Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] [Cases] Move field mappings from actions to cases #84587

Merged
merged 87 commits into from
Dec 15, 2020

Conversation

stephmilovic
Copy link
Contributor

@stephmilovic stephmilovic commented Nov 30, 2020

Summary

Moves field mappings for case connectors (servicenow, jira, resilient) out of actions and into cases. Specifically:

  1. Remove incidentConfiguration and isCaseOwned from the config schema in each connector
  2. Create a migration which removes the incidentConfiguration and isCaseOwned from each action savedObject.
  3. Remove field transformation, comment transformation, and mapping logic. The logic is moved to cases. Cases now sends the fields already transformed to the actions.
  4. Clean up entity information from fields and comments.
  5. Remove all files but common types.ts from within the cases folder inside built in actions.
  6. Creates a new saved object to manage case mappings, cases-connector-mappings
  7. Remove mappings from actions ui and create static mappings component in security_solution (shown in gif below)
  8. Remove the builtin_action_types/case_mappings folder.

Part 3 of 3 in dynamic mappings coming soon, then thorough testing.

fff

Checklist

Delete any items that are not applicable to this PR.

// eslint-disable-next-line react-hooks/exhaustive-deps
}, []);
}, [actionParams]);
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

need to run editAction with subActionParams on mount in order to run error validation, but setting both with deps of [] creates a race condition and only one gets set. by checking for undefined values whenever the actionParams change, we can overcome the race condition

@cnasikas
Copy link
Member

@elasticmachine merge upstream

@kibanamachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 2135 2138 +3
triggersActionsUi 309 302 -7
total -4

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 8.3MB 8.3MB +10.9KB
triggersActionsUi 1.6MB 1.5MB -78.9KB
total -68.0KB

Distributable file count

id before after diff
default 47227 47991 +764

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
securitySolution 245.3KB 241.4KB -3.9KB
triggersActionsUi 161.7KB 161.4KB -273.0B
total -4.1KB

Saved Objects .kibana field count

Every field in each saved object type adds overhead to Elasticsearch. Kibana needs to keep the total field count below Elasticsearch's default limit of 1000 fields. Only specify field mappings for the fields you wish to search on or query. See https://www.elastic.co/guide/en/kibana/master/development-plugin-saved-objects.html#_mappings

id before after diff
cases-connector-mappings - 5 +5

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@stephmilovic stephmilovic merged commit 335cd1f into elastic:master Dec 15, 2020
stephmilovic added a commit that referenced this pull request Dec 15, 2020
…#84587) (#85957)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
stephmilovic added a commit to stephmilovic/kibana that referenced this pull request Dec 18, 2020
stephmilovic added a commit to stephmilovic/kibana that referenced this pull request Dec 18, 2020
@cnasikas cnasikas added the release_note:plugin_api_changes Contains a Plugin API changes section for the breaking plugin API changes section. label Jan 12, 2021
});
};

export const transformFields = <
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here @elastic/security-threat-hunting is the start of the migration we didn't catch

@@ -128,23 +72,13 @@ const pushToServiceHandler = async ({
});
} else {
res = await externalService.createIncident({
incident: {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is the start of the missed migration @elastic/security-threat-hunting

comments = transformComments(caseComments, ['informationAdded']);
}
}
return { incident, comments };
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is (part) of the end of the missed migration @elastic/security-threat-hunting

} = params as JiraPushToServiceApiParams['incident'];
return {
incident: { priority, labels, issueType, parent },
thirdPartyName: 'Jira',
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is (part) of the end of the missed migration @elastic/security-threat-hunting

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature:Cases Cases feature release_note:plugin_api_changes Contains a Plugin API changes section for the breaking plugin API changes section. release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting Security Solution Threat Hunting Team v7.11.0 v8.0.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants