e-8884-0fd4e69587e8">

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2023-07-11 14:05:45 +02:00
Ashokaditya
5d066944fc
[Defend Workflows] Unskip policy response test (#161588)
## Summary

Unskip test that was timing out at indexing test hosts. 
The timeout has since been increased in elastic/kibana/pull/159518

Was added in elastic/kibana/pull/154505 and skipped in
elastic/kibana/pull/156104
2023-07-11 13:58:42 +02:00
Stratoula Kalafateli
f8ef18a26b
[Textbased] Depict histogram for timebased adhoc dataviews (#161524)
## Summary

Part of https://github.com/elastic/kibana/issues/158802

We decided that in the case we don't render a Lens suggestion (for
example when we have the SELECT * case) to render the histogram.

**Reminder**: Histogram makes sense only of there is a time field. For
text based mode, time field exists **ONLY** if there is the @timestamp
field.

I don't allow navigation to Lens or open the edit flyout in this case.
When the edit flyout allows the editing of the form based visualizations
(such as histogram) I will enable it then.

FTs have been changed to accomodate this change.


<img width="1751" alt="image"
src="3d28d881-bc60-43de-acf8-8cbcd172a3df">


### Checklist
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2023-07-11 14:32:33 +03:00
Marta Bondyra
91a0d2f454
[Lens] Refactor drag and drop (#161257)
## Summary

When I created drag and drop for Lens, the API I went for was not the
most readable one. It was designed this way because I wanted to gain
some performance, but it was very hard to maintain the performance gain
with a lot of changes in the drag and drop area because all the pieces
of the code needed to memoized in a tricky way and it wasn't
communicated well.
In the end it works even without these tricks so I decided to simplify
it in this PR.

The main changes include:

1. Instead of multiple `useState` per parameter, we keep all the state
in reducer both for `ReorderProvider` and `RootDragDropProvider`. Thanks
to that we get multiple improvements:
2. The code in `DragDrop` component becomes more descriptive as we don't
run multiple state updates when user executes an action but one state
update describing what actually happens (eg. `dispatchDnd({type:
'selectDropTarget' ....})`. The internal logic of the update lives in
the reducer.
3. We don't have to pass `trackUiCounterEvents` as another prop to
`DragDrop` and run it wherever we need - instead we pass it as a
middleware to the context and run before dispatching (and it's very easy
to add more middlewares if we need extra integrations at some point!)
4. We also run a11y announcements as a middleware instead of inside
`DragDrop` component
5. The `ChildDragDropProvider` props look much cleaner:
    before:
```
      <ChildDragDropProvider
        keyboardMode={keyboardModeState}
        setKeyboardMode={setKeyboardModeState}
        dragging={draggingState.dragging}
        setA11yMessage={setA11yMessage}
        setDragging={setDragging}
        activeDropTarget={activeDropTargetState}
        setActiveDropTarget={setActiveDropTarget}
        registerDropTarget={registerDropTarget}
        dropTargetsByOrder={dropTargetsByOrderState}
        dataTestSubjPrefix={dataTestSubj}
        onTrackUICounterEvent={onTrackUICounterEvent}
      >
        {children}
      </ChildDragDropProvider>
```
after:
```
<ChildDragDropProvider value={[state, dispatch]}>{children}</ChildDragDropProvider>
```
6. Created custom hook `useDragDropContext` instead of using
`useContext(DragContext)` and making DragContext private. This way we
will avoid potential problems with using context outside of root.
7. Bonus thing - if we ever decide to move to redux, the structure is
there already



What I am still not happy with is that the tests are very
domain-dependant instead of user-driven - instead of checking the store
actions, I should check the interface from the user perspective. I will
try to work on it once I find some time between more important tasks
though.
2023-07-11 13:05:03 +02:00
Tomasz Ciecierski
203c9b04b6
[Defend Workflows] Fix response actions copy (#161615) 2023-07-11 12:49:58 +02:00
Sander Philipse
8228c2afc2
[Enterprise Search] Remove GitHub connector and GCS native (#161620)
## Summary

This removes the GitHub connector (which is not ready yet) and moves the
Google Cloud Storage connector to non-native.
2023-07-11 03:06:01 -07:00
Patryk Kopyciński
ba539d7a39
[Defend Workflows] Use Vagrant for real agent Cypress e2e (#160050)
## Summary

Run Real Endpoint Cypress E2E on CI using Vagrant

---------

Co-authored-by: Tomasz Ciecierski <ciecierskitomek@gmail.com>
Co-authored-by: Ashokaditya <am.struktr@gmail.com>
2023-07-11 03:02:51 -07:00
Georgii Gorbachev
15a86c355a
[Security Solution] Move test plans from /cypress to /docs (#161517)
**Related to:** https://github.com/elastic/security-team/issues/6867
(internal)

## Summary

As requested in
https://github.com/elastic/kibana/pull/160685#issuecomment-1621635262.

In test plans, we mention how scenarios are going to be automated --
whether a given scenario will be automated using Cypress for e2e tests,
Jest for integration tests and unit tests, etc. But currently, test
plans are under `x-pack/plugins/security_solution/cypress/`.

