[Security Solution][Detection Rules] Adds a catch-all display tag for Mitre descriptions by dplumlee · Pull Request #87240 · elastic/kibana

dplumlee · 2021-01-04T21:34:39Z

Summary

Changes the default label for the Detections Rules that no longer exist or were created via API without a valid Mitre Attack name by reverting to the data on the threat field itself instead of linking it to the MITRE repo data. Before this, the tag just wouldn't be displayed and it would be an empty ui bracket that linked to the associated link.

Screenshots

Before:

After:

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios

For maintainers

This was checked for breaking API changes and was labeled appropriately

...ugins/security_solution/public/detections/components/rules/description_step/translations.tsx

spong · 2021-01-06T01:12:35Z

...ck/plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx

+                    {tactic != null
+                      ? tactic.text
+                      : `${singleThreat.tactic.name} (${singleThreat.tactic.id})`}


No need to change or anything, but just noting that instead of a ternary you could use optional chaining + nullish coalescing to pair this down a bit if you'd like.

e.g.

{tactic?.text ?? `${singleThreat.tactic.name} (${singleThreat.tactic.id})`}

spong

LGTM once green -- thanks @dplumlee! 🙂

spong · 2021-01-06T01:16:20Z

@elasticmachine merge upstream

kibanamachine · 2021-01-06T03:31:56Z

💛 Build succeeded, but was flaky

continuous-integration/kibana-ci/pull-request
Commit: c9ffcbe
Flaky suites:
- xpack-kibana-ciGroup7

Test Failures

Chrome X-Pack UI Plugin Functional Tests.x-pack/test/plugin_functional/test_suites/resolver.Resolver test app when the user is interacting with the node with ID: secondChild when the user hovers over the primary button when the user has clicked the primary button (which selects the node.) should render as expected

Link to Jenkins

Standard Out

Failed Tests Reporter:
  - Test has failed 1 times on tracked branches: https://github.com/elastic/kibana/issues/87425

