[Security Solution][Detection Engine] adds backend implementation for IM alert suppression #175032

vitaliidm · 2024-01-17T14:55:37Z

Summary

Summarize your PR. If it involves visual changes include a screenshot or gif.

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
Flaky Test Runner was used on any tests changed
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
This was checked for cross-browser compatibility

Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to identify risks that should be tested prior to the change/feature release.

When forming the risk matrix, consider some of the following examples and how they may potentially impact the change:

Risk	Probability	Severity	Mitigation/Notes
Multiple Spaces—unexpected behavior in non-default Kibana Space.	Low	High	Integration tests will verify that all features are still supported in non-default Kibana Space and when user switches between spaces.
Multiple nodes—Elasticsearch polling might have race conditions when multiple Kibana nodes are polling for the same tasks.	High	Low	Tasks are idempotent, so executing them multiple times will not result in logical error, but will degrade performance. To test for this case we add plenty of unit tests around this logic and document manual testing procedure.
Code should gracefully handle cases when feature X or plugin Y are disabled.	Medium	High	Unit tests will verify that any feature flag or plugin combination still results in our service operational.
See more potential risk examples

For maintainers

This was checked for breaking API changes and was labeled appropriately

…-im-ftr-tests

… IM alert suppression

…backend

vitaliidm · 2024-01-17T14:56:45Z

/ci

…-fix'

…/kibana into suppression/im-backend # Conflicts: # x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/utils/search_after_bulk_create_suppressed_alerts.ts

vitaliidm · 2024-01-17T19:46:18Z

/ci

vitaliidm · 2024-01-18T17:11:06Z

/ci

…backend

vitaliidm · 2024-01-22T18:44:41Z

/ci

…/kibana into suppression/im-backend

vitaliidm · 2024-01-25T14:30:24Z

/ci

vitaliidm · 2024-01-25T18:55:31Z

/ci

vitaliidm · 2024-01-26T08:55:33Z

/ci

vitaliidm · 2024-01-26T10:24:27Z

/ci

…backend # Conflicts: # x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/trial_license_complete_tier/execution_logic/indicator_match_alert_suppression.ts

vitaliidm · 2024-01-26T13:04:20Z

/ci

vitaliidm · 2024-01-26T17:23:55Z

/ci

kibana-ci · 2024-01-26T17:33:29Z

💔 Build Failed

Failed CI Steps

Test Failures

[job] [logs] Defend Workflows Cypress Tests #5 / Automated Response Actions From alerts "before all" hook for "should have generated endpoint and rule" "before all" hook for "should have generated endpoint and rule"
[job] [logs] Defend Workflows Cypress Tests #5 / Automated Response Actions From alerts "before all" hook for "should have generated endpoint and rule" "before all" hook for "should have generated endpoint and rule"
[job] [logs] Defend Workflows Cypress Tests #14 / Document signing: "before all" hook for "should fail if data tampered" "before all" hook for "should fail if data tampered"
[job] [logs] Defend Workflows Cypress Tests #14 / Document signing: "before all" hook for "should fail if data tampered" "before all" hook for "should fail if data tampered"
[job] [logs] Defend Workflows Cypress Tests on Serverless #1 / Endpoint generated alerts "before each" hook for "should create a Detection Engine alert from an endpoint alert" "before each" hook for "should create a Detection Engine alert from an endpoint alert"
[job] [logs] Defend Workflows Cypress Tests on Serverless #1 / Endpoint generated alerts "before each" hook for "should create a Detection Engine alert from an endpoint alert" "before each" hook for "should create a Detection Engine alert from an endpoint alert"
[job] [logs] Defend Workflows Cypress Tests #3 / Response console Execute operations: "before all" hook for ""execute --command" - should execute a command" "before all" hook for ""execute --command" - should execute a command"
[job] [logs] Defend Workflows Cypress Tests on Serverless #3 / Response console Execute operations: "before all" hook for ""execute --command" - should execute a command" "before all" hook for ""execute --command" - should execute a command"
[job] [logs] Defend Workflows Cypress Tests on Serverless #3 / Response console Execute operations: "before all" hook for ""execute --command" - should execute a command" "before all" hook for ""execute --command" - should execute a command"
[job] [logs] Defend Workflows Cypress Tests #3 / Response console Execute operations: "before all" hook for ""execute --command" - should execute a command" "before all" hook for ""execute --command" - should execute a command"
[job] [logs] Defend Workflows Cypress Tests #4 / Response console File operations: "before all" hook for ""get-file --path" - should retrieve a file" "before all" hook for ""get-file --path" - should retrieve a file"
[job] [logs] Defend Workflows Cypress Tests #4 / Response console File operations: "before all" hook for ""get-file --path" - should retrieve a file" "before all" hook for ""get-file --path" - should retrieve a file"
[job] [logs] Defend Workflows Cypress Tests #15 / Response console From endpoint list "before all" hook for "should open responder" "before all" hook for "should open responder"
[job] [logs] Defend Workflows Cypress Tests #15 / Response console From endpoint list "before all" hook for "should open responder" "before all" hook for "should open responder"
[job] [logs] Defend Workflows Cypress Tests #5 / Response console Host Isolation: "before all" hook for "should isolate a host from response console" "before all" hook for "should isolate a host from response console"
[job] [logs] Defend Workflows Cypress Tests #5 / Response console Host Isolation: "before all" hook for "should isolate a host from response console" "before all" hook for "should isolate a host from response console"
[job] [logs] Defend Workflows Cypress Tests #7 / Response console Host Isolation: "before all" hook for "should release an isolated host via response console" "before all" hook for "should release an isolated host via response console"
[job] [logs] Defend Workflows Cypress Tests on Serverless #1 / Response console Host Isolation: "before all" hook for "should release an isolated host via response console" "before all" hook for "should release an isolated host via response console"
[job] [logs] Defend Workflows Cypress Tests #7 / Response console Host Isolation: "before all" hook for "should release an isolated host via response console" "before all" hook for "should release an isolated host via response console"
[job] [logs] Defend Workflows Cypress Tests on Serverless #1 / Response console Host Isolation: "before all" hook for "should release an isolated host via response console" "before all" hook for "should release an isolated host via response console"
[job] [logs] Defend Workflows Cypress Tests #6 / Response console Processes operations: "before all" hook for ""processes" - should obtain a list of processes" "before all" hook for ""processes" - should obtain a list of processes"
[job] [logs] Defend Workflows Cypress Tests on Serverless #6 / Response console Processes operations: "before all" hook for ""processes" - should obtain a list of processes" "before all" hook for ""processes" - should obtain a list of processes"
[job] [logs] Defend Workflows Cypress Tests #6 / Response console Processes operations: "before all" hook for ""processes" - should obtain a list of processes" "before all" hook for ""processes" - should obtain a list of processes"
[job] [logs] Defend Workflows Cypress Tests on Serverless #6 / Response console Processes operations: "before all" hook for ""processes" - should obtain a list of processes" "before all" hook for ""processes" - should obtain a list of processes"
[job] [logs] Defend Workflows Cypress Tests #13 / Response console: From Alerts "before all" hook for "should open responder from alert details flyout" "before all" hook for "should open responder from alert details flyout"
[job] [logs] Defend Workflows Cypress Tests #13 / Response console: From Alerts "before all" hook for "should open responder from alert details flyout" "before all" hook for "should open responder from alert details flyout"
[job] [logs] Defend Workflows Cypress Tests #5 / Unenroll agent from fleet changing agent policy when agent tamper protection is enabled but then is switched to a policy with it also enabled "before each" hook for "should unenroll from fleet without issues" "before each" hook for "should unenroll from fleet without issues"
[job] [logs] Defend Workflows Cypress Tests #5 / Unenroll agent from fleet changing agent policy when agent tamper protection is enabled but then is switched to a policy with it also enabled "before each" hook for "should unenroll from fleet without issues" "before each" hook for "should unenroll from fleet without issues"
[job] [logs] Defend Workflows Cypress Tests #4 / Unenroll agent from fleet changing when agent tamper protection is enabled but then is switched to a policy with it disabled "before each" hook for "should unenroll from fleet without issues" "before each" hook for "should unenroll from fleet without issues"
[job] [logs] Defend Workflows Cypress Tests #4 / Unenroll agent from fleet changing when agent tamper protection is enabled but then is switched to a policy with it disabled "before each" hook for "should unenroll from fleet without issues" "before each" hook for "should unenroll from fleet without issues"
[job] [logs] Defend Workflows Cypress Tests #3 / Unenroll agent from fleet when agent tamper protection is disabled but then is switched to a policy with it enabled "before each" hook for "should unenroll from fleet without issues" "before each" hook for "should unenroll from fleet without issues"
[job] [logs] Defend Workflows Cypress Tests #3 / Unenroll agent from fleet when agent tamper protection is disabled but then is switched to a policy with it enabled "before each" hook for "should unenroll from fleet without issues" "before each" hook for "should unenroll from fleet without issues"
[job] [logs] Defend Workflows Cypress Tests #15 / Unenroll agent from fleet with agent tamper protection is disabled "before each" hook for "should unenroll from fleet without issues" "before each" hook for "should unenroll from fleet without issues"
[job] [logs] Defend Workflows Cypress Tests #15 / Unenroll agent from fleet with agent tamper protection is disabled "before each" hook for "should unenroll from fleet without issues" "before each" hook for "should unenroll from fleet without issues"
[job] [logs] Defend Workflows Cypress Tests #6 / Uninstall agent from host changing agent policy when agent tamper protection is disabled but then is switched to a policy with it enabled "before each" hook for "should uninstall from host without issues" "before each" hook for "should uninstall from host without issues"
[job] [logs] Defend Workflows Cypress Tests #6 / Uninstall agent from host changing agent policy when agent tamper protection is disabled but then is switched to a policy with it enabled "before each" hook for "should uninstall from host without issues" "before each" hook for "should uninstall from host without issues"
[job] [logs] Defend Workflows Cypress Tests #8 / Uninstall agent from host changing agent policy when agent tamper protection is enabled but then is switched to a policy with it also enabled "before each" hook for "should uninstall from host without issues" "before each" hook for "should uninstall from host without issues"
[job] [logs] Defend Workflows Cypress Tests #8 / Uninstall agent from host changing agent policy when agent tamper protection is enabled but then is switched to a policy with it also enabled "before each" hook for "should uninstall from host without issues" "before each" hook for "should uninstall from host without issues"
[job] [logs] Defend Workflows Cypress Tests #7 / Uninstall agent from host changing agent policy when agent tamper protection is enabled but then is switched to a policy with it disabled "before each" hook for "should uninstall from host without issues" "before each" hook for "should uninstall from host without issues"
[job] [logs] Defend Workflows Cypress Tests #7 / Uninstall agent from host changing agent policy when agent tamper protection is enabled but then is switched to a policy with it disabled "before each" hook for "should uninstall from host without issues" "before each" hook for "should uninstall from host without issues"
[job] [logs] Defend Workflows Cypress Tests #16 / Uninstall agent from host when agent tamper protection is disabled "before each" hook for "should uninstall from host without issues" "before each" hook for "should uninstall from host without issues"
[job] [logs] Defend Workflows Cypress Tests #16 / Uninstall agent from host when agent tamper protection is disabled "before each" hook for "should uninstall from host without issues" "before each" hook for "should uninstall from host without issues"
[job] [logs] Defend Workflows Cypress Tests #2 / Uninstall agent from host when agent tamper protection is enabled "before each" hook for "should uninstall from host with the uninstall token" "before each" hook for "should uninstall from host with the uninstall token"
[job] [logs] Defend Workflows Cypress Tests #2 / Uninstall agent from host when agent tamper protection is enabled "before each" hook for "should uninstall from host with the uninstall token" "before each" hook for "should uninstall from host with the uninstall token"

