I believe the cause of this issue is that we weren't saving the app state after updating it from the saved query. So the new query would be in memory but not in the URL. Something would cause the old app state to get read from the URL and override the changes. Simply adding a call to state.save after changing the query in app state seems to have solved it.
Visualize didn't have this issue, but I'm guessing there was nothing causing the old state to be read from the URL. So I applied this fix to Visualize as well to avoid any issues in the future.
Asciidoctor sees `,` as the edge of parameters and chokes on one of our
deprecation warnings, rendering funny looking garbage. This wraps the
whole parameter in `"` which makes it look good. It *does* add `"`s
around the result in AsciiDoc, but we plan to migrate from AsciiDoc
"real soon now".
* Fix time filter woes and add tests
* Fix up tests and fix loading states for non ssp tables
* Only add onChange if searching is enabled
* Replace missing function
* [APM] Replace ui/kfetch with core.http
Closes#46548.
* Remove kfetch mocks in tests
* Expose HttpFetchError from src/core/public/index
* Make HttpFetchError public
* Simplify tests for ServiceOverview
* Add button with link to license management in ML popup
* Corrections to button styling
* Updated button icon
* Update snapshots
* Correcting json translation files
* Fix zh_CN json file
* And now fixing the translation file properly
* [ML] Adds new SIEM auditbeat, winlogbeat and packetbeat modules
* [ML] Removed rare_country_for_user jobs
* [ML] Removed rare_country_for_user jobs from manifests
* First pass of spec update to OSS plugin
* Update existing doc links
* Move data_frame files to new depreceated namespace
* Removing this setting per https://github.com/elastic/elasticsearch/pull/47717
* Add new files
* Added transforms overrides
* Updated deprecated data transforms file names
Fixed broken __template's
Updated autocomplete for new transforms endpoints
* [APM] Make sure toasts work for failed useFetcher calls
toasts.addWarning is a class method, and fails when called without bound context, which was what happened in useFetcher notifications.
* Remove unnecessary destructuring
* [Code] use native git to iterate git files
* [Code] use native git to clone/update repository
* [Code] git history using native git
* [Code] use native git to read file tree and file content
* [Code] fix the 'bad file' warning from status api
* [Code] use native git to handle worktree
* [Code] use native git to resolve references
* [Code] use native git to handle blame / diff
* [Code] patch git binaries in kibana build script
* [Code] migrate unit tests to use native git
* Added UI components and ability to interact with saveObjects api
* Remove unused files
* [Infra-ui] make saved views work
* Implement UI polish and feedback
- Added checkbox for including time
- Updated all copy to use `FormatedMessage`
- Add default view to flyout
* Cleaner implementation of default view.
* Make it easier to use saved views on more than just inventory
* Add percy test for saved views flow
* Fix order of operations for test
* Add ability to save metric explorer views
* Add delete confirmation for deleting view
* Add visual regression test for saved views on metric explorer page
* Add save icon to give a visual clue
* Add a toast to handle error cases for fetching and saving
* Fix type error
* Fix i18n id
* Small copy and ux tweaks
* Adding new saved view type and mappings for inventory-view
* Adding Metrics Explorer saved object mappings
* Changing how saved object mapping is included
* Implement design changes
* Fixing mappings
* Use the Metrics Explorer saved object type
* Remove hard coded view type
* Change structure to match how saved object attibutes are being saved
* Remove hard coded view type
* Fix alignment
* Fixing types
* Better caching
* Add another dep
* Fixing flyout width
* [Maps] retrieve geo_point value from docvalue_fields instead of _source
* add functional test ensuring _search request only pulls what is needed
* clean up i18n translation fiels
## Summary
* Adds Endgame events to the SIEM Overview page, per the following screenshot:
<img width="1680" alt="overview-chrome" src="https://user-images.githubusercontent.com/4459398/66524250-26a47800-eaaf-11e9-8ff9-311c031e5d00.png">
* Adds `endgame-*` to the default SIEM index pattern, per the following screenshot:
<img width="1665" alt="siem-advanced-settings" src="https://user-images.githubusercontent.com/4459398/66524300-45a30a00-eaaf-11e9-93c3-dce74917e73a.png">
RELEASE NOTE: To view Endgame events in existing SIEM deployments, you must manually add `endgame-*` to the SIEM index pattern in `Kibana Management > Advanced Settings > SIEM > Elasticsearch indices`. Also note that the `Reset to default` feature for this setting in the Advanced Settings page now includes `endgame-*`.
* Adds the GraphQL plumbing for rendering Endgame data in the Timeline via row renderers (in an upcoming PR), with the introduction of the following fields:
```
dns.question.name
dns.question.type
dns.resolved_ip
dns.response_code
endgame.exit_code
endgame.file_name
endgame.file_path
endgame.logon_type
endgame.parent_process_name
endgame.pid
endgame.process_name
endgame.subject_domain_name
endgame.subject_logon_id
endgame.subject_user_name
endgame.target_domain_name
endgame.target_logon_id
endgame.target_user_name
event.code
file.name
process.hash.md5
process.hash.sha1
process.hash.sha256
user.domain
winlog.event_id
```
## Testing
### Cypress
The `smoke_tests/overview/overview.spec.ts` Cypress test was updated to include the new counts on the Overview page, per the screenshot below:
### API Integration test
The Overview page API integration test `xpack/test/api_integration/apis/siem/overview_host.ts` was updated to include counts of mock Endgame data added to `test/functional/es_archives/auditbeat/overview/data.json.gz`
### Unit tests
Overview page unit tests were updated to include the new Endgame event counts
### Desk testing
* Desk tested by hand-editing `components/page/overview/overview_host/index.tsx` and setting the `endDate` and `startDate` values below to a fixed datetime:
```
<OverviewHostQuery endDate={endDate} sourceId="default" startDate={startDate}>
```
The counts shown on the overview page where then compared to the counts shown in the timeline in the same date period, to verify the counts match 1:1.
* The additional fields mentioned above in this PR (e.g. `dns.question.name`,`endgame.target_domain_name`) that are now being requested via GraphQL can be seen via the Timeline Inspect (query) feature:
1) Enter `event.module: endgame` in the Timeline KQL bar. (Adjust the date range if necessary.)
2) After Endgame events are displayed in the timeline, click the Inspect button in the Timeline settings gear.
The additional fields (and values) will be included in the Inspect query Request / Response tabs.
### Cross-browser dark/light testing
#### Firefox
<img width="1680" alt="overview-firefox" src="https://user-images.githubusercontent.com/4459398/66524773-9c5d1380-eab0-11e9-9383-c155872881b0.png">
#### Safari
<img width="1680" alt="overview-safari" src="https://user-images.githubusercontent.com/4459398/66524790-a54de500-eab0-11e9-9786-aa7dbe18c1bf.png">
#### IE11
This PR was *not* tested in IE11 due to the current blocker with `react-reverse-portal`
https://github.com/elastic/siem-team/issues/465https://github.com/elastic/ecs-dev/issues/178
* [lens] Basic usage telemetry for total visualizations, and by type
* Implement overall, 30 day, 90 day tracking for saved visualizations
* Add forgotten file
* Implement collection using scripted metrics
* Add functional test to ensure painless script is working