[00:00:00]       │
[00:00:00]         └-: Resolver test app
[00:00:00]           └-> "before all" hook
[00:00:00]           └-> "before all" hook
[00:00:00]             │ debg navigating to resolverTest url: http://localhost:61171/app/resolverTest
[00:00:00]             │ debg navigate to: http://localhost:61171/app/resolverTest
[00:00:00]             │ debg browser[INFO] http://localhost:61171/login?next=%2Fapp%2FresolverTest%3F_t%3D1609900475315 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:00:00]             │
[00:00:00]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:00:00]             │ debg ... sleep(700) start
[00:00:00]             │ debg ... sleep(700) end
[00:00:00]             │ debg returned from get, calling refresh
[00:00:01]             │ debg browser[INFO] http://localhost:61171/login?next=%2Fapp%2FresolverTest%3F_t%3D1609900475315 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:00:01]             │
[00:00:01]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:00:01]             │ debg currentUrl = http://localhost:61171/login?next=%2Fapp%2FresolverTest%3F_t%3D1609900475315
[00:00:01]             │          appUrl = http://localhost:61171/app/resolverTest
[00:00:01]             │ debg TestSubjects.find(kibanaChrome)
[00:00:01]             │ debg Find.findByCssSelector('[data-test-subj="kibanaChrome"]') with timeout=60000
[00:00:02]             │ debg Found login page
[00:00:02]             │ debg TestSubjects.setValue(loginUsername, test_user)
[00:00:02]             │ debg TestSubjects.click(loginUsername)
[00:00:02]             │ debg Find.clickByCssSelector('[data-test-subj="loginUsername"]') with timeout=10000
[00:00:02]             │ debg Find.findByCssSelector('[data-test-subj="loginUsername"]') with timeout=10000
[00:00:02]             │ debg TestSubjects.setValue(loginPassword, changeme)
[00:00:02]             │ debg TestSubjects.click(loginPassword)
[00:00:02]             │ debg Find.clickByCssSelector('[data-test-subj="loginPassword"]') with timeout=10000
[00:00:02]             │ debg Find.findByCssSelector('[data-test-subj="loginPassword"]') with timeout=10000
[00:00:03]             │ debg TestSubjects.click(loginSubmit)
[00:00:03]             │ debg Find.clickByCssSelector('[data-test-subj="loginSubmit"]') with timeout=10000
[00:00:03]             │ debg Find.findByCssSelector('[data-test-subj="loginSubmit"]') with timeout=10000
[00:00:03]             │ debg Find.waitForDeletedByCssSelector('.kibanaWelcomeLogo') with timeout=10000
[00:00:03]             │ proc [kibana]   log   [02:34:38.406] [info][plugins][routes][security] Logging in with provider "basic" (basic)
[00:00:03]             │ debg browser[INFO] http://localhost:61171/app/resolverTest?_t=1609900475315 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:00:03]             │
[00:00:03]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:00:03]             │ debg Find.findByCssSelector('[data-test-subj="kibanaChrome"]') with timeout=60000
[00:00:05]             │ debg Find.findByCssSelector('[data-test-subj="kibanaChrome"] nav:not(.ng-hide)') with timeout=60000
[00:00:06]             │ debg browser[INFO] http://localhost:61171/app/resolverTest?_t=1609900480889 341 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:00:06]             │
[00:00:06]             │ debg browser[INFO] http://localhost:61171/bootstrap.js 42:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:00:06]             │ debg Finished login process currentUrl = http://localhost:61171/app/resolverTest
[00:00:06]             │ debg ... sleep(501) start
[00:00:07]             │ debg ... sleep(501) end
[00:00:07]             │ debg in navigateTo url = http://localhost:61171/app/resolverTest
[00:00:07]             │ debg TestSubjects.exists(statusPageContainer)
[00:00:07]             │ debg Find.existsByDisplayedByCssSelector('[data-test-subj="statusPageContainer"]') with timeout=2500
[00:00:09]             │ debg --- retry.tryForTime error: [data-test-subj="statusPageContainer"] is not displayed
[00:00:10]             │ debg ======browser======== setWindowSize 3840 2400
[00:00:10]             │ debg ======browser======== actual initial screenshot size width=1200, height=800
[00:00:10]             │ debg ======browser======== actual second screenshot size width= 600, height=400
[00:00:10]             │ debg ======browser======== calculated values xBorder= 0, yBorder=0, xScaling=1, yScaling=1
[00:00:10]             │ debg ======browser======== setting browser size to 3840 x 2400
[00:00:12]             │ debg ======browser======== final screenshot size width=3840, height=2400
[00:00:12]           └-> renders at least one node
[00:00:12]             └-> "before each" hook: global before each
[00:00:12]             │ debg TestSubjects.exists(resolver:node)
[00:00:12]             │ debg Find.existsByDisplayedByCssSelector('[data-test-subj="resolver:node"]') with timeout=120000
[00:00:12]             └- ✓ pass  (65ms) "Resolver test app renders at least one node"
[00:00:12]           └-> renders a node list
[00:00:12]             └-> "before each" hook: global before each
[00:00:12]             │ debg TestSubjects.exists(resolver:node-list)
[00:00:12]             │ debg Find.existsByDisplayedByCssSelector('[data-test-subj="resolver:node-list"]') with timeout=120000
[00:00:12]             └- ✓ pass  (29ms) "Resolver test app renders a node list"
[00:00:12]           └-> renders at least one edge line
[00:00:12]             └-> "before each" hook: global before each
[00:00:12]             │ debg TestSubjects.exists(resolver:graph:edgeline)
[00:00:12]             │ debg Find.existsByDisplayedByCssSelector('[data-test-subj="resolver:graph:edgeline"]') with timeout=120000
[00:00:12]             └- ✓ pass  (75ms) "Resolver test app renders at least one edge line"
[00:00:12]           └-> renders graph controls
[00:00:12]             └-> "before each" hook: global before each
[00:00:12]             │ debg TestSubjects.exists(resolver:graph-controls)
[00:00:12]             │ debg Find.existsByDisplayedByCssSelector('[data-test-subj="resolver:graph-controls"]') with timeout=120000
[00:00:12]             └- ✓ pass  (29ms) "Resolver test app renders graph controls"
