Skip to content

Commit

Permalink
[Security Solution] [Attack discovery] Removes Alerts filtering featu…
Browse files Browse the repository at this point in the history
…re flag (elastic#209851)

### [Security Solution] [Attack discovery] Removes Alerts filtering feature flag

This PR removes the feature flag for the Attack discovery _Alerts filtering_ feature, introduced in <elastic#205070>.

The `Attack discovery settings` flyout shown in the gif below is now available for all Attack discovery users when they click the settings gear:

![00_alerts_filtering](https://github.com/user-attachments/assets/1a81413b-b8f4-4965-a006-25fb529668a6)

#### Details

This PR _removes_ the `attackDiscoveryAlertFiltering` feature flag, which was configured via the following setting in kibana.dev.yml:

```yaml
xpack.securitySolution.enableExperimental:
  - 'attackDiscoveryAlertFiltering'
```

#### Desk testing

1. Ensure the `attackDiscoveryAlertFiltering` feature flag is present in `kibana.dev.yml`:

```yaml
xpack.securitySolution.enableExperimental:
  - 'attackDiscoveryAlertFiltering'
```

2. Start Kibana server and observe the startup logs

**Expected result**

- A warning that the `attackDiscoveryAlertFiltering` flag is no longer supported is logged:

```
[2025-02-05T11:24:31.612-05:00][WARN ][plugins.securitySolution.config] Unsupported "xpack.securitySolution.enableExperimental" values detected.
The following configuration values are no longer supported and should be removed from the kibana configuration file:

    xpack.securitySolution.enableExperimental:
      - attackDiscoveryAlertFiltering
```

