Skip to content

[Security Solution] Saving is not working if hitting "favorites button" beforehand#88642

Merged
angorayc merged 17 commits intoelastic:masterfrom
angorayc:issue-85403
Feb 3, 2021
Merged

[Security Solution] Saving is not working if hitting "favorites button" beforehand#88642
angorayc merged 17 commits intoelastic:masterfrom
angorayc:issue-85403

Conversation

@angorayc
Copy link
Copy Markdown
Contributor

@angorayc angorayc commented Jan 19, 2021 •
edited
Loading

Summary

Issue description and how to reproduce:
#85403

Expected result:
#85403 (comment)

This PR also fixes event details not able to be loaded in notes tab after clicking on >

Screenshot 2021-01-21 at 23 01 15 (2)

I found no data from serverside:
Screenshot 2021-01-30 at 03 23 38

I am able to reproduce it with postman.
Screenshot 2021-01-30 at 03 23 15

I logged the error message from server side:
Screenshot 2021-01-30 at 03 23 07

It fails twice in my 30 trials:
bsearch-eventdetails2:30failed

Step to reproduce:

  1. Open any of a timeline with events in it.
  2. Leave an event note.
  3. Go to notes tab and clicking on >
  4. The failed to search error occurs

Expected result:
Event details should be loaded properly.

Checklist

@angorayc angorayc changed the title Open [Security Solution] Saving is not working if hitting "favorites button" beforehand [Security Solution] Saving is not working if hitting "favorites button" beforehand Jan 19, 2021
@angorayc angorayc mentioned this pull request Jan 19, 2021
Closed
@angorayc angorayc marked this pull request as ready for review January 19, 2021 14:09
@angorayc angorayc requested review from a team as code owners January 19, 2021 14:09
@angorayc angorayc added release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting Security Solution Threat Hunting Team v7.11.0 v7.11.1 and removed v7.11.0 labels Jan 19, 2021
@angorayc angorayc closed this Jan 20, 2021
@angorayc
Copy link
Copy Markdown
Contributor Author

angorayc commented Jan 20, 2021

Closing the PR as we want to re-write this to REST

@angorayc angorayc reopened this Jan 21, 2021
@angorayc
Copy link
Copy Markdown
Contributor Author

angorayc commented Jan 21, 2021

@elasticmachine merge upstream

@angorayc
Copy link
Copy Markdown
Contributor Author

angorayc commented Jan 25, 2021

@elasticmachine merge upstream

@angorayc
Copy link
Copy Markdown
Contributor Author

angorayc commented Jan 27, 2021

@elasticmachine merge upstream

@angorayc
Copy link
Copy Markdown
Contributor Author

angorayc commented Jan 27, 2021

@elasticmachine merge upstream

@angorayc
Copy link
Copy Markdown
Contributor Author

angorayc commented Feb 1, 2021

@elasticmachine merge upstream

@angorayc
Copy link
Copy Markdown
Contributor Author

angorayc commented Feb 1, 2021 •
edited
Loading

The error happens when no data is coming back (as search is still running, see below example isRunning: true), and breaks getDataFromSourceHits
https://github.com/elastic/kibana/blob/master/x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/details/index.ts#L35

e.g.:

{
    "id": "FldRU0lTbl8xUlRlc1ZtSERsbktuQ1EfVW1GSWZEX2lRZmVwQmw2c1V5RWsyZzo4MjE1OTk3Mw==",
    "rawResponse": {
        "took": 144,
        "timed_out": false,
        "terminated_early": false,
        "_shards": {
            "total": 124,
            "successful": 64,
            "skipped": 0,
            "failed": 0
        },
        "hits": {
            "total": 0,
            "max_score": null,
            "hits": []
        }
    },
    "isPartial": true,
    "isRunning": true,
    "total": 124,
    "loaded": 64,
    "data": [],
    "inspect": {
        "dsl": [
            "{\n  \"allowNoIndices\": true,\n  \"index\": \"auditbeat-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*,.siem-signals-angelachuang-default\",\n  \"ignoreUnavailable\": true,\n  \"body\": {\n    \"docvalue_fields\": [],\n    \"query\": {\n      \"terms\": {\n        \"_id\": [\n          \"adr_XXcBX5UUcOOYL-EQ\"\n        ]\n      }\n    },\n    \"fields\": [\n      \"*\"\n    ],\n    \"_source\": [\n      \"signal.*\"\n    ]\n  },\n  \"size\": 1\n}"
        ]
    }
}

The fix is just skip those formatter and return straight away when data is not ready, and the subscriber on client side sees isRunning = true, it knows to wait up a bit for data to come back.

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Feb 1, 2021

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 7.5MB 7.5MB +2.1KB

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@michaelolo24 michaelolo24 mentioned this pull request Feb 3, 2021
Merged
5 tasks
cnasikas
cnasikas approved these changes Feb 3, 2021
View reviewed changes
Copy link
Copy Markdown
Member

@cnasikas cnasikas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@angorayc angorayc merged commit 22a903a into elastic:master Feb 3, 2021
angorayc added a commit to angorayc/kibana that referenced this pull request Feb 3, 2021
@angorayc @kibanamachine
[Security Solution] Saving is not working if hitting "favorites butto…
98aeceb 
…n" beforehand (elastic#88642)

* fix favorites for templates

* fix integration test

* fix integration test

* fix event details request

* handle data when searchstrategy is still running

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
@angorayc angorayc mentioned this pull request Feb 3, 2021
Merged
angorayc added a commit to angorayc/kibana that referenced this pull request Feb 3, 2021
@angorayc @kibanamachine
[Security Solution] Saving is not working if hitting "favorites butto…
a8f9330 
…n" beforehand (elastic#88642)

* fix favorites for templates

* fix integration test

* fix integration test

* fix event details request

* handle data when searchstrategy is still running

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
@angorayc angorayc mentioned this pull request Feb 3, 2021
Merged
angorayc added a commit that referenced this pull request Feb 3, 2021
@angorayc @kibanamachine
[Security Solution] Saving is not working if hitting "favorites butto…
ca3fe07 
…n" beforehand (#88642) (#90132)

* fix favorites for templates

* fix integration test

* fix integration test

* fix event details request

* handle data when searchstrategy is still running

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
angorayc added a commit that referenced this pull request Feb 3, 2021
@angorayc @kibanamachine
[Security Solution] Saving is not working if hitting "favorites butto…
d981693 
…n" beforehand (#88642) (#90133)

* fix favorites for templates

* fix integration test

* fix integration test

* fix event details request

* handle data when searchstrategy is still running

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cnasikas cnasikas cnasikas approved these changes

Assignees

No one assigned

Labels

release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting Security Solution Threat Hunting Team v7.11.1

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@angorayc @kibanamachine @cnasikas