[Lists][Exceptions] - Updates exception list item comments structure by yctercero · Pull Request #68864 · elastic/kibana

yctercero · 2020-06-11T05:19:58Z

Summary

This is part of a series of upcoming changes to the exception list item structure. This PR focuses solely on updating exception_item.comment. The hope is to keep these PRs relatively small.

Updates exception_item.comment structure which was previously a string to exception_item.comments which is an array of { comment: string; created_by: string; created_at: string; }
Adds a few unit tests server side
Fixes some minor mispellings
Updates ExceptionViewer component in the UI to account for new structure

Snapshots

As you can see, comments are now appearing on the UI as expected.

Testing

To turn on lists plugin - in kibana.dev.yml

# Enable lists feature
xpack.lists.enabled: true
xpack.lists.listIndex: '.lists-yara'
xpack.lists.listItemIndex: '.items-yara'

Use the scripts in x-pack/plugins/lists/server/scripts to create some sample exception lists and items. You can use the following:

Create detection type list ./post_exception_list.sh ./exception_lists/new/exception_list_detection.json
Create detection type list items ./post_exception_list_item.sh ./exception_lists/new/exception_list_item_detection_auto_id.json - this script auto generates the item_id so you can run it as many times as you like to create multiple items associated with the list generated in step 1
Create endpoint list ./post_exception_list.sh
Create endpoint type list items ./post_exception_list_item.sh ./exception_lists/new/exception_list_item_auto_id.json - this script auto generates the item_id so you can run it as many times as you like to create multiple items associated with the list generated in step 3
Run ./find_exception_lists.sh to get the id of the two lists you created
Update the ExceptionsViewer component in x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.tsx to something like the following:

 <ExceptionsViewer
       ruleId={ruleId ?? ''}
       availableListTypes={[
          ExceptionListType.DETECTION_ENGINE,
          ExceptionListType.ENDPOINT,
        ]}
       commentsAccordionId={'ruleDetailsTabExceptions'}
       exceptionListsMeta ={[
         {
            id: [DETECTION_LIST_ID],  // `id` not `list_id`
            type: 'detection',
            namespaceType: 'single',
         },
         {
            id: [ENDPOINT_LIST_ID],  // `id` not `list_id`
             type: 'endpoint',
             namespaceType: 'single',
           },
         ]}  />

Navigate to the rules details page and click on the 'Exceptions' tab. Voila!

Checklist

Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
This was checked for keyboard-only and screenreader accessibility
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser
This was checked for cross-browser compatibility, including a check against IE11

…ture

elasticmachine · 2020-06-11T05:20:01Z

Pinging @elastic/siem (Team:SIEM)

kibanamachine · 2020-06-11T06:53:30Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: b1a3aae

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

dhurley14 · 2020-06-11T14:17:07Z

x-pack/plugins/lists/server/saved_objects/exception_list.ts

+    comments: {
+      properties: {
+        comment: {
+          type: 'keyword',


I'm curious if we could change comment type to text instead of keyword so the full content of the comment is searchable?

Good call. I noticed other ones like description was set to keyword. Wasn't sure if that was for a specific reason so I defaulted to keyword. Will update!

No worries I was just curious if it's something we might want. Open to hearing from others with their thoughts on this. Not a big deal either way I think.

Per our chat, I'm planning on updating these in the upcoming PR that addresses entries. I'll link to it once its up as a follow up.

FrankHassanabad · 2020-06-11T15:16:14Z

x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts

+    expect(getPaths(left(message.errors))).toEqual(['invalid keys "extraKey"']);
+    expect(message.schema).toEqual({});
+  });
+});


Thanks for the test!

yctercero · 2020-06-11T15:21:23Z

x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts

+
+  // TODO: Is it expected behavior for it not to auto-generate a uui or throw
+  // error if item_id is not passed in?
+  xtest('it should accept an undefined for "item_id" and auto generate a uuid', () => {


@FrankHassanabad I think I might have seen a to do related to this, but just wanted to double check the expected behavior here.

FrankHassanabad

Looks great! Thanks for the moving so fast on these and the tests!

