* Move timepicker (to be deprecated) into old kbn_top_nav
* Deleted search-bar and query-bar directives!
* moved search bar to kibana_react (it's a generic react component, not a service)
* translations
* Moved superDatePicker directive to kbn_top_nav (to be deprecated)
Deleted unused react_component directives call-out and tool-bar-search-box
* TS test fix
* Delete relative options
* Create actions plugin (#35679)
* Basic alerting plugin with actions
* Remove relative imports
* Code cleanup
* Split service into 3 parts, change connector structure
* Ability to disable plugin, ability to get actions
* Add slack connector
* Add email connector
* Ability to validate params and connector options
* Remove connectorOptionsSecrets for now
* Fix plugin config validation
* Add tests for slack connector
* Default connectors register on plugin init, console renamed to log, slack to message_slack
* Add remaining API endpoints for action CRUD
* Add list connectors API
* Change actions CRUD APIs to be closer with saved objects structure
* WIP
* Fix broken tests
* Add encrypted attribute support
* Add params and connectorOptions for email
* WIP
* Remove action's ability to have custom ids
* Remove ts-ignore
* Fix broken test
* Remove default connectors from this branch
* Fix API integration tests to use fixture connector
* Rename connector terminology to action type
* Rename actionTypeOptions to actionTypeConfig
* Code cleanup
* Fix broken tests
* Rename alerting plugin to actions
* Some code cleanup and add API unit tests
* Change signature of action type service execute function
* Add some plugin api integration tests
* Fix type check failure
* Code cleanup
* Create an actions client instead of an action service
* Apply Bill's PR feedback
* Fix broken test
* Find function to have destructured params
* Add tests to ensure encrypted attributes are not returned
* Fix broken test
* Add tests for validation
* Ensure actions can be updated without re-passing the config
* Remove dead code
* Test cleanup
* Fix eslint issue
* Apply Peter's PR feedback
* Code cleanup and fix broken tests
* Apply Brandon's PR feedback
* Add namespace support
* Fix broken test
* Pass services to action executors (#37194)
* Pass services to action executors
* Fix tests
* Apply PR feedback
* Apply PR feedback pt2
* Cleanup actions plugin (#37250)
* Cleanup actions, move code from alerting plugin PR
* Rename service terminology to registry
* Use static encryption key for encrypted attributes plugin inside of tests
* Empty data after create test is done running
* Fix type checks
* Fix inconsistent naming
* add server log action for alerting (#37530)
adds the first "builtin" alertType for performing a `server.log()`
* Create alerting plugin (#37043)
* WIP
* Rename fire function and remove @ts-ignore in all places
* Change naming in alerting service
* Remove alert instance class for now, support interval configuration
* Cleanup TS
* Split alerting between registry and client
* Use saved object alongside task manager instance
* Add remaining alerting APIs
* Change create structure
* Rename some variables, change actionGroups structure
* Use handlebars for templating strings at fire time
* Fix params given to alert type execute function
* Use alert instance class
* Alert instances support meta attributes
* Move alert instances deserialization
* Change interval to be ms
* Rename actions es archive
* Fix tests to use encrypted esArchive for action record
* Add create alert test to demo end to end flow
* Fix type check issue
* Alerts to use references to action objects
* Only update task manager tasks after saved objects are fully updated
* Use scope in task manager
* Fix type check
* Use task manager to execute actions
