Go to file
Devin W. Hurley 68ff6f6db4
[SIEM][Detection Engine] Rule Status Monitoring (#54452) (#54716)
* Working status updates in executor. Need to update read rules api endpoint to only respond with 'status' and not status info. Will create another endpoint to get status details for a rule which will include last five errors (if there are any). Still need tests

* adds new route for getting statuses for a list of given alert ids, adds try-catch and more logic in executor for logging errors, adds scripts and rules for testing, updates find_rules endpoint to display statuses too. Would like to look into using the alerts executor state to better manage logic for statuses, and need to update some types. Also needs unit tests still.

* updated types for routes, updated how merging of alert-to-rule and rule status happens when formatting REST response.

* typecast test server as ServerFacade type

* fix bug where we were not awaiting the accumulated result in the reducer

* update rule status saved object interfaces to play nicely with interfaces provided by saved objects module. Update tests to pass - Need to write new unit tests in an upcoming commit. Next commit will be cleanup from comments then new unit tests.

* fix missed conflicts after rebase

* replace id param with rule.id when searching in statuses, adds sort fields to the saved objects find queries.

* fixes bug where 'executing' statuses were being written into failing historical status list

* camelCase to snake_case in new statuses route, also fix merge conflict

* add deletion of rule statuses to delete_rules_bulk_route. Statuses are created inside of executor so we will not be needing to create statuses directly inside of the create rules bulk route, so I removed that extraneous code.

* pr feedback I forgot to fix earlier

* remove unused import. fixes type check error generated in previous commit

* removes status information from rule when saved to signals index and updates tests to represent this change. Also removes extraneous quotes inserted around alertId field when creating a new historical status.

* adds new bash script to delete all rule statuses, updates error messages in rule statuses to just store actual message, moved querying of rules statuses under a null check, initialize everything to null when first creating rule status, update number of results returned when querying saved objects based on usage, updates saved objects mapping types to use date for dates and keyword for alertId.

* use lodash snake case and update total number of saved objects to return for find rules, delete rules, and read rules.

* updates how statuses are transformed inside of read_rules_route, only update updated_at in rule on update of rule, removes unlabeled todo comment, updates scripts descriptions, removes interval from query_with_rule_id.json sample query, removes debug statement, removes verbose from curl script.

* display rule status on update
2020-01-14 09:17:11 -05:00
.ci [7.x] Flaky test runner improvements/fixes (#49367) (#54591) 2020-01-13 12:14:42 -05:00
.github Revert commit of CODEOWNERS in non-master branch 2019-12-11 12:11:56 -08:00
bin Update node options Initialization on our scripts (#40302) (#43358) 2019-08-15 17:30:07 +01:00
common/graphql [Uptime] Implement EuiSuperDatePicker (#28217) 2019-01-18 13:44:58 -05:00
config Hide stderr git output during APM agent configuration (#52878) (#52890) 2019-12-12 17:58:40 +01:00
data
docs Support "Deprecated" label in advanced settings (#54539) (#54660) 2020-01-14 01:14:03 +02:00
examples [State Management] State containers improvements (#54436) (#54562) 2020-01-13 14:12:25 +01:00
licenses Migrate x-pack-kibana source to kibana 2018-04-24 13:48:10 -07:00
packages [7.x] Add support for workspaces in NP x-pack plugins (#53825) (#54479) 2020-01-13 10:27:02 -07:00
rfcs/text Console to NP ready (#43346) (#45511) 2019-09-12 18:30:03 +02:00
scripts autofix all violations 2019-12-13 23:55:01 -07:00
src fix np app navlink url (#54691) (#54706) 2020-01-14 15:08:46 +01:00
style_guides Style guide cleanup (#46464) (#46559) 2019-09-25 13:19:15 +02:00
tasks [7.x] share specific instances of some ui packages (#54079) (#54514) 2020-01-10 20:20:18 -07:00
test Fix chromeless NP apps not using full page width (#54550) (#54683) 2020-01-14 09:57:24 +01:00
typings [State Management] State syncing utilities (#53582) (#54454) 2020-01-13 10:10:56 +03:00
utilities remove use of experimental fs.promises api (#53346) (#53796) 2019-12-25 21:28:41 -07:00
vars [7.x] Elasticsearch snapshots automation (#53706) (#54150) 2020-01-08 10:27:17 -05:00
webpackShims [7.x] share specific instances of some ui packages (#54079) (#54514) 2020-01-10 20:20:18 -07:00
x-pack [SIEM][Detection Engine] Rule Status Monitoring (#54452) (#54716) 2020-01-14 09:17:11 -05:00
.backportrc.json [backport-config] Adds 7.4 branch (#44402) 2019-08-29 10:11:53 -07:00
.browserslistrc [7.x] [autoprefixer] upgrade to 9.6.1, unify browserslist hand… (#41145) 2019-07-15 13:01:17 -07:00
.editorconfig
.eslintignore [7.x] Move @kbn/es-query into data plugin (#51014) (#51783) 2019-11-26 16:07:16 -07:00
.eslintrc.js [7.x] share specific instances of some ui packages (#54079) (#54514) 2020-01-10 20:20:18 -07:00
.gitattributes [7.x] [canvas] Color fixes + Storybook 5 (#34075) (#34369) 2019-04-02 16:35:28 -05:00
.gitignore Instrument Kibana with Elastic APM (#43548) (#52186) 2019-12-04 17:04:12 +01:00
.i18nrc.json move management registry to new platform (#53020) (#54058) 2020-01-06 16:16:04 -06:00
.node-version Update Node.js to version 10.18.0 (#52865) (#53471) 2019-12-18 15:48:59 +01:00
.nvmrc Update Node.js to version 10.18.0 (#52865) (#53471) 2019-12-18 15:48:59 +01:00
.prettierrc Increase prettier line width to 100 (#20535) 2018-07-09 22:50:37 +02:00
.sass-lint.yml Move query utils ⇒ NP (#49636) (#50633) 2019-11-14 14:49:25 +02:00
.yarnrc [kbn-pm] Use yarn workspaces for dependencies (#24095) 2018-11-12 12:38:11 -06:00
CONTRIBUTING.md Sync contribution guide with master (#54256) 2020-01-09 14:03:05 +01:00
FAQ.md
github_checks_reporter.json implementing github checks - second attempt (#35757) (#35906) 2019-05-01 19:53:02 -05:00
Gruntfile.js autofix all violations 2019-12-13 23:55:01 -07:00
Jenkinsfile Add PR comments to pipeline (#51504) (#52143) 2019-12-03 20:36:16 -05:00
kibana.d.ts Update eslint related packages (#48513) (#48853) 2019-10-22 06:41:28 -07:00
LICENSE.txt Migrate x-pack-kibana source to kibana 2018-04-24 13:48:10 -07:00
NOTICE.txt Bump year in NOTICE.txt 2019-12-31 21:47:57 -05:00
package.json [7.x] Add support for workspaces in NP x-pack plugins (#53825) (#54479) 2020-01-13 10:27:02 -07:00
preinstall_check.js Apache 2.0 license headers (#19383) 2018-05-28 20:06:30 -07:00
README.md [7.x] chore: point issue links to choose (#49616) (#49648) 2019-10-29 20:37:52 +01:00
renovate.json5 [State Management] State containers improvements (#54436) (#54562) 2020-01-13 14:12:25 +01:00
STYLEGUIDE.md [7.x] Upgrade to TypeScript 3.7.2 (#47188) (#50756) 2019-11-15 13:49:03 +01:00
tsconfig.browser.json [typescript] continue to use the default config in development (#21966) 2018-08-14 15:27:07 -07:00
tsconfig.json Es ui shared updates (#46570) (#46716) 2019-10-29 11:25:50 +01:00
tsconfig.types.json [Core] Move Saved objects files to core (#38771) (#39158) 2019-06-19 17:27:16 +02:00
TYPESCRIPT.md [7.x] Update deprecated React.SFC and React.StatelessComponent types (#50852) (#51336) 2019-11-22 13:12:30 +01:00
yarn.lock Update fstream dependency (1.0.111.0.12). (#53932) (#54711) 2020-01-14 15:09:03 +01:00

Kibana

Kibana is your window into the Elastic Stack. Specifically, it's a browser-based analytics and search dashboard for Elasticsearch.

Getting Started

If you just want to try Kibana out, check out the Elastic Stack Getting Started Page to give it a whirl.

If you're interested in diving a bit deeper and getting a taste of Kibana's capabilities, head over to the Kibana Getting Started Page.

Using a Kibana Release

If you want to use a Kibana release in production, give it a test run, or just play around:

Building and Running Kibana, and/or Contributing Code

You might want to build Kibana locally to contribute some code, test out the latest features, or try out an open PR:

Documentation

Visit Elastic.co for the full Kibana documentation.

For information about building the documentation, see the README in elastic/docs.

Version Compatibility with Elasticsearch

Ideally, you should be running Elasticsearch and Kibana with matching version numbers. If your Elasticsearch has an older version number or a newer major number than Kibana, then Kibana will fail to run. If Elasticsearch has a newer minor or patch number than Kibana, then the Kibana Server will log a warning.

Note: The version numbers below are only examples, meant to illustrate the relationships between different types of version numbers.

Situation Example Kibana version Example ES version Outcome
Versions are the same. 5.1.2 5.1.2 💚 OK
ES patch number is newer. 5.1.2 5.1.5 ⚠️ Logged warning
ES minor number is newer. 5.1.2 5.5.0 ⚠️ Logged warning
ES major number is newer. 5.1.2 6.0.0 🚫 Fatal error
ES patch number is older. 5.1.2 5.1.0 ⚠️ Logged warning
ES minor number is older. 5.1.2 5.0.0 🚫 Fatal error
ES major number is older. 5.1.2 4.0.0 🚫 Fatal error

Questions? Problems? Suggestions?

  • If you've found a bug or want to request a feature, please create a GitHub Issue. Please check to make sure someone else hasn't already created an issue for the same topic.
  • Need help using Kibana? Ask away on our Kibana Discuss Forum and a fellow community member or Elastic engineer will be glad to help you out.