wazuh-dashboard-plugins icon indicating copy to clipboard operation
wazuh-dashboard-plugins copied to clipboard

Replace the tables on the Security section with TableWzAPI component

Open Desvelao opened this issue 1 year ago • 3 comments

Wazuh Elastic Rev Security
4.x 7.x 4xxx Basic, ODFE, Xpack
Browser
Chrome, Firefox, Safari, etc

Description We are working to implement a new search bar, and redoing some sections that have a search bar and table to use the reusable TableWzAPI component. See https://github.com/wazuh/wazuh-kibana-app/issues/4312.

It would be interesting to unify the tables in the Security section to use the new search bar. Currently, these sections retrieve the first 500 results (this is a bug) and use a EuiInMemoryTable component with the provided search bar. The problem is that these tables are using data from 2 different endpoints, and this reduces the possibility of using the TableWzAPI component. Moreover, some searches could not be possible due to how the data is saved in the data endpoint.

For example, the section Security/Users, displays data about the Wazuh API users (username, allow run as and roles). The data is coming from:

  • GET /security/users
  • GET /security/roles and combined to generate the table.

In the case, we want to implement the new search bar, the suggestions for the Roles will display number IDs instead of the names.

image

The same situation happens in the rest of the Security sections.

Desvelao avatar May 19 '23 12:05 Desvelao

Since the 4.8.0 branch is not available, I started working from the 4.7.0 branch. Then I realized that in that branch there are no changes to the new search bar applied in 4.6.0. For this reason, I am going to start from the 4.6.0 branch.

lucianogorza avatar Aug 16 '23 14:08 lucianogorza

According to the documentation: https://documentation.wazuh.com/current/user-manual/api/reference.html#operation/api.controllers.security_controller.get_users It is not possible to filter or search the user's GET endpoint by individual fields. There is only a "search" parameter that allows you to specify a string. Therefore, to implement the TabeWzApi component, we have two options:

  • Make changes to the TableWzApi component to optionally support only a general search using the "search" parameter instead of the "q" parameter.

  • Modify the API to support the "q" parameter and thus enable specific search for fields.

lucianogorza avatar Aug 16 '23 16:08 lucianogorza

After doing an analysis, I think it is better to see the possibility of incorporating the "q" parameter to the GET endpoints of the security section, instead of adapting the search bar for the "search" parameter, because it would be inconsistent for the user and would add unnecessary code to the component.

lucianogorza avatar Aug 16 '23 19:08 lucianogorza