Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Severity level chart on Alerts page #146938

Merged
merged 18 commits into from
Dec 12, 2022
Merged

[Security Solution] Severity level chart on Alerts page #146938

merged 18 commits into from
Dec 12, 2022

Conversation

christineweng
Copy link
Contributor

@christineweng christineweng commented Dec 3, 2022 •
edited
Loading

Summary

Capabilities added

  • Additional 'Charts' drop down on Alerts page
  • A table and a donut chart that shows severity level composition
  • Filter capabilities when donut is clicked or when hovering to the Levels column

Feature flag: alertsPageChartsEnabled

image

Screen.Recording.2022-12-07.at.12.21.35.PM.mov

Checklist

For maintainers

@christineweng christineweng self-assigned this Dec 6, 2022
@christineweng christineweng added Team:Threat Hunting Security Solution Threat Hunting Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. release_note:feature Makes this part of the condensed release notes Team:Threat Hunting:Investigations Security Solution Investigations Team 8.7 candidate v8.7.0 release_note:enhancement labels Dec 6, 2022
@christineweng christineweng marked this pull request as ready for review December 8, 2022 16:06
@christineweng christineweng requested review from a team as code owners December 8, 2022 16:06
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@christineweng christineweng removed the request for review from a team December 8, 2022 23:40
jamster10
jamster10 approved these changes Dec 12, 2022
View reviewed changes
Copy link
Contributor

@jamster10 jamster10 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed for @elastic/security-threat-hunting-explore. Looks great. Thanks Christine!

kqualters-elastic
kqualters-elastic approved these changes Dec 12, 2022
View reviewed changes
Copy link
Contributor

@kqualters-elastic kqualters-elastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Made most of my comments on zoom, but looks good! Some of these types might be reused in the wider security solution, but can come back to that if needed, they are relatively simple anyway. LGTM 👍

@kibana-ci
Copy link
Collaborator

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 3386 3392 +6

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 10.1MB 10.1MB +6.5KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
securitySolution 50.5KB 50.5KB +27.0B
Unknown metric groups

ESLint disabled in files

id before after diff
osquery 1 2 +1

ESLint disabled line counts

id before after diff
enterpriseSearch 19 21 +2
fleet 60 66 +6
osquery 109 115 +6
securitySolution 445 451 +6
total +20

Total ESLint disabled count

id before after diff
enterpriseSearch 20 22 +2
fleet 69 75 +6
osquery 110 117 +7
securitySolution 521 527 +6
total +21

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @christineweng

@christineweng christineweng merged commit 7e8e7e7 into elastic:main Dec 12, 2022
@kibanamachine kibanamachine added the backport:skip This commit does not require backporting label Dec 12, 2022
@christineweng christineweng mentioned this pull request Jan 23, 2023
Merged
5 tasks
christineweng added a commit that referenced this pull request Jan 30, 2023
@christineweng @kibanamachine
[Security Solution] KPI visualizations on Alerts Page (#149173)
dda650f 
## Summary

This PR is a part 2 of #146938
that populates the remaining 2 charts for the summary section on Alerts
Page.

Capabilities added

- Alerts by type: alert count by rule and by type (prevention vs.
detection)
- Top alerts: top 10 alert grouping based on user selected drop down

Changes from previous PR

- Refactor `useSeverityChartData` to `useSummaryChartData` so that it
can be used by all 3 charts to fetch data
- Move `SeverityLevel` chart up one level to `alerts_kpi` folder to
better isolate components for testing.

Feature flag: `alertsPageChartsEnabled`


![image](https://user-images.githubusercontent.com/18648970/213945018-57a15c60-ed53-4e86-90f5-c1909e88420d.png)

### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

Co-authored-by: Kibana Machine <[email protected]>
@christineweng christineweng mentioned this pull request Feb 3, 2023
Merged
4 tasks
kqualters-elastic pushed a commit to kqualters-elastic/kibana that referenced this pull request Feb 6, 2023
@christineweng @kibanamachine @kqualters-elastic
[Security Solution] KPI visualizations on Alerts Page (elastic#149173)
709b8d9 
## Summary

This PR is a part 2 of elastic#146938
that populates the remaining 2 charts for the summary section on Alerts
Page.

Capabilities added

- Alerts by type: alert count by rule and by type (prevention vs.
detection)
- Top alerts: top 10 alert grouping based on user selected drop down

Changes from previous PR

- Refactor `useSeverityChartData` to `useSummaryChartData` so that it
can be used by all 3 charts to fetch data
- Move `SeverityLevel` chart up one level to `alerts_kpi` folder to
better isolate components for testing.

Feature flag: `alertsPageChartsEnabled`


![image](https://user-images.githubusercontent.com/18648970/213945018-57a15c60-ed53-4e86-90f5-c1909e88420d.png)

### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

Co-authored-by: Kibana Machine <[email protected]>
christineweng added a commit that referenced this pull request Feb 7, 2023
@christineweng
[Security Solution] Alert page charts new layout and chart collapse (#…
e05797b 
…150242)

## Summary

This PR is part 3 of #149173 and
#146938 that add additional KPI
visualizations to the Alerts page.

#### Capabilities added

Charts menu: changed from a drop down selection to tabs format, with
wording that better describe the usage of each charts
Chart collapse: when the toggle is collapsed, instead of showing the
same menu options, a summary of the KPIs are shown.

Feature flag: `alertsPageChartsEnabled` is set to true by default

#### Changes from previous PR
Before this PR, each chart (trend, tree map etc.) keeps its own state of
toggle status. This is no longer suitable because the new layout does
not show options when collapsed. This PR also moves the toggle status to
be at the chart panel's level, and be passed down to each chart
component.

One exception is the histogram (trend analysis), it is currently being
used in alerts detail page and overview dashboard, hence it needs to
keep track of toggle state on its own.

#### When charts are expanded

![image](https://user-images.githubusercontent.com/18648970/216714087-a872cdeb-5d69-40fd-a392-4130ad6c925c.png)

#### When collapsed and has data

![image](https://user-images.githubusercontent.com/18648970/216714168-e4d72ca2-b214-48d8-9182-932927c0b473.png)

#### When collapsed with no data

![image](https://user-images.githubusercontent.com/18648970/216714250-628b96d2-6380-4999-a2a6-ed22eb0d8791.png)


### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kqualters-elastic kqualters-elastic kqualters-elastic approved these changes

@jamster10 jamster10 jamster10 approved these changes

@michaelolo24 michaelolo24 Awaiting requested review from michaelolo24

Assignees

@christineweng christineweng

Labels
8.7 candidate backport:skip This commit does not require backporting release_note:enhancement release_note:feature Makes this part of the condensed release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Investigations Security Solution Investigations Team Team:Threat Hunting Security Solution Threat Hunting Team v8.7.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@christineweng @elasticmachine @kibana-ci @michaelolo24 @jamster10 @kqualters-elastic @kibanamachine