[Security Solution] New Rules Installation and Upgrade UI Workflows #158450
+2,830
−1,608
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jpdjere
force-pushed
the
new-installation-upgrade-rules-ui
branch
2 times, most recently
from
2835282
to
d6e2387
Compare
jpdjere
force-pushed
the
new-installation-upgrade-rules-ui
branch
2 times, most recently
from
c4573e4
to
9c5a781
Compare
jpdjere
commented
Jun 1, 2023
| @@ -92,6 +92,7 @@ const calculateRuleInfos = (results: CalculateRuleDiffResult[]): RuleUpgradeInfo | |||
| return { | |||
| id: installedCurrentVersion.id, | |||
| rule_id: installedCurrentVersion.rule_id, | |||
| revision: installedCurrentVersion.revision, | |||
There was a problem hiding this comment.
@xcrzx The RuleUpgradeSpecifier expects to be sent the current revision of the rule, but the response payload of upgrade _review as it was did not return it. I added it here so it can be resent to the backend on rule upgrade _perform.
Does this make sense to you? Or did I misunderstand the OCC mechanism?
There was a problem hiding this comment.
Yup, that's correct. I overlooked the revision in my previous PR. Thank you for adding it, @jpdjere. 👍
jpdjere
force-pushed
the
new-installation-upgrade-rules-ui
branch
from
c0c59c2
to
e63db16
Compare
jpdjere
changed the title
jpdjere
force-pushed
the
new-installation-upgrade-rules-ui
branch
from
0d92ba0
to
fd43956
Compare
jpdjere
added
Team: SecuritySolution
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
jpdjere
added
release_note:enhancement
backport:skip
|
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
xcrzx
force-pushed
the
new-installation-upgrade-rules-ui
branch
from
1a9b099
to
27a5ed3
Compare
xcrzx
approved these changes
Jun 13, 2023
Files by Code Ownerelastic/security-defend-workflows
elastic/security-detection-engine
elastic/security-threat-hunting
elastic/security-threat-hunting-explore
|
semd
reviewed
Jun 13, 2023
Co-authored-by: Sergi Massaneda <[email protected]>
patrykkopycinski
approved these changes
Jun 13, 2023
semd
approved these changes
Jun 13, 2023
💛 Build succeeded, but was flaky
Failed CI StepsMetrics [docs]Module Count
Async chunks
Page load bundle
Unknown metric groupsESLint disabled line counts
Total ESLint disabled count
History
To update your PR or re-run it, just comment with: cc @jpdjere |
e40pud
approved these changes
Jun 14, 2023
This was referenced Jun 14, 2023
9 tasks
5 tasks
jpdjere
added a commit
that referenced
this pull request
Jun 19, 2023
…ring in Add Rules and Rule Upgrade tables (#159700) ## Summary **1.** Replaces the EUI out-of-the-box filtering by rule name and tags [used in the initial implementation](#158450) with custom in-memory filtering. This aligns the look-and-feel of the Rules Management table with the new Add Elastic Rules and Rule Upgrades table   **2.** Adds a CTA in the Add Elastic RUles table when all rules have been installed, that navigates the user back to the Rules Management table.  ### Checklist Delete any items that are not applicable to this PR. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https:/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] Any UI touched in this PR is usable by keyboard only (learn more about [keyboard accessibility](https://webaim.org/techniques/keyboard/)) - [ ] Any UI touched in this PR does not create any new axe failures (run axe in browser: [FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/), [Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US)) - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https:/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This renders correctly on smaller devices using a responsive layout. (You can test this [in your browser](https://www.browserstack.com/guide/responsive-testing-on-local-server)) - [ ] This was checked for [cross-browser compatibility](https://www.elastic.co/support/matrix#matrix_browsers) ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
jpdjere
added a commit
that referenced
this pull request
Jun 20, 2023
…de (#159868) ## Summary Reintroduces ML Jobs warning popover that was removed during [new install/upgrade initial implementation.](#158450) ML Jobs warning popover that appears when user has legacy ML jobs installed, and the user attempts to update their prebuilt rules. Modified behaviour so that the popover now appears in any of the three cases: upgrading **all rules**, upgrading **specific rules** and upgrading **a single rule**. ### Testing In the `state` returned by `UpgradePrebuiltRulesTableContextProvider`, replace the value of `legacyJobsInstalled` for a mock value. See below: ```ts return { state: { rules, tags, isFetched, isLoading: isLoading && loadingJobs, isRefetching, selectedRules, loadingRules, lastUpdated: dataUpdatedAt, legacyJobsInstalled: [ { id: 'rc-rare-process-windows-5', description: 'Looks for rare and anomalous processes on a Windows host. Requires process execution events from Sysmon.', groups: ['host'], processed_record_count: 8577, memory_status: 'ok', jobState: 'closed', hasDatafeed: true, datafeedId: 'datafeed-rc-rare-process-windows-5', datafeedIndices: ['winlogbeat-*'], datafeedState: 'stopped', latestTimestampMs: 1561402325194, earliestTimestampMs: 1554327458406, isSingleMetricViewerJob: true, awaitingNodeAssignment: false, jobTags: {}, bucketSpanSeconds: 900, }, { id: 'siem-api-rare_process_linux_ecs', description: 'SIEM Auditbeat: Detect unusually rare processes on Linux (beta)', groups: ['siem'], processed_record_count: 582251, memory_status: 'hard_limit', jobState: 'closed', hasDatafeed: true, datafeedId: 'datafeed-siem-api-rare_process_linux_ecs', datafeedIndices: ['auditbeat-*'], datafeedState: 'stopped', latestTimestampMs: 1557434782207, earliestTimestampMs: 1557353420495, isSingleMetricViewerJob: true, awaitingNodeAssignment: false, jobTags: {}, bucketSpanSeconds: 900, }, ], isUpgradeModalVisible, ruleIdToUpgrade, modalConfirmationUpdateMethod, }, actions, }; ``` ### Checklist Delete any items that are not applicable to this PR. - [ ] Any UI touched in this PR is usable by keyboard only (learn more about [keyboard accessibility](https://webaim.org/techniques/keyboard/)) - [ ] Any UI touched in this PR does not create any new axe failures (run axe in browser: [FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/), [Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US)) - [ ] This renders correctly on smaller devices using a responsive layout. (You can test this [in your browser](https://www.browserstack.com/guide/responsive-testing-on-local-server)) - [ ] This was checked for [cross-browser compatibility](https://www.elastic.co/support/matrix#matrix_browsers) ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Addresses: #154614 #154615
Figma designs: https://www.figma.com/file/gLHm8LpTtSkAUQHrkG3RHU/%5B8.7%5D-%5BRules%5D-Rule-Immutability%2FCustomization?type=design&node-id=2935-577576&t=ziqgnlEJBpowqa7F-0
Summary
prebuiltRulesNewUpgradeAndInstallationWorkflowsEnabledfeature flag. All new prebuilt endpoints now available by default.useAddPrebuiltRulesTableContextanduseUpgradePrebuiltRulesTableContextrespectively)useFetchPrebuiltRulesStatusQueryandusePrebuiltRulesStatusconsume the/internal/detection_engine/prebuilt_rules/statusendpoint and provide information about number of rules available for installation, number of installed rules, and number of rules with available updates.useFetchPrebuiltRulesInstallReviewQueryandusePrebuiltRulesInstallReviewconsume the/internal/detection_engine/prebuilt_rules/installation/_reviewendpoint and return the rules available for installation which are listed in the Add Rules page.useFetchPrebuiltRulesUpgradeReviewQueryandusePrebuiltRulesUpgradeReviewconsume the/internal/detection_engine/prebuilt_rules/upgrade/_reviewendpoint and return the rules which have available updates, and are listed in the Rule Updates page.usePerformInstallAllRules,usePerformInstallSpecificRules, and its respective mutation hooksusePerformAllRulesInstallMutationandusePerformSpecificRulesInstallMutationconsume the/internal/detection_engine/prebuilt_rules/upgrade/_performendpoint in order to install rules.usePerformUpgradeAllRules,usePerformUpgradeSpecificRulesand its respective mutation hooksusePerformAllRulesUpgradeMutationandusePerformSpecificRulesUpgradeMutationconsume the/internal/detection_engine/prebuilt_rules/upgrade/_performendpoint in order to upgrade rules.Deprecated code
Hooks:
useCreatePrebuiltRulesMutationuseInstallPrePackagedRulesuseCreatePrePackagedRulesusePrePackagedRulesInstallationStatususePrePackagedTimelinesInstallationStatusMajor points to resolve
/api/detection_engine/rules/prepackagedendpoint in favour of the new ones, we are not currently installing timeline templates. Serverside, we will need a new endpoint to install them separately from rules? In the UI, how would this still work: would they get installed in the background now? Or maybe have a new button for it somewhere?Deviations from design
This PR includes a reduced scope to the final workflow shown in the Figma designs.
Most notably, in Milestone 2, to be released in 8.9, we did not build the flyout that, in the Add Rules page, shows the rule details when the user clicks on it, so the user can review it before installing. The same is true in the Rule Updates table, which does not allow, for now, reviewing the rules. In both cases, the user can only click in "Install Rule" and "Upgrade Rule".
There are other differences in the UI, for technical reasons:
security-rule) was created or updated, this is information we don't currently have within the SO. After discussion with @ksevasilyeva and @ARWNightingale, we decided, for now, to remove the column. In the meantime, @terrancedejesus created an issue to includecreatedAtandupdatedAtfields within the rule assets, that we can use to display in the table in later iterations.Other remaining work:
How to test rule upgrade
rule_idfrom the Network tab.PATCH /api/detection_engine/ruleswith therule_idin the payload, and also set theversionto a number lower than the current version./upgrade/_reviewendpoint will now return that rule as available for upgrade.Videos
Rule Installation Workflow
New.Rule.Installation.Workflow.mp4
Rule Upgrade Workflow
New.Role.Upgrade.Workflow.mp4
TODO