Skip to content

[SIEM] Add DNS histogram#50409

Merged
angorayc merged 12 commits intoelastic:masterfrom
angorayc:dnsHistogram
Nov 22, 2019
Merged

[SIEM] Add DNS histogram#50409
angorayc merged 12 commits intoelastic:masterfrom
angorayc:dnsHistogram

Conversation

@angorayc
Copy link
Copy Markdown
Contributor

@angorayc angorayc commented Nov 12, 2019

Summary

Implementation of #42461
Add DNS histogram on network page:
Screenshot 2019-11-15 at 17 49 05

Summary for Code Change:

  1. To make color mapping sharable with other components, move it to the folder of matrix_over_time component
  2. To compatible with more data types, change the name from matrix_over_time to matrix_histogram (as the X-axis may be other types aside timestamp)
  3. Add DNS histogram

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

For maintainers

@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/siem (Team:SIEM)

@angorayc angorayc changed the title [SIEM] Dns histogram [SIEM] DNS histogram Nov 12, 2019
@elasticmachine
Copy link
Copy Markdown
Contributor

💔 Build Failed

@angorayc
Copy link
Copy Markdown
Contributor Author

Hello @tsg, @cwurm,
Here are some details I'd like to confirm about this ticket, thanks in advance.

  1. Display name of the histogram
  2. Data display on x-axis
  3. Is it necessary to align the data with DNS table?

@tsg
Copy link
Copy Markdown
Contributor

tsg commented Nov 13, 2019

@angorayc This looks pretty good to me already. Two small comments:

  • Would it be possible to format the y-axis as bytes? So it shows something like 16KB, etc.

  • The legend seems superfluous given that the x-axis contains the domains already.

Is it necessary to align the data with DNS table?

Not sure I understand this one, in which sense to align it.

@angorayc
Copy link
Copy Markdown
Contributor Author

@angorayc This looks pretty good to me already. Two small comments:

  • Would it be possible to format the y-axis as bytes? So it shows something like 16KB, etc.
  • The legend seems superfluous given that the x-axis contains the domains already.

Is it necessary to align the data with DNS table?

Not sure I understand this one, in which sense to align it.

Given that our DNS table is group by IP:
Screenshot 2019-11-13 at 12 13 31

therefor I am wondering would user expect to find IP as the x-axis for histogram or not (this is what we are doing)?

Screenshot 2019-11-11 at 10 11 58

In some existing histogram, we put x-axis as timestamp and split series
into different group, not sure whether it is still make sense here.

Screenshot 2019-11-13 at 12 22 06

From users' perspective:
The advantage of current implementation is that we can see the exact bytes for each IP, but we lost the trend by time.
If we use the timestamp as x-axis may give us a good view of trend but users my not easy enough to find the exact bytes for each IP.

From implementation's perspective:
Current implementation reuse the existing query of DNS table, so no additional request sent and no new code added for handling the request either.

Therefore I think I need to rephrase my question, as in the end I'd like to know whether we should use timestamp or IP as x-axis.

@tsg
Copy link
Copy Markdown
Contributor

tsg commented Nov 13, 2019

@angorayc I see, but you seem to have copied the Anomalies table when this one should go in the DNS tab, right? That one looks like this, it's grouped by domain:

Screenshot 2019-11-13 at 15 41 35

I see what you are saying with the x-axis. I am good either way, but I kind of like the histogram as you currently have it in your PR, I think it's nice that not all charts look the same.

setQuery,
setAbsoluteRangeDatePicker,
}: NetworkRoutesProps) => {
const narrowDateRange = useCallback(
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why have you decided to remove useCallback?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice catch, I was playing around with it and failed to add it back.

dataKey="histogram"
endDate={to}
startDate={from}
title="DNS bytes out by domain"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i18n?

value,
});

const getCustomChartData = (
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe we could extract logic to ./utils.ts?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good call, isolated utils functions and types to separate files.

@angorayc
Copy link
Copy Markdown
Contributor Author

@angorayc I see, but you seem to have copied the Anomalies table when this one should go in the DNS tab, right? That one looks like this, it's grouped by domain:

Screenshot 2019-11-13 at 15 41 35

I see what you are saying with the x-axis. I am good either way, but I kind of like the histogram as you currently have it in your PR, I think it's nice that not all charts look the same.

Apologies for the wrong example, but the idea remains the same. It's nice to find that current implementation is ok.

@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

@elasticmachine
Copy link
Copy Markdown
Contributor

💔 Build Failed

@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

@elasticmachine
Copy link
Copy Markdown
Contributor

💔 Build Failed

@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

@angorayc angorayc marked this pull request as ready for review November 15, 2019 17:51
@angorayc angorayc changed the title [SIEM] DNS histogram [SIEM] Add DNS histogram Nov 16, 2019
@elasticmachine
Copy link
Copy Markdown
Contributor

💔 Build Failed

@angorayc
Copy link
Copy Markdown
Contributor Author

jenkins, test this

@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Copy link
Copy Markdown
Contributor

@patrykkopycinski patrykkopycinski left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

@angorayc angorayc merged commit d5b0fc8 into elastic:master Nov 22, 2019
angorayc added a commit to angorayc/kibana that referenced this pull request Nov 22, 2019
* add histogram

* fix types error

* rename matrix histogram component

* clean up

* add dns histogram container

* wrap passed in function with useCallback

* isolate utils functions

* extract types

* disable chart legend for dns histogram

* add dns bytes in
angorayc added a commit that referenced this pull request Nov 22, 2019
* add histogram

* fix types error

* rename matrix histogram component

* clean up

* add dns histogram container

* wrap passed in function with useCallback

* isolate utils functions

* extract types

* disable chart legend for dns histogram

* add dns bytes in
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants