[Cloud Security] Asset Inventory table flyout controls #208452

JordanSh · 2025-01-27T21:18:51Z

Resolves #211365
Resolves https://github.com/elastic/security-team/issues/11445

Summary

Screen.Recording.2025-02-03.at.16.11.40.mov

Adding base controls to open entity flyouts based on entity type:

Open flyout on expand click
Open next flyout without closing current flyout
Close flyout on clicking the same expand button
Close on hitting ESC or X
Integrates with table's row highlighting and expand icon state
Open universal/user/host/service flyout based on entity.type, defaults to universal
Added mock UniversalEntityEcs

UniversalEntityFlyout content, real UniversalEntityEcs and dynamic flyout closing will be added next.
So the content files are just placeholders right now, you dont have to review them

JordanSh · 2025-02-03T14:53:19Z

...security/plugins/security_solution/public/asset_inventory/hooks/use_dynamic_entity_flyout.ts

+    const entityFlyoutParams = getFlyoutParamsByEntity(entity, scopeId, contextId);
+
+    // User, Host, and Service entity flyouts rely on entity name to fetch required data
+    if (entity.type !== 'universal' && !entity.name) {


Suggested change

if (entity.type !== 'universal' && !entity.name) {

if (entity.type !== UNIVERSAL_ENTITY_TYPE_UNIVERSAL && !entity.name) {

Not sure if this needs a constant right now, mainly because I would prefer it to be coming from ECS and not some local value

I would prefer it to be coming from ECS and not some local value

I agree, it would be very beneficial for consistency to have the entity.category types under ECS, just like the event field.

For consistency, I also think there's a huge benefit from having the entity.category values defined from the ECS schema, as we currently do for the event.category field. That would help us to track the source of truth outside of Kibana. cc @tinnytintin10

JordanSh · 2025-02-03T14:54:35Z

...security/plugins/security_solution/public/asset_inventory/hooks/use_dynamic_entity_flyout.ts

+  const closeDynamicFlyout = () => {
+    closeFlyout();
+  };


Once we'll add the details and preview panels, this function will expand. right now its mostly for comfort so you dont have to import both this hook and the expandable flyout api separately just to close the flyout

JordanSh · 2025-02-03T14:58:52Z

x-pack/solutions/security/plugins/security_solution/public/asset_inventory/pages/all_assets.tsx

-                renderDocumentView={renderDocumentView}
+                expandedDoc={expandedDoc}
+                setExpandedDoc={onExpandDocClick}
+                renderDocumentView={EmptyComponent}


This table has an opinionated way to open the flyout, it expects a components to render and to save the ref into a state. I tried a bunch of changes to the table to introduce some unopinionated control options, but ended up going with the same solution Timelines used in order to keep code consistency and not having to change core logic and add new tests. We might decide to do it later if someone thinks its needed

kibana/x-pack/solutions/security/plugins/security_solution/public/timelines/components/timeline/unified_components/data_table/index.tsx

Line 412 in 4e0c0a7

renderDocumentView={EmptyComponent}

I see, while the UnifiedDataTable component doesn't require renderDocumentView to be defined there's a conditional logic that relies on the presence of the renderDocumentView to display the flyout button.

I guess the usage of the EmptyComponent is ok for now, we should just test if the flyout is properly cleaned when the page is unmounted.

elasticmachine · 2025-02-03T16:01:47Z

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

…-fix'

…ordanSh/kibana into universal-entity-flyout-panels

...security/plugins/security_solution/public/asset_inventory/hooks/use_dynamic_entity_flyout.ts

albertoblaz

Looks good, nice stuff!! 👏 @JordanSh

hop-dev

Just to confirm is this behind a feature flag @JordanSh? Why merge these controls before the flyout is done, just to keep the PRs smaller?

…al-entity-flyout-panels

JordanSh · 2025-02-11T10:55:20Z

Just to confirm is this behind a feature flag @JordanSh? Why merge these controls before the flyout is done, just to keep the PRs smaller?

The entire page is behind a feature flag and for now we are still pushing small PRs which are not fully functioning. Both to keep PRs smaller, but mainly to have features integration between us

semd · 2025-02-11T12:26:58Z

src/platform/packages/shared/kbn-securitysolution-ecs/src/universal_entity/index.ts

+// TODO: Asset Inventory - This file is a placeholder for the ECS schema that will be used in the Asset Inventory app
+export interface UniversalEntityEcs {
+  id: string;
+  name: string;
+  type: 'universal' | 'user' | 'host' | 'service';
+  timestamp: Date;
+}


Will a universal_entity field be added to ECS?

yes, but actually it will be just named entity, i will refactor with a rename

semd

LGTM

opauloh · 2025-02-10T19:03:23Z

src/platform/packages/shared/kbn-securitysolution-ecs/src/universal_entity/index.ts

+export interface UniversalEntityEcs {
+  id: string;
+  name: string;
+  type: 'universal' | 'user' | 'host' | 'service';
+  timestamp: Date;
+}


I think that instead of universal entity, this file should reflect the entity field that's going to be added to ECS, so we could add the file under entity/index.ts,

Also according to the ECS Entity PR, the category is what we plan to use to make a high-level classification of the entity (universal, host, user, etc...), while type is going to be used for more granular classification (i.e aws_s3_bucket, gcp_cloud_storage_bucket, etc).

Suggested change

export interface UniversalEntityEcs {

id: string;

name: string;

type: 'universal' | 'user' | 'host' | 'service';

timestamp: Date;

}

export interface EntityEcs {

id: string;

source: string;

category: 'universal' | 'user' | 'host' | 'service';

type: string;

name: string;

}

name change done, ~~will add refactor to use category instead of type~~
edit: check second comment regarding this field name

might be a secondary consideration, but i noticed this on observeability inventory page:

Might be a bit confusing for users.

Since @tinnytintin10 is on PTO currently and the ECS suggestion is still in draft, it might get changed, im ok with merging it as type and refactoring later if its needed. lmk if you think otherwise

I agree let's defer that until @tinnytintin10 is back

opauloh · 2025-02-10T19:14:12Z

...security/plugins/security_solution/public/asset_inventory/hooks/use_dynamic_entity_flyout.ts

+    const entityFlyoutParams = getFlyoutParamsByEntity(entity, scopeId, contextId);
+
+    // User, Host, and Service entity flyouts rely on entity name to fetch required data
+    if (entity.type !== 'universal' && !entity.name) {


I would prefer it to be coming from ECS and not some local value

I agree, it would be very beneficial for consistency to have the entity.category types under ECS, just like the event field.

For consistency, I also think there's a huge benefit from having the entity.category values defined from the ECS schema, as we currently do for the event.category field. That would help us to track the source of truth outside of Kibana. cc @tinnytintin10

opauloh · 2025-02-10T19:32:59Z

x-pack/solutions/security/plugins/security_solution/public/asset_inventory/pages/all_assets.tsx

-                renderDocumentView={renderDocumentView}
+                expandedDoc={expandedDoc}
+                setExpandedDoc={onExpandDocClick}
+                renderDocumentView={EmptyComponent}


I see, while the UnifiedDataTable component doesn't require renderDocumentView to be defined there's a conditional logic that relies on the presence of the renderDocumentView to display the flyout button.

I guess the usage of the EmptyComponent is ok for now, we should just test if the flyout is properly cleaned when the page is unmounted.

…al-entity-flyout-panels

elasticmachine · 2025-02-11T16:48:26Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 940863c

Failed CI Steps

Serverless Rule Management - Prebuilt Rules - Security Solution Cypress Tests #1

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	6698	6702	+4

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	21.4MB	24.9MB	⚠️ +3.5MB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	92.3KB	92.5KB	+219.0B

History

cc @JordanSh

…on-206439 * main: (402 commits) [Search]: Fix Number type field to have correct property (elastic#210462) Change filter for rule monitoring gaps (elastic#209983) Update Logs Explorer deprecation messages (elastic#201307) [APM] Remove `error.id` in `getErrorGroupMainStatistics` query as it's not used (elastic#210613) [Embeddable] Fix presentation panel styles (elastic#210113) [ci] enable Scout reporter for on-merge-unsupported-ftrs (elastic#210627) [Fix][Synonyms UI]Add navigation link to the Detail breadcrumb. (elastic#209574) chore(dep): bump `store2` from `2.12.0` to `2.14.4` (elastic#210530) [scout] adding test helper `@kbn/scout-oblt` package and uptate onboarding tests (elastic#209761) [Cloud Security] Asset Inventory table flyout controls (elastic#208452) [ML] Fix model deployment check in file uploader (elastic#209585) Updates archive again (elastic#209828) [Security Solution] Added concurrency limits and request throttling to prebuilt rule routes (elastic#209551) [Search] [Onboarding] Update search api to use EventEmitter instead of Provider (elastic#209784) [maps] lazy load map actions (elastic#210252) [Cloud Security] Adding telemetry collection condition based on render condition (elastic#208758) [Solution nav] Use flyout for Stack Management in Search and Observability solutions (elastic#208632) [Search] Fix Add Inference Endpoint API call (elastic#210243) [Agentless Connectors] Integration overview panel (elastic#210222) [Lens] Restore dynamic colouring by value for Last value agg (elastic#209110) ...

JordanSh added 8 commits January 27, 2025 23:17

added on click to open flyouts from table

d1d39aa

cleaning

a3e4aff

cleaning

561b852

moved to hook

352253f

added translations

e8bfc43

cleaning

c5d37a5

cleaning

fe8766b

cleaning

36db7f8

JordanSh commented Feb 3, 2025

View reviewed changes

JordanSh self-assigned this Feb 3, 2025

JordanSh added release_note:skip Skip the PR/issue when compiling release notes backport:skip This commit does not require backporting v9.0.0 Team:Cloud Security Cloud Security team related labels Feb 3, 2025

merge

b1ff93e

JordanSh requested review from albertoblaz and opauloh February 3, 2025 15:33

type

4814c2c

JordanSh marked this pull request as ready for review February 3, 2025 16:01

JordanSh requested review from a team as code owners February 3, 2025 16:01

JordanSh requested a review from hop-dev February 3, 2025 16:01

JordanSh and others added 3 commits February 3, 2025 18:24

adds tests

3c3bd43

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

b29aeab

…-fix'

Merge branch 'universal-entity-flyout-panels' of https://github.com/J…

89c54ef

…ordanSh/kibana into universal-entity-flyout-panels

JordanSh added 2 commits February 3, 2025 18:36

types

bce8adf

types

32bde94

alexreal1314 reviewed Feb 4, 2025

View reviewed changes

...security/plugins/security_solution/public/asset_inventory/hooks/use_dynamic_entity_flyout.ts Show resolved Hide resolved

alexreal1314 reviewed Feb 4, 2025

View reviewed changes

...security/plugins/security_solution/public/asset_inventory/hooks/use_dynamic_entity_flyout.ts Show resolved Hide resolved

alexreal1314 reviewed Feb 4, 2025

View reviewed changes

...security/plugins/security_solution/public/asset_inventory/hooks/use_dynamic_entity_flyout.ts Outdated Show resolved Hide resolved

JordanSh added 2 commits February 4, 2025 10:50

types

3fd91a4

types

2fd4e4d

alexreal1314 approved these changes Feb 5, 2025

View reviewed changes

albertoblaz approved these changes Feb 10, 2025

View reviewed changes

hop-dev reviewed Feb 11, 2025

View reviewed changes

Merge branch 'main' of https://github.com/elastic/kibana into univers…

35de92b

…al-entity-flyout-panels

hop-dev approved these changes Feb 11, 2025

View reviewed changes

JordanSh added the v9.1.0 label Feb 11, 2025

semd reviewed Feb 11, 2025

View reviewed changes

refactor ecs placeholder name

f401e11

semd approved these changes Feb 11, 2025

View reviewed changes

JordanSh enabled auto-merge (squash) February 11, 2025 13:31

opauloh reviewed Feb 11, 2025

View reviewed changes

JordanSh disabled auto-merge February 11, 2025 14:02

Merge branch 'main' of https://github.com/elastic/kibana into univers…

940863c

…al-entity-flyout-panels

JordanSh enabled auto-merge (squash) February 11, 2025 16:29

JordanSh merged commit 000e913 into elastic:main Feb 11, 2025
9 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Cloud Security] Asset Inventory table flyout controls #208452

[Cloud Security] Asset Inventory table flyout controls #208452

JordanSh commented Jan 27, 2025 •

edited

Loading

JordanSh Feb 3, 2025

opauloh Feb 10, 2025

JordanSh Feb 3, 2025

JordanSh Feb 3, 2025

opauloh Feb 10, 2025

elasticmachine commented Feb 3, 2025

albertoblaz left a comment

hop-dev left a comment

JordanSh commented Feb 11, 2025

semd Feb 11, 2025

JordanSh Feb 11, 2025

semd left a comment

opauloh Feb 10, 2025

JordanSh Feb 11, 2025 •

edited

Loading

JordanSh Feb 11, 2025

opauloh Feb 11, 2025

opauloh Feb 10, 2025

opauloh Feb 10, 2025

elasticmachine commented Feb 11, 2025 •

edited

Loading

	if (entity.type !== 'universal' && !entity.name) {
	if (entity.type !== UNIVERSAL_ENTITY_TYPE_UNIVERSAL && !entity.name) {

[Cloud Security] Asset Inventory table flyout controls #208452

[Cloud Security] Asset Inventory table flyout controls #208452

Conversation

JordanSh commented Jan 27, 2025 • edited Loading

Summary

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Feb 3, 2025

albertoblaz left a comment

Choose a reason for hiding this comment

hop-dev left a comment

Choose a reason for hiding this comment

JordanSh commented Feb 11, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

semd left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

JordanSh Feb 11, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Feb 11, 2025 • edited Loading

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Module Count

Async chunks

Page load bundle

History

JordanSh commented Jan 27, 2025 •

edited

Loading

JordanSh Feb 11, 2025 •

edited

Loading

elasticmachine commented Feb 11, 2025 •

edited

Loading