[00:00:12]           └-: when the user is interacting with the node with ID: origin
[00:00:12]             └-> "before all" hook
[00:00:37]           └-: when the user is interacting with the node with ID: secondChild
[00:00:37]             └-> "before all" hook
[00:00:37]             └-> should render as expected
[00:00:37]               └-> "before each" hook: global before each
[00:00:37]               └-> "before each" hook
[00:00:37]               │ debg Find.findByCssSelector('[data-test-resolver-node-id="secondChild"]') with timeout=10000
[00:00:37]               │ debg compareAgainstBaseline
[00:00:37]               │ info Taking screenshot "/dev/shm/workspace/parallel/17/kibana/x-pack/test/plugin_functional/screenshots/session/second_child.png"
[00:00:38]               │ debg comparePngs: /dev/shm/workspace/parallel/17/kibana/x-pack/test/plugin_functional/screenshots/session/second_child.png vs /dev/shm/workspace/parallel/17/kibana/x-pack/test/plugin_functional/screenshots/baseline/second_child.png
[00:00:38]               │ debg calculating diff pixels...
[00:00:38]               │ debg percent different: 0.04666666666666667
[00:00:38]               └- ✓ pass  (1.2s) "Resolver test app when the user is interacting with the node with ID: secondChild should render as expected"
[00:00:38]             └-: when the user hovers over the primary button
[00:00:38]               └-> "before all" hook
[00:00:38]               └-> should render as expected
[00:00:38]                 └-> "before each" hook: global before each
[00:00:38]                 └-> "before each" hook
[00:00:38]                 └-> "before each" hook
[00:00:38]                   │ debg Find.findByCssSelector('[data-test-resolver-node-id="secondChild"]') with timeout=10000
[00:00:39]                 │ debg Find.findByCssSelector('[data-test-resolver-node-id="secondChild"]') with timeout=10000
[00:00:39]                 │ debg compareAgainstBaseline
[00:00:39]                 │ info Taking screenshot "/dev/shm/workspace/parallel/17/kibana/x-pack/test/plugin_functional/screenshots/session/second_child_with_primary_button_hovered.png"
[00:00:40]                 │ debg comparePngs: /dev/shm/workspace/parallel/17/kibana/x-pack/test/plugin_functional/screenshots/session/second_child_with_primary_button_hovered.png vs /dev/shm/workspace/parallel/17/kibana/x-pack/test/plugin_functional/screenshots/baseline/second_child_with_primary_button_hovered.png
[00:00:40]                 │ debg calculating diff pixels...
[00:00:40]                 │ debg percent different: 0.05201388888888889
[00:00:40]                 └- ✓ pass  (1.3s) "Resolver test app when the user is interacting with the node with ID: secondChild when the user hovers over the primary button should render as expected"
[00:00:40]               └-: when the user has clicked the primary button (which selects the node.)
[00:00:40]                 └-> "before all" hook
[00:00:40]                 └-> should render as expected
[00:00:40]                   └-> "before each" hook: global before each
[00:00:40]                   └-> "before each" hook
[00:00:40]                   └-> "before each" hook
[00:00:40]                     │ debg Find.findByCssSelector('[data-test-resolver-node-id="secondChild"]') with timeout=10000
[00:00:40]                   └-> "before each" hook
[00:00:41]                   │ debg Find.findByCssSelector('[data-test-resolver-node-id="secondChild"]') with timeout=10000
[00:00:41]                   │ debg compareAgainstBaseline
[00:00:41]                   │ info Taking screenshot "/dev/shm/workspace/parallel/17/kibana/x-pack/test/plugin_functional/screenshots/session/second_child_selected_with_primary_button_hovered.png"
[00:00:43]                   │ debg comparePngs: /dev/shm/workspace/parallel/17/kibana/x-pack/test/plugin_functional/screenshots/session/second_child_selected_with_primary_button_hovered.png vs /dev/shm/workspace/parallel/17/kibana/x-pack/test/plugin_functional/screenshots/baseline/second_child_selected_with_primary_button_hovered.png
[00:00:43]                   │ debg calculating diff pixels...
[00:00:43]                   │ debg percent different: 0.09599537037037037
[00:00:43]                   │ info Taking screenshot "/dev/shm/workspace/parallel/17/kibana/x-pack/test/plugin_functional/screenshots/failure/Resolver test app when the user is interacting with the node with ID_ secondChild when the user hovers over the primary button when the user has clicked the primary button _which selects the node_ should render as expected.png"
[00:00:43]                   │ info Current URL is: http://localhost:61171/app/resolverTest?resolver-test=(panelParameters%3A(nodeID%3AsecondChild)%2CpanelView%3AnodeDetail)
[00:00:43]                   │ info Saving page source to: /dev/shm/workspace/parallel/17/kibana/x-pack/test/plugin_functional/failure_debug/html/Resolver test app when the user is interacting with the node with ID_ secondChild when the user hovers over the primary button when the user has clicked the primary button _which selects the node_ should render as expected.html
[00:00:43]                   └- ✖ fail: Resolver test app when the user is interacting with the node with ID: secondChild when the user hovers over the primary button when the user has clicked the primary button (which selects the node.) should render as expected
[00:00:43]                   │      Error: expected 0.09599537037037037 to be below 0.09
[00:00:43]                   │       at Assertion.assert (/dev/shm/workspace/parallel/17/kibana/packages/kbn-expect/expect.js:100:11)
[00:00:43]                   │       at Assertion.lessThan.Assertion.below (/dev/shm/workspace/parallel/17/kibana/packages/kbn-expect/expect.js:336:8)
[00:00:43]                   │       at Function.lessThan (/dev/shm/workspace/parallel/17/kibana/packages/kbn-expect/expect.js:531:15)
[00:00:43]                   │       at Context.<anonymous> (test/plugin_functional/test_suites/resolver/index.ts:119:23)
[00:00:43]                   │       at Object.apply (/dev/shm/workspace/parallel/17/kibana/packages/kbn-test/src/functional_test_runner/lib/mocha/wrap_function.js:84:16)
[00:00:43]                   │ 
[00:00:43]                   │

