Skip to content

[ti_abusech] Add Support for New Dashboards and Update Deprecated Visualizations - #15344

Merged
mohitjha-elastic merged 4 commits into
elastic:mainfrom
mohitjha-elastic:ti_abusech-3.4.0
Sep 22, 2025
Merged

[ti_abusech] Add Support for New Dashboards and Update Deprecated Visualizations#15344
mohitjha-elastic merged 4 commits into
elastic:mainfrom
mohitjha-elastic:ti_abusech-3.4.0

Conversation

@mohitjha-elastic

@mohitjha-elastic mohitjha-elastic commented Sep 16, 2025 •
edited by efd6
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

ti_abusech: add support for new dashboards and update deprecated visualizations

Added support for the 'Domain and IP Addresses' dashboard and
the 'Software and x509 Certificates' dashboard to enhance coverage and
visibility of threat indicators. 

Updated deprecated visualization charts and applied best practices
across the existing Overview, Files, and URLs dashboards to improve
performance, maintainability, and consistency.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Clone integrations repo.
  • Install elastic package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/ti_abusech directory.
  • Run the following command to run tests.

elastic-package test -v

Related Issue
@mohitjha-elastic mohitjha-elastic self-assigned this Sep 16, 2025
@mohitjha-elastic mohitjha-elastic added enhancement New feature or request dashboard Relates to a Kibana dashboard bug, enhancement, or modification. Integration:ti_abusech abuse.ch Category: Integration quality Category: Quality used for SI planning Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Sep 16, 2025
@mohitjha-elastic
mohitjha-elastic marked this pull request as ready for review September 16, 2025 13:42
@mohitjha-elastic
mohitjha-elastic requested a review from a team as a code owner September 16, 2025 13:42
@elasticmachine

elasticmachine commented Sep 16, 2025

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
efd6
efd6 reviewed Sep 16, 2025
View reviewed changes
Comment thread packages/ti_abusech/kibana/dashboard/ti_abusech-2457fb50-3bc3-11ec-ae8c-7d00429ad420.json Outdated
"params": {
"fontSize": 12,
"markdown": "**Navigation**\n\n[abuse.ch Overview](/app/dashboards#/view/ti_abusech-c0d8d1f0-3b20-11ec-ae50-2fdf1e96c6a6) \n[abuse.ch Files](/app/dashboards#/view/ti_abusech-6a90c980-3b32-11ec-ae50-2fdf1e96c6a6) \n**abuse.ch URLs** \n\n[Integrations Page](/app/integrations/detail/ti_abusech/overview)\n\n\n**Overview**\n\nThis dashboard is an overview of the different threat intelligence indicators with a **threat.indicator.type: url**. \n\nThe dashboard is made to provide general statistics and show the health of your indicators like popular domains, file extensions, statistics about how many unique indicators are ingested and other relevant information.",
"markdown": "**Navigation**\n\n[abuse.ch Domain and IP Addresses](/app/dashboards#/view/ti_abusech-d11a94be-9b9f-42f8-9fed-d5e89005f24d) \n[abuse.ch Files](/app/dashboards#/view/ti_abusech-6a90c980-3b32-11ec-ae50-2fdf1e96c6a6) \n[abuse.ch Overview](/app/dashboards#/view/ti_abusech-c0d8d1f0-3b20-11ec-ae50-2fdf1e96c6a6) \n[abuse.ch Software and x509 Certificates](/app/dashboards#/view/ti_abusech-68ac01ad-dddf-476c-9a54-8c33c1047e53) \n**abuse.ch URLs**\n\n**[Integrations Page](/app/integrations/detail/ti_abusech/overview)**\n\n\n**Overview**\n\nThis dashboard is an overview of the different threat intelligence indicators with a **threat.indicator.type: url**. \n\nThe dashboard is made to provide general statistics and show the health of your indicators like popular domains, file extensions, statistics about how many unique indicators are ingested and other relevant information.",

@efd6 efd6 Sep 16, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we migrate to links panels instead?
Comment thread packages/ti_abusech/img/abusech-softwares.png

@efd6 efd6 Sep 16, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's disconcerting that the abuse.ch text gets linkified. If we can't avoid that, perhaps it should be removed.

@mohitjha-elastic mohitjha-elastic Sep 18, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! Removed the text and added links panels.
efd6
efd6 reviewed Sep 18, 2025
View reviewed changes
Comment thread packages/ti_abusech/kibana/links/ti_abusech-1bc63d46-478e-4a7b-b888-f9294909fd89.json Outdated

@efd6 efd6 Sep 18, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like package spec does not know about this. Where did it come from?

@mohitjha-elastic mohitjha-elastic Sep 19, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I created the link panels and saved them to the library, intending to reuse them across other dashboards, similar to how we do it for saved searches. However, it seems the Elastic package doesn’t support this approach, and the check is failing.

For now, I’ve removed the links folder and added the links directly to each dashboard individually.

Ideally, this should work as expected since we should be able to save navigations to the library and reuse them.
WDYT?

@efd6 efd6 Sep 22, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, this is a feature that should exist if it doesn't.

@mohitjha-elastic mohitjha-elastic Sep 22, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! I’ve created an issue in the elastic-package repo to track this further.
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Sep 19, 2025

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

Package ti_abusech 👍(5) 💚(2) 💔(5)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
url 10449.32 7874.02 -2575.3 (-24.65%) 💔
ja3_fingerprints 23809.52 7955.45 -15854.07 (-66.59%) 💔
malware 16129.03 7530.12 -8598.91 (-53.31%) 💔
malwarebazaar 15151.52 12315.27 -2836.25 (-18.72%) 💔
sslblacklist 20533.88 16420.36 -4113.52 (-20.03%) 💔

To see the full report comment with /test benchmark fullreport
@elasticmachine

elasticmachine commented Sep 19, 2025

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @mohitjha-elastic
@elastic-sonarqube

elastic-sonarqube Bot commented Sep 19, 2025

Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
99.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
@mohitjha-elastic
mohitjha-elastic merged commit eddc7d2 into elastic:main Sep 22, 2025
9 checks passed
@mohitjha-elastic
mohitjha-elastic deleted the ti_abusech-3.4.0 branch September 22, 2025 08:31
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Sep 22, 2025

Copy link
Copy Markdown
Contributor

Package ti_abusech - 3.4.0 containing this change is available at https://epr.elastic.co/package/ti_abusech/3.4.0/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Category: Integration quality Category: Quality used for SI planning dashboard Relates to a Kibana dashboard bug, enhancement, or modification. enhancement New feature or request Integration:ti_abusech abuse.ch Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants

@mohitjha-elastic @elasticmachine @efd6