[SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings #209475

janmonschke · 2025-02-04T09:22:29Z

Summary

Fixes #191767

Multiple IPs are now displayed as individual links, even in the case where multiple IPs are passed as a single string (e.g. 127.0.0.1,127.0.0.2). Clicking on an individual link will open the flyout correctly as well.

Screen.Recording.2025-02-05.at.13.51.56.mov

Checklist

Unit or functional tests were updated or added to match the most common scenarios

elasticmachine · 2025-02-04T09:22:32Z

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

PhilippeOberti

Nice fix, code LGTM and desk tested! While we need to improve the UI to better show the ellipsis and the values in the tooltip in both the alerts table and timeline (and probably other places as well), this is outside of this PR's scope.
Nice job, thanks for fixing this!

The content wrapper isn't need anymore and it prevented the ellipsis from working

janmonschke · 2025-02-05T12:51:01Z

While we need to improve the UI to better show the ellipsis and the values in the tooltip in both the alerts table and timeline (...)

@PhilippeOberti Made the ellipsis work in a9bc4ce

janmonschke · 2025-02-05T14:31:19Z

@elasticmachine merge upstream

PhilippeOberti · 2025-02-05T14:33:23Z

While we need to improve the UI to better show the ellipsis and the values in the tooltip in both the alerts table and timeline (...)

@PhilippeOberti Made the ellipsis work in a9bc4ce

Tested! Works beautifully, nice job! We lost the tooltip but there was not any useful information in it anyway as it was not displaying the value... plus I checked and the user name, host name, rule name (basically the other links) don't have it either.
Awesome!

janmonschke · 2025-02-05T14:34:34Z

We lost the tooltip but there was not any useful information (...)

Yeah, I should've specified that the wrapper wasn't used anymore and it was actually showing a tooltip when it was not used anywhere else in the table.

kapral18

LGTM with 1 questions, thanks!

kapral18 · 2025-02-05T14:38:45Z

x-pack/solutions/security/plugins/security_solution/public/common/components/links/index.tsx

-  ip,
-  flowTarget = FlowTarget.source,
+const NetworkDetailsLinkComponent: React.FC<NetworkDetailsLinkProps> = ({ ip, ...restProps }) => {
+  // We see that sometimes the `ip` is passed as a string value of "IP1,IP2".


can the same happen for arrays, i.e. ["IP1,IP2", "IP3,IP4"]?

I'm not sure to be honest. It's not something that I've seen before though.

I'd say, let's not make the code more complex. I don't think an array of string with multiple values like that is a situation that we need to handle...

kibanamachine · 2025-02-05T20:40:34Z

Starting backport for target branches: 8.16, 8.17, 8.18, 8.x, 9.0

https://github.com/elastic/kibana/actions/runs/13166188116

elasticmachine · 2025-02-05T20:41:19Z

💚 Build Succeeded

Buildkite Build
Commit: d41e376

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	21.5MB	21.5MB	+225.0B

History

💔 Build #273597 failed 737cf97

cc @janmonschke

… in strings (elastic#209475) ## Summary Fixes elastic#191767 Multiple IPs are now displayed as individual links, even in the case where multiple IPs are passed as a single string (e.g. `127.0.0.1,127.0.0.2`). Clicking on an individual link will open the flyout correctly as well. https://github.com/user-attachments/assets/74b05cff-3843-4149-bf27-cd0af07aa558 ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: Elastic Machine <[email protected]> (cherry picked from commit dda5381)

kibanamachine · 2025-02-05T20:47:24Z

💔 Some backports could not be created

Status	Branch	Result
❌	8.16	Backport failed because of merge conflicts
❌	8.17	Backport failed because of merge conflicts
✅	8.18
✅	8.x
✅	9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Manual backport

To create the backport manually run:

node scripts/backport --pr 209475

Questions ?

Please refer to the Backport tool documentation

…dresses in strings (#209475) (#209907) # Backport This will backport the following commits from `main` to `8.18`: - [[SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475)](#209475)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Jan Monschke <[email protected]>

…resses in strings (#209475) (#209908) # Backport This will backport the following commits from `main` to `8.x`: - [[SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475)](#209475)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Jan Monschke <[email protected]>

…resses in strings (#209475) (#209909) # Backport This will backport the following commits from `main` to `9.0`: - [[SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475)](#209475)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Jan Monschke <[email protected]>

… in strings (elastic#209475) ## Summary Fixes elastic#191767 Multiple IPs are now displayed as individual links, even in the case where multiple IPs are passed as a single string (e.g. `127.0.0.1,127.0.0.2`). Clicking on an individual link will open the flyout correctly as well. https://github.com/user-attachments/assets/74b05cff-3843-4149-bf27-cd0af07aa558 ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: Elastic Machine <[email protected]> (cherry picked from commit dda5381) # Conflicts: # x-pack/plugins/security_solution/public/timelines/components/formatted_ip/index.tsx

janmonschke · 2025-02-06T09:55:47Z

💚 All backports created successfully

Status	Branch	Result
✅	8.17
✅	8.16

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

… in strings (elastic#209475) ## Summary Fixes elastic#191767 Multiple IPs are now displayed as individual links, even in the case where multiple IPs are passed as a single string (e.g. `127.0.0.1,127.0.0.2`). Clicking on an individual link will open the flyout correctly as well. https://github.com/user-attachments/assets/74b05cff-3843-4149-bf27-cd0af07aa558 ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: Elastic Machine <[email protected]> (cherry picked from commit dda5381) # Conflicts: # x-pack/plugins/security_solution/public/timelines/components/formatted_ip/index.tsx

janmonschke · 2025-02-06T10:05:37Z

💚 All backports created successfully

Status	Branch	Result
✅	8.17

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…dresses in strings (#209475) (#209971) # Backport This will backport the following commits from `main` to `8.17`: - [[SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475)](#209475)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) \n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n\n\nCo-authored-by: Jan Monschke <[email protected]>"}},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/209907","number":209907,"state":"MERGED","mergeCommit":{"sha":"7767ad87599a4d97027757e94abc7b9db1df3cd1","message":"[8.18] [SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475) (#209907)\n\n# Backport\n\nThis will backport the following commits from `main` to `8.18`:\n- [[SecuritySolution][Alerts table] Fix issue with multiple ip addresses\nin strings (#209475)](https://github.com/elastic/kibana/pull/209475)\n\n\n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n\n\nCo-authored-by: Jan Monschke <[email protected]>"}},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/209475","number":209475,"mergeCommit":{"message":"[SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475)\n\n## Summary\n\nFixes https://github.com/elastic/kibana/issues/191767\n\nMultiple IPs are now displayed as individual links, even in the case\nwhere multiple IPs are passed as a single string (e.g.\n`127.0.0.1,127.0.0.2`). Clicking on an individual link will open the\nflyout correctly as well.\n\n\n\nhttps://github.com/user-attachments/assets/74b05cff-3843-4149-bf27-cd0af07aa558\n\n\n\n### Checklist\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n---------\n\nCo-authored-by: Elastic Machine <[email protected]>","sha":"dda538111ed66cb6a36148f07a87068d7de076b6"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/209908","number":209908,"state":"MERGED","mergeCommit":{"sha":"e62eef171bec5fe025f463b105cbac1fa44a4fff","message":"[8.x] [SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475) (#209908)\n\n# Backport\n\nThis will backport the following commits from `main` to `8.x`:\n- [[SecuritySolution][Alerts table] Fix issue with multiple ip addresses\nin strings (#209475)](https://github.com/elastic/kibana/pull/209475)\n\n\n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n\n\nCo-authored-by: Jan Monschke <[email protected]>"}},{"url":"https://github.com/elastic/kibana/pull/209969","number":209969,"branch":"8.16","state":"OPEN"}]}] BACKPORT-->

…dresses in strings (#209475) (#209969) # Backport This will backport the following commits from `main` to `8.16`: - [[SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475)](#209475)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) \n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n\n\nCo-authored-by: Jan Monschke <[email protected]>"}},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/209907","number":209907,"state":"MERGED","mergeCommit":{"sha":"7767ad87599a4d97027757e94abc7b9db1df3cd1","message":"[8.18] [SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475) (#209907)\n\n# Backport\n\nThis will backport the following commits from `main` to `8.18`:\n- [[SecuritySolution][Alerts table] Fix issue with multiple ip addresses\nin strings (#209475)](https://github.com/elastic/kibana/pull/209475)\n\n\n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n\n\nCo-authored-by: Jan Monschke <[email protected]>"}},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/209475","number":209475,"mergeCommit":{"message":"[SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475)\n\n## Summary\n\nFixes https://github.com/elastic/kibana/issues/191767\n\nMultiple IPs are now displayed as individual links, even in the case\nwhere multiple IPs are passed as a single string (e.g.\n`127.0.0.1,127.0.0.2`). Clicking on an individual link will open the\nflyout correctly as well.\n\n\n\nhttps://github.com/user-attachments/assets/74b05cff-3843-4149-bf27-cd0af07aa558\n\n\n\n### Checklist\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n---------\n\nCo-authored-by: Elastic Machine <[email protected]>","sha":"dda538111ed66cb6a36148f07a87068d7de076b6"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/209908","number":209908,"state":"MERGED","mergeCommit":{"sha":"e62eef171bec5fe025f463b105cbac1fa44a4fff","message":"[8.x] [SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475) (#209908)\n\n# Backport\n\nThis will backport the following commits from `main` to `8.x`:\n- [[SecuritySolution][Alerts table] Fix issue with multiple ip addresses\nin strings (#209475)](https://github.com/elastic/kibana/pull/209475)\n\n\n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n\n\nCo-authored-by: Jan Monschke <[email protected]>"}}]}] BACKPORT-->

… in strings (elastic#209475) ## Summary Fixes elastic#191767 Multiple IPs are now displayed as individual links, even in the case where multiple IPs are passed as a single string (e.g. `127.0.0.1,127.0.0.2`). Clicking on an individual link will open the flyout correctly as well. https://github.com/user-attachments/assets/74b05cff-3843-4149-bf27-cd0af07aa558 ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: Elastic Machine <[email protected]>

mistic · 2025-02-11T17:24:12Z

This PR didn't make it into the latest BC for v8.17.2. Updating the labels.

fix issue with multiple ip addresses in strings

f47e675

janmonschke added release_note:fix Team:Threat Hunting:Investigations Security Solution Investigations Team backport:prev-major Backport to (8.x, 8.18, 8.17, 8.16) the previous major branch and other branches in development labels Feb 4, 2025

janmonschke self-assigned this Feb 4, 2025

janmonschke requested review from a team as code owners February 4, 2025 09:22

janmonschke added the backport:prev-minor Backport to (9.0) the previous minor version (i.e. one version back from main) label Feb 4, 2025

PhilippeOberti approved these changes Feb 4, 2025

View reviewed changes

remove unused <Content /> wrapper

a9bc4ce

The content wrapper isn't need anymore and it prevented the ellipsis from working

Merge branch 'main' into security/multiple-ip-links

737cf97

kapral18 approved these changes Feb 5, 2025

View reviewed changes

janmonschke enabled auto-merge (squash) February 5, 2025 15:06

update snapshots

d41e376

janmonschke merged commit dda5381 into elastic:main Feb 5, 2025
9 checks passed

kibanamachine added the v9.1.0 label Feb 5, 2025

kibanamachine mentioned this pull request Feb 5, 2025

[8.18] [SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475) #209907

Merged

kibanamachine mentioned this pull request Feb 5, 2025

[8.x] [SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475) #209908

Merged

kibanamachine mentioned this pull request Feb 5, 2025

[9.0] [SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475) #209909

Merged

kibanamachine added the v8.18.0 label Feb 5, 2025

kibanamachine added the v8.19.0 label Feb 5, 2025

kibanamachine added the v9.0.0 label Feb 5, 2025

janmonschke mentioned this pull request Feb 6, 2025

[8.17] [SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475) #209968

Closed

janmonschke mentioned this pull request Feb 6, 2025

[8.16] [SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475) #209969

Merged

janmonschke mentioned this pull request Feb 6, 2025

[8.17] [SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings (#209475) #209971

Merged

kibanamachine added the v8.17.2 label Feb 6, 2025

kibanamachine added the v8.16.4 label Feb 6, 2025

mistic added v8.17.3 and removed v8.17.2 labels Feb 11, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings #209475

[SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings #209475

janmonschke commented Feb 4, 2025 •

edited by kibanamachine

Loading

elasticmachine commented Feb 4, 2025

PhilippeOberti left a comment

janmonschke commented Feb 5, 2025

janmonschke commented Feb 5, 2025

PhilippeOberti commented Feb 5, 2025

janmonschke commented Feb 5, 2025

kapral18 left a comment •

edited

Loading

kapral18 Feb 5, 2025

janmonschke Feb 5, 2025

PhilippeOberti Feb 5, 2025

kibanamachine commented Feb 5, 2025

elasticmachine commented Feb 5, 2025

kibanamachine commented Feb 5, 2025

janmonschke commented Feb 6, 2025

janmonschke commented Feb 6, 2025

mistic commented Feb 11, 2025

[SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings #209475

[SecuritySolution][Alerts table] Fix issue with multiple ip addresses in strings #209475

Conversation

janmonschke commented Feb 4, 2025 • edited by kibanamachine Loading

Summary

Checklist

elasticmachine commented Feb 4, 2025

PhilippeOberti left a comment

Choose a reason for hiding this comment

janmonschke commented Feb 5, 2025

janmonschke commented Feb 5, 2025

PhilippeOberti commented Feb 5, 2025

janmonschke commented Feb 5, 2025

kapral18 left a comment • edited Loading

Choose a reason for hiding this comment

kapral18 Feb 5, 2025

Choose a reason for hiding this comment

janmonschke Feb 5, 2025

Choose a reason for hiding this comment

PhilippeOberti Feb 5, 2025

Choose a reason for hiding this comment

kibanamachine commented Feb 5, 2025

elasticmachine commented Feb 5, 2025

💚 Build Succeeded

Metrics [docs]

Async chunks

History

kibanamachine commented Feb 5, 2025

💔 Some backports could not be created

Manual backport

Questions ?

janmonschke commented Feb 6, 2025

💚 All backports created successfully

Questions ?

janmonschke commented Feb 6, 2025

💚 All backports created successfully

Questions ?

mistic commented Feb 11, 2025

janmonschke commented Feb 4, 2025 •

edited by kibanamachine

Loading

kapral18 left a comment •

edited

Loading