Stack Trace

Error: expected 0.09599537037037037 to be below 0.09
    at Assertion.assert (/dev/shm/workspace/parallel/17/kibana/packages/kbn-expect/expect.js:100:11)
    at Assertion.lessThan.Assertion.below (/dev/shm/workspace/parallel/17/kibana/packages/kbn-expect/expect.js:336:8)
    at Function.lessThan (/dev/shm/workspace/parallel/17/kibana/packages/kbn-expect/expect.js:531:15)
    at Context.<anonymous> (test/plugin_functional/test_suites/resolver/index.ts:119:23)
    at Object.apply (/dev/shm/workspace/parallel/17/kibana/packages/kbn-test/src/functional_test_runner/lib/mocha/wrap_function.js:84:16)

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	8.5MB	8.5MB	+185.0B

Distributable file count

id	before	after	diff
`default`	47262	48022	+760

History

💔 Build #97143 failed 724b666
💚 Build #96815 succeeded 1ce59c6
💔 Build #96797 failed 22aa3ce

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

… Mitre descriptions (elastic#87240)

… Mitre descriptions (#87240) (#87426)

… Mitre descriptions (#87240) (#87427)

adds a soft fail that displays unknown

9dfa1cc

dplumlee self-assigned this Jan 4, 2021

dplumlee commented Jan 4, 2021

View reviewed changes

...ugins/security_solution/public/detections/components/rules/description_step/translations.tsx Outdated Show resolved Hide resolved

dplumlee marked this pull request as ready for review January 4, 2021 21:39

dplumlee requested review from a team as code owners January 4, 2021 21:39

dplumlee added 3 commits January 4, 2021 14:54

removes todo

22aa3ce

updates tests

1ce59c6

switches revert field

724b666

spong added the v7.12.0 label Jan 6, 2021

spong reviewed Jan 6, 2021

View reviewed changes

spong approved these changes Jan 6, 2021

View reviewed changes

Merge branch 'master' into rule-description-empty-mitre-label

c9ffcbe

dplumlee merged commit 327d0b5 into elastic:master Jan 6, 2021

dplumlee deleted the rule-description-empty-mitre-label branch January 6, 2021 04:38

This was referenced Jan 6, 2021

[7.x] [Security Solution][Detection Rules] Adds a catch-all display tag for Mitre descriptions (#87240) #87426

Merged

[7.11] [Security Solution][Detection Rules] Adds a catch-all display tag for Mitre descriptions (#87240) #87427

Merged

dplumlee added a commit to dplumlee/kibana that referenced this pull request Jan 6, 2021

[Security Solution][Detection Rules] Adds a catch-all display tag for…

7f0f76b

… Mitre descriptions (elastic#87240)

dplumlee added a commit that referenced this pull request Jan 6, 2021

[Security Solution][Detection Rules] Adds a catch-all display tag for…

00ccdac

… Mitre descriptions (#87240) (#87426)

dplumlee added a commit that referenced this pull request Jan 6, 2021

[Security Solution][Detection Rules] Adds a catch-all display tag for…

760b7ef

… Mitre descriptions (#87240) (#87427)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Detection Rules] Adds a catch-all display tag for Mitre descriptions#87240

[Security Solution][Detection Rules] Adds a catch-all display tag for Mitre descriptions#87240
dplumlee merged 5 commits intoelastic:masterfrom
dplumlee:rule-description-empty-mitre-label

dplumlee commented Jan 4, 2021 •

edited

Loading

Uh oh!

Uh oh!

spong Jan 6, 2021

Uh oh!

spong left a comment

Uh oh!

spong commented Jan 6, 2021

Uh oh!

kibanamachine commented Jan 6, 2021

Standard Out

Stack Trace

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dplumlee commented Jan 4, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Screenshots

Before:

After:

Checklist

For maintainers

Uh oh!

Uh oh!

spong Jan 6, 2021

Choose a reason for hiding this comment

Uh oh!

spong left a comment

Choose a reason for hiding this comment

Uh oh!

spong commented Jan 6, 2021

Uh oh!

kibanamachine commented Jan 6, 2021

💛 Build succeeded, but was flaky

Test Failures

Standard Out

Stack Trace

Metrics [docs]

Async chunks

Distributable file count

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dplumlee commented Jan 4, 2021 •

edited

Loading