From 42d2464157b8c8ae07e21762e34d652c9a27d377 Mon Sep 17 00:00:00 2001 From: Andrew Macri Date: Thu, 20 Feb 2025 16:17:12 -0500 Subject: [PATCH] [Security Solution] [Attack discovery] Removes Alerts filtering feature flag (#209851) ### [Security Solution] [Attack discovery] Removes Alerts filtering feature flag This PR removes the feature flag for the Attack discovery _Alerts filtering_ feature, introduced in . The `Attack discovery settings` flyout shown in the gif below is now available for all Attack discovery users when they click the settings gear: ![00_alerts_filtering](https://github.com/user-attachments/assets/1a81413b-b8f4-4965-a006-25fb529668a6) #### Details This PR _removes_ the `attackDiscoveryAlertFiltering` feature flag, which was configured via the following setting in kibana.dev.yml: ```yaml xpack.securitySolution.enableExperimental: - 'attackDiscoveryAlertFiltering' ``` #### Desk testing 1. Ensure the `attackDiscoveryAlertFiltering` feature flag is present in `kibana.dev.yml`: ```yaml xpack.securitySolution.enableExperimental: - 'attackDiscoveryAlertFiltering' ``` 2. Start Kibana server and observe the startup logs **Expected result** - A warning that the `attackDiscoveryAlertFiltering` flag is no longer supported is logged: ``` [2025-02-05T11:24:31.612-05:00][WARN ][plugins.securitySolution.config] Unsupported "xpack.securitySolution.enableExperimental" values detected. The following configuration values are no longer supported and should be removed from the kibana configuration file: xpack.securitySolution.enableExperimental: - attackDiscoveryAlertFiltering ``` 3. Remove the `attackDiscoveryAlertFiltering` feature flag from `kibana.dev.yml` 4. Restart Kibana server and once again observe the startup logs **Expected result** - The warning displayed in step 2 is NOT logged 5. Navigate to Security > Attack discovery 6. Click the `Settings` gear **Expected result** - The `Attack discovery settings` flyout shown in the PR description above appears --- .../impl/capabilities/index.ts | 1 - .../get_capabilities_route.gen.ts | 1 - .../get_capabilities_route.schema.yaml | 3 - .../translations/translations/fr-FR.json | 10 -- .../translations/translations/ja-JP.json | 10 -- .../translations/translations/zh-CN.json | 10 -- .../common/experimental_features.ts | 5 - .../pages/header/index.test.tsx | 17 +- .../attack_discovery/pages/header/index.tsx | 32 +--- .../alerts_settings/index.test.tsx | 39 ----- .../settings_modal/alerts_settings/index.tsx | 78 --------- .../settings_modal/footer/index.test.tsx | 42 ----- .../header/settings_modal/footer/index.tsx | 57 ------- .../header/settings_modal/index.test.tsx | 72 -------- .../pages/header/settings_modal/index.tsx | 158 ------------------ .../is_tour_enabled/index.test.ts | 76 --------- .../settings_modal/is_tour_enabled/index.ts | 18 -- .../header/settings_modal/translations.ts | 81 --------- .../attack_discovery/pages/index.test.tsx | 43 +---- .../public/attack_discovery/pages/index.tsx | 29 +--- .../loading_messages/index.test.tsx | 42 +---- .../loading_messages/index.tsx | 18 +- .../pages/settings_flyout/footer/index.tsx | 2 +- .../settings_flyout/footer/translations.ts | 29 ++++ .../security_solution/server/plugin.ts | 1 - 25 files changed, 58 insertions(+), 816 deletions(-) delete mode 100644 x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/alerts_settings/index.test.tsx delete mode 100644 x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/alerts_settings/index.tsx delete mode 100644 x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/footer/index.test.tsx delete mode 100644 x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/footer/index.tsx delete mode 100644 x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/index.test.tsx delete mode 100644 x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/index.tsx delete mode 100644 x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/is_tour_enabled/index.test.ts delete mode 100644 