Skip to content

[Security Solution][DQD] Historical results (Phase 1) #184158

Closed

Description

Changes we are introducing in scope of Phase 1 DQD Historical results implementation agreed with @dhru42 :

UI Changes

DQD Checks ListView UI overhaul:

changes:

  • Check All Panel ui redesign (behavior of checkbox for "deprecated indices" will be clarified later)
  • Collapsible panels for index patterns
  • New action buttons for checking individual indexes (expand flyout + check)
  • Summary field tab is completely removed
  • Remaining field tabs are moved into Latest Check View Flyout Tab (see below)
  • Expand action icon opens Latest Check View Flyout Tab (see below) instead of opening nested panel like it is happening now
  • Refresh (check) icon triggers in-place checking of latest index result
  • The rest is the same (including pagination after 10 indexes per pattern)

image

(NEW) Latest Check View Flyout Tab:

use cases:

  • View latest check of a given index
  • Latest automatic check happening upon entering the tab
  • Manually check the index again via Check now button at the bottom
  • List field tabs the same way as before (uncluding count labels that are currently missing from the new design) (table features like sorting, pagination and search are still discussed in the new design)
  • Add telemetry tracking for check button

image

(NEW) Historical Checks View Flyout Tab:

use cases:

  • View list of historical results for given index
  • Trigger manual check with button at the bottom
  • Select range of historical results by creation date
  • Filter results by outcome status
  • No automatic check upon transition into the view
  • Paginate per 10 items (not in design yet).
  • Sort historical results in descending order ( latest - oldest )
  • tab specific actions are the same (copy to clipboard, add to new case)
  • add telemetry tracking for check button
  • add telemetry tracking click on historical view tab

image

Server / API Changes (Internal)

api changes:

  • GET /internal/ecs_data_quality_dashboard/results?pattern -> GET /internal/ecs_data_quality_dashboard/results_latest/:pattern

new api:

  • GET /internal/ecs_data_quality_dashboard/results/:pattern - fetches list of authorized indices results without aggregation.
    Supports new query params
    • from for pagination (ex. from=5)
    • size for doc size limiting (ex. size=2)
    • startDate and endDate for historical range selection (ex. startDate=now-1w/w&endDate=now-1d/d (inclusive))
    • outcome for filtering by presence of incompatibleFieldCount field (ex. outcome=pass or outcome=fail)

P. S.

All relevant tickets are or will be also added to the linked epic.

Tasks

  1. 8.15 candidate Feature:Data Health Quality Team:Threat Hunting Team:Threat Hunting:Explore release_note:skip
    kapral18
  2. 8.15 candidate Feature:Data Health Quality Team:Threat Hunting Team:Threat Hunting:Explore
    kapral18
  3. 8.15 candidate Feature:Data Health Quality Team:Threat Hunting Team:Threat Hunting:Explore
    kapral18
  4. 8.15 candidate Team:Threat Hunting Team:Threat Hunting:Explore
    kapral18
  5. 8.15 candidate Feature:Data Health Quality Team:Threat Hunting Team:Threat Hunting:Explore
    kapral18
  6. 8.16 candidate Feature:Data Health Quality Team:Threat Hunting Team:Threat Hunting:Explore
    kapral18
  7. 8.16 candidate Feature:Data Health Quality Team:Threat Hunting Team:Threat Hunting:Explore
    kapral18
  8. 8.16 candidate Feature:Data Health Quality Team:Threat Hunting Team:Threat Hunting:Explore
    kapral18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions