[SecuritySolutions] Update risk score docs and add links to existing workflows by machadoum · Pull Request #166741 · elastic/kibana

machadoum · 2023-09-19T14:20:57Z

issue: #166717

Summary

Add the "How is risk score calculated?" button to the entity analytics page and risk score tab on the Host/User page.
Add risk score hover action to the user/host overview component. We can't open a flyout here because this component is already inside a flyout. The links send the user to the complete documentation.

TODO

Update text with final version

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios

elasticmachine · 2023-09-20T12:39:55Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

elasticmachine · 2023-09-20T12:39:57Z

Pinging @elastic/security-solution (Team: SecuritySolution)

machadoum · 2023-09-20T14:39:38Z

@elasticmachine merge upstream

christineweng

@machadoum thanks for making these changes!

The risk scores on alerts flyout (old and new) do not have the "learn more about risk score" tooltip. it will be best to stay consistent if this is the new standard

x-pack/plugins/security_solution/public/flyout/right/components/host_entity_overview.tsx

x-pack/plugins/security_solution/public/flyout/right/components/user_entity_overview.tsx

...ns/security_solution/public/detections/pages/alert_details/tabs/summary/host_panel/index.tsx

...ns/security_solution/public/detections/pages/alert_details/tabs/summary/user_panel/index.tsx

angorayc · 2023-09-23T20:35:25Z

Hey @machadoum , the implementation looks fine, LGTM. Just found some UI inconsistency we could confirm them with PM and UX.

In host overview we have no information icon:

The contents in the tooltips are different:

In host risk table we have colour and risk level with a hover action view unknown risk host:

In alerts table, the behaviour host risk classification seems to have different behaviour:
We could consider (in the future) display the column name as Host risk classification and have the same content rendered in the cell with an extra hover action.

We have host classification here but no hover action to filter by severity:

machadoum · 2023-09-25T12:27:14Z

Hey @machadoum , the implementation looks fine, LGTM. Just found some UI inconsistency we could confirm them with PM and UX.
In host overview we have no information icon:
The contents in the tooltips are different:

In host risk table we have colour and risk level with a hover action view unknown risk host:
In alerts table, the behaviour host risk classification seems to have different behaviour: We could consider (in the future) display the column name as `Host risk classification` and have the same content rendered in the cell with an extra hover action.
We have host classification here but no hover action to filter by severity:

Hey Angela! Thank you for the attentive review. I created an issue for the reported UI inconsistencies and I will address them with Product and UX.

machadoum · 2023-09-25T13:23:27Z

@elasticmachine merge upstream

christineweng · 2023-09-25T21:49:52Z

Hey @machadoum , the implementation looks fine, LGTM. Just found some UI inconsistency we could confirm them with PM and UX.

This is great catch @angorayc, the tech preview tooltip exists in the old alerts flyout (to see old flyout, add an alert to timeline and expand alert details in timeline - see screenshot below). At the time, risk score showed tech preview badge in some places, and we weren't sure if the badge can be dropped. To maintain consistency, a similar tech preview was added in the new expandable alerts view.

@machadoum appreciate you creating the ticket, let me know if you have any updates from product and UX :)

SourinPaul · 2023-09-26T20:15:52Z

@machadoum an additional item to track if we create a follow-up GH issue along with these inconsistencies:

Changing the UI field label for Host/ User Risk Classification to Host/User Risk Label

We use the term classification in additional functionalities like 'asset classification'. Hence we decided to change the user-facing label to label to avoid confusion. cc: @craig-abbott

Please lmk if you need additional contexts. Thanks!

machadoum · 2023-09-27T08:32:15Z

@SourinPaul @christineweng Here is the ticket for inconsistencies: #167143
I will update it with the new findings.

machadoum · 2023-09-27T09:05:56Z

@elasticmachine merge upstream

machadoum · 2023-09-27T13:09:49Z

@christineweng I updated all places where risk score fields are displayed to have the tooltip (except for tables). Could you please take a second look? I also extracted the tooltip content to a component so we can reuse it.

christineweng

LGTM 🚀 Thank you for making the changes!

nkhristinin

Detection-engine changes look good to me, but I am confused in the text that we query "open" alerts, and I am not sure that it's true for new algo.

@rylnd do we have this filter for alerts?

kibana-ci · 2023-09-28T12:16:01Z

💔 Build Failed

Buildkite Build
Commit: 04a600ea0b36a8d8fa2cc20dadb37603abf1758e
Interpreting CI Failures

Failed CI Steps

Checks

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	4550	4551	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	12.8MB	12.8MB	+4.4KB

History

💔 Build #163005 failed 3fc37ce44750564321f1927ae573c1f6e21756d0
💔 Build #162910 failed bf6d618314eaa3891fd94fad12f8e5250f625443
💔 Build #162892 failed ef974781c917bdb008ce42e42d79cb1050b89f9a
💔 Build #162786 failed c9773c3b8961fe980a02f26fedce83e295ff3ccd
💔 Build #161759 failed 45d11c402c6631e869451c439970488703933cc1

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @machadoum

rylnd · 2023-09-28T18:02:22Z

@rylnd do we have this filter for alerts?

