kibana/x-pack
Andrew Goldstein 9d4414d523
[SIEM] Overview page feedback (#56261)
## [SIEM] Overview page feedback

Implements feedback and fixes to the Overview page

### Overview (default theme)

![01-overview-default-theme](https://user-images.githubusercontent.com/4459398/73315509-899c5500-41ed-11ea-9949-82853dd4ba59.png)

### Overview (dark theme)

![02-overview-dark-theme](https://user-images.githubusercontent.com/4459398/73315527-902acc80-41ed-11ea-9701-6a2c5fa40cce.png)

## Highlights

* The new order of widgets is Signals, Alerts, Events, Host Events, Network events, per https://github.com/elastic/siem-team/issues/494

* Changed the default `External alerts count` `Stack by` to `event.module` https://github.com/elastic/siem-team/issues/491

*  Added `event.module` to the `Events count` histogram https://github.com/elastic/siem-team/issues/491

* Widget titles will no longer include the currently selected `Stack by option`. The widgets will use the same static title text that appears on the other pages (i.e.. `Signals count`, `External alerts count`, and `Events count`) https://github.com/elastic/siem-team/issues/491

* The `Signals count` includes a `Stack by` that defaults to `signal.rule.threat.tatic.name`

* Standardized on a 300px widget height for all histograms in the app (thanks @MichaelMarcialis for paring on this!)

* The `Open as duplicate timeline` action is `Recent timelines` is now only shown when hovering over a recent timeline

## Loading States

* The `Recent timelines` and `Security news` widgets now use the horizontal bar loading indicator

* The `Host events` and `Network events` widgets now use the horizontal bar loading indicator

* The `Host events` and `Network events` Showing _n_ events subtitles are now hidden on initial load

* The counts in the `Host events` and `Network events` Showing _n_ events subtitles are now hidden on initial load

* We no longer hide some histogram subtitles after initial load, to prevent shifting of content when a user makes a `Stack by` selection

## News Feed Error State

![news-feed-error-state](https://user-images.githubusercontent.com/4459398/73316060-1e538280-41ef-11ea-83f5-b8d6e9fa3741.png)

* Fixed an issue where the `Security news` header was hidden when an invalid URL is configured

* Added a space between the word `via` and the `SIEM advanced settings` link

* Removed the capital “N” from "News" in the error message

## Misc Visual Changes

* Fixed text truncation of the `Severity` column in the `Detections` page's `Signals` table

* Added the “showing” subtitle to the `Signals count` histogram on the Detections page

* Increased the `Stack by` histogram selector and the `View signals | alerts | events' buttons from 8 to 24px

* Tweaked the border rendering in the Overview `Host Events` and `Network events` widget headers

* Added 8px of spacing between the Overview `Host Events` and `Network events` widget accordion headers and their contents

* Fixed an issue where the `Host events` and `Networ events` widgets didn't render in ie11 https://github.com/elastic/siem-team/issues/499

## Non-Visual Fixes

* Removed an incorrect usage of `usememo`

* Removed the placeholder client-side username query from `x-pack/legacy/plugins/siem/public/components/recent_timelines/index.tsx`

* Updated the query of the Overview `Host events` widget to filter by "host.name exists"

* Updated the query of the Overview `Network events` widget to filter by "source.ip exists or destination.ip : exists"
2020-01-29 00:33:40 -07:00
..
.github
build_chromium
dev-tools [Watcher] Move out of legacy (#54752) 2020-01-23 15:35:36 +01:00
legacy [SIEM] Overview page feedback (#56261) 2020-01-29 00:33:40 -07:00
plugins Basic Functionality Alert List (#55800) 2020-01-28 20:37:19 -07:00
scripts Create UI for alerting and actions plugin (#48959) 2020-01-13 16:16:20 -08:00
tasks run mocha tests from x-pack with root mocha script (#51352) 2019-11-25 11:39:20 -07:00
test Skip tests that depend on other skipped test 2020-01-28 15:13:07 -05:00
test_utils [Index Management] Add Mappings Editor to Index Template Wizard (#47562) 2020-01-14 17:09:29 -08:00
typings migrate Actions to Kibana platform (#55026) 2020-01-22 17:08:54 +00:00
.gitignore Add lockfile symlinks (#55440) 2020-01-27 11:38:20 -05:00
.i18nrc.json [Watcher] Move out of legacy (#54752) 2020-01-23 15:35:36 +01:00
.kibana-plugin-helpers.json
gulpfile.js run mocha tests from x-pack with root mocha script (#51352) 2019-11-25 11:39:20 -07:00
index.js Create UI for alerting and actions plugin (#48959) 2020-01-13 16:16:20 -08:00
package.json Upgraded EUI to 18.2.1 (#55090) 2020-01-16 15:03:40 -07:00
README.md Updating accessibility guide and contributing readmes (#52038) 2019-12-04 19:11:16 -06:00
tsconfig.json [Metric] convert mocha tests to jest (#54054) 2020-01-17 12:00:35 -06:00
yarn.lock Add lockfile symlinks (#55440) 2020-01-27 11:38:20 -05:00

Elastic License Functionality

This directory tree contains files subject to the Elastic License. The files subject to the Elastic License are grouped in this directory to clearly separate them from files licensed under the Apache License 2.0.

