(Backport 6.0) - Return remediation steps with events

changelog/unreleased/issue-19354.toml

@@ -0,0 +1,5 @@
+type = "added"
+message = "Added remediation steps to general events view."
+
+issues = ["19354"]
+pulls = ["19853"]

graylog2-server/src/main/java/org/graylog/events/search/EventsSearchResult.java

@@ -20,7 +20,9 @@
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.google.auto.value.AutoValue;
 import com.google.common.collect.ImmutableMap;
+import jakarta.annotation.Nullable;
 import org.graylog.events.event.EventDto;
+import org.graylog.events.processor.EventDefinitionDto;
 
 import java.util.List;
 import java.util.Map;
@@ -109,8 +111,16 @@ public static abstract class ContextEntity {
         @JsonProperty("description")
         public abstract String description();
 
+        @Nullable
+        @JsonProperty(EventDefinitionDto.FIELD_REMEDIATION_STEPS)
+        public abstract String remediationSteps();
+
         public static ContextEntity create(String id, String title, String description) {
-            return new AutoValue_EventsSearchResult_ContextEntity(id, title, description);
+            return new AutoValue_EventsSearchResult_ContextEntity(id, title, description, null);
+        }
+
+        public static ContextEntity create(String id, String title, String description, String remediationSteps) {
+            return new AutoValue_EventsSearchResult_ContextEntity(id, title, description, remediationSteps);
         }
     }
 }

graylog2-server/src/main/java/org/graylog/events/search/EventsSearchService.java

@@ -156,6 +156,7 @@ private Map<String, EventsSearchResult.ContextEntity> lookupEventDefinitions(Set
                 .map(eventDefinitionService::get)
                 .filter(Optional::isPresent)
                 .map(Optional::get)
-                .collect(Collectors.toMap(EventDefinitionDto::id, d -> EventsSearchResult.ContextEntity.create(d.id(), d.title(), d.description())));
+                .collect(Collectors.toMap(EventDefinitionDto::id,
+                        d -> EventsSearchResult.ContextEntity.create(d.id(), d.title(), d.description(), d.remediationSteps())));
     }
 }

graylog2-web-interface/src/components/events/events/EventDetails.tsx

@@ -20,6 +20,7 @@ import isEmpty from 'lodash/isEmpty';
 import usePluginEntities from 'hooks/usePluginEntities';
 import { Col, Row } from 'components/bootstrap';
 import { Timestamp } from 'components/common';
+import { MarkdownPreview } from 'components/common/MarkdownEditor';
 import type { Event, EventDefinitionContext } from 'components/events/events/types';
 import EventFields from 'components/events/events/EventFields';
 import EventDefinitionLink from 'components/event-definitions/event-definitions/EventDefinitionLink';
@@ -74,6 +75,18 @@ const EventDetails = ({ event, eventDefinitionContext }: Props) => {
              
             ({(plugin && plugin.displayName) || event.event_definition_type})
           </dd>
+          <dt>Remediation Steps</dt>
+          <dd>
+            {eventDefinitionContext?.remediation_steps ? (
+              <MarkdownPreview show
+                               withFullView
+                               noBorder
+                               noBackground
+                               value={eventDefinitionContext.remediation_steps} />
+            ) : (
+              <i>No remediation steps</i>
+            )}
+          </dd>
           {event.replay_info && (
             <>
               <dt>Actions</dt>
@@ -88,14 +101,14 @@ const EventDetails = ({ event, eventDefinitionContext }: Props) => {
       <Col md={6}>
         <dl>
           {event.timerange_start && event.timerange_end && (
-          <>
-            <dt>Aggregation time range</dt>
-            <dd>
-              <Timestamp dateTime={event.timerange_start} />
-                  &ensp;&mdash;&ensp;
-              <Timestamp dateTime={event.timerange_end} />
-            </dd>
-          </>
+            <>
+              <dt>Aggregation time range</dt>
+              <dd>
+                <Timestamp dateTime={event.timerange_start} />
+                &ensp;&mdash;&ensp;
+                <Timestamp dateTime={event.timerange_end} />
+              </dd>
+            </>
           )}
           <dt>Event Key</dt>
           <dd>{event.key || 'No Key set for this Event.'}</dd>

graylog2-web-interface/src/components/events/events/types.ts

@@ -41,4 +41,6 @@ export type Event = {
 export type EventDefinitionContext = {
   id: string,
   title: string,
+  remediation_steps?: string,
+  description?: string,
 };