[SIEM] Formats the bytes columns in timeline by stephmilovic · Pull Request #43147 · elastic/kibana

stephmilovic · 2019-08-12T20:03:56Z

Summary

Formats bytes in Timeline and TimelineDetails using the format value from getAllFieldsByName with the new PreferenceFormattedBytes component. https://github.com/elastic/siem-team/issues/341

Before:

After:

Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

~~This was checked for cross-browser compatibility, including a check against IE11~~
~~Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support~~
~~Documentation was added for features that require explanation or tutorials~~
Unit or functional tests were updated or added to match the most common scenarios
~~This was checked for keyboard-only and screenreader accessibility~~

For maintainers

~~This was checked for breaking API changes and was labeled appropriately~~
~~This includes a feature addition or change that requires a release note and was labeled appropriately~~

elasticmachine · 2019-08-12T20:03:57Z

Pinging @elastic/siem

stephmilovic · 2019-08-12T20:08:32Z

So far this PR only formats timeline columns with fields that end in .bytes. It does not include bytes fields like bytes_in, bytes_out, zeek.files.seen_bytes, suricata.eve.flow, mysql.slowlog.bytes_sent, etc... there are a lot of misc fields like this that I have not been able to populate data for, so I am hesitant to apply this fix to any field with bytes in the name without seeing what the data looks like... that's why I went with .bytes as the last key. If we can confirm that any field with bytes in the name should be formatted as bytes, I can update this PR to do that. Please let me know @cwurm @tsg

elasticmachine · 2019-08-12T21:03:30Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request

cwurm · 2019-08-13T08:26:19Z

We ship with a hardcoded ECS schema in the SIEM app, can we use that? It contains formatting information, e.g. for source.bytes:

kibana/x-pack/legacy/plugins/siem/server/utils/beat_schema/8.0.0/packetbeat.ts

Lines 1720 to 1727 in 2d81859

    
           { 
        
             name: 'bytes', 
        
             level: 'core', 
        
             type: 'long', 
        
             format: 'bytes', 
        
             example: 184, 
        
             description: 'Bytes sent from the source to the destination.', 
        
           },

That way, we could keep the number of places where we hardcode things to a minimum.

The rest of Kibana uses index patterns for formatting information, and I wish we could do the same, but we don't rely on index patterns in the SIEM app (maybe we should, but that would be a bigger change).

XavierM · 2019-08-13T12:43:18Z

I think that with the fields browser, we should be able to do exactly what @cwurm is talking about since it is a mix of the ECS schema and index pattern.

stephmilovic · 2019-08-13T13:00:45Z

@cwurm @XavierM perfect, I'll work on piping that format value through and determining bytes display based off of that

elasticmachine · 2019-08-13T16:04:57Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request

x-pack/legacy/plugins/siem/public/components/bytes/index.tsx

x-pack/legacy/plugins/siem/public/components/source_destination/country_flag.tsx

elasticmachine · 2019-08-13T17:32:35Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request

andrew-goldstein · 2019-08-13T19:42:18Z

Thanks for adding this feature @stephmilovic , and for fixing the flag issue!

For consistency with the special formatting applied to dates and IP addresses, would you be willing to also apply the new bytes formatting to the fields shown in an expanded timeline event, per the screenshot below?

elasticmachine · 2019-08-14T03:34:41Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request

elasticmachine · 2019-08-16T15:21:42Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request

