Context:
The import button can be used to import both timelines and timeline templates.
In theory, one imported file could have multiple timelines and timeline templates at the same time.
Solution:
Since the import endpoint only returns the total count and not the type of the imported documents.
It seems like that rewording "timeline(s)" to "item(s)" is the most straightforward fix that solves
the user problem.
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Adding feature flag for auth
* Hiding SOs and adding consumer field
* First pass at adding security changes
* Consumer as the app's plugin ID
* Create addConsumerToSO migration helper
* Fix mapping's SO consumer
* Add test for CasesActions
* Declare hidden types on SO client
* Restructure integration tests
* Init spaces_only integration tests
* Implementing the cases security string
* Adding security plugin tests for cases
* Rough concept for authorization class
* Adding comments
* Fix merge
* Get requiredPrivileges for classes
* Check privillages
* Ensure that all classes are available
* Success if hasAllRequested is true
* Failure if hasAllRequested is false
* Adding schema updates for feature plugin
* Seperate basic from trial
* Enable SIR on integration tests
* Starting the plumbing for authorization in plugin
* Unit tests working
* Move find route logic to case client
* Create integration test helper functions
* Adding auth to create call
* Create getClassFilter helper
* Add class attribute to find request
* Create getFindAuthorizationFilter
* Ensure savedObject is authorized in find method
* Include fields for authorization
* Combine authorization filter with cases & subcases filter
* Fix isAuthorized flag
* Fix merge issue
* Create/delete spaces & users before and after tests
* Add more user and roles
* [Cases] Convert filters from strings to KueryNode (#95288)
* [Cases] RBAC: Rename class to scope (#95535)
* [Cases][RBAC] Rename scope to owner (#96035)
* [Cases] RBAC: Create & Find integration tests (#95511)
* [Cases] Cases client enchantment (#95923)
* [Cases] Authorization and Client Audit Logger (#95477)
* Starting audit logger
* Finishing auth audit logger
* Fixing tests and types
* Adding audit event creator
* Renaming class to scope
* Adding audit logger messages to create and find
* Adding comments and fixing import issue
* Fixing type errors
* Fixing tests and adding username to message
* Addressing PR feedback
* Removing unneccessary log and generating id
* Fixing module issue and remove expect.anything
* [Cases] Migrate sub cases routes to a client (#96461)
* Adding sub cases client
* Move sub case routes to case client
* Throw when attempting to access the sub cases client
* Fixing throw and removing user ans soclients
* [Cases] RBAC: Migrate routes' unit tests to integration tests (#96374)
Co-authored-by: Jonathan Buttner <jonathan.buttner@elastic.co>
* [Cases] Move remaining HTTP functionality to client (#96507)
* Moving deletes and find for attachments
* Moving rest of comment apis
* Migrating configuration routes to client
* Finished moving routes, starting utils refactor
* Refactoring utilites and fixing integration tests
* Addressing PR feedback
* Fixing mocks and types
* Fixing integration tests
* Renaming status_stats
* Fixing test type errors
* Adding plugins to kibana.json
* Adding cases to required plugin
* [Cases] Refactoring authorization (#97483)
* Refactoring authorization
* Wrapping auth calls in helper for try catch
* Reverting name change
* Hardcoding the saved object types
* Switching ensure to owner array
* [Cases] Add authorization to configuration & cases routes (#97228)
* [Cases] Attachments RBAC (#97756)
* Starting rbac for comments
* Adding authorization to rest of comment apis
* Starting the comment rbac tests
* Fixing some of the rbac tests
* Adding some integration tests
* Starting patch tests
* Working tests for comments
* Working tests
* Fixing some tests
* Fixing type issues from pulling in master
* Fixing connector tests that only work in trial license
* Attempting to fix cypress
* Mock return of array for configure
* Fixing cypress test
* Cleaning up
* Addressing PR comments
* Reducing operations
* [Cases] Add RBAC to remaining Cases APIs (#98762)
* Starting rbac for comments
* Adding authorization to rest of comment apis
* Starting the comment rbac tests
* Fixing some of the rbac tests
* Adding some integration tests
* Starting patch tests
* Working tests for comments
* Working tests
* Fixing some tests
* Fixing type issues from pulling in master
* Fixing connector tests that only work in trial license
* Attempting to fix cypress
* Mock return of array for configure
* Fixing cypress test
* Cleaning up
* Working case update tests
* Addressing PR comments
* Reducing operations
* Working rbac push case tests
* Starting stats apis
* Working status tests
* User action tests and fixing migration errors
* Fixing type errors
* including error in message
* Addressing pr feedback
* Fixing some type errors
* [Cases] Add space only tests (#99409)
* Starting spaces tests
* Finishing space only tests
* Refactoring createCaseWithConnector
* Fixing spelling
* Addressing PR feedback and creating alert tests
* Fixing mocks
* [Cases] Add security only tests (#99679)
* Starting spaces tests
* Finishing space only tests
* Refactoring createCaseWithConnector
* Fixing spelling
* Addressing PR feedback and creating alert tests
* Fixing mocks
* Starting security only tests
* Adding remainder security only tests
* Using helper objects
* Fixing type error for null space
* Renaming utility variables
* Refactoring users and roles for security only tests
* Adding sub feature
* [Cases] Cleaning up the services and TODOs (#99723)
* Cleaning up the service intialization
* Fixing type errors
* Adding comments for the api
* Working test for cases client
* Fix type error
* Adding generated docs
* Adding more docs and cleaning up types
* Cleaning up readme
* More clean up and links
* Changing some file names
* Renaming docs
* Integration tests for cases privs and fixes (#100038)
* [Cases] RBAC on UI (#99478)
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Fixing case ids by alert id route call
* [Cases] Fixing UI feature permissions and adding UI tests (#100074)
* Integration tests for cases privs and fixes
* Fixing ui cases permissions and adding tests
* Adding test for collection failure and fixing jest
* Renaming variables
* Fixing type error
* Adding some comments
* Validate cases features
* Fix new schema
* Adding owner param for the status stats
* Fix get case status tests
* Adjusting permissions text and fixing status
* Address PR feedback
* Adding top level feature back
* Fixing feature privileges
* Renaming
* Removing uneeded else
* Fixing tests and adding cases merge tests
* [Cases][Security Solution] Basic license security solution API tests (#100925)
* Cleaning up the fixture plugins
* Adding basic feature test
* renaming to unsecuredSavedObjectsClient (#101215)
* [Cases] RBAC Refactoring audit logging (#100952)
* Refactoring audit logging
* Adding unit tests for authorization classes
* Addressing feedback and adding util tests
* return undefined on empty array
* fixing eslint
* [Cases] Cleaning up RBAC integration tests (#101324)
* Adding tests for space permissions
* Adding tests for testing a disable feature
Co-authored-by: Christos Nasikas <christos.nasikas@elastic.co>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* [Discover] add fix of row header in firefox from previous version
* [Discover] add link comment to the issue
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* [Timelion] Update the removal message to mention the exact version
* Fix typo
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
## Summary
Test cases for signals and aliases, including a failure of where we do not copy alias data at the moment even if the target is an ECS compatible field.
For example with this mapping:
```json
{
"dynamic": "strict",
"properties": {
"@timestamp": {
"type": "date"
},
"host": {
"properties": {
"name": {
"type": "alias",
"path": "host_alias.name"
}
}
},
"host_alias": {
"properties": {
"name": {
"type": "keyword"
}
}
}
}
}
```
If we detect this as a signal hit we should be copying over both:
* `host_alias.name` -> `host.name`
* `host_alias.name` -> `host_alias.name`
to the target signal index, but we only copy:
* `host_alias.name` -> `host_alias.name`
### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
## Summary
We have a few bugs where when the source index for detections is not `"strict_date_optional_time"` it is possible that we will misinterpret the format to be epoch milliseconds when it could be epoch seconds or another ambiguous format or blow up when trying to write out the signals index. This fixes it to where we query for the source index format as an ISO8601 and when we copy the date time format we copy it back out as ISO8601 and insert it into the signal index as ISO8601.
See this [gist](https://gist.github.com/FrankHassanabad/f614ec9762d59cd1129b3269f5bae41c) for more details of how this was accidentally introduced when we added support for runtime fields and the general idea of the fix.
* Removes `docvalue_field` and we now only use `fields` in detection engine search requests
* Splits out the timestamp e2e tests into their own file for `timestamps` file
* Adds more tests to ensure we copy what we expect and we are converting to ISO8601 in the signals
* Removes `ts-expect-error` in a lot of areas including tests and then I fix the types and issues once it is removed.
### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
## Summary
Adds e2e tests for the `constant_keyword` regular `keyword` to compare between the two. Bugs found with these is one where we do not copy `constant_keyword` fields into signals which I added `.skip` to the tests now.
Tested these rule types:
* KQL
* EQL
* Threshold
For the mappings of the `constant_keyword` I use both the `constant_keyword` and the field `alias` like so:
```json
{
"properties": {
"@timestamp": {
"type": "date"
},
"data_stream": {
"properties": {
"dataset": {
"type": "constant_keyword",
"value": "dataset_name_1"
},
"module": {
"type": "constant_keyword",
"value": "module_name_1"
}
}
},
"event": {
"properties": {
"category": {
"type": "keyword"
},
"dataset": {
"type": "alias",
"path": "data_stream.dataset"
},
"module": {
"type": "alias",
"path": "data_stream.module"
}
}
}
}
}
```
To ensure we can detect against fields. I also mix them with regular const keyword fields in another index to ensure they work also in mixed use cases.
### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
* heatmap wip
* format values on X axis
* format values for cells
* show labels
* support legend configuration
* render preview
* add icon
* [ML] update visualization
* [ML] init suggestions
* [ML] fix preview
* [ML] fix groupPosition for the legend control
* [ML] add formatter for Y-axis
* [ML] filterOperations for cell value
* [ML] fill all available height
* [ML] delete unused file
* [ML] fix suggestion state
* [ML] update suggestion, add hiding logic
* [ML] suggestions unit tests
* [ML] rename legend interface
* [ML] unit tests for visualization, add error messages
* [ML] fix typos in xy visualization tests
* [ML] support click event
* [ML] add xDomain for time series data
* [ML] support empty Y axis
* [ML] change legend default position
* [ML] getTimeZone util
* [ML] hide suggestions for reorder
* [ML] support brush event
* [ML] update unit tests
* [ML] render grid lines in preview
* [ML] don't display errors on init
* [ML] utilize chartsThemeService
* [ML] support histogram for the vertical axis
* [ML] fix clearLayer
* [ML] show empty placeholder on no data
* [ML] fix X domain min
* [ML] reject suggestions for 3 or more buckets
* [ML] suggestions for histograms and histogram for Y-axis
* [ML] fix unit tests
* [ML] update suggestions for active heatmap
* [ML] chart data test for heatmap
* [ML] test for transitioning from heatmap to barchart
* [ML] disable xDomain
* [ML] support intervals in axes configurations
* [ML] hide label on the vertical axis when there is only a horizontal dimension
* [ML] set min cell height for better suggestions preview rendering
* [ML] fix tooltip for empty vertical axis config
* [ML] fix click and brushing for empty Y axis
* [ML] update functional test
* [ML] show beta label
* [ML] fix legend control
* [ML] dataIndex sort by default for the X axis
* [ML] use euiPaletteForTemperature with quantize color scale
* [ML] hide all suggestions
* [ML] fix chart data extension issue
* [ML] fix the caret symbol positioning
* [ML] update unit tests for the heatmap suggestions
* [ML] replace EuiBetaBadge with EuiBadge
* [ML] update functional test
* [ML] fix chart switch styles
* [ML] fix functional test
* [ML] return null instead of expression with a missing value accessor
* [ML] use table id as a chart id
* [ML] fix scale type for a single row of data
* [ML] filter out undefined values
* [ML] fix isXAxisLabelVisible
* [ML] update chart_switch styles
* show warning message for the array values
* remove unused code
* replace ts-ignore with manual type casting
* add unit tests for error and warning messages
* add css class for append, conditional flex group
* Add RoleOptionLabel component
* Refactor RoleSelector to use EuiRadioGroup
Previously, we used individual radio buttons in a map in the component. However the new designs have a shared label and work best in the EuiRadioGroup component.
