[Entity Analytics][API] New API to allow user to configure risk engine SO #201344

abhishekbhatia1710 · 2024-11-22T10:34:01Z

Summary

New API to allow user to configure saved object

Optional Params required to test the API :

exclude_alert_statuses : ["open", "closed"]
range : {"start" : "now-40m", "end" : "now"}
exclude_alert_tags : ["False positive"]

Example requests :

curl --location --request PUT 'http://localhost:5601/api/risk_score/engine/saved_object/configure' \
--header 'kbn-xsrf: hello' \
--header 'elastic-api-version: 2023-10-31' \
--header 'x-elastic-internal-origin: test' \
--header 'Content-Type: application/json' \
--header 'Authorization: <REDACTED>' \
--data '{
    "exclude_alert_statuses" : ["open", "closed"],
    "range": {
        "start" : "now-23m",
        "end" : "now"
    },
    "exclude_alert_tags" : ["False-positive"]
}'

Unit and integration tests are added considering the spaces as well.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Unit or functional tests were updated or added to match the most common scenarios
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines

elasticmachine · 2024-11-22T10:34:03Z

Pinging @elastic/security-entity-analytics (Team:Entity Analytics)

CAWilson94 · 2024-11-22T11:22:34Z

x-pack/test/api_integration/services/security_solution_api.gen.ts

+      kibanaSpace: string = 'default'
+    ) {
+      return supertest
+        .patch(routeWithNamespace('/api/risk_score/engine/saved_object/configure', kibanaSpace))


General open question about this path: I noticed that wrapping this in an interface and adding it to the consts file is a nice approach. However, I see the same path being hardcoded here and in the YAML file. Would it make sense to extract the path itself into a constant to make updates and maintenance easier?

These .gen.ts files are generated automatically for us by the OpenAPI doc generator 👍

tiansivive · 2024-11-28T11:44:56Z

...tion/common/api/entity_analytics/risk_engine/engine_configure_saved_object_route.schema.yaml

+              schema:
+                $ref: '#/components/schemas/ConfigureRiskEngineSavedObjectErrorResponse'
+
+components:


is it worth it to move this component to a common file? I believe we already have one for the risk engine?

tiansivive · 2024-11-28T12:00:56Z

...tion/common/api/entity_analytics/risk_engine/engine_configure_saved_object_route.schema.yaml

+                exclude_alert_statuses:
+                  type: array
+                  items:
+                    type: string


can we define this as an Enum instead?

tiansivive

LGTM!
code changes look good, just a small question.

Desk testes as well and seems to be working 👍🏽

hop-dev

Code LGTM, I have tested locally via the UI 🚀

hop-dev · 2024-12-09T13:45:30Z

@elasticmachine merge upstream

elasticmachine · 2024-12-09T15:22:25Z

💚 Build Succeeded

Buildkite Build
Commit: df98eac

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	6347	6348	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	14.6MB	14.6MB	+444.0B

History

💛 Build #253544 was flaky 563474b
💔 Build #253499 failed 0310e97

cc @abhishekbhatia1710

…lerts for risk score calculation (#201909) ## Summary We are introducing a new feature that allows users to include "closed" alerts in risk score calculations. Users can toggle a button to include closed alerts in the risk score calculation and specify a date/time range for the calculation. Additionally, they can preview the data before finalising and saving these changes for the next engine run. ![Image](https://github.com/user-attachments/assets/5f91c990-22d6-46e5-8a7b-9875003867e4) ### **Note : This PR is an extension to the following PRs.** - [API] : #201344 - [API] : #201397 ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

abhishekbhatia1710 · 2024-12-13T06:43:34Z

Changes in this PR are merged along with #201909. Hence, closing this.

…lerts for risk score calculation (elastic#201909) ## Summary We are introducing a new feature that allows users to include "closed" alerts in risk score calculations. Users can toggle a button to include closed alerts in the risk score calculation and specify a date/time range for the calculation. Additionally, they can preview the data before finalising and saving these changes for the next engine run. ![Image](https://github.com/user-attachments/assets/5f91c990-22d6-46e5-8a7b-9875003867e4) ### **Note : This PR is an extension to the following PRs.** - [API] : elastic#201344 - [API] : elastic#201397 ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit a95ec61) # Conflicts: # x-pack/plugins/security_solution/public/entity_analytics/api/hooks/use_preview_risk_scores.ts # x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/risk_engine/engine_configure_saved_object_route.gen.ts # x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/risk_engine/engine_configure_saved_object_route.schema.yaml # x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/risk_engine/preview_route.gen.ts # x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/risk_engine/preview_route.schema.yaml # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/api/hooks/use_configure_risk_engine_saved_object.ts # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/__snapshots__/risk_score_configuration_section.test.tsx.snap # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_configuration_section.test.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_configuration_section.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_page_styles.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_preview_section.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_useful_links_section.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/translations.ts # x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/configure_saved_object.test.ts # x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/configure_saved_object.ts # x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/risk_engine/utils/saved_object_configuration.ts # x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/risk_score/calculate_risk_scores.ts # x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/risk_score/routes/preview.ts # x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/types.ts # x-pack/test/security_solution_api_integration/test_suites/entity_analytics/utils/risk_engine.ts

