-
Notifications
You must be signed in to change notification settings - Fork 359
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add 2 drilldowns #3146
Add 2 drilldowns #3146
Conversation
Testing with the current
I'm not sure why we're requiring two drilldown searches- that probably has to change, but in the meantime, these probably need to be updated. Let's sync when you're online about some of the testing that was done with Correlations specifically, since UI elements in ES are driven by their drilldown searches, which require specifically crafted searches. |
…ield named 'eferences' to 'references'
The detections missing drilldowns have been updated - but this doesn't address your additional points. |
Current status of appinspect job: Its now targeting this branch appropriately so builds are actually happening, and should work across the board a bit better. The failures on that job are real. However, they may have been unintended- While hunting searches are excluded from the drilldown requirement, they are still getting a line added to their stanzas in savedsearches.conf that looks like this:
This is because of the template changes made to add drilldown support. We can bump all those versions once, now, and keep this as a standard way we're going to output drilldowns, or we can go back to contentctl, change the template, try not to break anything, and not bump those versions. Details about template: At first, I was a bit confused as to why it was there/what was going on. After loading it up in an IDE that identified pairs of brackets, I collapsed a few sections and found out the And that's how we got them on searches that don't require them. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should be fine to merge now.
I guess
Adding two default drilldowns to all detections - TTP, Anomaly, TTP except experiemental/deprecated