[Security Solution] Update CellActions field type to be FieldSpec #157243

machadoum · 2023-05-10T08:41:40Z

Context

Some Actions need to access FieldSpec data, which is not present on the CellActions API (subTypeand isMapped). So we are updating the CellActions field property to be compatible with FieldSpec.

Summary

This PR is the first step to fix #150347.

Updates the CellActions field type to FieldSpec
Adds minimal possible changes to make Security Solution compatible with the new type.
- Adding the mandatory properties searchable and aggregatble to every CellActions call.
Fix SecurityCelActions calls to provide the right Kibana and ES field types
- Previously we were mixing esTypes and kbnTypes. For example, if the esType is a keyword the kbnType has to be a string.
  Here you can check all possible ES and KBN types and here you can see the mapping between esType and kbnType

Next steps

Add subType property to all CellActions calls so we can fix CellActions component should hide ShowTopN action for nested fields #150347
We need to refactor the Security Solution to get FieldSpec from the DataView instead of using BrowserFields. Ideally, we have to do that for every CellAction call so the actions have access to the subType property.
Add isMapped to all CellActions calls so we can fix [Security Solution] Disable filter cellActions for unmapped fields on Alerts table #154714

Checklist

Unit or functional tests were updated or added to match the most common scenarios

machadoum · 2023-05-12T12:16:37Z

x-pack/plugins/security_solution/public/actions/show_top_n/cell_action/show_top_n.tsx

@@ -46,7 +47,7 @@ export const createShowTopNCellActionFactory = createCellActionFactory(
    getDisplayNameTooltip: ({ field }) => SHOW_TOP(field.name),
    isCompatible: async ({ field }) =>
      fieldHasCellActions(field.name) &&
-      !UNSUPPORTED_FIELD_TYPES.includes(field.type) &&
+      !UNSUPPORTED_FIELD_TYPES.includes(head(field.esTypes) ?? '') &&


I updated the check to use esTypes and all CellActions calls to pass the rights types.

Are we always going to check only the first element in esTypes?

elasticmachine · 2023-05-15T09:23:01Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

elasticmachine · 2023-05-15T09:23:02Z

Pinging @elastic/security-solution (Team: SecuritySolution)

kibana-ci · 2023-05-15T17:32:36Z

💔 Build Failed

Buildkite Build
Commit: 5231efd8836377569cbc27df02e502a3b1d78a08
Interpreting CI Failures
Storybooks Preview

Failed CI Steps

Test Failures

[job] [logs] Security Solution Tests #1 / Detection response view Open in timeline opens timeline with correct query count for hosts by alert severity table
[job] [logs] Security Solution Tests #1 / Detection response view Open in timeline opens timeline with correct query count for hosts by alert severity table
[job] [logs] Security Solution Tests #1 / Detection response view Open in timeline opens timeline with correct query count for open alerts by rule table
[job] [logs] Security Solution Tests #1 / Detection response view Open in timeline opens timeline with correct query count for open alerts by rule table
[job] [logs] Security Solution Tests #1 / Detection response view Open in timeline opens timeline with correct query count for users by alert severity table
[job] [logs] Security Solution Tests #1 / Detection response view Open in timeline opens timeline with correct query count for users by alert severity table
[job] [logs] Jest Tests #9 / draggable_score renders correctly against snapshot
[job] [logs] Jest Tests #9 / draggable_score renders correctly against snapshot when the index is not included
[job] [logs] Jest Tests #9 / entity_draggable renders correctly against snapshot
[job] [logs] Security Solution Tests #3 / Hover actions Adds global filter - filter in
[job] [logs] Security Solution Tests #3 / Hover actions Adds global filter - filter in
[job] [logs] Security Solution Tests #3 / Hover actions Adds global filter - filter out
[job] [logs] Security Solution Tests #3 / Hover actions Adds global filter - filter out
[job] [logs] Security Solution Tests #3 / Hover actions Adds to timeline
[job] [logs] Security Solution Tests #3 / Hover actions Adds to timeline

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	3875	3876	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	9.2MB	9.2MB	+762.0B

History

💚 Build #127696 succeeded b5924eb
💔 Build #127506 failed 5843babf851730a2cfc203d3cfa03429c120798c
💛 Build #127394 was flaky cedfde0ba1e02871e23a834a3952f6af12040f64
💔 Build #127376 failed b7dea3daebabe85814a0a695cb008f9af979ee2c

