* [DOCS] Alerting PagerDuty benefits
* [DOCS] Fixes broken link
* [DOCS] Organization changes
* [DOCS] Changes to meet template and incorporate review comments
* [DOCS] Fixed formatting of bulleted list
* [DOCS] Incorporates review comments
* Update docs/user/alerting/action-types/pagerduty.asciidoc
Co-Authored-By: Mike Côté <mikecote@users.noreply.github.com>
* [DOCS] Fixes naming and other formatting issues
Co-authored-by: Mike Côté <mikecote@users.noreply.github.com>
* refactor: 💡 use inspector service in visualizations to open it
* refactor: 💡 remove expressions plugin dependency on inspector
* test: 💍 fix Jest mock
* fix: 🐛 remove Inspectore from Expressions plugin dependency inf
* docs: ✏️ add JSDocs for createStartServicesGetter() method
* test: 💍 fix TypeScript errors in expressions mocks
* move old code to legacy folder
* Use search service directly from search source
* Move get search params to fetch folder
* Delete search strategy folder
* Doc update
* Minor cleanups
* Moved es client to legacy folder
* Clean up some unused code (isViable, old search function)
* Updated tests
* strings update
* Fix jest test
* re-arrange runSearch function
* re-arrange runSearch function
* fix jest tests
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
* Refresh index and also show more info to user
* updated type
* updated type
* updated test
* updated formatting
* update text
* updated types
* updated translation
* update
* fixed types
* updated code
* fixed types
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
* [Alerting] Documentation for how to pre-configure connectors.
* small fix
* Adjusted titles
* Fixed wrong link
* fixed warning
* Fixed ci issues
* [DOCS] Edits preconfigured connector docs
* Replaced words 'pre-configured' with 'preconfigured'
Co-authored-by: gchaps <chappell_5@yahoo.com>
### Summary [63717]
This PR updates the rules lists param to be `exceptions_list`. This is done in an attempt to make the terminology less confusing as lists will generally be referring to the big lists values. It should also make it more clear that the `exceptions_list` logic is being applied as a double not.
* Add cert API request and runtime type checking.
* Collapse on sha256 field instead of common_name.
* Add basic wildcard search capabilities.
* Support searching.
* Update fields and queries, remove server response validation.
* Update API to utilize x509 fields.
* Add new fields to certs API request, provide defaults.
* Add api test for cert api.
* Add unload command to certs test.
* Extract API params interface to io-ts type.
* Rename a functional test.
* Fix broken type.
* Move logic to NP and add basic plugin structure
* Remove unused server-side licensing logic and old index
* Set license in maps_legacy via new plugin
* Change add to set for service settings queryParams function
* Fix accidentally changed emsClient method call
* Require at least a basic license
* Type updates
* Remove unneeded legacy license test
* Remove unused headers in test
* added header to actions section
* adjusted some spacing in Create Alert
* lighter text in Actions section headings
* fixed bulk actions dropdown
* improve alert collapsed item actions
* improve dropdown and adjust some buttos
* adjust font size of steps to match hierarchy
* need to check master
* improve collapsed actions menu
* added periods to help texts
* going back to EuiButtonEmpty to be able to use isLoading
* fix prop
* remove Fragment
* remove translations we're not using
* Fix functional tests
Co-authored-by: Mike Cote <mikecote@users.noreply.github.com>
Middleware receive state and actions, but they shouldn't mutate either. With this PR, middleware using the `substateMiddlewareFactory` helper will have this enforced via typescript.
* replace `MiddlewareFactory` with `ImmutableMiddlewareFactory`
* Added types: `ImmutableMiddleware` and `ImmutableMiddlewareAPI` which are similar to the ones built into redux but which enforce that state and actions aren't mutated (and which allow `Immutable` versions of actions to be dispatched.
No changes to runtime code.
* Move server code into NP folder
* NP config is not yet used
* Relative imports are somewhat broken
* Move common folder into NP
* Move cypress folder into NP
* Move scripts folder into NP
* Move misc. config into NP folder
A few of these were moved into the cypress folder as they're
cypress-specific.
I tried to update all the relative paths but some are likely broken. I'm
not going to know until other stuff is fixed, though.
* Move value for siem index pattern into common/constants
The other default values live in there, this is no different.
* Update paths following file move
If this was referencing the full project, it now references both paths
(legacy for UI, and NP for server).
* Fix typescript errors related to module resolution
These are mostly updating imports to the common/ folder on the UI side
(since things changed relative to those files).
* Replace Legacy Config with NP Config
* Updates plugin to use NP config
* defines new config previously coming from savedObjects config
* cleans up legacy types
Conflicts:
x-pack/plugins/siem/server/lib/detection_engine/routes/rules/export_rules_route.ts
x-pack/plugins/siem/server/lib/detection_engine/routes/rules/import_rules_route.ts
x-pack/plugins/siem/server/lib/detection_engine/rules/types.ts
x-pack/plugins/siem/server/plugin.ts
x-pack/plugins/siem/server/routes/index.ts
x-pack/plugins/siem/server/types.ts
* Remove local SIEM tsconfig
This was originally added to address an issue with tsserver, but that
issue is no longer relevant. The presence of this file confuses
typescript into thinking that siem is a separate TS project.