* Convert ids into references and back
* Apply PR feedback
* Fix broken test
* Fix some bugs
* Fix test errors
* Alert interval to be previous runAt + interval instead of now + interval
* Add range support
* Remove extra line
* Cleanup
* Add alert_instance.test.ts
* Add alert_type_registry.test.ts
* Move tests around
* Create generic task manager mock
* Add note about saved objects client mock
* Create alert_type_registry.mock.ts
* Add alerts_client.test.ts
* Add create_alert_instance_factory.test.ts
* Add create_fire_handler.test.ts
* WIP
* Fix get_create_task_runner_function.test.ts and make test pass
* Make get_create_task_runner_function.test.ts 100% coverage
* Add unit tests for routes
* Move files around
* Created transform_action_params.ts
* Add get_next_run_at.ts
* Add comment explaining why we copy nextRunAt
* Re-use state within alert instance
* Finalize code coverage in unit tests
* Create base api integration tests
* Add a test that ensures end to end functionality of an alert
* Fix ui capabilities test
* Fix broken plugin api integration test
* Fix jest tests with new saved objects client
* Fix broken integration tests
* Change api integration test fixture to make more sense, add functions for future tests
* Move alerts integration testing into own file, prep to add more tests
* Add tests to ensure failed task instances get retried
* Add get_create_task_runner_function.test.ts for actions, create encrypted saved objects mock
* Add action validation tests
* Ensure action type validation occurs on update
* Test 400 on unregistered alert types
* Ensure alertTypeId can't be updated
* Add validation test for alert create / update
* Fix broken checks / tests
* Skip failing test for now
* Cleanup jest tests
* Ensure action objects can be updated while keeping encrypted attributes readable
* Remove partial update sopport, remove ability to change actionTypeId, require config
* Ensure actionTypeConfig is validated on create and update
* Add alertTypeParams validation support
* Fix failing tests
* Ensure alert cleanup errors don't replace the original error
* Pass callCluster as a service to alerts and actions
* Only pass log to alerts client
* Pass savedObjectsClient as a service to alerting and actions
* Fix failing tests
* Remove range support, provide when current and previous task got scheduled
* Ensure Joi validation happens before every execute
* Remove skipped tests, to be done in future PR
* Apply self feedback pt1
* Apply self feedback pt2
* Fix broken tests
* Apply PR feedback
* PR feedback pt1
* Apply security team PR feedback
* PR feedback pt1
* PR feedback pt2
* PR feedback pt3
* Fix broken tests
* Fix callCluster to have signature
* Revert f11a6aeb06
* PR feedback pt4
* Remove __jest__ folders
* PR feedback pt5
* Fix Joi from leaking secrets
* Fire instance actions in parallel instead of series
* Fix failing jest tests
* Accept core api changes
* Fix saved objects client mock
* PR feedback pt1
* Fix eslint issues
* Throw error when alert instance already fired (#39251)
* Throw error when alert instance already fired
* shouldFire doesn't need its own boolean value
* Actions & alerting getting started user guides (#39093)
* Initial user guides
* Cleanup
* Typos, example changes
* Switch to tables, use ordered list for usage
* Start docs around alert instances and templating
* Documentation changes
* Some adjustments
* Apply PR feedback
* Apply suggestions from code review
Co-Authored-By: gchaps <33642766+gchaps@users.noreply.github.com>
* PR feedback pt2
* Provide better examples for alert types
* Apply PR feedback
* Update README locations
* Add file upload x-pack plugin
* Clean up
* Remove unneeded cluster config
* Remove unneeded test
* First pass basic telemetry (not connected).