We do now: be1d844

machadoum · 2023-09-29T12:50:42Z

The changes in this PR have widely diverged from the code reviewed code. I am closing this PR and opening a new one that only contains the final changes.

…e in-app docs (#167638) issue: #166717 original PR: #166741 ## Summary General * Add the "How is risk score calculated?" button to the entity analytics dashboard and risk score tab on the Host/User page. * ~Add risk score hover action to the user/host overview component.~ Add a tooltip with link to risk score external doc. * Update risk score in-app doc * Update the field name “classification” to “level” everywhere the risk score is displayed * Update the “tech preview” label to “beta” everywhere the risk score is displayed * Rename Learn More to "How is host/user risk score calculated?" and link to External Docs * Add Beta tag to the settings page EA Dashboard: (User and Host) * Retain panel tooltip - Remove “Tech Preview” * Learn more link -> In Product flyout * Learn More (in Flyout) -> Add link to external docs page * Remove the tooltip from *Risk Classification column Alert Page -> Insights: * Change Tooltip on *Classification field -> How is Risk Score Calculated link Host/User Pages-> Risk Score Tab * Retain panel tool-tip * Add "How is Risk Score Calculated" similar to Dashboard * Remove tooltip from "Risk Classification" column Host/User Details: * Change Tooltip on "Classification field -> How is Risk Score Calculated link * Move score over time "learn more" link to the table header * Don't show the dashboard link when risk engine is enabled. ### Checklist Delete any items that are not applicable to this PR. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

machadoum added Team:Threat Hunting Security Solution Threat Hunting Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Explore Feature:Entity Analytics Security Solution Entity Analytics features v8.11.0 labels Sep 19, 2023

machadoum self-assigned this Sep 19, 2023

machadoum force-pushed the siem-explore-166717 branch 2 times, most recently from c1eb20b to 0183038 Compare September 20, 2023 12:15

machadoum marked this pull request as ready for review September 20, 2023 12:39

machadoum requested review from a team as code owners September 20, 2023 12:39

machadoum added the release_note:skip Skip the PR/issue when compiling release notes label Sep 20, 2023

christineweng reviewed Sep 22, 2023

View reviewed changes

angorayc approved these changes Sep 23, 2023

View reviewed changes

machadoum mentioned this pull request Sep 25, 2023

[Security Solutions] Investigate risk score feature UX inconsistencies #167143

Open

machadoum force-pushed the siem-explore-166717 branch from b1fdf18 to f6ad671 Compare September 25, 2023 12:31

machadoum force-pushed the siem-explore-166717 branch from 83f1218 to c9773c3 Compare September 27, 2023 09:15

machadoum force-pushed the siem-explore-166717 branch from ef97478 to bf6d618 Compare September 27, 2023 13:12

christineweng approved these changes Sep 27, 2023

View reviewed changes

nkhristinin approved these changes Sep 28, 2023

View reviewed changes

machadoum force-pushed the siem-explore-166717 branch from 3fc37ce to 04a600e Compare September 28, 2023 11:59

machadoum marked this pull request as draft September 28, 2023 13:45

Fix many risk score UI inconsistencies

ad23238

machadoum force-pushed the siem-explore-166717 branch from 04a600e to ad23238 Compare September 29, 2023 12:49

machadoum closed this Sep 29, 2023

machadoum mentioned this pull request Sep 29, 2023

[Security Solutions] Fix many risk score UI inconsistencies and update in-app docs #167638

Merged

2 tasks

Conversation

machadoum commented Sep 19, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

elasticmachine commented Sep 20, 2023

Uh oh!

elasticmachine commented Sep 20, 2023

Uh oh!

machadoum commented Sep 20, 2023

Uh oh!

christineweng left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

angorayc commented Sep 23, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

machadoum commented Sep 25, 2023

Uh oh!

machadoum commented Sep 25, 2023

Uh oh!

christineweng commented Sep 25, 2023

Uh oh!

SourinPaul commented Sep 26, 2023

Uh oh!

machadoum commented Sep 27, 2023

Uh oh!

machadoum commented Sep 27, 2023

Uh oh!

machadoum commented Sep 27, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

christineweng left a comment

Choose a reason for hiding this comment

Uh oh!

nkhristinin left a comment

Choose a reason for hiding this comment

Uh oh!

kibana-ci commented Sep 28, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

Metrics [docs]

Module Count

Async chunks

History

Uh oh!

rylnd commented Sep 28, 2023

Uh oh!

machadoum commented Sep 29, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

machadoum commented Sep 19, 2023 •

edited

Loading

christineweng left a comment •

edited

Loading

angorayc commented Sep 23, 2023 •

edited

Loading

machadoum commented Sep 27, 2023 •

edited

Loading

kibana-ci commented Sep 28, 2023 •

edited

Loading

machadoum commented Sep 29, 2023 •

edited

Loading