Since test plans are in fact technology agnostic, it does not make much
sense to keep them inside a specific framework technology folder. That's
why we're moving them to a generic
`x-pack/plugins/security_solution/docs/testing` folder.
2023-07-11 02:27:00 -07:00
Walter Rafelsberger
a39531edce
[ML] Explain Log Rate Spikes: Reenable API integration tests. (#160180)
Fixes #155737. This passed 350 flaky test runner runs, reenabling. These API
integration tests were missing from CODEOWNERS, adding that in this PR
too (`/x-pack/test/api_integration/apis/aiops/ @elastic/ml-ui`).
2023-07-11 11:21:43 +02:00
Jill Guyonnet
557dc27eb4
[Fleet] Add format query param to package policies API (#160921)
Closes https://github.com/elastic/kibana/issues/155044

## Summary

This PR implements a new `format` query parameter for the package
policies API endpoints that return one or a list of package policies.
This parameter is optional and is allowed the following two values:
* `legacy` (default behaviour): the package policy inputs are formatted
as they are currently, i.e. in an array.
* `simplified`: the package policy inputs are formatted in a key-value
map, which is the new preferred format.

Example:
```
GET kbn:/api/fleet/package_policies -> current format (array) for inputs
GET kbn:/api/fleet/package_policies?format=simplified -> new simplified format (map) for inputs
GET kbn:/api/fleet/package_policies?format=legacy -> current format (array) for inputs
GET kbn:/api/fleet/package_policies?format=foo -> 400 bad request
```

Endpoints with the new `format` query parameter:
* [GET
/package_policies](https://www.elastic.co/guide/en/fleet/master/fleet-apis.html#getPackagePolicies)
* [GET
/package_policies/{packagePolicyId}](https://www.elastic.co/guide/en/fleet/master/fleet-apis.html#getPackagePolicy)
* [POST
/package_policies](https://www.elastic.co/guide/en/fleet/master/fleet-apis.html#createPackagePolicy)
* [POST
/package_policies/_bulk_get](https://www.elastic.co/guide/en/fleet/master/fleet-apis.html#bulkGetPackagePolicies)
* [PUT
/package_policies/{packagePolicyId}](https://www.elastic.co/guide/en/fleet/master/fleet-apis.html#updatePackagePolicy)

Unaffected endpoints:
* [DELETE
/package_policies/{packagePolicyId}](https://www.elastic.co/guide/en/fleet/master/fleet-apis.html#deletePackagePolicy)
* [POST
/package_policies/delete](https://www.elastic.co/guide/en/fleet/master/fleet-apis.html#postDeletePackagePolicy)
* [POST
/package_policies/upgrade](https://www.elastic.co/guide/en/fleet/master/fleet-apis.html#upgradePackagePolicy)
* [POST
/package_policies/upgrade/dryrun](https://www.elastic.co/guide/en/fleet/master/fleet-apis.html#upgradePackagePolicyDryRun)
(⚠️ TO CHECK)

Note: with this implementation, it is possible in the `POST
/package_policies` and `PUT /package_policies/{packagePolicyId}`
endpoints to provide an inputs list in the deprecated array format and
still get the inputs in the new map format in the response by passing
`?format=simplified`. Conversely, it is possible to pass a map in the
body and get an array in the response.

⚠️ **Important**: as can be seen in the failing CI builds, adding the
`format` query param to `GET /package_policies` caused requests such as
```
GET /api/fleet/package_policies?perPage=10000&page=1&kuery=ingest-package-policies.package.name%3Atomcat
```
to fail with 400 Bad Request as `perPage`, `page` and `kuery` were not
listed as query params in the schema. I've added them, which fixed the
tests, but this might be risky, as I'm not sure whether this is also
needed elsewhere.

### Swagger screenshots

See [latest
commit](7dc8da691f/x-pack/plugins/fleet/common/openapi/bundled.json#/).

![Screenshot 2023-07-07 at 12 19
24](9888437d-4160-4aaa-82ee-5b0a1a2237a5)

![Screenshot 2023-07-07 at 12 19
32](6ab0a91b-d191-410a-be45-ff9c59c20eae)

![Screenshot 2023-07-07 at 12 19
43](608b6ea1-73e0-4481-88ad-3098d159da67)

![Screenshot 2023-07-07 at 12 20
07](9d6e6b6f-1138-42b1-a1e0-8d86db104e55)

![Screenshot 2023-07-07 at 12 20
23](5e02daba-4643-498b-9572-09ddffa51fc3)

### Checklist

Delete any items that are not applicable to this PR.

- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2023-07-11 10:16:51 +02:00
Nikita Indik
c30a7d47eb
[Security Solution] Tests: Filter by rule execution status (#160502)
**Resolves: https://github.com/elastic/kibana/issues/138903**

## Summary

Adds an E2E Cypress test to check filtering by execution status in the
rules table.
<img width="953" alt="Screenshot 2023-06-26 at 14 10 10"
src="e1eb67ed-779c-42ad-8194-04a26598cfbc">
2023-07-11 10:12:37 +02:00
Katerina Patticha
8e80f192e3
Cypress for observability serverless (#160674)
Created a separated PR in order setup a basic setup for cypress and test
https://github.com/elastic/kibana/pull/160620 for serverless.


 Basic setup to run cypress for serverless-oblt

#### How to  run it 

from
`x-pack/test_serverless/functional/test_suites/observability/cypress`
```
yarn cypress:serverless:open
```


![image](8ba7dd80-a9a4-4777-898b-4d9f39bee118)
2023-07-11 09:43:06 +02:00