Skip to content

[sentinel_one] Update Deprecated Visualizations and Enhanced Dashboards - #15437

Merged
mohitjha-elastic merged 4 commits into
elastic:mainfrom
mohitjha-elastic:sentinel_one-1.40.0
Oct 7, 2025
Merged

[sentinel_one] Update Deprecated Visualizations and Enhanced Dashboards#15437
mohitjha-elastic merged 4 commits into
elastic:mainfrom
mohitjha-elastic:sentinel_one-1.40.0

Conversation

@mohitjha-elastic

@mohitjha-elastic mohitjha-elastic commented Sep 23, 2025

Copy link
Copy Markdown
Contributor

Proposed commit message

sentinel_one: Update dashboards with new screenshots, navigation panels, and visualizations.

Update all dashboards by replacing outdated screenshots and adding navigation panels for
improved usability. Migrated from legacy metrics visualizations to the new Metrics visualization
for consistency and better performance. Additionally, added controls to all dashboards to enhance 
interactivity and user experience.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Clone integrations repo.
  • Install elastic package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/sentinel_one directory.
  • Run the following command to run tests.

elastic-package test -v

Related Issue
@mohitjha-elastic mohitjha-elastic self-assigned this Sep 23, 2025
@mohitjha-elastic mohitjha-elastic added the enhancement New feature or request label Sep 23, 2025
@mohitjha-elastic
mohitjha-elastic requested a review from a team as a code owner September 23, 2025 11:38
@mohitjha-elastic mohitjha-elastic added dashboard Relates to a Kibana dashboard bug, enhancement, or modification. Integration:sentinel_one SentinelOne Category: Integration quality Category: Quality used for SI planning Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Sep 23, 2025
@elasticmachine

elasticmachine commented Sep 23, 2025

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
efd6
efd6 reviewed Sep 23, 2025
View reviewed changes
Comment thread packages/sentinel_one/img/sentinel-one-activities-dashboard.png

@efd6 efd6 Sep 23, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should move the filters from the dashboard to the visualisations so that users do not remove them accidentally.
kcreddy
kcreddy reviewed Sep 24, 2025
View reviewed changes
Comment thread packages/sentinel_one/img/sentinel-one-agents-dashboard.png
Comment thread packages/sentinel_one/kibana/dashboard/sentinel_one-acd472d9-a6b7-4a53-a58d-06c315764c8d.json
Comment on lines +415 to +422
"links": [
{
"destinationRefName": "link_81cc8355-af43-42be-a636-6650086f4e79_dashboard",
"id": "81cc8355-af43-42be-a636-6650086f4e79",
"label": "Activities",
"order": 0,
"type": "dashboardLink"
},

@kcreddy kcreddy Sep 24, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We would need to apply fix from: #15016 as we don't want to carry the filters/queries from previous dashboards, it may even break them.
By default the links panel carries the filters, so disable the option and re-export dashboards.

Image

cc: @efd6, I think this could be applicable for all integrations when migrating to links panels: #15075

@efd6 efd6 Sep 24, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a very good reason why filters should be on the visualisation and not on the dashboard. I think that we should use the filters and queries from the origin, but that those filters should only be filters that the user has applied and the filters that are required for correctness are not affected.

@kcreddy kcreddy Sep 25, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we enable it, in scenario when users apply the filter/query on a custom field, say sentinel_one.threat.fieldA: true on Threat dashboard, and when the user navigates to alert dashboard the experience would be broken (because this custom field doesn't exist in alert data stream).
Is that expected correctly?

@efd6 efd6 Sep 28, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, can you clarify? If the user applies a filter and it doesn't work, they are the person who has applied it and so should be aware of its presence, so they can rectify it. ISTM that it should not break, but if it does the solution would be to remove it. On the other hand, if an analyst is working on a train of thought which involves a specific filter, and wants to correlate two dashboards, then keeping the filter in place makes sense. Now, this may not be the situation always, but it is easier to remove a filter than it is to have to replace it when the system has removed it. I don't think there is definitively correct default, but IMO leaving them in place makes more sense.

@kcreddy kcreddy Sep 30, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I haven't thought from an analyst POV, it makes sense that way. Thanks!
We can let it be at default (carry filters/queries) for now.

@kcreddy kcreddy Sep 30, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mohitjha-elastic, can you please revert the change for links panel and allow them to carry the filters?

@mohitjha-elastic mohitjha-elastic Oct 6, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! @efd6 @kcreddy
Reverted the changes related to the nav links panel carrying the filter. Please take a look.
@mohitjha-elastic
Resolve review comments.
b8e646d 
1. Add filter at viz level.
2. Remove links of exporting filters in nav links of dashboard.
3. Made the width same for all the nav panels across all dashboards.
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Sep 26, 2025

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
@elastic-sonarqube

elastic-sonarqube Bot commented Sep 26, 2025

Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
kcreddy
kcreddy approved these changes Oct 6, 2025
View reviewed changes

@kcreddy kcreddy left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks @mohitjha-elastic
@elasticmachine

elasticmachine commented Oct 6, 2025

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @mohitjha-elastic
efd6
efd6 approved these changes Oct 7, 2025
View reviewed changes

@efd6 efd6 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks
@mohitjha-elastic
mohitjha-elastic merged commit 47a06e1 into elastic:main Oct 7, 2025
7 checks passed
@mohitjha-elastic
mohitjha-elastic deleted the sentinel_one-1.40.0 branch October 7, 2025 06:59
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Oct 7, 2025

Copy link
Copy Markdown
Contributor

Package sentinel_one - 1.40.0 containing this change is available at https://epr.elastic.co/package/sentinel_one/1.40.0/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Category: Integration quality Category: Quality used for SI planning dashboard Relates to a Kibana dashboard bug, enhancement, or modification. enhancement New feature or request Integration:sentinel_one SentinelOne Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

4 participants

@mohitjha-elastic @elasticmachine @kcreddy @efd6