…lastic#68864) ### Summary This is part of a series of upcoming changes to the exception list item structure. This PR focuses solely on updating exception_item.comment. The hope is to keep these PRs relatively small. - Updates exception_item.comment structure which was previously a string to exception_item.comments which is an array of { comment: string; created_by: string; created_at: string; } - Adds a few unit tests server side - Fixes some minor misspellings - Updates ExceptionViewer component in the UI to account for new structure

…cture (#68864) (#68907) * [Lists][Exceptions] - Updates exception list item comments structure (#68864) ### Summary This is part of a series of upcoming changes to the exception list item structure. This PR focuses solely on updating exception_item.comment. The hope is to keep these PRs relatively small. - Updates exception_item.comment structure which was previously a string to exception_item.comments which is an array of { comment: string; created_by: string; created_at: string; } - Adds a few unit tests server side - Fixes some minor misspellings - Updates ExceptionViewer component in the UI to account for new structure * Update API review file per CI instructions

…nt structure (#69532) ### Summary This PR is a follow up to #68864 . That PR used a partial to differentiate between new and existing comments, this meant that comments could be updated when they shouldn't. It was decided in our discussion of exception list schemas that comments should be append only. This PR assures that's the case, but also leaves it open to editing comments (via API). It checks to make sure that users can only update their own comments.

…nt structure (elastic#69532) ### Summary This PR is a follow up to elastic#68864 . That PR used a partial to differentiate between new and existing comments, this meant that comments could be updated when they shouldn't. It was decided in our discussion of exception list schemas that comments should be append only. This PR assures that's the case, but also leaves it open to editing comments (via API). It checks to make sure that users can only update their own comments.

…nt structure (#69532) (#70107) ### Summary This PR is a follow up to #68864 . That PR used a partial to differentiate between new and existing comments, this meant that comments could be updated when they shouldn't. It was decided in our discussion of exception list schemas that comments should be append only. This PR assures that's the case, but also leaves it open to editing comments (via API). It checks to make sure that users can only update their own comments.

elasticmachine · 2021-09-23T14:33:19Z

Pinging @elastic/security-solution (Team: SecuritySolution)

yctercero added 2 commits June 11, 2020 01:05

COMMENTS - updates exceptions list item comment typing

bbc4107

COMMENTS - update typing for update exception list item comment struc…

d4828ab

…ture

yctercero added release_note:enhancement Team:SIEM v8.0.0 v7.9.0 labels Jun 11, 2020

yctercero requested review from a team as code owners June 11, 2020 05:19

yctercero self-assigned this Jun 11, 2020

removed test data

b1a3aae

dhurley14 reviewed Jun 11, 2020

View reviewed changes

FrankHassanabad reviewed Jun 11, 2020

View reviewed changes

yctercero commented Jun 11, 2020

View reviewed changes

FrankHassanabad approved these changes Jun 11, 2020

View reviewed changes

yctercero merged commit da5aa03 into elastic:master Jun 11, 2020

yctercero mentioned this pull request Jun 11, 2020

[7.x] [Lists][Exceptions] - Updates exception list item comments structure (#68864) #68907

Merged

yctercero mentioned this pull request Jun 18, 2020

[SIEM][Exceptions] - Cleaned up and updated exception list item comment structure #69532

Merged

2 tasks

yctercero deleted the exc-comments branch October 14, 2020 12:00

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Lists][Exceptions] - Updates exception list item comments structure#68864

[Lists][Exceptions] - Updates exception list item comments structure#68864
yctercero merged 3 commits intoelastic:masterfrom
yctercero:exc-comments

yctercero commented Jun 11, 2020 •

edited

Loading

Uh oh!

elasticmachine commented Jun 11, 2020

Uh oh!

kibanamachine commented Jun 11, 2020

Uh oh!

dhurley14 Jun 11, 2020

Uh oh!

yctercero Jun 11, 2020

Uh oh!

dhurley14 Jun 11, 2020

Uh oh!

yctercero Jun 11, 2020

Uh oh!

FrankHassanabad Jun 11, 2020

Uh oh!

yctercero Jun 11, 2020

Uh oh!

FrankHassanabad left a comment

Uh oh!

elasticmachine commented Sep 23, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

yctercero commented Jun 11, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Snapshots

Testing

Checklist

Uh oh!

elasticmachine commented Jun 11, 2020

Uh oh!

kibanamachine commented Jun 11, 2020

💚 Build Succeeded

Uh oh!

dhurley14 Jun 11, 2020

Choose a reason for hiding this comment

Uh oh!

yctercero Jun 11, 2020

Choose a reason for hiding this comment

Uh oh!

dhurley14 Jun 11, 2020

Choose a reason for hiding this comment

Uh oh!

yctercero Jun 11, 2020

Choose a reason for hiding this comment

Uh oh!

FrankHassanabad Jun 11, 2020

Choose a reason for hiding this comment

Uh oh!

yctercero Jun 11, 2020

Choose a reason for hiding this comment

Uh oh!

FrankHassanabad left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Sep 23, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

yctercero commented Jun 11, 2020 •

edited

Loading