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @machadoum

machadoum · 2023-05-16T08:13:24Z

I am moving this PR to #157834

…7243 (#157834) issue: #150347 ## Context Some Actions need to access `FieldSpec` data, which is not present on the `CellActions` API (`subType`and `isMapped`). So we are updating the `CellActions` `field` property to be compatible with `FieldSpec`. ## Summary This PR is the first step to fix #150347. * Updates the `CellActions` to support an array of data objects, each containing field (`FieldSpec`) and value * Create a new `SecurityCellActions` component that accepts a field name and loads `FieldSpec` from the Dataview. ## Examples Before: ```tsx <SecurityCellActions value={'admin'} field={{ name: 'user.name', type: 'keyword', searchable: true, aggregatable: true, ... }} /> ``` After: ```tsx <SecurityCellActions data={{ field: 'user.name', value: 'admin' }}/> ``` `SecurityCellActions` will load the spec from the Dataview and provide it to `CellActons`. `CellActons` now also support an of fields instead of only one field. It will be useful when rendering cell actions for aggregated data like on the Entity Analytic page. But for now, the actions are not supporting multiple values, we need to rewrite them #159480. ### Next steps We must refactor the Security Solution to get `FieldSpec` from the `DataView` instead of using BrowserFields. Ideally, we have to do that for every `CellAction` call so the actions can access the `subType` property. - [x] ~Refactor the Security Solution CellActions calls to get `FieldSpec` from the `DataView`~ - [x] Refactor data grid cell actions to get `FieldSpec` from the `DataView` - [ ] Rewrite actions to support multiple fields and use them on the investigation in timeline (.andFilters) - [ ] Fix #150347 using `subType` from `fieldSpec` - [ ] Fix #154714 using `isMapped` from `fieldSpec` ### Extra information *** Previously we were mixing `esTypes` and `kbnTypes`. For example, if the `esType` is a keyword the `kbnType` has to be a `string`. [Here](https://github.com/machadoum/kibana/blob/9799dbba27c5baf594357eae0bbfc79b4e7da77c/packages/kbn-field-types/src/types.ts#L22) you can check all possible ES and KBN types and [here](https://github.com/machadoum/kibana/blob/9799dbba27c5baf594357eae0bbfc79b4e7da77c/packages/kbn-field-types/src/kbn_field_types_factory.ts) you can see the mapping between esType and kbnType ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

machadoum force-pushed the siem-explore-cell-actions-150347 branch from a3c227b to 3fea3f8 Compare May 10, 2023 11:35

machadoum changed the title ~~Siem explore cell actions 150347~~ [Security Solution] Update CellActions field type to be FieldSpec May 10, 2023

machadoum force-pushed the siem-explore-cell-actions-150347 branch 4 times, most recently from c5a273b to b7dea3d Compare May 12, 2023 11:17

machadoum self-assigned this May 12, 2023

machadoum commented May 12, 2023

View reviewed changes

machadoum added 9 commits May 15, 2023 11:01

wip

f23c8a5

wip2

c6c3795

Fix types and tests

c5022e6

Fix type

7bc856c

Add ts dependency

f34a53f

Fix types

f21ac0a

Fix test

7115723

Update SecurityCelActions calls to provite the right field types

ed142cd

Fix tests

b5924eb

machadoum force-pushed the siem-explore-cell-actions-150347 branch from 5843bab to b5924eb Compare May 15, 2023 09:01

machadoum marked this pull request as ready for review May 15, 2023 09:22

machadoum requested review from a team as code owners May 15, 2023 09:22

machadoum force-pushed the siem-explore-cell-actions-150347 branch from 730bbda to 5231efd Compare May 15, 2023 17:09

machadoum force-pushed the siem-explore-cell-actions-150347 branch from 5231efd to b5924eb Compare May 16, 2023 08:03

machadoum closed this May 16, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Update CellActions field type to be FieldSpec #157243

[Security Solution] Update CellActions field type to be FieldSpec #157243

machadoum commented May 10, 2023 •

edited

Loading

machadoum May 12, 2023 •

edited

Loading

semd May 15, 2023

elasticmachine commented May 15, 2023

elasticmachine commented May 15, 2023

kibana-ci commented May 15, 2023 •

edited

Loading

machadoum commented May 16, 2023

[Security Solution] Update CellActions field type to be FieldSpec #157243

[Security Solution] Update CellActions field type to be FieldSpec #157243

Conversation

machadoum commented May 10, 2023 • edited Loading

Context

Summary

Next steps

Checklist

machadoum May 12, 2023 • edited Loading

Choose a reason for hiding this comment

semd May 15, 2023

Choose a reason for hiding this comment

elasticmachine commented May 15, 2023

elasticmachine commented May 15, 2023

kibana-ci commented May 15, 2023 • edited Loading

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Async chunks

History

machadoum commented May 16, 2023

machadoum commented May 10, 2023 •

edited

Loading

machadoum May 12, 2023 •

edited

Loading

kibana-ci commented May 15, 2023 •

edited

Loading