History

💛 Build #189576 was flaky 2f08c53
💔 Build #189548 failed 2e33138
💔 Build #189525 failed 95aa197
💔 Build #189429 failed 002c564

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @vitaliidm

vitaliidm added 13 commits January 10, 2024 12:07

initial commit

c5586d0

cover code branches

55c8262

Merge branch 'security/alert-suppression-im-eql' into suppression/add…

ff21f56

…-im-ftr-tests

Update mappings.json

7623305

Update mappings.json

42cd3b7

deduplication test

3dfd64c

Update indicator_match_alert_suppression.ts

52392c5

Merge branch 'security/alert-suppression-im-eql' into suppression/add…

c1f22b5

…-im-ftr-tests

Update indicator_match_alert_suppression.ts

672978b

Merge branch 'security/alert-suppression-im-eql' into suppression/add…

ea0426b

…-im-ftr-tests

Merge branch 'security/alert-suppression-im-eql' into suppression/add…

52d4517

…-im-ftr-tests

[Security Solution][Detection Engine] adds backend implementation for…

6287048

… IM alert suppression

Merge branch 'security/alert-suppression-im-eql' into suppression/im-…

eecd793

…backend

vitaliidm requested a review from WafaaNasr January 17, 2024 14:56

vitaliidm self-assigned this Jan 17, 2024

kibanamachine and others added 4 commits January 17, 2024 15:25

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

c076394

…-fix'

fix tests

938a69f

Merge branch 'suppression/im-backend' of https://github.com/vitaliidm…

d5bb020

…/kibana into suppression/im-backend # Conflicts: # x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/utils/search_after_bulk_create_suppressed_alerts.ts

remove .only

19096a7

vitaliidm added 3 commits January 18, 2024 11:30

fix typos

5ed5e53

push array tests

78597d9

implement second code execution branch

892c579

vitaliidm added 2 commits January 22, 2024 18:44

add license && FF checks

14302ba

Merge branch 'security/alert-suppression-im-eql' into suppression/im-…

60be017

…backend

vitaliidm added 2 commits January 23, 2024 19:01

suppressed alerts count

3482ff6

Merge branch 'suppression/im-backend' of https://github.com/vitaliidm…

7a337d5

…/kibana into suppression/im-backend

fixe more corner cases

d346dcf

vitaliidm added 3 commits January 25, 2024 16:35

fix serverless rule executions

debf162

fix even more corner cases

240b52e

fix 9,000 case

002c564

remove .only

95aa197

fix broken tests

2e33138

vitaliidm force-pushed the suppression/im-backend branch from 9c44daa to 2e33138 Compare January 26, 2024 10:24

vitaliidm added 3 commits January 26, 2024 10:52

fix corner cases

f944321

fixes

0852428

refactor search after

7af14cf

add tests

bd1b891

vitaliidm marked this pull request as ready for review January 26, 2024 18:31

vitaliidm requested review from a team as code owners January 26, 2024 18:31

vitaliidm removed request for a team and WafaaNasr January 26, 2024 18:31

vitaliidm merged commit a7a4281 into elastic:security/alert-suppression-im-eql Jan 26, 2024
4 of 5 checks passed

vitaliidm deleted the suppression/im-backend branch March 4, 2024 17:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Detection Engine] adds backend implementation for IM alert suppression #175032

[Security Solution][Detection Engine] adds backend implementation for IM alert suppression #175032

vitaliidm commented Jan 17, 2024

vitaliidm commented Jan 17, 2024

vitaliidm commented Jan 17, 2024

vitaliidm commented Jan 18, 2024

vitaliidm commented Jan 22, 2024

vitaliidm commented Jan 25, 2024

vitaliidm commented Jan 25, 2024

vitaliidm commented Jan 26, 2024

vitaliidm commented Jan 26, 2024

vitaliidm commented Jan 26, 2024

vitaliidm commented Jan 26, 2024

kibana-ci commented Jan 26, 2024 •

edited

Loading

[Security Solution][Detection Engine] adds backend implementation for IM alert suppression #175032

[Security Solution][Detection Engine] adds backend implementation for IM alert suppression #175032

Conversation

vitaliidm commented Jan 17, 2024

Summary

Checklist

Risk Matrix

For maintainers

vitaliidm commented Jan 17, 2024

vitaliidm commented Jan 17, 2024

vitaliidm commented Jan 18, 2024

vitaliidm commented Jan 22, 2024

vitaliidm commented Jan 25, 2024

vitaliidm commented Jan 25, 2024

vitaliidm commented Jan 26, 2024

vitaliidm commented Jan 26, 2024

vitaliidm commented Jan 26, 2024

vitaliidm commented Jan 26, 2024

kibana-ci commented Jan 26, 2024 • edited Loading

💔 Build Failed

Failed CI Steps

Test Failures

History

kibana-ci commented Jan 26, 2024 •

edited

Loading