-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' into handle-disabled-process-collection-v2
- Loading branch information
Showing
34 changed files
with
1,528 additions
and
314 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import { ExceptionListClient } from '../services/exception_lists/exception_list_client'; | ||
| import { MAX_EXCEPTION_LIST_SIZE } from '../../common/constants'; | ||
| import { foundExceptionListItemSchema } from '../../common/schemas'; | ||
| import { NamespaceType } from '../../common/schemas/types'; | ||
| import { validate } from '../../common/siem_common_deps'; | ||
|
|
||
| export const validateExceptionListSize = async ( | ||
| exceptionLists: ExceptionListClient, | ||
| listId: string, | ||
| namespaceType: NamespaceType | ||
| ): Promise<{ body: string; statusCode: number } | null> => { | ||
| const exceptionListItems = await exceptionLists.findExceptionListItem({ | ||
| filter: undefined, | ||
| listId, | ||
| namespaceType, | ||
| page: undefined, | ||
| perPage: undefined, | ||
| sortField: undefined, | ||
| sortOrder: undefined, | ||
| }); | ||
| if (exceptionListItems == null) { | ||
| // If exceptionListItems is null then we couldn't find the list so it may have been deleted | ||
| return { | ||
| body: `Unable to find list id: ${listId} to verify max exception list size`, | ||
| statusCode: 500, | ||
| }; | ||
| } | ||
| const [validatedItems, err] = validate(exceptionListItems, foundExceptionListItemSchema); | ||
| if (err != null) { | ||
| return { | ||
| body: err, | ||
| statusCode: 500, | ||
| }; | ||
| } | ||
| // Unnecessary since validatedItems comes from exceptionListItems which is already | ||
| // checked for null, but typescript fails to detect that | ||
| if (validatedItems == null) { | ||
| return { | ||
| body: `Unable to find list id: ${listId} to verify max exception list size`, | ||
| statusCode: 500, | ||
| }; | ||
| } | ||
| if (validatedItems.total > MAX_EXCEPTION_LIST_SIZE) { | ||
| return { | ||
| body: `Failed to add exception item, exception list would exceed max size of ${MAX_EXCEPTION_LIST_SIZE}`, | ||
| statusCode: 400, | ||
| }; | ||
| } | ||
| return null; | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
70 changes: 70 additions & 0 deletions
70
x-pack/plugins/security_solution/public/resolver/data_access_layer/factory.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import { KibanaReactContextValue } from '../../../../../../src/plugins/kibana_react/public'; | ||
| import { StartServices } from '../../types'; | ||
| import { DataAccessLayer } from '../types'; | ||
| import { | ||
| ResolverRelatedEvents, | ||
| ResolverTree, | ||
| ResolverEntityIndex, | ||
| } from '../../../common/endpoint/types'; | ||
| import { DEFAULT_INDEX_KEY as defaultIndexKey } from '../../../common/constants'; | ||
|
|
||
| /** | ||
| * The data access layer for resolver. All communication with the Kibana server is done through this object. This object is provided to Resolver. In tests, a mock data access layer can be used instead. | ||
| */ | ||
| export function dataAccessLayerFactory( | ||
| context: KibanaReactContextValue<StartServices> | ||
| ): DataAccessLayer { | ||
| const dataAccessLayer: DataAccessLayer = { | ||
| /** | ||
| * Used to get non-process related events for a node. | ||
| */ | ||
| async relatedEvents(entityID: string): Promise<ResolverRelatedEvents> { | ||
| return context.services.http.get(`/api/endpoint/resolver/${entityID}/events`, { | ||
| query: { events: 100 }, | ||
| }); | ||
| }, | ||
| /** | ||
| * Used to get descendant and ancestor process events for a node. | ||
| */ | ||
| async resolverTree(entityID: string, signal: AbortSignal): Promise<ResolverTree> { | ||
