[8.11] [Security Solution] Adds feature flag to enable/disable ESQL in timeline (#174029) #174112

spong · 2024-01-02T17:29:37Z

Backport

This will backport the following commits from main to 8.11:

[Security Solution] Adds feature flag to enable/disable ESQL in timeline (#174029)

Questions ?

Please refer to the Backport tool documentation

@timestamp

…ine (elastic#174029) ## Summary This PR introduces a feature flag `timelineEsqlTabDisabled` which is by default `false`. This gives customer ability to disable the esql tab by enabling this experimental feature flag as below in `kibana.yml` ```yaml xpack.securitySolution.enableExperimental: - timelineEsqlTabDisabled ``` The availability of ESQL Tab in timeline also affects `AI Assistant` as it facilities re-directing user to timeline with an esql query. That `redirect` button should not be available for `esql` query if ESQL Tab is disabled. ## Desk Testing 1. ESQL Tab Presence - timelineEsqlTabDisabled : true - If Tab is disabled, `ESQL` Tab should not show when timeline is open. Timeline should also not fire any `bsearch` requests with `esql` strategy. - ESQL tab is enabled i.e. `timelineEsqlTabDisabled : true` is present in kibana.dev.yml - User should be able to use ESQL queries without any issue. Below should be the default query in both `8.12` and `8.11.4` ```esql from .alerts-security.alerts-default,apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,traces-apm*,winlogbeat-*,-*elastic-cloud-logs-* | limit 10 | keep @timestamp, message, event.category, event.action, host.name, source.ip, destination.ip, user.name ``` 2. Open ESQL Tab from URL 1. Enable ESQL tab and Activate it when in timeline 2. Now change `kibana.dev.yml` to add experimental flag `timelineEsqlTabDisabled` to disable ESQL Tab. 3. Restart kibana server 4. Refresh the page in step 1 where `ESQL` tab was active 5. User should automatically be redirected to `Query` tab. 3. AI Assistant Today AI Assistant can help user add an ESQL query to the timeline as shown in below video. We need to make sure that `Send to timeline` button is not available only for `esql` queries when above experimental flag is enabled. https://github.com/elastic/kibana/assets/7485038/e452a6c6-cf97-462e-a5dc-bd8c0fd38d58 --------- Co-authored-by: Gloria Hornero <[email protected]> Co-authored-by: kibanamachine <[email protected]> (cherry picked from commit da0370e) # Conflicts: # x-pack/plugins/security_solution/common/experimental_features.ts # x-pack/plugins/security_solution/public/timelines/components/timeline/tabs_content/index.tsx

elasticmachine · 2024-01-02T17:30:00Z

CI was triggered for this PR, but this PR targets 8.11 which should not receive a future release. CI is not supported for these branches. Please consult the release schedule, or contact #kibana-operations if you believe this is an error.

The following branches are currently considered to be open:

main
8.12
7.17

spong · 2024-01-02T17:51:57Z

x-pack/plugins/security_solution/public/timelines/components/timeline/tabs_content/index.tsx

@@ -132,6 +134,7 @@ const ActiveTimelineTab = memo<ActiveTimelineTabProps>(
    setConversationId,
    showTimeline,
  }) => {
+    const isEsqlSettingEnabled = useKibana().services.configSettings.ESQLEnabled;


@logeekal, based on the note in #173640, I think we need to remove all occurrences of isEsqlSettingEnabled.

@spong, Conditional render should same as here without isEsqlSettingEnabled. Does that make sense?

Yeah, thank you!

Here is the updated conditional without isEsqlSettingEnabled:

https://github.com/elastic/kibana/pull/174112/files#diff-c9eb10e636b9cedb21368945df018d08cb60b87ccf469be22cbab0abd7ae5ed3R401

spong · 2024-01-02T17:53:38Z

x-pack/plugins/security_solution/public/timelines/components/timeline/tabs_content/index.tsx

-        >
-          <EsqlTab timelineId={timelineId} />
-        </HideShowContainer>
+        {showTimeline && isEsqlSettingEnabled && activeTimelineTab === TimelineTabs.esql && (


I guess this conditional goes away entirely as well since not already in 8.11?

This conditional is now the same as https://github.com/elastic/kibana/pull/173640/files#diff-c9eb10e636b9cedb21368945df018d08cb60b87ccf469be22cbab0abd7ae5ed3R182, which should merge first and be an empty change here.

x-pack/plugins/security_solution/public/timelines/components/timeline/tabs_content/index.tsx

Resolving conflicts as detailed from elastic#173640

elasticmachine · 2024-01-02T18:10:59Z

CI was triggered for this PR, but this PR targets 8.11 which should not receive a future release. CI is not supported for these branches. Please consult the release schedule, or contact #kibana-operations if you believe this is an error.

The following branches are currently considered to be open:

main
8.12
7.17

spong · 2024-01-02T18:19:21Z

x-pack/plugins/security_solution/public/timelines/components/timeline/tabs_content/index.tsx

+        {showTimeline && activeTimelineTab === TimelineTabs.esql && (
+          <HideShowContainer
+            $isVisible={true}
+            data-test-subj={`timeline-tab-content-${TimelineTabs.esql}`}
+          >
+            <EsqlTab timelineId={timelineId} />
+          </HideShowContainer>
+        )}


This delta is from: https://github.com/elastic/kibana/pull/173640/files#diff-c9eb10e636b9cedb21368945df018d08cb60b87ccf469be22cbab0abd7ae5ed3R182-R189, which should merge first

logeekal

Thank you. Desk tested. LGTM 🚀

jbudz · 2024-01-02T18:41:14Z

buildkite test this

kibana-ci · 2024-01-03T00:02:21Z

💔 Build Failed

Failed CI Steps

Test Failures

[job] [logs] Security Solution Cypress Tests #3 / Alert tagging Add and remove a tag using the alert bulk action menu Add and remove a tag using the alert bulk action menu
[job] [logs] Investigations - Security Solution Cypress Tests #8 / Detections : Page Filters Impact of inputs "after each" hook for "should recover from invalid kql Query result" "after each" hook for "should recover from invalid kql Query result"
[job] [logs] Investigations - Security Solution Cypress Tests #8 / Detections : Page Filters Impact of inputs should recover from invalid kql Query result should recover from invalid kql Query result

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	13.0MB	13.0MB	+1.7KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	63.0KB	63.0KB	+27.0B

History

💔 Build #185518 failed 87c1cca
💔 Build #185499 failed 1770d51

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

spong added the backport label Jan 2, 2024

spong enabled auto-merge (squash) January 2, 2024 17:29

spong mentioned this pull request Jan 2, 2024

[Security Solution] Adds feature flag to enable/disable ESQL in timeline #174029

Merged

spong commented Jan 2, 2024

View reviewed changes

x-pack/plugins/security_solution/public/timelines/components/timeline/tabs_content/index.tsx Outdated Show resolved Hide resolved

Update index.tsx

1770d51

Resolving conflicts as detailed from elastic#173640

spong commented Jan 2, 2024

View reviewed changes

logeekal approved these changes Jan 2, 2024

View reviewed changes

PhilippeOberti disabled auto-merge January 2, 2024 18:45

jbudz and others added 2 commits January 2, 2024 14:14

Merge branch '8.11' into backport/8.11/pr-174029

87c1cca

skip Cypress test (currently skipped in main)

a40d453

PhilippeOberti merged commit 8832416 into elastic:8.11 Jan 3, 2024
26 of 30 checks passed

spong deleted the backport/8.11/pr-174029 branch January 3, 2024 16:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[8.11] [Security Solution] Adds feature flag to enable/disable ESQL in timeline (#174029) #174112

[8.11] [Security Solution] Adds feature flag to enable/disable ESQL in timeline (#174029) #174112

spong commented Jan 2, 2024

elasticmachine commented Jan 2, 2024

spong Jan 2, 2024

logeekal Jan 2, 2024

spong Jan 2, 2024

spong Jan 2, 2024

spong Jan 2, 2024

elasticmachine commented Jan 2, 2024

spong Jan 2, 2024

logeekal left a comment

jbudz commented Jan 2, 2024

kibana-ci commented Jan 3, 2024 •

edited

Loading

[8.11] [Security Solution] Adds feature flag to enable/disable ESQL in timeline (#174029) #174112

[8.11] [Security Solution] Adds feature flag to enable/disable ESQL in timeline (#174029) #174112

Conversation

spong commented Jan 2, 2024

Backport

Questions ?

elasticmachine commented Jan 2, 2024

spong Jan 2, 2024

Choose a reason for hiding this comment

logeekal Jan 2, 2024

Choose a reason for hiding this comment

spong Jan 2, 2024

Choose a reason for hiding this comment

spong Jan 2, 2024

Choose a reason for hiding this comment

spong Jan 2, 2024

Choose a reason for hiding this comment

elasticmachine commented Jan 2, 2024

spong Jan 2, 2024

Choose a reason for hiding this comment

logeekal left a comment

Choose a reason for hiding this comment

jbudz commented Jan 2, 2024

kibana-ci commented Jan 3, 2024 • edited Loading

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

Async chunks

Page load bundle

History

kibana-ci commented Jan 3, 2024 •

edited

Loading