Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] [Detections] EQL Rule Creation #76831

Merged
merged 17 commits into from
Sep 15, 2020

Commits on Sep 4, 2020

  1. Configuration menu
    Copy the full SHA
    cce81d4 View commit details
    Browse the repository at this point in the history
  2. Render our field components with React.createElement

    Without this, we get some bad behaviors:
    * Cannot use React.memo'd components
    * Cannot switch between UseField components (causes a "change in the
      order of hooks" error from React)
    rylnd committed Sep 4, 2020
    Configuration menu
    Copy the full SHA
    9d5ce1c View commit details
    Browse the repository at this point in the history
  3. WIP: EQL Rules can be created

    WIP because: they're probably not treated well in the UI, and they're certainly not
    going to execute properly, and there are no tests.
    rylnd committed Sep 4, 2020
    Configuration menu
    Copy the full SHA
    3e1a793 View commit details
    Browse the repository at this point in the history

Commits on Sep 8, 2020

  1. Configuration menu
    Copy the full SHA
    f71af23 View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    2314ba3 View commit details
    Browse the repository at this point in the history

Commits on Sep 9, 2020

  1. Add unit tests for new EQL query input component

    It's mostly just a glorified textarea for now.
    rylnd committed Sep 9, 2020
    Configuration menu
    Copy the full SHA
    e162d53 View commit details
    Browse the repository at this point in the history
  2. Add integration test for EQL Rule creation

    * Does not assert the query language, as that is not displayed on Rule
      Details
    * Does not exercise rule execution
    rylnd committed Sep 9, 2020
    Configuration menu
    Copy the full SHA
    872bbe6 View commit details
    Browse the repository at this point in the history
  3. Use predicate helper

    rylnd committed Sep 9, 2020
    Configuration menu
    Copy the full SHA
    3a47b2f View commit details
    Browse the repository at this point in the history
  4. Throw an error if an EQL Rule is executed

    This is to prevent undefined behavior until EQL execution is
    implemented.
    rylnd committed Sep 9, 2020
    Configuration menu
    Copy the full SHA
    1611b52 View commit details
    Browse the repository at this point in the history
  5. Fix failing tests

    I changed the default value for the form field mock from an array to a
    string; this fixes the few tests that were relying on it being an array.
    rylnd committed Sep 9, 2020
    Configuration menu
    Copy the full SHA
    8d88dcb View commit details
    Browse the repository at this point in the history
  6. Audit our rule statements/switches

    I made a pass through our treatment of RuleType to verify that EQL rules
    would be treated appropriately. Since the default/fallthrough case is
    typically the Query rule, and since this rule has the same
    attributes/behavior as the new EQL rule, not much had to change here.
    
    I converted a few if statements to exhaustive switches where possible,
    and used predicate helpers in places where it was not.
    rylnd committed Sep 9, 2020
    Configuration menu
    Copy the full SHA
    c85ffcf View commit details
    Browse the repository at this point in the history
  7. Merge branch 'master' into eql_rules_creation

    * master: (38 commits)
      Reporting/Test: unskip non-screenshot tests (elastic#77088)
      Move metrics to setup and add cgroup metrics (elastic#76730)
      [Enterprise Search] Add Overview landing page/plugin (elastic#76734)
      First pass. Change TS type. Update OpenAPI (elastic#76434)
      [CI] Balance xpack ci groups a bit (elastic#77068)
      [Security_solution][Detections] Refactor signal ancestry to allow multiple parents (elastic#76531)
      [Maps] convert MetricsEditor to TS (elastic#76727)
      IndexMigrator: fix non blocking migration wrapper promise rejection (elastic#77018)
      [Enterprise Search] Update config data endpoint to v2 (elastic#76970)
      [ML] Add decision path charts to exploration results table (elastic#73561)
      Bump eventemitter3 from 4.0.0 to 4.0.7 (elastic#77016)
      [Ingest Pipelines] Add descriptions for ingest processors K-S (elastic#76981)
      [Metrics UI] Replace Snapshot API with Metrics API (elastic#76253)
      legacy utils cleanup (elastic#76608)
      [ML] Account for "properties" layer in find_file_structure mappings (elastic#77035)
      fixed typo
      Upgrade to Kea 2.2 (elastic#77047)
      a11y tests on spaces home page including feature control  (elastic#76515)
      [ML] Transforms list: persist pagination through refresh interval (elastic#76786)
      [ML] Replace all use of date_histogram interval with fixed_interval (elastic#76876)
      ...
    rylnd committed Sep 9, 2020
    Configuration menu
    Copy the full SHA
    5094b04 View commit details
    Browse the repository at this point in the history

Commits on Sep 10, 2020

  1. Add tests around use of custom components with UseField

    There was an issue previously where memoized components would not work;
    these are primarily regression tests covering that use case.
    rylnd committed Sep 10, 2020
    Configuration menu
    Copy the full SHA
    a9a6703 View commit details
    Browse the repository at this point in the history
  2. Fix typo

    rylnd committed Sep 10, 2020
    Configuration menu
    Copy the full SHA
    ef64b1f View commit details
    Browse the repository at this point in the history

Commits on Sep 14, 2020

  1. Configuration menu
    Copy the full SHA
    3759011 View commit details
    Browse the repository at this point in the history
  2. Add keys to UseField to ensure unmount

    When swapping between the Custom Query and EQL rule types, we want to
    ensure that the corresponding input component coming from UseField fully
    unmounts and remounts with the new component.
    rylnd committed Sep 14, 2020
    Configuration menu
    Copy the full SHA
    35b00cd View commit details
    Browse the repository at this point in the history

Commits on Sep 15, 2020

  1. Configuration menu
    Copy the full SHA
    b9b590b View commit details
    Browse the repository at this point in the history