…lerts for risk score calculation (elastic#201909) ## Summary We are introducing a new feature that allows users to include "closed" alerts in risk score calculations. Users can toggle a button to include closed alerts in the risk score calculation and specify a date/time range for the calculation. Additionally, they can preview the data before finalising and saving these changes for the next engine run. ![Image](https://github.com/user-attachments/assets/5f91c990-22d6-46e5-8a7b-9875003867e4) ### **Note : This PR is an extension to the following PRs.** - [API] : elastic#201344 - [API] : elastic#201397 ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit a95ec61) # Conflicts: # x-pack/plugins/security_solution/public/entity_analytics/api/hooks/use_preview_risk_scores.ts # x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/risk_engine/engine_configure_saved_object_route.gen.ts # x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/risk_engine/engine_configure_saved_object_route.schema.yaml # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/api/hooks/use_configure_risk_engine_saved_object.ts # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/__snapshots__/risk_score_configuration_section.test.tsx.snap # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_configuration_section.test.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_configuration_section.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_page_styles.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_preview_section.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_useful_links_section.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/translations.ts # x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/configure_saved_object.test.ts # x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/configure_saved_object.ts # x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/risk_engine/utils/saved_object_configuration.ts # x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/risk_score/calculate_risk_scores.ts # x-pack/test/security_solution_api_integration/test_suites/entity_analytics/utils/risk_engine.ts

…lerts for risk score calculation (elastic#201909) ## Summary We are introducing a new feature that allows users to include "closed" alerts in risk score calculations. Users can toggle a button to include closed alerts in the risk score calculation and specify a date/time range for the calculation. Additionally, they can preview the data before finalising and saving these changes for the next engine run. ![Image](https://github.com/user-attachments/assets/5f91c990-22d6-46e5-8a7b-9875003867e4) ### **Note : This PR is an extension to the following PRs.** - [API] : elastic#201344 - [API] : elastic#201397 ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit a95ec61) # Conflicts: # x-pack/plugins/security_solution/public/entity_analytics/api/hooks/use_preview_risk_scores.ts # x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/risk_engine/engine_configure_saved_object_route.gen.ts # x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/risk_engine/engine_configure_saved_object_route.schema.yaml # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/api/hooks/use_configure_risk_engine_saved_object.ts # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/__snapshots__/risk_score_configuration_section.test.tsx.snap # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_configuration_section.test.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_configuration_section.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_page_styles.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_preview_section.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_score_useful_links_section.tsx # x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/configure_saved_object.test.ts # x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/configure_saved_object.ts # x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/risk_engine/utils/saved_object_configuration.ts # x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/risk_score/calculate_risk_scores.ts # x-pack/test/security_solution_api_integration/test_suites/entity_analytics/utils/risk_engine.ts

New API to allow user to configure risk engine so

0310e97

abhishekbhatia1710 added release_note:feature Makes this part of the condensed release notes Team:Entity Analytics Security Entity Analytics Team 8.17 candidate labels Nov 22, 2024

abhishekbhatia1710 requested a review from machadoum November 22, 2024 10:34

abhishekbhatia1710 self-assigned this Nov 22, 2024

abhishekbhatia1710 requested review from a team as code owners November 22, 2024 10:34

CAWilson94 reviewed Nov 22, 2024

View reviewed changes

CAWilson94 and others added 3 commits November 22, 2024 11:24

Merge branch 'main' into ea-task-api-soConfigure

c8eae58

[CI] Auto-commit changed files from 'yarn openapi:bundle'

57f5ec3

[CI] Auto-commit changed files from 'make api-docs'

563474b

abhishekbhatia1710 added the v9.0.0 label Nov 22, 2024

tiansivive reviewed Nov 28, 2024

View reviewed changes

tiansivive approved these changes Nov 28, 2024

View reviewed changes

hop-dev approved these changes Nov 28, 2024

View reviewed changes

Merge branch 'main' into ea-task-api-soConfigure

df98eac

abhishekbhatia1710 closed this Dec 13, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Entity Analytics][API] New API to allow user to configure risk engine SO #201344

[Entity Analytics][API] New API to allow user to configure risk engine SO #201344

Uh oh!

abhishekbhatia1710 commented Nov 22, 2024 •

edited

Loading

Uh oh!

elasticmachine commented Nov 22, 2024

Uh oh!

CAWilson94 Nov 22, 2024

Uh oh!

hop-dev Nov 28, 2024

Uh oh!

tiansivive Nov 28, 2024

Uh oh!

tiansivive Nov 28, 2024

Uh oh!

tiansivive left a comment

Uh oh!

hop-dev left a comment

Uh oh!

hop-dev commented Dec 9, 2024

Uh oh!

elasticmachine commented Dec 9, 2024

Uh oh!

abhishekbhatia1710 commented Dec 13, 2024

Uh oh!

Uh oh!

[Entity Analytics][API] New API to allow user to configure risk engine SO #201344

[Entity Analytics][API] New API to allow user to configure risk engine SO #201344

Uh oh!

Conversation

abhishekbhatia1710 commented Nov 22, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

elasticmachine commented Nov 22, 2024

Uh oh!

CAWilson94 Nov 22, 2024

Choose a reason for hiding this comment

Uh oh!

hop-dev Nov 28, 2024

Choose a reason for hiding this comment

Uh oh!

tiansivive Nov 28, 2024

Choose a reason for hiding this comment

Uh oh!

tiansivive Nov 28, 2024

Choose a reason for hiding this comment

Uh oh!

tiansivive left a comment

Choose a reason for hiding this comment

Uh oh!

hop-dev left a comment

Choose a reason for hiding this comment

Uh oh!

hop-dev commented Dec 9, 2024

Uh oh!

elasticmachine commented Dec 9, 2024

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

History

Uh oh!

abhishekbhatia1710 commented Dec 13, 2024

Uh oh!

Uh oh!

abhishekbhatia1710 commented Nov 22, 2024 •

edited

Loading