Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Advanced Analytics (UEBA) sub-category to integrations #499

Closed
6 of 8 tasks
susan-shu-c opened this issue Apr 12, 2023 · 15 comments
Closed
6 of 8 tasks

Add Advanced Analytics (UEBA) sub-category to integrations #499

susan-shu-c opened this issue Apr 12, 2023 · 15 comments
Assignees
@susan-shu-c @SourinPaul
Labels
enhancement New feature or request Team:Fleet Label for the Fleet team

Comments

@susan-shu-c
Copy link
Member

susan-shu-c commented Apr 12, 2023 •
edited by mrodm
Loading

Overview

For customer navigation, we'd like to add a new subcategory to integrations, since having all these packages under Security (which has 175 packages) makes it hard to discover.

Category name: Security > Advanced Analytics (UEBA)

Related packages

  • ProblemChild (Living off the Land Detection)
  • DGA
  • DED (Data Exfiltration Detection)
  • LMD (Lateral Movement Detection)

We can make the PRs for these in the integrations repo after this issue/ticket is resolved.

Business & User Value:

  • Users need a convenient view of all ML-based advanced detection packs within their space. We are building additional integration packages under this category. The category will significantly reduce user efforts, reduce user error, and aid in feature discovery.
  • Elastic security (Entity Analytics Onboarding) workflow will leverage this filtered view in the user journey for discovering these packages. Without a reconciled view, the onboarding workflow will remain incomplete.

Implementation tasks

  • Add to package-spec (ref PR)
  • Add to package-registry (ref PR)
  • Release new version of package spec (contact @mrodm)
  • Release new version of elastic-package (contact @mrodm)
  • Release new version of package registry (contact @mrodm)

Mockup:

Screenshot 2023-04-12 at 9 22 19 AM

Related tickets
@susan-shu-c susan-shu-c added the discuss Issue needs discussion label Apr 12, 2023
@susan-shu-c
Copy link
Member Author

@jen-huang mentioned that this should be a subcategory under Security, which would then look like this (source):

Screenshot 2023-04-12 at 3 30 50 PM

So then it would be Security > Advanced Analytics (UEBA), since the goal of the recent cleanup was to reduce the high level categories to only a few - link

@SourinPaul

@SourinPaul
Copy link

So then it would be Security > Advanced Analytics (UEBA), since the goal of the recent cleanup was to reduce the high-level categories to only a few

This sounds perfect!

@susan-shu-c susan-shu-c changed the title Add Advanced Analytics (UEBA) category to integrations Add Advanced Analytics (UEBA) sub-category to integrations Apr 13, 2023
@jen-huang
Copy link
Contributor

Adding this as a new subcategory under Security makes sense to me. Per discussion with @susan-shu-c, the ML team will handle the implementation work. I have added the list of tasks to the parent issue description.

@jen-huang jen-huang added enhancement New feature or request Team:Fleet Label for the Fleet team and removed discuss Issue needs discussion labels Apr 13, 2023
@susan-shu-c
Copy link
Member Author

Thank you, @jen-huang for approving; I'll take it from here 👍

This was referenced Apr 26, 2023
Merged
Merged
Merged
@susan-shu-c
Copy link
Member Author

Hi, @mrodm I've created various PRs based on Jen's instructions, please let me know if there's anything I'm missing!

@mrodm
Copy link
Contributor

mrodm commented Apr 28, 2023

Hi @susan-shu-c , these PRs should be enough. Afterwards, some releases (package-spec, elastic-package and package-registry) would need to be performed.

@susan-shu-c
Copy link
Member Author

Sounds good, @mrodm . I don't have permissions to merge in package-spec, but I will merge the other 2 PRs in Kibana, package-registry

susan-shu-c added a commit to elastic/kibana that referenced this issue Apr 28, 2023
@susan-shu-c
Add Advanced Analytics (UEBA) package subcategory under Security …
bd5f330 
…category (#155935)

## Summary

Summarize your PR. If it involves visual changes include a screenshot or
gif.

Add `Advanced Analytics (UEBA)` subcategory under Security

* elastic/package-spec#499

### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### Risk Matrix

Delete this section if it is not applicable to this PR.

(This PR doesn't add new features, thus deleting the table in the
boilerplate)


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
@jsoriano
Copy link
Member

Sounds good, @mrodm . I don't have permissions to merge in package-spec, but I will merge the other 2 PRs in Kibana, package-registry

I have merged the package-spec one.

@susan-shu-c
Copy link
Member Author

Thanks @jsoriano I merged the other two!

@susan-shu-c
Copy link
Member Author

Thank you @mrodm , the 3 PRs have now been merged 👍

@jen-huang jen-huang mentioned this issue May 8, 2023
Open
@mrodm
Copy link
Contributor

mrodm commented May 15, 2023

@susan-shu-c package-spec, package-registry and elastic-package have been released the new versions needed.

If this needs to be used as a subcategory in packages in the integrations repository, it is needed to update the elastic-package dependency version used by that repository. This is done in this PR elastic/integrations#6211

@susan-shu-c susan-shu-c mentioned this issue May 17, 2023
Merged
4 tasks
@susan-shu-c
Copy link
Member Author

Hi @mrodm I've created a PR, please let me know if there's anything required!

@mrodm
Copy link
Contributor

mrodm commented May 22, 2023

Hi @mrodm I've created a PR, please let me know if there's anything required!

Hi @susan-shu-c , that missing PR was already merged last week. The new category should be already available in the integrations repository to be used in the packages.
You could trigger again the testing in your branch adding a comment with /test, to check that CI runs successfully.

@susan-shu-c
Copy link
Member Author

Thank you @mrodm I've gotten the integrations repo PR merged! Which adds the subcategory to the respective packagesI think we're all good now 😁

@jen-huang jen-huang mentioned this issue May 25, 2023
Closed
@susan-shu-c
Copy link
Member Author

Nice, it's live!

Screenshot 2023-06-08 at 12 09 18 PM Screenshot 2023-06-08 at 12 09 28 PM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@susan-shu-c susan-shu-c

@SourinPaul SourinPaul

Labels
enhancement New feature or request Team:Fleet Label for the Fleet team
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@jsoriano @jen-huang @mrodm @susan-shu-c @SourinPaul