[Security Solutions][Case] Settings per case per connector by cnasikas · Pull Request #77327 · elastic/kibana

cnasikas · 2020-09-14T12:04:13Z

Summary

This PR allows users to specify connector incident fields when cases are being sent to them. Specifically:

Jira: issue type, priority, and parent issue in the case of a subtask.
IBM Resilient: issue types, and severity.
ServiceNow: urgency, severity, and impact.

Ref: #76222, #76212, #75622

Dev docs

To create a case (POST <kibana host>:<port>/api/cases) you need to provide a connector. Requests without a connector response to 400 Bad Request.
To update the connector of a case (PATCH <kibana host>:<port>/api/cases) you need to provide the connector. The previously connector_id attribute has been removed in favor of the connector attribute.
To sets the default connector (POST <kibana host>:<port>/api/cases/configure) you need to provide a connector. The previously connector_id and connector_name attributes have been removed in favor of the connector attribute.
To update the connector’s case closure settings (PATCH <kibana host>:<port>/api/cases/configure) you need to provide a connector. The previously connector_id and connector_name attributes have been removed in favor of the connector attribute.

Connector schema:

`connector`

Property	Description	Type
id	ID of the connector used for pushing case updates to external systems.	string
name	The connector name.	string
type	The type of the connector. Must be one of these: `.servicenow`, `jira`, `.resilient`, and `.none`	string
fields	Object containing the connector’s fields.	fields

`fields`

For ServiceNow connectors:

Property	Description	Type
urgency	The urgency of the incident.	string
severity	The severity of the incident.	string
impact	The impact of the incident.	string

For Jira connectors:

Property	Description	Type
issueType	The issue type of the issue.	string
priority	The priority of the issue.	string
parent	The key of the parent issue (Valid when the issue type is Sub-task).	string

For IBM Resilient connectors:

Property	Description	Type
issueTypes	The issue types of the issue.	string[]
severityCode	The severity code of the issue.	string

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
This was checked for keyboard-only and screenreader accessibility
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser
This was checked for cross-browser compatibility

For maintainers

This was checked for breaking API changes and was labeled appropriately

XavierM

I tested locally, migration has been working as expected. I was able to create/update cases with these new settings fields. I review the code and I thought the fields registry is a great way of implementation. It will be easy to add new connectors and features on top of it.

@stephmilovic did also a good job by refactoring code and spending time fixing bugs and clean up the code. Great teamwork here!!! never easy when you have the pressure of feature freeze.

I think we can all feel like Christos today ;)

stephmilovic

LGTM! LTFF!

) (#79716) Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com> Co-authored-by: Steph Milovic <stephanie.milovic@elastic.co> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

kibanamachine · 2020-10-06T18:48:24Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: ad024db

Metrics [docs]

@kbn/optimizer bundle module count

id	before	after	diff
`securitySolution`	1998	2027	+29

async chunks size

id	before	after	diff
`securitySolution`	10.3MB	10.4MB	+103.4KB

distributable file count

id	before	after	diff
`default`	48094	48104	+10

page load bundle size

id	before	after	diff
`securitySolution`	587.2KB	592.9KB	+5.7KB

Saved Objects .kibana field count

id	before	after	diff
`cases`	32	38	+6
`cases-configure`	14	19	+5
total			+11

History

💚 Build #80157 succeeded ad024db
💚 Build #80133 succeeded 24bfbc6
💚 Build #80097 succeeded d700222
💚 Build #80008 succeeded b87113d
💔 Build #79984 failed 4262a0f

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

gchaps · 2020-10-16T15:51:24Z

@cnasikas For this PR to be included in the breaking changes doc, I need a write up that includes the details and impact of the change. See this breaking changes doc for an example.

cnasikas · 2020-10-16T16:20:29Z

@gchaps This PR updates our docs to accommodate the breaking changes. Is that enough or do you want me to post the details here?

cjcenizal · 2020-11-05T23:17:05Z

@cnasikas Ideally, there would be a section in the PR description that identifies the breaking changes for people who want to understand the changes encapsulated by the PR. Here are some good examples: #80766, #65467, #42353

cnasikas · 2020-11-07T14:12:12Z

@cjcenizal Thanks for your feedback. I updated the description accordingly and improve the labeling for the release note.

elasticmachine · 2021-09-23T14:25:57Z

Pinging @elastic/security-solution (Team: SecuritySolution)

cnasikas self-assigned this Sep 14, 2020

cnasikas added v7.10.0 v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:SIEM labels Sep 14, 2020

cnasikas changed the title ~~[Security Solutions][Case] Settings per case per connector~~ [Security Solutions][Case][skip-ci] Settings per case per connector Sep 14, 2020

cnasikas force-pushed the cases_settings branch 7 times, most recently from ccc076d to f292f95 Compare September 18, 2020 22:06

cnasikas force-pushed the cases_settings branch 2 times, most recently from 81347fc to 027e8c6 Compare September 22, 2020 10:53

cnasikas added 15 commits September 23, 2020 11:02

Init registry

4d4eebd

Init setting registration

0e11f14

Create and use case settings context

926e06f

Create jira settings

587b70e

Convert from context to hook

c9a310d

Fields at the creation page

5527613

Add fields to cases savedObject

b5f9db3

Improve types

3b078ce

Change configuration savedObject

4da7da2

Change connector definition

a95e56d

Move helpers to utils

265bf64

Improve configuration types

fa34784

Create cases with fields

3f9a41d

Improve urls

865c14e

Connectors at case view page

78656e4

pair review with christos fixing few bugs

24bfbc6

XavierM approved these changes Oct 6, 2020

View reviewed changes

stephmilovic approved these changes Oct 6, 2020

View reviewed changes

Pass fields to external service

ad024db

cnasikas merged commit 2875418 into elastic:master Oct 6, 2020

cnasikas deleted the cases_settings branch October 6, 2020 17:03

cnasikas added the Team:Threat Hunting Security Solution Threat Hunting Team label Oct 6, 2020

cnasikas mentioned this pull request Oct 7, 2020

[Security Solution][Case] Cannot push to the connector when changing field and connector at the same time #79833

Closed

cnasikas added release_note:breaking and removed release_note:skip Skip the PR/issue when compiling release notes labels Oct 12, 2020

jmikell821 mentioned this pull request Oct 12, 2020

[DOCS] Add connector incident settings to Cases elastic/security-docs#311

Closed

stephmilovic mentioned this pull request Oct 15, 2020

[Security Solution] [Cases] Cypress for case connector selector options #80745

Merged

1 task

gchaps mentioned this pull request Nov 3, 2020

[DOCS] 7.10 Release Notes #82380

Merged

1 task

cnasikas added release_note:plugin_api_changes Contains a Plugin API changes section for the breaking plugin API changes section. and removed release_note:breaking labels Nov 7, 2020

ghost mentioned this pull request Dec 2, 2020

[Question] Information about Settings per case per connector is not mention in docs under the cases section elastic/security-docs#390

Closed

cnasikas mentioned this pull request Feb 9, 2021

[Docs][Cases] Fix docs for 7.10: Connector elastic/security-docs#508

Merged

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solutions][Case] Settings per case per connector#77327

[Security Solutions][Case] Settings per case per connector#77327
cnasikas merged 175 commits intoelastic:masterfrom
cnasikas:cases_settings

cnasikas commented Sep 14, 2020 •

edited by gchaps

Loading

Uh oh!

XavierM left a comment

Uh oh!

stephmilovic left a comment

Uh oh!

kibanamachine commented Oct 6, 2020

Uh oh!

gchaps commented Oct 16, 2020

Uh oh!

cnasikas commented Oct 16, 2020

Uh oh!

cjcenizal commented Nov 5, 2020

Uh oh!

cnasikas commented Nov 7, 2020

Uh oh!

elasticmachine commented Sep 23, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

Conversation

cnasikas commented Sep 14, 2020 • edited by gchaps Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Dev docs

Connector schema:

connector

fields

Checklist

For maintainers

Uh oh!

XavierM left a comment

Choose a reason for hiding this comment

Uh oh!

stephmilovic left a comment

Choose a reason for hiding this comment

Uh oh!

kibanamachine commented Oct 6, 2020

💚 Build Succeeded

Metrics [docs]

@kbn/optimizer bundle module count

async chunks size

distributable file count

page load bundle size

Saved Objects .kibana field count

History

Uh oh!

gchaps commented Oct 16, 2020

Uh oh!

cnasikas commented Oct 16, 2020

Uh oh!

cjcenizal commented Nov 5, 2020

Uh oh!

cnasikas commented Nov 7, 2020

Uh oh!

elasticmachine commented Sep 23, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

cnasikas commented Sep 14, 2020 •

edited by gchaps

Loading

`connector`

`fields`