Skip to content

[7.x] [SIEM] Overview page feedback (#56261)#56276

Merged
andrew-goldstein merged 1 commit intoelastic:7.xfrom
andrew-goldstein:backport/7.x/pr-56261
Jan 29, 2020
Merged

[7.x] [SIEM] Overview page feedback (#56261)#56276
andrew-goldstein merged 1 commit intoelastic:7.xfrom
andrew-goldstein:backport/7.x/pr-56261

Conversation

@andrew-goldstein
Copy link
Copy Markdown
Contributor

Backports the following commits to 7.x:

## [SIEM] Overview page feedback

Implements feedback and fixes to the Overview page

### Overview (default theme)

![01-overview-default-theme](https://user-images.githubusercontent.com/4459398/73315509-899c5500-41ed-11ea-9949-82853dd4ba59.png)

### Overview (dark theme)

![02-overview-dark-theme](https://user-images.githubusercontent.com/4459398/73315527-902acc80-41ed-11ea-9701-6a2c5fa40cce.png)

## Highlights

* The new order of widgets is Signals, Alerts, Events, Host Events, Network events, per elastic/siem-team#494

* Changed the default `External alerts count` `Stack by` to `event.module` elastic/siem-team#491

*  Added `event.module` to the `Events count` histogram elastic/siem-team#491

* Widget titles will no longer include the currently selected `Stack by option`. The widgets will use the same static title text that appears on the other pages (i.e.. `Signals count`, `External alerts count`, and `Events count`) elastic/siem-team#491

* The `Signals count` includes a `Stack by` that defaults to `signal.rule.threat.tatic.name`

* Standardized on a 300px widget height for all histograms in the app (thanks @MichaelMarcialis for paring on this!)

* The `Open as duplicate timeline` action is `Recent timelines` is now only shown when hovering over a recent timeline

## Loading States

* The `Recent timelines` and `Security news` widgets now use the horizontal bar loading indicator

* The `Host events` and `Network events` widgets now use the horizontal bar loading indicator

* The `Host events` and `Network events` Showing _n_ events subtitles are now hidden on initial load

* The counts in the `Host events` and `Network events` Showing _n_ events subtitles are now hidden on initial load

* We no longer hide some histogram subtitles after initial load, to prevent shifting of content when a user makes a `Stack by` selection

## News Feed Error State

![news-feed-error-state](https://user-images.githubusercontent.com/4459398/73316060-1e538280-41ef-11ea-83f5-b8d6e9fa3741.png)

* Fixed an issue where the `Security news` header was hidden when an invalid URL is configured

* Added a space between the word `via` and the `SIEM advanced settings` link

* Removed the capital “N” from "News" in the error message

## Misc Visual Changes

* Fixed text truncation of the `Severity` column in the `Detections` page's `Signals` table

* Added the “showing” subtitle to the `Signals count` histogram on the Detections page

* Increased the `Stack by` histogram selector and the `View signals | alerts | events' buttons from 8 to 24px

* Tweaked the border rendering in the Overview `Host Events` and `Network events` widget headers

* Added 8px of spacing between the Overview `Host Events` and `Network events` widget accordion headers and their contents

* Fixed an issue where the `Host events` and `Networ events` widgets didn't render in ie11 elastic/siem-team#499

## Non-Visual Fixes

* Removed an incorrect usage of `usememo`

* Removed the placeholder client-side username query from `x-pack/legacy/plugins/siem/public/components/recent_timelines/index.tsx`

* Updated the query of the Overview `Host events` widget to filter by "host.name exists"

* Updated the query of the Overview `Network events` widget to filter by "source.ip exists or destination.ip : exists"
@andrew-goldstein andrew-goldstein added the backport This PR is a backport of another PR label Jan 29, 2020
@kibanamachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@andrew-goldstein andrew-goldstein merged commit b546bf8 into elastic:7.x Jan 29, 2020
@andrew-goldstein andrew-goldstein deleted the backport/7.x/pr-56261 branch January 29, 2020 08:59
jloleysens added a commit to jloleysens/kibana that referenced this pull request Jan 29, 2020
…55831

* '7.x' of github.com:elastic/kibana: (78 commits)
  Re-enable watcher FireFox functional test (elastic#56112) (elastic#56294)
  [Metrics UI] Fixing title truncation in Metrics Explorer (elastic#55917) (elastic#56248)
  [APM] x-axis labels on Error occurrences chart are incorrect based on Kibana timezone (elastic#55686) (elastic#56288)
  Migrate saved_object_save_as_checkbox directive to timelion (elastic#56114) (elastic#56286)
  [APM] Treat error.exception.stacktrace.line as optional (elastic#55733) (elastic#55840)
  Remove alerts and actions from feature catalogue (elastic#56140) (elastic#56208)
  Migrate UI capabilities to use new platform APIs (elastic#56070) (elastic#56207)
  [ML] Add functional tests for analytics UI: creation addition and regression/outlier results (elastic#56059) (elastic#56191)
  [SIEM] Overview page feedback (elastic#56261) (elastic#56276)
  [NP Cleanup] Remove ui/public/inspector (elastic#55677) (elastic#56271)
  [Index template] Fix editor should support mappings types (elastic#55804)
  fixes map index message (elastic#56104) (elastic#56194)
  [SIEM] [TIMELINE] Only add endpoint logo when on event.module === endgame (elastic#56263) (elastic#56269)
  [SIEM] Fix filters on Hosts and Network page (elastic#56234) (elastic#56267)
  [SIEM] Adds ability to infer the newsfeed.enabled setting (elastic#56236) (elastic#56265)
  [SIEM][Detection Engine] critical blocker for updated rules (elastic#56259)
  [SIEM] Put the notice for rules in comment block (elastic#56123) (elastic#56246)
  [SIEM][Detection Engine] critical blocker, fixes ordering issue that causes rules to not run the first time (elastic#56256)
  [Reporting/NP] Migration of Reporting Security dependency (elastic#56046) (elastic#56198)
  [SIEM] Add link to endpoint app through reference.url (elastic#56211) (elastic#56250)
  ...

# Conflicts:
#	x-pack/plugins/watcher/public/plugin.ts
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants