[Security Solution] Added guided onboarding for the rules area #144016

xcrzx · 2022-10-26T11:06:40Z

Resolves: https://github.com/elastic/security-team/issues/5089

Related PR with other onboarding steps: #143598

Summary

Added Rules Area guided onboarding steps.

1. If no onboarding rules are installed - show the install rules tour step

We search for any prebuilt detection rules that have the "Guided Onboarding" tag on them. I there's no any, we will show the tour step. It works for both cases when the user has no rules at all or their rules are outdated. If the rules are already installed - skip to the next step.

2. If onboarding rules are installed - show the enable rule step

We check if any of the shipped onboarding rules are activated. If yes - skip to the end of the tour; otherwise, show the tour step. Once the user activates an onboarding rule, we automatically finish the current onboarding step.

Testing instructions

add feature flag to kibana.dev.yml: xpack.securitySolution.enableExperimental: ['guidedOnboarding']
Run kibana with examples: yarn start --run-examples
Go to /app/guidedOnboardingExample
Use the "Set guide state" section to set Guide to security and Step ID to rules
The Setup guide menu will automatically open. Hit the "Start" button
You will be redirected to the rules management page with tour steps active.

...ib/detection_engine/prebuilt_rules/content/prepackaged_rules/apm_403_response_to_a_post.json

stephmilovic · 2022-10-27T20:16:44Z

@elasticmachine merge upstream

kellyemurphy

Small change to the text in one of the tour screens, otherwise the copy LGTM

...tion/public/detection_engine/rule_management_ui/components/guided_onboarding/translations.ts

elasticmachine · 2022-10-28T16:01:34Z

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine · 2022-10-28T16:01:35Z

Pinging @elastic/security-solution (Team: SecuritySolution)

This reverts commit 2bb0b7d.

maximpn

@xcrzx LGTM

The only thing which is unclear to me is why there are changes for "more detailed cache keys" in guided onboarding for the rules area.

kibana-ci · 2022-10-31T10:36:19Z

💚 Build Succeeded

Buildkite Build
Commit: 37bbf51

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	3267	3270	+3

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	9.6MB	9.6MB	+3.1KB

Unknown metric groups

ESLint disabled in files

id	before	after	diff
`osquery`	1	2	+1

ESLint disabled line counts

id	before	after	diff
`enterpriseSearch`	19	21	+2
`fleet`	57	63	+6
`osquery`	103	108	+5
`securitySolution`	439	443	+4
total			+17

Total ESLint disabled count

id	before	after	diff
`enterpriseSearch`	20	22	+2
`fleet`	65	71	+6
`osquery`	104	110	+6
`securitySolution`	516	520	+4
total			+18

History

💚 Build #83556 succeeded ddbb89f
💚 Build #83520 succeeded 0d2659d
💚 Build #83491 succeeded 2bb0b7d
💚 Build #83348 succeeded d6a3e54
💚 Build #83145 succeeded 5a5c3c3
💚 Build #83118 succeeded 7f73dad

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @xcrzx

xcrzx · 2022-10-31T10:43:30Z

The only thing which is unclear to me is why there are changes for "more detailed cache keys" in guided onboarding for the rules area.

@maximpn Initially, I was going to implement the tour logic based on cache invalidation. But it turned out to be not necessary. So I left the changes related to cache keys in this PR, which is a nice improvement disregarding the final implementation.

xcrzx · 2022-10-31T10:45:37Z

@gavinwye I've merged this PR, but feel free to leave any feedback here. I'll address it in a follow-up PR.

* main: Upgrade @elastic/makelogs from v6.0.0 to v6.1.1 (elastic#144231) [Files] move to src (elastic#144044) [Synthetics UI] Add pagination and date filtering to test runs table (elastic#144029) Update time range when opening timeline from Entity Analytics page (elastic#144024) [Security Solution] Added guided onboarding for the rules area (elastic#144016)

…area (#145223) **Related to: #144016 ## Summary This follow-up PR addresses guided onboarding feedback mentioned [here](elastic/security-team#5386) and [here](#144458). To summarize: - We're keeping the first step (install prebuilt rules) intact, but most users wouldn't see it as the rules are installed automatically during previous stages. This step is needed to cover edge cases when rules were deleted for some reason. - We're splitting the second step into two: 1) search the first rule and 2) activate it. - We're adding "Next" buttons to these steps. - For the search step, the "Next" button will automatically filter the rules table, so the first rule becomes visible. - For the activate step, the "Next" button automatically activates the first rule. - The "Next" button stays optional; we still automatically progress the guide once user actions satisfy certain conditions, like the user filtered the rules table manually or activated the first rule by clicking its toggle.

…area (elastic#145223) **Related to: elastic#144016 ## Summary This follow-up PR addresses guided onboarding feedback mentioned [here](elastic/security-team#5386) and [here](elastic#144458). To summarize: - We're keeping the first step (install prebuilt rules) intact, but most users wouldn't see it as the rules are installed automatically during previous stages. This step is needed to cover edge cases when rules were deleted for some reason. - We're splitting the second step into two: 1) search the first rule and 2) activate it. - We're adding "Next" buttons to these steps. - For the search step, the "Next" button will automatically filter the rules table, so the first rule becomes visible. - For the activate step, the "Next" button automatically activates the first rule. - The "Next" button stays optional; we still automatically progress the guide once user actions satisfy certain conditions, like the user filtered the rules table manually or activated the first rule by clicking its toggle.

xcrzx added release_note:enhancement Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team v8.6.0 labels Oct 26, 2022

xcrzx self-assigned this Oct 26, 2022

xcrzx commented Oct 26, 2022

View reviewed changes

...ib/detection_engine/prebuilt_rules/content/prepackaged_rules/apm_403_response_to_a_post.json Outdated Show resolved Hide resolved

stephmilovic mentioned this pull request Oct 26, 2022

[Security solution] Guided onboarding rules stephmilovic/kibana#6

Closed

xcrzx mentioned this pull request Oct 27, 2022

[Security Solution] Skip flaky tests #144089

Closed

xcrzx force-pushed the rules-guided-onboarding branch 3 times, most recently from 7f73dad to 5a5c3c3 Compare October 27, 2022 12:07

yuliacech requested a review from kellyemurphy October 27, 2022 12:48

kellyemurphy reviewed Oct 27, 2022

View reviewed changes

...tion/public/detection_engine/rule_management_ui/components/guided_onboarding/translations.ts Show resolved Hide resolved

xcrzx force-pushed the rules-guided-onboarding branch from 68bf5c7 to 2bb0b7d Compare October 28, 2022 11:31

xcrzx marked this pull request as ready for review October 28, 2022 16:01

xcrzx requested a review from a team as a code owner October 28, 2022 16:01

xcrzx requested a review from maximpn October 28, 2022 16:01

xcrzx and others added 3 commits October 31, 2022 10:27

Added guided onboarding for the rules area

b76263b

[Security solution] Guided onboarding rules (#1)

7fd258c

Revert "[Security solution] Guided onboarding rules (#1)"

37bbf51

This reverts commit 2bb0b7d.

xcrzx force-pushed the rules-guided-onboarding branch from ddbb89f to 37bbf51 Compare October 31, 2022 09:27

maximpn approved these changes Oct 31, 2022

View reviewed changes

maximpn mentioned this pull request Oct 31, 2022

[Security Solution] Simplify bulk action execution #143019

Closed

3 tasks

gavinwye self-requested a review October 31, 2022 10:12

xcrzx merged commit 7a3243b into elastic:main Oct 31, 2022

kibanamachine added the backport:skip This commit does not require backporting label Oct 31, 2022

xcrzx deleted the rules-guided-onboarding branch October 31, 2022 10:44

xcrzx mentioned this pull request Nov 15, 2022

[Security Solution] Address guided onboarding feedback for the rules area #145223

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Added guided onboarding for the rules area #144016

[Security Solution] Added guided onboarding for the rules area #144016

xcrzx commented Oct 26, 2022 •

edited

Loading

stephmilovic commented Oct 27, 2022

kellyemurphy left a comment

elasticmachine commented Oct 28, 2022

elasticmachine commented Oct 28, 2022

maximpn left a comment

kibana-ci commented Oct 31, 2022

ESLint disabled in files

ESLint disabled line counts

Total ESLint disabled count

xcrzx commented Oct 31, 2022

xcrzx commented Oct 31, 2022

[Security Solution] Added guided onboarding for the rules area #144016

[Security Solution] Added guided onboarding for the rules area #144016

Conversation

xcrzx commented Oct 26, 2022 • edited Loading

Summary

1. If no onboarding rules are installed - show the install rules tour step

2. If onboarding rules are installed - show the enable rule step

Testing instructions

stephmilovic commented Oct 27, 2022

kellyemurphy left a comment

Choose a reason for hiding this comment

elasticmachine commented Oct 28, 2022

elasticmachine commented Oct 28, 2022

maximpn left a comment

Choose a reason for hiding this comment

kibana-ci commented Oct 31, 2022

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

ESLint disabled in files

ESLint disabled line counts

Total ESLint disabled count

History

xcrzx commented Oct 31, 2022

xcrzx commented Oct 31, 2022

xcrzx commented Oct 26, 2022 •

edited

Loading