[SECURITY SOLUTION] Eql in timeline

[XavierM]

Summary

Timeline can support EQL query.

Checklist

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[andrew-goldstein]

consider changing this to

import { isEmpty } from 'lodash/fp';

for consistency with other imports of isEmpty

[XavierM]

Kibana wants us to use lodash directly

[andrew-goldstein]

consider changing this to

import { isEmpty, isEqual } from 'lodash/fp';

[andrew-goldstein]

I can tab through all the elements on the page when in the Query tab, but I can't tab past the events table on the Correlation tab. I'm wondering if we need to update the onTimelineTabKeyPressed function, or one of the helpers invoked by it.

[andrew-goldstein]

The event count badge on the Correlation tab doesn't appear to be reset when a new timeline is created:

[andrew-goldstein]

Per the following screenshot, when a case is created from a Resolver view, additional URL state is included to re-open the Resolver view when users click the rule from a case:

Consider appending the active tab to the URL state such that when users click on a timeline link from a case, timeline opens the Correlation tab, because the Query tab will likely be empty when the timeline is opened, which may be confusing.

[XavierM]

Would you be willing to confirm that the 200 results shown in the screenshot below is the expected behavior because size is a multiplier that's applied to each instance of a [ ] in the EQL syntax?

I'm 99% sure this is the intended behavior, and experimentally, when I add a third event.category, registry in the example below:

sequence
  [ file where file.extension == "exe" ]
  [ process where true ]
  [ registry where true ]

i get 300 results, so I think it's working as intended.

Yes it is working as expected

[XavierM]

The event count badge on the Correlation tab doesn't appear to be reset when a new timeline is created:

I can not reproduce it

[andrew-goldstein]

Thanks for this milestone PR @XavierM! 🎉
LGTM 🚀

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: c888f33

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	2197	2203	+6

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	7.6MB	7.7MB	+91.3KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
securitySolution	237.2KB	237.4KB	+168.0B

Saved Objects .kibana field count

Every field in each saved object type adds overhead to Elasticsearch. Kibana needs to keep the total field count below Elasticsearch's default limit of 1000 fields. Only specify field mappings for the fields you wish to search on or query. See https://www.elastic.co/guide/en/kibana/master/development-plugin-saved-objects.html#_mappings

id	before	after	diff
siem-ui-timeline	91	97	+6

Unknown metric groups

async chunk count

id	before	after	diff
securitySolution	24	25	+1

History

• 💚 Build #106539 succeeded 3f7b62e
• 💔 Build #106516 failed 70d6e55
• 💔 Build #106391 failed ab8f02e
• 💔 Build #106388 failed 4c42158
• 💔 Build #105465 failed 909941f

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream