* [ML] add advanced settings
* [ML] default advanced settings
* [ML] advanced settings validators
* [ML] range control for top n buckets
* [ML] execute rule with a new query for most recent anomalies
* [ML] find most anomalous bucket from the top N
* Revert "[ML] range control for top n buckets"
This reverts commit e039f250
* [ML] validate check interval against the lookback interval
* [ML] update descriptions
* [ML] fix test subjects
* [ML] update warning message
* [ML] add functional tests
* [ML] adjust unit tests, mark getLookbackInterval
* [ML] update lookback interval description and warning message
* [ML] update fetchResult tsDoc
* [ML] cleanup
* [ML] fix imports to reduce bundle size
* [ML] round up lookback interval
* [ML] update functional test assertion
* [ML] async import for validator
* Added a11y tests for Remote Clusters plugin and fixed discovered violations
* Added an a11y test for a delete modal
* Updated payload type casting
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Remove alerting feature flag from advanced settings
Make it so the alerting UI in Observability can only be turned on and off in kibana.yml with `xpack.observability.enableAlertingExperience`.
We no longer:
* Allow turning this on and off for the current space in the advanced settings in Kibana
* Allow turning this on on cloud
* Send telemetry on whether or not the flag is enabled
Add some docs in READMEs as well.
* Add API integration tests for threshold rules and more tests for EQL rules
* Add API more tests for exceptions and value list exceptions
* Fix unit test and add EQL api test checking multiple signal generation
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Intercept installation errors and add meta info.
* Adjust mock.
* Catch errors in all steps of install/upgrade.
* Adjust handler for direct package upload.
* Don't throw not-found errors on assets during rollback.
* Correctly catch errors from _installPackage()
* Propagate error from installResult in bulk install case.
* Add tests for rollback.
* Remove unused code.
* Skipping test that doesn't test what it says.
* Fix and reenable test.
* Move inspector adapter integration into search source
* docs and ts
* Move other bucket to search source
* test ts + delete unused tabilfy function
* hierarchical param in aggconfig.
ts improvements
more inspector tests
* fix jest
* separate inspect
more tests
* jest
* inspector
* Error handling and more tests
* put the fun in functional tests
* code review
* Add functional test for other bucket in search example app
* test
* test
* ts
* test
* test
* ts
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Makes lens default editor in dashboard
Added all editors menu to dashboard panel toolbar
Fixed toggle on editor menu
Removed unnecessary comments
Added data test subjects to editor menu buttons
Populated editor menu with vis types
Removed unused imports
Fixed imports
Adds showCreateNewMenu prop to AddPanelFlyout
Rearranged order of editor menu options
Fixed ts errors
Added groupnig to embeddable factory
Use embeddable state transfer service to redirect to editors
Added showGroups to TypeSelectionState
Fixed add panel flyout test
Fixed data test subjects
Fixed factory groupings
Removed unused import
Fixed page object
Added telemtry to dashboard toolbar
Added telemtry to editor menu
Fix ml embeddable functional tests
Fix lens dashboard test
Fix empty dashboard test
Fixed ts errors
Fixed time to visualize security test
Fixed empty dashboard test
Fixed clickAddNewEmbeddableLink in dashboardAddPanel service
Fixed agg based vis functional tests
Revert test changes
Fixed typo
Fix tests
Fix more tests
Fix ts errors
Fixed more tests
Fixed toolbar sizes and margins to align with lens
Fix tests
Fixed callbacks
Fixed button prop type
New vis modal copy updates
Added savedObjectMetaData to log stream embeddable factory
Addressed feedback
Fixed ts error
Fix more tests
Fixed ts errors
Updated dashboard empty prompt copy
Adds tooltip to log stream embeddable factory saved object meta data
Made icons monochrome in toolbar
Fixed icon colors in dark mode
Cleaned up css
Fixed ts errors
Updated snapshot
Fixed map icon color
* Added tooltips for ML embeddables
* Restored test
* Added empty dashboard panel test
* Fixed i18n id
* Fix dashboard_embedding test
* Removed unused service
* Fixed i18n error
* Added icon and description properties to embeddable factory definition
* Fixed ts errors
* Fixed expected value
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Adds helper to normalize legacy ML rule field to an array
This will be used on read of rules, to normalize legacy rules while
avoiding an explicit migration.
* Fix our detection-specific ML search function
Luckily this was just a translation layer to our anomaly call, and the
underlying functions already accepted an array of strings.
* WIP: Run rules against multiple ML Job IDs
We don't yet support creation of rules with multiple job ids, either on
the API or the UI, but when we do they will work.
Note: the logic was previously to generate an error if the underlying
job was not running, but to still query and generate alerts. Extending
that logic to multiple jobs: if any are not running, we generate an
error but continue querying and generating alerts.
* WIP: updating ml rule schemas to support multiple job IDs
* Simplify normalization method
We don't care about null or empty string values here; those were
holdovers from copying the logic of normalizeThreshold and don't apply
to this situation.
* Move normalized types to separate file to fix circular dependency
Our use of NonEmptyArray within common/schemas seemed to be causing the
above; this fixes it for now.
* Normalize ML job_ids param at the API layer
Previous changes to the base types already covered the majority of
routes; this updates the miscellaneous helpers that don't leverage those
shared utilities.
At the DB level, the forthcoming migration will ensure that we always
have "normalized" job IDs as an array.
* Count stopped ML Jobs as partial failure during ML Rule execution
Since we continue to query anomalies and potentially generate alerts, a
"failure" status is no longer the most accurate for this situation.
* Update 7.13 alerts migration to allow multi-job ML Rules
This ensures that we can assume string[] for this field during rule
execution.
* Display N job statuses on rule details
* WIP: converts MLJobSelect to a multiselect
Unfortunately, the SuperSelect does not allow multiselect so we need to
convert this to a combobox. Luckily we can reuse most of the code here
and remain relatively clean.
Since all combobox options must be the same (fixed) height, we're
somewhat more limited than before for displaying the rows. The
truncation appears fine, but I need to figure out a way to display the
full description as well.
* Update client-side logic to handle an array of ML job_ids
* Marginally more legible error message
* Conditionally call our normalize helper only if we have a value
This fixes a type error where TS could not infer that the return value
would not be undefined despite knowing that the argument was never
undefined. I tried some fancy conditional generic types, but that didn't
work.
This is more analogous to normalizeThresholdObject now, anyway.
* Fix remaining type error
* Clean up our ML executor tests with existing contract mocks
* Update ML Executor tests with new logic
We now record a partial failure instead of an error.
* Add and update tests for new ML normalization logic
* Add and update integration tests for ML Rules
Ensures that dealing with legacy job formats continues to work in the
API.
* Fix a type error
These params can no longer be strings.
* Update ML cypress test to create a rule with 2 ML jobs
If we can create a rule with 2 jobs, we should also be able to create a
rule with 1 job.
* Remove unused constant
* Persist a partial failure message written by a rule executor
We added the result.warning field as a way to indicate that a partial
failure was written to the rule, but neglected to account for that in the
main rule execution code, which caused a success status to immediately
overwrite the partial failure if the rule execution did not otherwise
fail/short-circuit.
* Set up Observability rule APIs
* Populate alerts table with data from API
* Move field map types/utils to common
* Format reason/link in alert type
* Format reason/link in alert type
* Fix issues with tsconfigs
* Storybook cleanup for example alerts
* Use `MemoryRouter` in the stories and `useHistory` in the component to get the history
* Replace examples with ones from "real" data
* Use `() => {}` instead of `jest.fn()` in mock registry data
* Store/display evaluations, add active/recovered badge
* Some more story fixes
* Decode rule data with type from owning registry
* Use transaction type/environment in link to app
* Fix type issues
* Fix API tests
* Undo changes in task_runner.ts
* Remove Mutable<> wrappers for field map
* Remove logger.debug calls in alerting es client
* Add API test for recovery of alerts
* Revert changes to src/core/server/http/router
* Use type imports where possible
* Update limits
* Set limit to 100kb
Co-authored-by: Nathan L Smith <smith@nlsmith.com>
## Summary
Fixes a bug where on the DNS tab of networks you can get a `too_many_buckets_exception`. Worked through the query with @angorayc and together I think we figured out that the query could be re-written with aggregations in a way to get the same results without having to query a large amount of terms which causes the buckets exception.
Added a e2e test and one way of being able to call bsearch in the e2e when it returns the search is still in progress so we don't have the large query test cause flakiness 🤞 .
### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
## Summary
- fcbc9d9 Rename `force` param to `revoke` for `/agents/{agent_id}/unenroll` & `/agents/bulk_unenroll`
- 03b9b90 Add new `force` param
See https://github.com/elastic/kibana/issues/96873 for background
<table>
<thead>
<tr>
<td rowspan="2"></td><td colspan="2">Unenroll Agent</td><td rowspan="2">Revoke API Keys</td>
</tr>
<tr>
<td>Regular</td><td>Hosted</td></td>
</tr>
</thead>
<tr><td colspan="4"><strong>Rename <code>force</code> to <code>revoke</code></strong></td></tr>
<tr><td>Current <code>force=false|undefined</code></td><td>✅</td><td>❌</td><td>❌</td></tr>
<tr><td>Proposed <code>revoke=false|undefined</code></td><td>✅</td><td>❌</td><td>❌</td></tr>
<tr><td>Current <code>force=true</code></td><td>✅</td><td>❌</td><td>✅</td></tr>
<tr><td>Proposed <code>revoke=true</code></td><td>✅</td><td>❌</td><td>✅</td></tr>
<tr><td colspan="4"><strong>Change <code>force</code> param </strong></td></tr>
<tr><td>Proposed <code>force=false|undefined</code></td><td>✅</td><td>❌</td><td>❌</td></tr>
<tr><td>Proposed <code>force=true</code></td><td>✅</td><td>✅</td><td>❌</td></tr>
<tr><td>Proposed <code>force=true</code> & <code>revoke=true</code></td><td>✅</td><td>✅</td><td>✅</td></tr>
</table>
### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
### Changes required for consumers
Any call to `/agents/{agent_id}/unenroll` & `/agents/bulk_unenroll` which passes the `force` param should change to `revoke` to maintain the current behavior.
* Reporting: Fix _index and _id columns in CSV export
* optimize - cache _columns and run getColumns once per execution
* Update x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts
Co-authored-by: Michael Dokolin <dokmic@gmail.com>
* feedback
* fix typescripts
* fix plugin list test
* fix plugin list
* take away the export interface to test CI build stats
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Michael Dokolin <dokmic@gmail.com>
* network module
adds the network module with four ml jobs for the 7.13 release
* Update datafeed_high_count_network_denies.json
json formatting
* update test
added the security_network module to the list
* renames
module name change to security_network / Security: Network
* formatting
change hyphen char to underscores
* fixes and name changes
fixes to df queries, descriptions. created_by param
* update tests
tests need the security_network module added
* formatting
change hyphens to underscores
* descriptions
format descriptions
* Update datafeed_high_count_network_events.json
indentation fixes
* Update x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/manifest.json
Co-authored-by: Lisa Cawley <lcawley@elastic.co>
* Update x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/high_count_network_denies.json
Co-authored-by: Lisa Cawley <lcawley@elastic.co>
* Update datafeed_high_count_network_events.json
change to a filter
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Lisa Cawley <lcawley@elastic.co>