3. Remove the `attackDiscoveryAlertFiltering` feature flag from `kibana.dev.yml`

4. Restart Kibana server and once again observe the startup logs

**Expected result**

- The warning displayed in step 2 is NOT logged

5. Navigate to Security > Attack discovery

6. Click the `Settings` gear

**Expected result**

- The `Attack discovery settings` flyout shown in the PR description above appears
  • Loading branch information
andrew-goldstein authored Feb 20, 2025
1 parent ad9baa6 commit 42d2464
Show file tree
Hide file tree
Showing 25 changed files with 58 additions and 816 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,5 @@ export type AssistantFeatureKey = keyof AssistantFeatures;
export const defaultAssistantFeatures = Object.freeze({
assistantModelEvaluation: false,
defendInsights: true,
attackDiscoveryAlertFiltering: false,
contentReferencesEnabled: false,
});
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ import { z } from '@kbn/zod';
export type GetCapabilitiesResponse = z.infer<typeof GetCapabilitiesResponse>;
export const GetCapabilitiesResponse = z.object({
assistantModelEvaluation: z.boolean(),
attackDiscoveryAlertFiltering: z.boolean(),
contentReferencesEnabled: z.boolean(),
defendInsights: z.boolean(),
});
Original file line number Diff line number Diff line change
Expand Up @@ -22,15 +22,12 @@ paths:
properties:
assistantModelEvaluation:
type: boolean
attackDiscoveryAlertFiltering:
type: boolean
contentReferencesEnabled:
type: boolean
defendInsights:
type: boolean
required:
- assistantModelEvaluation
- attackDiscoveryAlertFiltering
- contentReferencesEnabled
- defendInsights
'400':
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -34217,16 +34217,6 @@
"xpack.securitySolution.attackDiscovery.pages.pageTitle.statusConnectors": "Vous avez {newDiscoveriesCount} {newDiscoveriesCount, plural, =1 {nouvelle découverte} other {nouvelles découvertes}} à travers {newConnectorResultsCount} {newConnectorResultsCount, plural, =1 {connecteur} other {connecteurs}} à examiner.",
"xpack.securitySolution.attackDiscovery.pages.welcome.firstSetUpLabel": "Tout d’abord, configurez un connecteur d’IA générative.",
"xpack.securitySolution.attackDiscovery.pages.welcome.welcomeToAttackDiscoveryLabel": "Bienvenue sur Attack discovery !",
"xpack.securitySolution.attackDiscovery.settingsModal.alertsLabel": "Alertes",
"xpack.securitySolution.attackDiscovery.settingsModal.attackDiscoverySendsMoreAlertsTourText": "La découverte d'attaques envoie davantage d'alertes en tant que contexte.",
"xpack.securitySolution.attackDiscovery.settingsModal.cancelButton": "Annuler",
"xpack.securitySolution.attackDiscovery.settingsModal.configureYourSettingsHereTourText": "Configurez vos paramètres ici.",
"xpack.securitySolution.attackDiscovery.settingsModal.latestAndRiskiestOpenAlertsLabel": "Envoyez à Attack discovery des informations sur vos {alertsCount} alertes ouvertes ou confirmées les plus récentes et les plus risquées.",
"xpack.securitySolution.attackDiscovery.settingsModal.resetLabel": "Réinitialiser",
"xpack.securitySolution.attackDiscovery.settingsModal.saveButton": "Enregistrer",
"xpack.securitySolution.attackDiscovery.settingsModal.settingsLabel": "Paramètres",
"xpack.securitySolution.attackDiscovery.settingsModal.tourSubtitle": "Améliorations récentes de Attack Discovery",
"xpack.securitySolution.attackDiscovery.settingsModal.tourTitle": "Envoyer plus d'alertes",
"xpack.securitySolution.attackDiscovery.showAnonymizedLabel": "Afficher les anonymisés",
"xpack.securitySolution.attackDiscovery.showRealValuesLabel": "Afficher les valeurs réelles",
"xpack.securitySolution.attackDiscovery.summaryCount.alertsLabel": "{alertsCount} {alertsCount, plural, =1 {alerte} other {alertes}}",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -34079,16 +34079,6 @@
"xpack.securitySolution.attackDiscovery.pages.pageTitle.statusConnectors": "{newConnectorResultsCount} {newConnectorResultsCount, plural, other {コネクター}}全体で、表示する{newDiscoveriesCount}件の新しい{newDiscoveriesCount, plural, other {検出}}があります。",
"xpack.securitySolution.attackDiscovery.pages.welcome.firstSetUpLabel": "まず、生成AIコネクターを設定します。",
"xpack.securitySolution.attackDiscovery.pages.welcome.welcomeToAttackDiscoveryLabel": "Attack Discoveryへようこそ!",
"xpack.securitySolution.attackDiscovery.settingsModal.alertsLabel": "アラート",
"xpack.securitySolution.attackDiscovery.settingsModal.attackDiscoverySendsMoreAlertsTourText": "Attack discoveryはその他のアラートをコンテキストとして送信します。",
"xpack.securitySolution.attackDiscovery.settingsModal.cancelButton": "キャンセル",
"xpack.securitySolution.attackDiscovery.settingsModal.configureYourSettingsHereTourText": "ここで設定を構成します。",
"xpack.securitySolution.attackDiscovery.settingsModal.latestAndRiskiestOpenAlertsLabel": "{alertsCount}件の最新の最もリスクが高い未解決または確認済みのアラートに関するAttack discovery情報を送信します。",
"xpack.securitySolution.attackDiscovery.settingsModal.resetLabel": "リセット",
"xpack.securitySolution.attackDiscovery.settingsModal.saveButton": "保存",
"xpack.securitySolution.attackDiscovery.settingsModal.settingsLabel": "設定",
"xpack.securitySolution.attackDiscovery.settingsModal.tourSubtitle": "最近のAttack discoveryの改良",
"xpack.securitySolution.attackDiscovery.settingsModal.tourTitle": "その他のアラートを送信",
"xpack.securitySolution.attackDiscovery.showAnonymizedLabel": "匿名化して表示",
"xpack.securitySolution.attackDiscovery.showRealValuesLabel": "実際の値を表示",
"xpack.securitySolution.attackDiscovery.summaryCount.alertsLabel": "{alertsCount} {alertsCount, plural, other {件のアラート}}",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -33551,16 +33551,6 @@
"xpack.securitySolution.attackDiscovery.pages.pageTitle.statusConnectors": "您具有 {newDiscoveriesCount} 个新{newDiscoveriesCount, plural, other {发现}}可跨 {newConnectorResultsCount} 个{newConnectorResultsCount, plural, other {连接器}}查看。",
"xpack.securitySolution.attackDiscovery.pages.welcome.firstSetUpLabel": "首先设置生成式 AI 连接器。",
"xpack.securitySolution.attackDiscovery.pages.welcome.welcomeToAttackDiscoveryLabel": "欢迎使用 Attack Discovery!",
"xpack.securitySolution.attackDiscovery.settingsModal.alertsLabel": "告警",
"xpack.securitySolution.attackDiscovery.settingsModal.attackDiscoverySendsMoreAlertsTourText": "Attack Discovery 会发送更多告警作为上下文。",
"xpack.securitySolution.attackDiscovery.settingsModal.cancelButton": "取消",
"xpack.securitySolution.attackDiscovery.settingsModal.configureYourSettingsHereTourText": "在此配置您的设置。",
"xpack.securitySolution.attackDiscovery.settingsModal.latestAndRiskiestOpenAlertsLabel": "发送有关 {alertsCount} 个最新和风险最高的未决或已确认告警的 Attack Discovery 信息。",
"xpack.securitySolution.attackDiscovery.settingsModal.resetLabel": "重置",
"xpack.securitySolution.attackDiscovery.settingsModal.saveButton": "保存",
"xpack.securitySolution.attackDiscovery.settingsModal.settingsLabel": "设置",
"xpack.securitySolution.attackDiscovery.settingsModal.tourSubtitle": "最近的 Attack Discovery 改进",
"xpack.securitySolution.attackDiscovery.settingsModal.tourTitle": "发送更多告警",
"xpack.securitySolution.attackDiscovery.showAnonymizedLabel": "显示已匿名处理项",
"xpack.securitySolution.attackDiscovery.showRealValuesLabel": "显示实际值",
"xpack.securitySolution.attackDiscovery.summaryCount.alertsLabel": "{alertsCount} 个{alertsCount, plural, other {告警}}",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -114,11 +114,6 @@ export const allowedExperimentalValues = Object.freeze({
*/
assistantModelEvaluation: false,

/**
* Enables filtering of Attack Discovery alerts in a flyout
*/
attackDiscoveryAlertFiltering: false,

/**
* Enables content references (citations) in the AI Assistant
*/
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@
*/

import { DEFAULT_ATTACK_DISCOVERY_MAX_ALERTS } from '@kbn/elastic-assistant';
import { defaultAssistantFeatures } from '@kbn/elastic-assistant-common';
import { fireEvent, render, screen, waitFor } from '@testing-library/react';
import React from 'react';

Expand All @@ -16,18 +15,6 @@ import { Header } from '.';

jest.mock('../../../assistant/use_assistant_availability');

jest.mock('@kbn/elastic-assistant-common', () => {
const original = jest.requireActual('@kbn/elastic-assistant-common');

return {
...original,
defaultAssistantFeatures: {
...original.defaultAssistantFeatures,
attackDiscoveryAlertFiltering: jest.mocked<boolean>(false), // <-- feature flag is off by default
},
};
});

const defaultProps = {
stats: null,
connectorId: 'testConnectorId',
Expand All @@ -50,7 +37,6 @@ describe('Actions', () => {
});

jest.clearAllMocks();
(defaultAssistantFeatures.attackDiscoveryAlertFiltering as jest.Mocked<boolean>) = false; // reset feature flag to off
});

it('renders the connector selector', () => {
Expand Down Expand Up @@ -139,8 +125,7 @@ describe('Actions', () => {
expect(generate).toBeDisabled();
});

it('invokes openFlyout when the settings button is clicked, when the attackDiscoveryAlertFiltering feature flag is on', async () => {
(defaultAssistantFeatures.attackDiscoveryAlertFiltering as jest.Mocked<boolean>) = true;
it('invokes openFlyout when the settings button is clicked', async () => {
const openFlyout = jest.fn();

render(
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,11 @@ import {
useEuiTheme,
} from '@elastic/eui';
import { css } from '@emotion/react';
import { ConnectorSelectorInline, useAssistantContext } from '@kbn/elastic-assistant';
import { ConnectorSelectorInline } from '@kbn/elastic-assistant';
import type { AttackDiscoveryStats } from '@kbn/elastic-assistant-common';
import { noop } from 'lodash/fp';
import React, { useCallback, useEffect, useMemo, useState } from 'react';

import { SettingsModal } from './settings_modal';
import { StatusBell } from './status_bell';
import * as i18n from './translations';

Expand Down Expand Up @@ -51,10 +50,6 @@ const HeaderComponent: React.FC<Props> = ({
setLocalStorageAttackDiscoveryMaxAlerts,
stats,
}) => {
const {
assistantFeatures: { attackDiscoveryAlertFiltering },
} = useAssistantContext();

const { euiTheme } = useEuiTheme();
const disabled = connectorId == null;

Expand Down Expand Up @@ -120,24 +115,15 @@ const HeaderComponent: React.FC<Props> = ({
`}
grow={false}
>
{attackDiscoveryAlertFiltering ? (
<EuiToolTip content={i18n.SETTINGS} data-test-subj="openAlertSelectionToolTip">
<EuiButtonIcon
aria-label={i18n.SETTINGS}
color="text"
data-test-subj="openAlertSelection"
iconType="gear"
onClick={openFlyout}
/>
</EuiToolTip>
) : (
<SettingsModal
connectorId={connectorId}
isLoading={isLoading}
localStorageAttackDiscoveryMaxAlerts={localStorageAttackDiscoveryMaxAlerts}
setLocalStorageAttackDiscoveryMaxAlerts={setLocalStorageAttackDiscoveryMaxAlerts}
<EuiToolTip content={i18n.SETTINGS} data-test-subj="openAlertSelectionToolTip">
<EuiButtonIcon
aria-label={i18n.SETTINGS}
color="text"
data-test-subj="openAlertSelection"
iconType="gear"
onClick={openFlyout}
/>
)}
</EuiToolTip>
</EuiFlexItem>

<EuiFlexItem grow={false}>
Expand Down

This file was deleted.

This file was deleted.

This file was deleted.

Loading

0 comments on commit 42d2464

Please # to comment.