* Basic telemetry connected
* Review feedback
* Revise telemetry to use savedObjectRepository. Capture metrics on app and file types
* Lots of cleanup, consolidation of logic
* Clean up, reorg
* Update telem tests and telem functions
* Add back import data model
* Clean up and update telemetry tests
* Fix telemetry test issues and update corresponding code
* Up chunk limit to 30 MB
* Add file upload telemetry to saved objects management builder
* Missing space
* Add descriptive comments to dynamic keys in telemetry fields
* [Maps] [File upload] Geojson upload (#36410)
* Client side basics
* File added and default named correctly
* Connect transient layer removal to file import component
* Simplify transient layer removal
* Move file import ui over to new file upload plugin and make more generic
* Add post-processing option to file upload. Make component json-specific
* Add flag for source indexing
* Revise import layer workflow to be separate from add layer workflow
* Differentiate between normal sources and import sources. Add back layer add/next button
* Update indexing boolean in component after file upload & parse
* First pass rough indexing from maps working on specific use cases
* Update parsing logic to handle geojson formats
* Index pattern added following index creation
* Pass onsuccess callback to file_upload to add layer to maps app
* Handle mulltipolygon type in es geo utils
* Add functionality to make es layer permanent and switch to edit panel
* Add to index if exists or create new
* Make plugin API more intuitive. Set up to handle remove action
* Pass transient removal call through to file import
* Clean up layer viewing logic for temp and perm layers
* Remove change source from import screen
* Add option to provide mappings array and pass geo_point and geo_shape to array
* Add support for multiple mappings select and index naming
* Match style of import file button to add layer for now
* Remove duplicate case handling resulting from merge
* Move geo processing logic over to file upload plugin for reuse
* Remove old geo_shape formatting from geo_point code
* Set default index data type. Remove unneeded stringify request logic
* Check for custom processor object which contains function
* Move file picker to separate component
* Some cleaning. Add geojson clean & validate code
* Catch file parsing errors and notify user
* Disable index type if valid file not referenced
* Set error messaging on invalid index name used
* Add index pattern checking logic and error handling
* Dynamically populate geo index options
* Set index data type earlier in the workflow. Don't duplicate requests
* Pass back index ready status from plugin and connect to layer next button
* Increase max bytes to ~50MB
* Don't parse files over max size & warn user. Also, remove toasts and warn similarly to other components
* Uploaded file default label: 'fileToImport' -> 'Import File'
* Expand out feature properties for mapping
* Pass through telemetry data to plugin back-end
* Clean up indexing flow. Separate creation of index patterns. Add new index pattern create callbacks
* Pass back info for indexing failures but don't connect to UI yet
* Fix telemetry test issues and update corresponding code
# Conflicts:
# x-pack/plugins/file_upload/server/telemetry/telemetry.test.ts
* Add file upload telemetry to saved objects management builder
* Missing space
* Add descriptive comments to dynamic keys in telemetry fields
* Divide up the import layer add workflow on the maps side and tweak to avoid layer color change
* Fix bug affecting file preview replacement not updating coordinate index type
* Remove index pattern. Organize effects. General clean up
* preIndexTransform -> transformDetails
* Update proptypes
* Cleaning, organizing
* Add index name guidelines. Show conditionally
* Add file size, type guidance. Filter on file size, not chunk size. Small tweaks to file/index tips
* Zoom to layer extent on preview of imported data
* Revert "Revise import layer workflow to be separate from add layer workflow"
This reverts commit 3b35f5371d.
* Handle import file determination to accomodate add layer flow. Update card wording
* Decompose addLayer component into smaller pieces. Add placeholder import progress component
* Dynamically change footer button text for context
* Move import card to top of sources
* Get basic progress tracking in place
* Allow second layer (indexed layer) to get removed. Reconnect file remove. Small UI tweaks
* Add link to management for further index mods
* Fix i18n failures
* Add file parsing progress indicator & text
* Reset importView on source reset
* Add dynamic chunking to handle fluctuating data sizes common to geo features
* Don't duplicate index request if request in flight
* Modify json upload and import to use JS classes & react class component state
* Transition remaining file_upload components over to class/component structure with state
* Move functions into index_settings class
* Review feedback
* Add fetch with timeout
* Split out import editor into separate component and clean up logic
* Clean up add layer panel/button title logic
* More cleanup
* Tweaks to success and error handling flow
* Handle success/error handling on add/view indexed data
* Jump to indexing complete on error. Handle nothing returned to client app
* Update name/location of source select css file
* Update import source card border color and icon
* Suggest name for index based upon file name
* Add validation to auto-suggested index name/pattern
* Use constants for geo_point and geo_shape in mappings
* Update geojson upload card/description
* Catch-all review feedback
* Fix internationalization syntax errors
* Review feedback
* Get index names and patterns only when needed
* Make addLayer async again to fix zoom to extent issue, waits on just the async syncDataForLayer function (which is async)
* Remove panel description as derived state and shift to function
* Remove geojson fit to extent for now
* Remove unused class selector
* Remove unneeded i18 wrapper for what's already passed in as an i18 element
* Revise import state to be handle via redux. Some json upload args changes
* Review feedback. Some cleanup and bug fixes
* Roll back store actions changes and layer_addpanel changes related to color change
* Follow scss file naming conventions for source_select
* Review feedback
* Restore clobbered layer_control view to master state. Add source_select css
* Update import to use plugin local indexPatternService, not maps'
* Review feedback, mostly i18n. Also add index to scss path
* i18n translation updates
* Assign error message to values rather than error object
* Update getMapColors to filter out transient layer
* Wrap Feature as FeatureCollection in Maps
* Add jest tests for geo processing functions. Add fixes for single feature handling
* i18n
* Review feedback. Test cleanup/fixes
* Update layer add panel footer logic to still show when source not selected
* Fix issue of not recognizing MultiPoint type. Remove throw logic for now
* Update telemetry with newly required placeholder function
* Prevent external modification of nested geojson objects
* i18n translation updates
* Revert "Fix issue of not recognizing MultiPoint type. Remove throw logic for now"
This reverts commit d692f913f8.
* Revert "Prevent external modification of nested geojson objects"
This reverts commit 0ea9fd3336.
* yarn.lock update
* [File upload] Remove dynamic fields from mappings, code and telemetry test (#38902)
* Remove dynamic fields from mappings, code and telemetry test
* Add file-upload-telemetry to spaces and es archiver test mappings
* Don't create telemetry saved object if none exists, create on first update instead
* Back out es archiver mappings update
* [SR] Snapshot and restore plugin boilerplate (#32276)
* Initial plugin set up
* Set up client shell
* Add initial repository list routes
* Fix merge issues and some typings
* Decouple server from plugin.ts files, tighten up typings
* Use exported constant for required license
* Translate plugin name, more typings
* Fix more types, move list components under /home
* Remove unused var
* Change scss prefix
* Uncouple unmount logic from routing shim, and some other PR feedback
* [SR] Repository list and details UI (#33367)
* Initial pass at repositories list UI
* Add detail panel for file system repositories, and a generic detail panel with json settings view
* Add detail components for other types
* Add detail panel footer, rename `useStateValue` to `useAppState`
* Fix detail panel footer
* Fix unused vars
* PR feedback
* PR feedback
* [SR] Refactor proposal (#33690)
* Move app dependencies to its own context provider
* Add index.ts barrel file for common types
* Move Enums to constants.ts file
* Refactor function component using `React.FunctionComponent<Props>`
* Refactor service folder structure
* Fix type import
* Move REPOSITORY_DOC_PATHS from common to public constants
* Move AppCore and AppPlugins interfaces back to shim and re-export them from app types
* [SR] Create and edit repositories UI (#34020)
* Add routing and placeholder form
* Fix typings
* Set up edit repository route, and basic form UI
* Add typings for wrapCustomError, and copy extractCausedByChain from CCR wrapEsError
* Throw errors that are already boomified
* Create and edit for basic repository types (fs, url, source)
* Add repository verification UI to table and details
* Create and edit for plugin repository types (hdfs, azure, s3, gcs)
* Fix linting
* Fix test
* Fix test
* Remove unused import
* Fix duplicate i18n key
* Fix details opening on cancel edit, remove unnecessary Fragments, definition file for some EUI components to x-pack, rename saveError
* Remove breaks
* Adjust add and edit repo routes so they don't conflict with list route
* Add repo plugin and types doc links to form
* Bootstrap documentation service
* Bootstrap text service and replace RepositoryTypeName component with it
* Bootstrap breadcrumb service and replace usages
* Bootstrap httpService, remove chrome and http from app dependencies(!)
* Add request creator and replace all instances of useRequest and sendRequest with it
* Fix typo
* Simplify update repository and update repository setting methods
* Adjust copy
* Lint
* Remove unused var
* Remove unused import
* [SR] Add API for retrieving snapshots. (#34598)
* [SR] Single and multiple repository delete (#34593)
* Add single/multi repository delete API and UI
* Address PR feedback
* [SR] Add SnapshotTable and SnapshotDetails. (#34837)
* Remove associations between multiple repositories with a single snapshot.
* Retrieve complete snapshot details in getAllHandler.
* Fix cleanup function bug in useRequest hook.
* Fix bug in useRequest which prevented old data from being cleared when subsequent requests returned errors.
* Add initialValue config option to useRequest.
* Add formatDate service to text module.
* [SR] Fix linting and add (de)serialization for repositories (#35031)
* Fix eslint issues and add (de)serialization for repositories
* Add comment about flattening settings
* [SR] Surface repository errors and index failures more prominently (#35042)
* Add links to repositories from Snapshot Table and Snapshot Details.
- Rename services/breadcrumbs to services/navigation and add linkToRepository function.
- Refactor home component to update active tab when URL was changed.
* Add warning callout to let user know when their repositories contain errors.
* Sort failures by shard and add test for snapshot serialization.
* Sort failures and indices.
* Add filter for filtering snapshots by their repository.
* Surface states with humanized text, icons, and tooltips where necessary.
* Fix pluralization of seconds.
* Surface failures tab even if there are none.
- Display a '-' for missing times and durations.
- Create DataPlaceholder component.
* [SR] Polish repositories UX (#35123)
* Refactor repository detail panel to load repository based directly on route param.
* Display repository detail panel while table is loading.
* Make 'Edit repository' table action a link instead of a button.
* Render disabled EuiSelect as a readonly EuiFieldText.
* Prepend HDFS URI with hdfs:// protocol.
* Present scheme options for Read-Only URL repository as a select.
* [SR] Add client-side validation to repository form and link to snapshots from details (#35238)
* Add client side repository form validation, extract `flatten` into common lib
* Add snapshot count to repository details and link to snapshot list
* Reset validation when changing repository type
* Fix snapshot list filter deep linking for repository names with slashes and spaces
* Fix imports
* PR feedback
* [SR] Design and copywriting fixes (#35591)
* Split repository form into two steps; move `clean_settings.ts` to server
* Default to snapshots tab, adjust snapshot empty prompt, add app description
* Add minimum timeout to list view requests to avoid flicker, use EuiEmptyPrompt for loading screen, add doc link to settings step
* Add information about snapshots to delete repository behavior, add doc link for source only toggle, add size notation help text
* Add main doc link
* Copywriting and i18n fixes, and add some common settings to third party repo types
* Add fields to third party repo detail panel
* More copywriting fixes
* Use spinner for duration and end time if snapshotting is still in progress
* Show all repository type options, mark missing plugins
* Revert "Show all repository type options, mark missing plugins"
This reverts commit e34ee47cec.
* Fix space
* [SR] Add permissions UI and Cloud-specific repository type UI branch (#35833)
* Add missing permissions UI and cloud-specific repository type UI branch
* Add ES UI as owners of /snapshot_restore directory
* Add no repository types callout for Cloud edge case
* Redirect invalid section param to repositories
* Add warning empty prompt if all repositories have errrors
* Replace repository cards with EuiCard
* Add snapshot doc link to repository error empty prompt
* Remove auto-verification from list and get routes, add separate verification route, add manual verification to repository detail panel
* Update copy and remove obsolete test
* Remove unused scss files
* Final changes to repository cards
Attempts to make KQL syntax errors more sensical to the average user.
I initially tried to use a similar solution to the one we used for detecting usage of old lucene syntax. In other words, I tried to create rules in the grammar that would match strings containing common mistakes the user might make and throw custom error messages for each situation. This proved to be more difficult for detecting errors in the regular language. While the Lucene rules could be completely separated from the main grammar, the KQL error rules had to be mixed into the main grammar which made it much more complex and had a lot of unintended side effects.
So instead I decided to lean more heavily on PEG's built in error reporting. Giving certain rules human readable names allows the parser to use those names in the error reporting instead of auto generating a long list of possible characters that might be expected based on the matching rules. Since the PEG errors contain location information I was also able to add ascii art that points the user to exactly where the error occurred in their query string. While this approach is not quite as nice as bespoke error messages that tell the user exactly what is wrong in plain English, it's much more maintainable and I think it still results in much better error messages compared to what we have today.
I've also removed the old original kuery grammar (for queries like is(response, 200)). We were only using it to display an error if I user was still using the old syntax. This version of kuery hasn't existed since 6.3 and we've had error messages telling users this since then. I think it's safe to remove the legacy parser at this point, which greatly reduces the complexity of our error reporting.
Makes feature-secops closely mirror master of kibana
* Puts the ci/cd system back to where it mirrors master
* Removed stylelint
* Fixed accidental linter differences that accumulated along the way
* Fixed accidental package addition of `cherrio`
* Added back the translation file of `zh-CN.json`
* https://github.com/elastic/ingest-dev/issues/397
* https://github.com/elastic/ingest-dev/issues/198
* Implemented zeek.connection, zeek.dns, zeek.http, zeek.notice, zeek.ssl, and zeek.files
* Added unit tests and snapshot tests
* Broke out GoogleLink from Suricata
* SHA1 hashes from files gets linked to total virus for on-clicks
* Updated GraphQL and ECS to add more fields needed (http, url, module)
* Swept through with TestProvider cleanup in unit tests
* Added fix for the width for the timetable to render Suricata/Zeek the same as notes
* https://github.com/elastic/ingest-dev/issues/298
* Fixed `event.severity` to be operational now that ECS has been updated
* Added a Suricata SID database with references
* Wired in the references
* Created a tagging system for the UI
* Added Suricata SID and made it draggable onto the filters of the timeline
* Changed the hand rolled sushi 🍣 inline flex styles to EuiFlexItem, EuiGroupItem
* Removed older CVE column renderer from the system
* Wrote unit tests
* https://github.com/elastic/ingest-dev/issues/175
* https://github.com/elastic/ingest-dev/issues/299
* Fix hardcoded plugin name and license modes in common license checker
* Fix licensePreRoutingFactory scope issues
* PR feedback adjustments
* Use minimum license string instead of array of valid license
* Pass plugin name instead of ID for UX
* Return license status instead of `showLinks` and other flags
* Adjust factory closure for readability
* Fix test
* Additional PR feedback:
* Move license status constants to `/common`
* Internationalize plugin names that are passed to check license, and its error messages
* Remove `isAvailable` flag, change pre-routing logic to use `LICENSE_STATUS.VALID` instead
* Change constant `INACTIVE` to `EXPIRED`
* Convert check license test from mocha to jest
* Fix test
This commit accompanies the four that precede it. Rather than squash
them altogether, the four previous commits all do nothing except move
files to help avoid conflicts.
* Add ILM to i18nrc.json. Fix validation errors.
* Localize CCR and Rollups checkLicense errors.
* Fix bug in Remote Clusters checkLicense error.
* Use rollupJobs namespace in checkLicense.
* Added support for i18n to our project
* Translated all text I could find within the project
* Added `translations.ts` cascading files to each component folder
* Utilized `i18n.translate` within the files for the majority of translations
* Wired up .i18nrc.json to our project for the builds and added ignores where needed
* Changed unit tests to use <i18nProvider> where needed
* Added `<i18nProvider>` to the root level at start_app.tsx
* Changed `moment(date).fromNow()` to use relative date times of `<FormattedRelative value={new Date(date)} />`
* Added plurals for Rows
* Ran `node scripts/i18n_check --path x-pack/plugins/secops --output /tmp --output-format json5` and then opened the `/tmp/en.json` to ensure the keys are extracted as expected
* https://github.com/elastic/ingest-dev/issues/88
* Followed advice from https://github.com/elastic/kibana/issues/27968 and did _NOT_ inject anything I did not have to.