andrew-goldstein

🙏 @stephmilovic for the additional formatting in the expanded events

ran it locally and it works great 💥

LGTM

…_update_json_spec * 'master' of github.com:elastic/kibana: (35 commits) fix: 🐛 pass whole action context to isCompatible() method (elastic#43457) Deleted old kbn-top-nav directive (elastic#43168) [ML] Fixing cloning of single metric distinct count job (elastic#43435) Update @elastic/charts version 8.1.6 > 9.1.1 (elastic#43516) [Inspector Views] [Request View] - Migrate inspector_views to new platform (elastic#43191) [ML] Adding loading indicators to all wizard charts (elastic#43382) disable flaky test (elastic#43492) feature(code/frontend): cancel file blob and directory commits request if outdated (elastic#43348) fix(code/frontend): button group url should have previous query string (elastic#43428) [SIEM] Fixes index substring incorrectly matching configured indices and failing to install ML job (elastic#43409) [SIEM] Adds performance enhancements such by removing wasted renderers and adding incremental DOM rendering (elastic#43157) disable flaky test (elastic#37859) Added sass lint to Canvas (elastic#43410) [Maps] add indicator when layer is filtered by search bar (elastic#43283) Properly validate current user password during password change. (elastic#43447) Spaces - allow for hex color codes that include uppercase characters (elastic#43470) [Reporting] Add a bit more logging and a few more logging level promotions (elastic#43415) Partially convert index pattern server to typescript (elastic#43291) [Infra UI] Use sum for aggregating AWS metrics. (elastic#43293) [SIEM] Format bytes columns in timeline (elastic#43147) ...

elasticmachine · 2019-09-16T13:54:21Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request

format bytes columns in timeline

4fc3426

stephmilovic added Team:SIEM release_note:skip Skip the PR/issue when compiling release notes v7.4.0 labels Aug 12, 2019

stephmilovic requested a review from andrew-goldstein August 12, 2019 20:08

XavierM and others added 2 commits August 13, 2019 11:03

add format in browser fields to allow better handling of formatting

db62a58

get format from beats docs

186070b

fix type

9785fbc

FrankHassanabad reviewed Aug 13, 2019

View reviewed changes

x-pack/legacy/plugins/siem/public/components/bytes/index.tsx Outdated Show resolved Hide resolved

FrankHassanabad reviewed Aug 13, 2019

View reviewed changes

x-pack/legacy/plugins/siem/public/components/source_destination/country_flag.tsx Show resolved Hide resolved

fix tests

76ac288

stephmilovic added 3 commits August 16, 2019 06:31

Merge branch 'master' into bytes-format-timeline

25dddad

apply bytes formatting to timeline details columns

59992c8

component from pure to memo

f8d0bff

stephmilovic marked this pull request as ready for review August 16, 2019 14:28

stephmilovic requested a review from FrankHassanabad August 16, 2019 14:28

andrew-goldstein approved these changes Aug 16, 2019

View reviewed changes

stephmilovic merged commit 38ace24 into elastic:master Aug 16, 2019

stephmilovic deleted the bytes-format-timeline branch August 16, 2019 17:58

stephmilovic mentioned this pull request Aug 16, 2019

[7.x] [SIEM] Format bytes columns in timeline (#43147) #43478

Merged

stephmilovic added a commit to stephmilovic/kibana that referenced this pull request Aug 16, 2019

[SIEM] Format bytes columns in timeline (elastic#43147)

cffba09

andrew-goldstein added the v8.0.0 label Aug 17, 2019

FrankHassanabad pushed a commit that referenced this pull request Aug 17, 2019

[SIEM] Format bytes columns in timeline (#43147) (#43478)

2010743

FrankHassanabad added release_note:fix and removed release_note:skip Skip the PR/issue when compiling release notes labels Sep 16, 2019

FrankHassanabad changed the title ~~[SIEM] Format bytes columns in timeline~~ [SIEM] Formats the bytes columns in timeline Sep 16, 2019

Conversation

stephmilovic commented Aug 12, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

For maintainers

Uh oh!

elasticmachine commented Aug 12, 2019

Uh oh!

stephmilovic commented Aug 12, 2019

Uh oh!

elasticmachine commented Aug 12, 2019

💚 Build Succeeded

Uh oh!

cwurm commented Aug 13, 2019

Uh oh!

XavierM commented Aug 13, 2019

Uh oh!

stephmilovic commented Aug 13, 2019

Uh oh!

elasticmachine commented Aug 13, 2019

💔 Build Failed

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Aug 13, 2019

💔 Build Failed

Uh oh!

andrew-goldstein commented Aug 13, 2019

Uh oh!

elasticmachine commented Aug 14, 2019

💚 Build Succeeded

Uh oh!

elasticmachine commented Aug 16, 2019

💚 Build Succeeded

Uh oh!

andrew-goldstein left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Sep 16, 2019

💔 Build Failed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

stephmilovic commented Aug 12, 2019 •

edited

Loading