Development

By default, Kibana will run with X-Pack installed as mentioned in the contributing guide.

Elasticsearch will run with a basic license. To run with a trial license, including security, you can specifying that with the yarn es command.

Example: yarn es snapshot --license trial --password changeme

By default, this will also set the password for native realm accounts to the password provided (changeme by default). This includes that of the kibana user which elasticsearch.username defaults to in development. If you wish to specific a password for a given native realm account, you can do that like so: --password.kibana=notsecure

Testing

Running specific tests

Test runner Test location Runner command (working directory is kibana/x-pack)
Jest x-pack/**/*.test.js
x-pack/**/*.test.ts
cd x-pack && node scripts/jest -t regexp [test path]
Functional x-pack/test/*integration/**/config.js
x-pack/test/*functional/config.js
x-pack/test/accessibility/config.js
node scripts/functional_tests_server --config x-pack/test/[directory]/config.js
node scripts/functional_test_runner --config x-pack/test/[directory]/config.js --grep=regexp

Examples:

  • Run the jest test case whose description matches 'filtering should skip values of null': cd x-pack && yarn test:jest -t 'filtering should skip values of null' plugins/ml/public/application/explorer/explorer_charts/explorer_charts_container_service.test.js
  • Run the x-pack api integration test case whose description matches the given string: node scripts/functional_tests_server --config x-pack/test/api_integration/config.js node scripts/functional_test_runner --config x-pack/test/api_integration/config.js --grep='apis Monitoring Beats list with restarted beat instance should load multiple clusters'

In addition to to providing a regular expression argument, specific tests can also be run by appeding .only to an it or describe function block. E.g. describe( to describe.only(.

Running all tests

You can run unit tests by running:

yarn test

If you want to run tests only for a specific plugin (to save some time), you can run:

yarn test --plugins <plugin>[,<plugin>]*    # where <plugin> is "reporting", etc.

Debugging browser tests

yarn test:browser:dev

Initializes an environment for debugging the browser tests. Includes an dedicated instance of the kibana server for building the test bundle, and a karma server. When running this task the build is optimized for the first time and then a karma-owned instance of the browser is opened. Click the "debug" button to open a new tab that executes the unit tests.

Run single tests by appending grep parameter to the end of the URL. For example http://localhost:9876/debug.html?grep=ML%20-%20Explorer%20Controller will only run tests with 'ML - Explorer Controller' in the describe block.

Running server unit tests

You can run server-side unit tests by running:

yarn test:server

Running functional tests

For more info, see the Elastic functional test development guide.

The functional UI tests, the API integration tests, and the SAML API integration tests are all run against a live browser, Kibana, and Elasticsearch install. Each set of tests is specified with a unique config that describes how to start the Elasticsearch server, the Kibana server, and what tests to run against them. The sets of tests that exist today are functional UI tests (specified by this config), API integration tests (specified by this config), and SAML API integration tests (specified by this config).

The script runs all sets of tests sequentially like so:

  • builds Elasticsearch and X-Pack
  • runs Elasticsearch with X-Pack
  • starts up the Kibana server with X-Pack
  • runs the functional UI tests against those servers
  • tears down the servers
  • repeats the same process for the API and SAML API integration test configs.

To do all of this in a single command run:

node scripts/functional_tests

Developing functional UI tests

If you are developing functional tests then you probably don't want to rebuild Elasticsearch and wait for all that setup on every test run, so instead use this command to build and start just the Elasticsearch and Kibana servers:

node scripts/functional_tests_server

After the servers are started, open a new terminal and run this command to run just the tests (without tearing down Elasticsearch or Kibana):

node scripts/functional_test_runner

For both of the above commands, it's crucial that you pass in --config to specify the same config file to both commands. This makes sure that the right tests will run against the right servers. Typically a set of tests and server configuration go together.

Read more about how the scripts work here.

For a deeper dive, read more about the way functional tests and servers work here.

Running API integration tests

API integration tests are run with a unique setup usually without UI assets built for the Kibana server.

API integration tests are intended to test only programmatic API exposed by Kibana. There is no need to run browser and simulate user actions, which significantly reduces execution time. In addition, the configuration for API integration tests typically sets optimize.enabled=false for Kibana because UI assets are usually not needed for these tests.

To run only the API integration tests:

node scripts/functional_tests --config test/api_integration/config

Running SAML API integration tests

We also have SAML API integration tests which set up Elasticsearch and Kibana with SAML support. Run only API integration tests with SAML enabled like so:

node scripts/functional_tests --config test/saml_api_integration/config

Running Jest integration tests

Jest integration tests can be used to test behavior with Elasticsearch and the Kibana server.

node scripts/jest_integration

An example test exists at test_utils/jest/integration_tests/example_integration.test.ts

Running Reporting functional tests

See here for more information on running reporting tests.