* Add reducer and actions to logic file for flyout visibility
* Remove redirects in favor of refreshing lists
With the existing multi-page view, we redirect after creating, editing or deleting a mapping. We now simply refresh the list after the action.
Also as a part of this commit, we show a hard-coded error message if a user tries to navigate to a non-existant mapping, instead of redirecting to a 404 page
* Add RoleMappingFlyout component
* Refactor AttributeSelector
No longer uses a panel or has the need for flex groups
- Also added a test for 100% coverage
* Refactor RoleMappingsTable
- Use EuiButtonIcons instead of Link
- Manage button now triggers flyout instead of linking to route
* Remove AddRoleMappingButton
We can just use an EuiButton to trigger the flyout
* Convert to use RoleSelector syntax
- Passes the entire array to the component instead of mapping.
- Uses ‘id’ instead of ‘type’ to match EUI component
- For App Search, as per design and PM direction, dropping labels for advanced and standard roles and showing them all in the same list.
- Removed unused constant and i18ns
* Move constants to shared
Will do a lot more of this in a future PR
* Remove DeleteMappingCallout
- This now an action in the row
- Also added tests for correct titles for 100% test coverage
* Remove routers and routes
- SPA FTW
* No longer pass isNew as prop
- Determine based on existence of Role Mapping instead
* No longer need to initialze role mapping in the component
This will become a flyout and the intialization will be triggered when the button in the table is clicked.
* Remove flash messages
This will be handled globally in the main component.
* Wrap components with flyout
Also add to main RoleMappings views
* Add form row validation for App Search
* Remove unnecessary layout components
- Don’t need the panel, headings, spacer, and Flex components
- Also removed constants and i18n from unused headings
* Wire up handleDeleteMapping to take ID param
The method now passes the ID directly from the table row action item
* Add EuiPortal wrapper for flyout
Without this, the flyout was was under the overlay. Hide whitespace changes on this commit
* Add spacer to better match design
* Update constants for new copy from design
* Replace all engines/groups radio and group/engine selectors
- The designs call for a radio group and a combo box, instead of separate radios and a list of checkboxes
- Also added a spacer to each layout
* Remove util that is no longer needed
- This was used for generating routes that are no longer there
- Also removed unused test file from a component deleted in an earlier PR
- Fix test since spacer was added
* Add missing i18n constant
* Add back missing scoped engine check
* Rename roleId -> roleMappingId
* Use shared constant for “Cancel”
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* New CrawlerOverview component
* CrawlerRouter should use CrawlerOverview in dev mode
* New CrawlerOverviewLogic
* New crawler route
* Display domains data for CrawlerOverview in EuiCode
* Update types
* Clean up tests for Crawler utils
* Better todo commenting for CrawlerOverview tests
* Remove unused div from CrawlerOverview
* Rename CrawlerOverviewLogic.actios.setCrawlerData to onFetchCrawlerData
* Cleaning up CrawlerOverviewLogic
* Cleaning up CrawlerOverviewLogic tests
* Fix CrawlerPolicies capitalization
* Add Loading UX
* Cleaning up afterEachs across Crawler tests
* Add un-isolate form to the endpoint flyout
* Add Endpoint details flyout footer and action button
* Refactor hooks into a directory
* Refactor endpoint list actions into reusable list + add it to Take action on details
* Refactor Endpoint list row actions to use new common hook for items
* generate different values for isolation in endpoint generator
* move `isEndpointHostIsolated()` utility to a common folder
* refactor detections to also use common `isEndpointHostIsolated()`
* httpHandlerMockFactory can now handle API paths with params (`{id}`)
* Initial set of re-usable http mocks for endpoint hosts set of pages
* fix bug in `composeHttpHandlerMocks()`
* small improvements to test utilities
* Show API errors for isolate in Form standard place
* [Visualize] Add unti test to compare the by value and by ref migrations
* Fix file name
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* start working on conditionally showing the field
* add tests and document regex matcher
* add tests for set processor
* fix broken tests
* move path below componentProps
* Add little comment about whitespaces handling
* template snippets can also contain strings other
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