* Update kibana.json to declare our dependencies
These are not necessarily correct in terms of what's required/optional,
but this is what's declared in our types.
* Remove legacy plugin instantiation
* Removes legacy instantiation of server plugin, which is now handled by
NP
* Loosens legacy config spec so we no longer have to duplicate config
types
* Update tests with NP config
These were written against the old Hapi config function; now, we just
have a POJO.
* Update es_archiver helpers' paths
I'm not quite sure if these are working yet, but they're no longer
throwing errors.
* Ignore restricted path on script
This was cribbed from infra, who has made a similar change.
* Ignore restricted path on temporary savedObject mappings import
This will be changed subsequently when we switch to the NP form of
savedObject type registration.
* Add symlink to lockfile
* Fix paths on circular deps script
* Add separate config for Rule and Timeline saved objects
We had previously used the savedObjects' config, but those are not
currently exposed to us on New Platform. For now, we're going to split
this into two sets of values for the SOs we deal with
importing/exporting within the SIEM app, with the same defaults as
savedObjects.
* Fixing relative paths within cypress
These are strings that wouldn't be caught by typescript.
* Added server api tests for event log service
* fixed tests
* fixed type check issue
* Fixed failing tests
* fixed jest tests
* Fixed due to comments
* Removed flackiness tests
* fixed type check error
* Fixed func test
This PR changes the way how test resources like indices and saved objects are used in ML and Transform functional tests. No actual test logic is changed.
* WIP replacing GQL with redux/rest.
* Finish implementing migration.
* Introduce new connected component for ping list.
* Replace GraphQL type with io-ts.
* Update some broken tests.
* Add test for new helper function.
* Write test snapshots.
* Migrate api tests from graphql to rest.
* Update fixtures that rely on pings.
* Move ping types to runtime_types folder with rest of io-ts files.
* Update Ping type location and imports, type checking.
* Remove reliance on fixtures for ping functional API tests.
* Fix broken unit tests.
* Fix broken types.
* Remove local state storage from parent components.
* Add functional test to cover Ping List functionality.
* Fix monitor page functional test that was broken by merge conflicts.
* Fix broken tests.
* Fix broken API test.
* Replace a test with a describe block that will pre-navigate all tests.
* Delete unused reducer keys.
* Re-introduce loading to ping list reducer.
* Inroduce code that will cause PingList to re-fetch when refresh button is pressed.
* Update expanded rows to support multiple concurrent expanded rows.
* Modify pingList reducer to have singular optional error field.
* Delete unnecessary helper code.
* Delete unused interface.
* Add runtime_type to parse getPings params, fix pagination index.
* Add dedicated monitor type to runtime_types.
* Fix broken tests.
* Fix broken tests.
* Rename '@timestamp' property to 'timestamp' on Ping type.
* Fix broken type and key pings list table on document ID instead of timestamp.
* Fix broken unit tests.
* Fix broken tests and types.
* Fix broken functional test.
* Add REST endpoint for monitor states.
* Add REST route to constants file.
* Introduce io-ts typing for monitor states.
* Remove remaining GraphQL types.
* Update monitor states types to use io-ts types.
* Add state management for monitor states.
* Introduce connected monitor list component.
* Fixup runtime types for monitor states.
* Remove all remaining references to apollo graphql.
* Update URL generator function tests to use inline snapshots instead of snapshot files.
* Fix missing imports and small type issues.
* Prefer inline snapshot to object literal comparison.
* Add type check and console log to API response.
* Update README to remove graphql references.
* Fix type error.
* Make monitor list refresh when global refresh button is pressed.
* Fix broken types.
* Rename `@timestamp` field to `timestamp`.
* Change spelling of var.
* Add timestamp map for `@timestamp` field in monitor states fetcher.
* Remove need for `monito_states` fixture.
* Write test code that allows for deletion of the `monitor_states_id_filtered` fixture.
* Rewrite pagination tests to no longer rely on monitor states page fixtures.
* Skip test that is causing other functional tests to fail.
* Remove unused translations.
* Fix broken test snapshots.
* Fix stale error reporting errors.
* Remove runtime validation from REST handler.
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
* add isConfigSchema type guard
* replace instanceof checks with isConfigSchema
* add dummy test plugin using a route with validation schema
* remove `?.` prop access
* remove test plugin
* fix test description
* Add headers to the sample curl
At least in 7.x it doesn't work without the kbn-xsrf and json headers.
* More headers to curl commands
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
[SIEM][Detections] - Update KQL/Lucene search to include lists exceptions (#63264)
### Summary
This PR adds logic to include the lists values in search so we can now filter off of lists.
- does work with KQL search
- does work with Lucene search
- does NOT yet filter off of large lists (will be separate PR)
- does NOT yet work on ML search (will be separate PR)
* Add unit test stub for multi fields.
* Add multi field handling to mapping generation.
* Start documenting index template generation.
* Add unit tests.
* Remove stub for fields.yml documentation
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