| return context.services.http.get(`/api/endpoint/resolver/${entityID}`, { | ||
| signal, | ||
| }); | ||
| }, | ||
|
|
||
| /** | ||
| * Used to get the default index pattern from the SIEM application. | ||
| */ | ||
| indexPatterns(): string[] { | ||
| return context.services.uiSettings.get(defaultIndexKey); | ||
| }, | ||
|
|
||
| /** | ||
| * Used to get the entity_id for an _id. | ||
| */ | ||
| async entities({ | ||
| _id, | ||
| indices, | ||
| signal, | ||
| }: { | ||
| _id: string; | ||
| indices: string[]; | ||
| signal: AbortSignal; | ||
| }): Promise<ResolverEntityIndex> { | ||
| return context.services.http.get('/api/endpoint/resolver/entity', { | ||
| signal, | ||
| query: { | ||
| _id, | ||
| indices, | ||
| }, | ||
| }); | ||
| }, | ||
| }; | ||
| return dataAccessLayer; | ||
| } |
96 changes: 96 additions & 0 deletions
96
...ns/security_solution/public/resolver/data_access_layer/mocks/one_ancestor_two_children.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import { | ||
| ResolverRelatedEvents, | ||
| ResolverTree, | ||
| ResolverEntityIndex, | ||
| } from '../../../../common/endpoint/types'; | ||
| import { mockEndpointEvent } from '../../store/mocks/endpoint_event'; | ||
| import { mockTreeWithNoAncestorsAnd2Children } from '../../store/mocks/resolver_tree'; | ||
| import { DataAccessLayer } from '../../types'; | ||
|
|
||
| interface Metadata { | ||
| /** | ||
| * The `_id` of the document being analyzed. | ||
| */ | ||
| databaseDocumentID: string; | ||
| /** | ||
| * A record of entityIDs to be used in tests assertions. | ||
| */ | ||
| entityIDs: { | ||
| /** | ||
| * The entityID of the node related to the document being analyzed. | ||
| */ | ||
| origin: 'origin'; | ||
| /** | ||
| * The entityID of the first child of the origin. | ||
| */ | ||
| firstChild: 'firstChild'; | ||
| /** | ||
| * The entityID of the second child of the origin. | ||
| */ | ||
| secondChild: 'secondChild'; | ||
| }; | ||
| } | ||
|
|
||
| /** | ||
| * A simple mock dataAccessLayer possible that returns a tree with 0 ancestors and 2 direct children. 1 related event is returned. The parameter to `entities` is ignored. | ||
| */ | ||
| export function oneAncestorTwoChildren(): { dataAccessLayer: DataAccessLayer; metadata: Metadata } { | ||
| const metadata: Metadata = { | ||
| databaseDocumentID: '_id', | ||
| entityIDs: { origin: 'origin', firstChild: 'firstChild', secondChild: 'secondChild' }, | ||
| }; | ||
| return { | ||
| metadata, | ||
| dataAccessLayer: { | ||
| /** | ||
| * Fetch related events for an entity ID | ||
| */ | ||
| relatedEvents(entityID: string): Promise<ResolverRelatedEvents> { | ||
| return Promise.resolve({ | ||
| entityID, | ||
| events: [ | ||
| mockEndpointEvent({ | ||
| entityID, | ||
| name: 'event', | ||
| timestamp: 0, | ||
| }), | ||
| ], | ||
| nextEvent: null, | ||
| }); | ||
| }, | ||
|
|
||
| /** | ||
| * Fetch a ResolverTree for a entityID | ||
| */ | ||
| resolverTree(): Promise<ResolverTree> { | ||
| return Promise.resolve( | ||
| mockTreeWithNoAncestorsAnd2Children({ | ||
| originID: metadata.entityIDs.origin, | ||
| firstChildID: metadata.entityIDs.firstChild, | ||
| secondChildID: metadata.entityIDs.secondChild, | ||
| }) | ||
| ); | ||
| }, | ||
|
|
||
| /** | ||
| * Get an array of index patterns that contain events. | ||
| */ | ||
| indexPatterns(): string[] { | ||
| return ['index pattern']; | ||
| }, | ||
|
|
||
| /** | ||
| * Get entities matching a document. | ||
| */ | ||
| entities(): Promise<ResolverEntityIndex> { | ||
| return Promise.resolve([{ entity_id: metadata.entityIDs.origin }]); | ||
| }, | ||
| }, | ||
| }; | ||
| } |
Oops, something went wrong.