x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/is_tour_enabled/index.ts delete mode 100644 x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/translations.ts create mode 100644 x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/footer/translations.ts diff --git a/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/capabilities/index.ts b/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/capabilities/index.ts index 9b7a26d73027b..b7c8e092b2eec 100644 --- a/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/capabilities/index.ts +++ b/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/capabilities/index.ts @@ -21,6 +21,5 @@ export type AssistantFeatureKey = keyof AssistantFeatures; export const defaultAssistantFeatures = Object.freeze({ assistantModelEvaluation: false, defendInsights: true, - attackDiscoveryAlertFiltering: false, contentReferencesEnabled: false, }); diff --git a/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.gen.ts b/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.gen.ts index 78ee4a6c3e605..9ff0c2ebf59e7 100644 --- a/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.gen.ts +++ b/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.gen.ts @@ -19,7 +19,6 @@ import { z } from '@kbn/zod'; export type GetCapabilitiesResponse = z.infer; export const GetCapabilitiesResponse = z.object({ assistantModelEvaluation: z.boolean(), - attackDiscoveryAlertFiltering: z.boolean(), contentReferencesEnabled: z.boolean(), defendInsights: z.boolean(), }); diff --git a/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.schema.yaml b/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.schema.yaml index 684ff6f020793..2dc79cfe3d116 100644 --- a/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.schema.yaml +++ b/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.schema.yaml @@ -22,15 +22,12 @@ paths: properties: assistantModelEvaluation: type: boolean - attackDiscoveryAlertFiltering: - type: boolean contentReferencesEnabled: type: boolean defendInsights: type: boolean required: - assistantModelEvaluation - - attackDiscoveryAlertFiltering - contentReferencesEnabled - defendInsights '400': diff --git a/x-pack/platform/plugins/private/translations/translations/fr-FR.json b/x-pack/platform/plugins/private/translations/translations/fr-FR.json index 869d6144f284b..d3322f1c0c511 100644 --- a/x-pack/platform/plugins/private/translations/translations/fr-FR.json +++ b/x-pack/platform/plugins/private/translations/translations/fr-FR.json @@ -34217,16 +34217,6 @@ "xpack.securitySolution.attackDiscovery.pages.pageTitle.statusConnectors": "Vous avez {newDiscoveriesCount} {newDiscoveriesCount, plural, =1 {nouvelle découverte} other {nouvelles découvertes}} à travers {newConnectorResultsCount} {newConnectorResultsCount, plural, =1 {connecteur} other {connecteurs}} à examiner.", "xpack.securitySolution.attackDiscovery.pages.welcome.firstSetUpLabel": "Tout d’abord, configurez un connecteur d’IA générative.", "xpack.securitySolution.attackDiscovery.pages.welcome.welcomeToAttackDiscoveryLabel": "Bienvenue sur Attack discovery !", - "xpack.securitySolution.attackDiscovery.settingsModal.alertsLabel": "Alertes", - "xpack.securitySolution.attackDiscovery.settingsModal.attackDiscoverySendsMoreAlertsTourText": "La découverte d'attaques envoie davantage d'alertes en tant que contexte.", - "xpack.securitySolution.attackDiscovery.settingsModal.cancelButton": "Annuler", - "xpack.securitySolution.attackDiscovery.settingsModal.configureYourSettingsHereTourText": "Configurez vos paramètres ici.", - "xpack.securitySolution.attackDiscovery.settingsModal.latestAndRiskiestOpenAlertsLabel": "Envoyez à Attack discovery des informations sur vos {alertsCount} alertes ouvertes ou confirmées les plus récentes et les plus risquées.", - "xpack.securitySolution.attackDiscovery.settingsModal.resetLabel": "Réinitialiser", - "xpack.securitySolution.attackDiscovery.settingsModal.saveButton": "Enregistrer", - "xpack.securitySolution.attackDiscovery.settingsModal.settingsLabel": "Paramètres", - "xpack.securitySolution.attackDiscovery.settingsModal.tourSubtitle": "Améliorations récentes de Attack Discovery", - "xpack.securitySolution.attackDiscovery.settingsModal.tourTitle": "Envoyer plus d'alertes", "xpack.securitySolution.attackDiscovery.showAnonymizedLabel": "Afficher les anonymisés", "xpack.securitySolution.attackDiscovery.showRealValuesLabel": "Afficher les valeurs réelles", "xpack.securitySolution.attackDiscovery.summaryCount.alertsLabel": "{alertsCount} {alertsCount, plural, =1 {alerte} other {alertes}}", diff --git a/x-pack/platform/plugins/private/translations/translations/ja-JP.json b/x-pack/platform/plugins/private/translations/translations/ja-JP.json index 6fbd5f2a994bf..9c3b79be6b06b 100644 --- a/x-pack/platform/plugins/private/translations/translations/ja-JP.json +++ b/x-pack/platform/plugins/private/translations/translations/ja-JP.json @@ -34079,16 +34079,6 @@ "xpack.securitySolution.attackDiscovery.pages.pageTitle.statusConnectors": "{newConnectorResultsCount} {newConnectorResultsCount, plural, other {コネクター}}全体で、表示する{newDiscoveriesCount}件の新しい{newDiscoveriesCount, plural, other {検出}}があります。", "xpack.securitySolution.attackDiscovery.pages.welcome.firstSetUpLabel": "まず、生成AIコネクターを設定します。", "xpack.securitySolution.attackDiscovery.pages.welcome.welcomeToAttackDiscoveryLabel": "Attack Discoveryへようこそ！", - "xpack.securitySolution.attackDiscovery.settingsModal.alertsLabel": "アラート", - "xpack.securitySolution.attackDiscovery.settingsModal.attackDiscoverySendsMoreAlertsTourText": "Attack discoveryはその他のアラートをコンテキストとして送信します。", - "xpack.securitySolution.attackDiscovery.settingsModal.cancelButton": "キャンセル", - "xpack.securitySolution.attackDiscovery.settingsModal.configureYourSettingsHereTourText": "ここで設定を構成します。", - "xpack.securitySolution.attackDiscovery.settingsModal.latestAndRiskiestOpenAlertsLabel": "{alertsCount}件の最新の最もリスクが高い未解決または確認済みのアラートに関するAttack discovery情報を送信します。", - "xpack.securitySolution.attackDiscovery.settingsModal.resetLabel": "リセット", - "xpack.securitySolution.attackDiscovery.settingsModal.saveButton": "保存", - "xpack.securitySolution.attackDiscovery.settingsModal.settingsLabel": "設定", - "xpack.securitySolution.attackDiscovery.settingsModal.tourSubtitle": "最近のAttack discoveryの改良", - "xpack.securitySolution.attackDiscovery.settingsModal.tourTitle": "その他のアラートを送信", "xpack.securitySolution.attackDiscovery.showAnonymizedLabel": "匿名化して表示", "xpack.securitySolution.attackDiscovery.showRealValuesLabel": "実際の値を表示", "xpack.securitySolution.attackDiscovery.summaryCount.alertsLabel": "{alertsCount} {alertsCount, plural, other {件のアラート}}", diff --git a/x-pack/platform/plugins/private/translations/translations/zh-CN.json b/x-pack/platform/plugins/private/translations/translations/zh-CN.json index 6e8207db310e0..0edea0d7c6b11 100644 --- a/x-pack/platform/plugins/private/translations/translations/zh-CN.json +++ b/x-pack/platform/plugins/private/translations/translations/zh-CN.json @@ -33551,16 +33551,6 @@ "xpack.securitySolution.attackDiscovery.pages.pageTitle.statusConnectors": "您具有 {newDiscoveriesCount} 个新{newDiscoveriesCount, plural, other {发现}}可跨 {newConnectorResultsCount} 个{newConnectorResultsCount, plural, other {连接器}}查看。", "xpack.securitySolution.attackDiscovery.pages.welcome.firstSetUpLabel": "首先设置生成式 AI 连接器。", "xpack.securitySolution.attackDiscovery.pages.welcome.welcomeToAttackDiscoveryLabel": "欢迎使用 Attack Discovery！", - "xpack.securitySolution.attackDiscovery.settingsModal.alertsLabel": "告警", - "xpack.securitySolution.attackDiscovery.settingsModal.attackDiscoverySendsMoreAlertsTourText": "Attack Discovery 会发送更多告警作为上下文。", - "xpack.securitySolution.attackDiscovery.settingsModal.cancelButton": "取消", - "xpack.securitySolution.attackDiscovery.settingsModal.configureYourSettingsHereTourText": "在此配置您的设置。", - "xpack.securitySolution.attackDiscovery.settingsModal.latestAndRiskiestOpenAlertsLabel": "发送有关 {alertsCount} 个最新和风险最高的未决或已确认告警的 Attack Discovery 信息。", - "xpack.securitySolution.attackDiscovery.settingsModal.resetLabel": "重置", - "xpack.securitySolution.attackDiscovery.settingsModal.saveButton": "保存", - "xpack.securitySolution.attackDiscovery.settingsModal.settingsLabel": "设置", - "xpack.securitySolution.attackDiscovery.settingsModal.tourSubtitle": "最近的 Attack Discovery 改进", - "xpack.securitySolution.attackDiscovery.settingsModal.tourTitle": "发送更多告警", "xpack.securitySolution.attackDiscovery.showAnonymizedLabel": "显示已匿名处理项", "xpack.securitySolution.attackDiscovery.showRealValuesLabel": "显示实际值", "xpack.securitySolution.attackDiscovery.summaryCount.alertsLabel": "{alertsCount} 个{alertsCount, plural, other {告警}}", diff --git a/x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts b/x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts index 9ce3b5d588371..02f3e85d143ca 100644 --- a/x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts +++ b/x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts @@ -114,11 +114,6 @@ export const allowedExperimentalValues = Object.freeze({ */ assistantModelEvaluation: false, - /** - * Enables filtering of Attack Discovery alerts in a flyout - */ - attackDiscoveryAlertFiltering: false, - /** * Enables content references (citations) in the AI Assistant */ diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/index.test.tsx b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/index.test.tsx index e48027812f1ec..2124c38722ec0 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/index.test.tsx +++ b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/index.test.tsx @@ -6,7 +6,6 @@ */ import { DEFAULT_ATTACK_DISCOVERY_MAX_ALERTS } from '@kbn/elastic-assistant'; -import { defaultAssistantFeatures } from '@kbn/elastic-assistant-common'; import { fireEvent, render, screen, waitFor } from '@testing-library/react'; import React from 'react'; @@ -16,18 +15,6 @@ import { Header } from '.'; jest.mock('../../../assistant/use_assistant_availability'); -jest.mock('@kbn/elastic-assistant-common', () => { - const original = jest.requireActual('@kbn/elastic-assistant-common'); - - return { - ...original, - defaultAssistantFeatures: { - ...original.defaultAssistantFeatures, - attackDiscoveryAlertFiltering: jest.mocked(false), // <-- feature flag is off by default - }, - }; -}); - const defaultProps = { stats: null, connectorId: 'testConnectorId', @@ -50,7 +37,6 @@ describe('Actions', () => { }); jest.clearAllMocks(); - (defaultAssistantFeatures.attackDiscoveryAlertFiltering as jest.Mocked) = false; // reset feature flag to off }); it('renders the connector selector', () => { @@ -139,8 +125,7 @@ describe('Actions', () => { expect(generate).toBeDisabled(); }); - it('invokes openFlyout when the settings button is clicked, when the attackDiscoveryAlertFiltering feature flag is on', async () => { - (defaultAssistantFeatures.attackDiscoveryAlertFiltering as jest.Mocked) = true; + it('invokes openFlyout when the settings button is clicked', async () => { const openFlyout = jest.fn(); render( diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/index.tsx b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/index.tsx index 46019520401e5..8b299eaab7025 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/index.tsx +++ b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/index.tsx @@ -15,12 +15,11 @@ import { useEuiTheme, } from '@elastic/eui'; import { css } from '@emotion/react'; -import { ConnectorSelectorInline, useAssistantContext } from '@kbn/elastic-assistant'; +import { ConnectorSelectorInline } from '@kbn/elastic-assistant'; import type { AttackDiscoveryStats } from '@kbn/elastic-assistant-common'; import { noop } from 'lodash/fp'; import React, { useCallback, useEffect, useMemo, useState } from 'react'; -import { SettingsModal } from './settings_modal'; import { StatusBell } from './status_bell'; import * as i18n from './translations'; @@ -51,10 +50,6 @@ const HeaderComponent: React.FC = ({ setLocalStorageAttackDiscoveryMaxAlerts, stats, }) => { - const { - assistantFeatures: { attackDiscoveryAlertFiltering }, - } = useAssistantContext(); - const { euiTheme } = useEuiTheme(); const disabled = connectorId == null; @@ -120,24 +115,15 @@ const HeaderComponent: React.FC = ({ `} grow={false} > - {attackDiscoveryAlertFiltering ? ( - - - - ) : ( - + - )} + diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/alerts_settings/index.test.tsx b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/alerts_settings/index.test.tsx deleted file mode 100644 index 958c9094fabf3..0000000000000 --- a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/alerts_settings/index.test.tsx +++ /dev/null @@ -1,39 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0; you may not use this file except in compliance with the Elastic License - * 2.0. - */ - -import { render, screen, fireEvent } from '@testing-library/react'; -import React from 'react'; - -import { AlertsSettings, MAX_ALERTS } from '.'; - -const maxAlerts = '150'; - -const setMaxAlerts = jest.fn(); - -describe('AlertsSettings', () => { - it('calls setMaxAlerts when the alerts range changes', () => { - render(); - - fireEvent.click(screen.getByText(`${MAX_ALERTS}`)); - - expect(setMaxAlerts).toHaveBeenCalledWith(`${MAX_ALERTS}`); - }); - - it('displays the correct maxAlerts value', () => { - render(); - - expect(screen.getByTestId('alertsRange')).toHaveValue(maxAlerts); - }); - - it('displays the expected text for anonymization settings', () => { - render(); - - expect(screen.getByTestId('latestAndRiskiest')).toHaveTextContent( - 'Send Attack discovery information about your 150 newest and riskiest open or acknowledged alerts.' - ); - }); -}); diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/alerts_settings/index.tsx b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/alerts_settings/index.tsx deleted file mode 100644 index 7741d3214ee36..0000000000000 --- a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/alerts_settings/index.tsx +++ /dev/null @@ -1,78 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0; you may not use this file except in compliance with the Elastic License - * 2.0. - */ - -import type { SingleRangeChangeEvent } from '@kbn/elastic-assistant'; -import { EuiFlexGroup, EuiFlexItem, EuiForm, EuiFormRow, EuiSpacer, EuiText } from '@elastic/eui'; -import { - AlertsRange, - SELECT_FEWER_ALERTS, - YOUR_ANONYMIZATION_SETTINGS, -} from '@kbn/elastic-assistant'; -import React, { useCallback } from 'react'; - -import * as i18n from '../translations'; - -export const MAX_ALERTS = 500; -export const MIN_ALERTS = 50; -export const STEP = 50; - -interface Props { - maxAlerts: string; - setMaxAlerts: React.Dispatch>; -} - -const AlertsSettingsComponent: React.FC = ({ maxAlerts, setMaxAlerts }) => { - const onChangeAlertsRange = useCallback( - (e: SingleRangeChangeEvent) => { - setMaxAlerts(e.currentTarget.value); - }, - [setMaxAlerts] - ); - - return ( - - - - - - - - - - - - {i18n.LATEST_AND_RISKIEST_OPEN_ALERTS(Number(maxAlerts))} - - - - - - - {YOUR_ANONYMIZATION_SETTINGS} - - - - - - {SELECT_FEWER_ALERTS} - - - - - - ); -}; - -AlertsSettingsComponent.displayName = 'AlertsSettings'; - -export const AlertsSettings = React.memo(AlertsSettingsComponent); diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/footer/index.test.tsx b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/footer/index.test.tsx deleted file mode 100644 index e487304c41350..0000000000000 --- a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/header/settings_modal/footer/index.test.tsx +++ /dev/null @@ -1,42 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0; you may not use this file except in compliance with the Elastic License - * 2.0. - */ - -import React from 'react'; -import { fireEvent, render, screen } from '@testing-library/react'; - -import { Footer } from '.'; - -describe('Footer', () => { - const closeModal = jest.fn(); - const onReset = jest.fn(); - const onSave = jest.fn(); - - beforeEach(() => jest.clearAllMocks()); - - it('calls onReset when the reset button is clicked', () => { - render(