[Cases] Add import/export functionality #110148

jonathan-buttner · 2021-08-25T20:52:22Z

This PR allows the cases saved objects to be exported and imported. The functionality is provided through the Saved Objects Management Page.

Since cases uses inbound references, when a case is selected for export we search for all comments and user actions that reference that case.

What is exported?

The Case itself (title, settings, reporter, tags, etc)
Comments/attachments
- Alerts that are attached to a case will have their information exported (id, index, rule information etc) but the body of the alert will not be exported
User actions
The connector if one exists

Permissions

For a user to view the Saved Objects Management Page they must have the Saved Objects Management privilege

Granting this privilege also grants the user all access to all saved objects. So it is possible for a user to have no Cases privileges but still be able to import/export via the Saved Objects Management privilege.

Issues

We're tracking some work in this issue: [SavedObjects] Ability to allow a type to be importable without it showing in the UI #110146
- Without that all the user actions and comments show up in the Saved Objects Management Page.
No validation on import
- The Saved Objects framework doesn't provide the ability to perform validation on import at this time: [Saved Objects] Import hook/interceptor for saved object management #109189 (comment)

Release note

Cases can now be imported and exported through the Saved Objects Management Page. Only the Cases themselves need to be selected for export. The Case title will be shown in the Saved Objects Management Page table's title column. Cases are also labeled with the case icon:

Rows labeled cases-comment or cases-user-actions should be ignored and not selected when exporting.

…export

jonathan-buttner · 2021-09-01T15:25:45Z

x-pack/plugins/cases/server/saved_object_types/import_export/export.ts

+import { createCaseError, defaultSortField } from '../../common';
+import { ESCaseAttributes } from '../../services/cases/types';
+
+export async function handleExport({


We intentionally do not want to do authorization checks while exporting because it is valid for a user to export a case while not having either security solution or observability cases read privileges.

Why is valid? It seems like users can always read a case this way even if they do not have read access.

Christos and I talked offline. This is the current behavior with other entities within Kibana. We don't have a way to enforce the feature privileges for import/export right now.

jonathan-buttner · 2021-09-01T15:27:35Z

x-pack/plugins/cases/server/saved_object_types/import_export/export.ts

+    }
+
+    const [{ savedObjects }] = await coreSetup.getStartServices();
+    const savedObjectsClient = savedObjects.getScopedClient(context.request, {


I'm creating the saved objects client directly here instead of using our service layer because the service layer can mutate the data (for example creating the connector_id field when the objects are returned). We can also make more performant calls here for both the attachments and user actions at the same time using point in time searches instead of the implementation that the service layer uses.

jonathan-buttner · 2021-09-01T15:30:05Z

x-pack/plugins/cases/server/saved_object_types/import_export/export.ts

+  }
+}
+
+async function getAttachmentsAndUserActionsForCases(


We only need to export the attachments and user actions. The connectors are stored as outbound references so they are exported automatically by the framework.

jonathan-buttner · 2021-09-01T15:31:39Z

x-pack/plugins/cases/server/saved_object_types/import_export/export.ts

+  sortField: string;
+  type: string;
+}): Promise<Array<SavedObject<T>>> {
+  const references = caseIds.map((id) => ({ type: CASE_SAVED_OBJECT, id }));


This is basically searching for all the case ids for attachments or user actions at the same time.

elasticmachine · 2021-09-01T15:42:19Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

jonathan-buttner · 2021-09-07T14:38:41Z

@elasticmachine merge upstream

jonathan-buttner · 2021-09-08T19:48:24Z

@elasticmachine merge upstream

jonathan-buttner · 2021-09-09T13:06:03Z

@elasticmachine merge upstream

jonathan-buttner · 2021-09-13T14:59:30Z

@elasticsearchmachine merge upstream

jonathan-buttner · 2021-09-13T15:26:23Z

@elasticmachine merge upstream

kibanamachine · 2021-09-13T17:40:16Z

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

💚 Build #152208 succeeded fe6ba69
💚 Build #151590 succeeded 9aee194
💔 Build #151528 failed 79e9a3d
💛 Build #150336 was flaky 93c25fd
💔 Build #150231 failed 0206986

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cnasikas

Tested locally. Everything worked as expected. LGTM!

jonathan-buttner · 2021-09-14T17:33:52Z

@cnasikas found an issue with the import where if the case is deleted and then imported it will mark the case as needing to be pushed. We talked about possible solutions for this and there are many other situations depending on what case is being imported that could cause us to get into a state where we think we need to push when we actually don't need to. For now we're going to leave it as it is and investigate other possible solutions for tracking when a case needs to be pushed. Like keeping a counter associated with the case to mark the sequential version of the case so that we don't need to use the user actions to determine if the case needs to be pushed.

* Working export but not import * Adding user action import flag * Adding a few integration tests * Adding connector test * Finishing integration tests * Removing connector after each test to restore original state * Bumping migration version for comment so Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

kibanamachine · 2021-09-14T17:45:31Z

💚 Backport successful

Status	Branch	Result
✅	7.x

This backport PR will be merged automatically after passing CI.

kobelb · 2021-09-14T18:20:58Z

Nice work @jonathan-buttner 🥇

* Working export but not import * Adding user action import flag * Adding a few integration tests * Adding connector test * Finishing integration tests * Removing connector after each test to restore original state * Bumping migration version for comment so Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Jonathan Buttner <56361221+jonathan-buttner@users.noreply.github.com>

Working export but not import

c71dbfa

jonathan-buttner added v8.0.0 Team:Threat Hunting Security Solution Threat Hunting Team Feature:Cases Cases feature release_note:feature Makes this part of the condensed release notes auto-backport Deprecated - use backport:version if exact versions are needed v7.16.0 labels Aug 25, 2021

Adding user action import flag

0953111

jonathan-buttner mentioned this pull request Aug 25, 2021

[SavedObjects] Ability to allow a type to be importable without it showing in the UI #110146

Closed

jonathan-buttner added 6 commits August 26, 2021 13:38

Merge branch 'master' of github.com:elastic/kibana into cases-import-…

7e45b43

…export

Adding a few integration tests

756283f

Merge branch 'master' of github.com:elastic/kibana into cases-import-…

408001a

…export

Adding connector test

5f8895e

Merge branch 'master' of github.com:elastic/kibana into cases-import-…

4e1ce91

…export

Finishing integration tests

0206986

jonathan-buttner commented Sep 1, 2021

View reviewed changes

jonathan-buttner requested review from cnasikas and semd September 1, 2021 15:35

jonathan-buttner marked this pull request as ready for review September 1, 2021 15:42

jonathan-buttner requested a review from a team as a code owner September 1, 2021 15:42

Removing connector after each test to restore original state

93c25fd

Merge branch 'master' into cases-import-export

79e9a3d

rudolf mentioned this pull request Sep 7, 2021

Import and export Cases using saved-object management #82533

Closed

jonathan-buttner mentioned this pull request Sep 7, 2021

[SavedObjects] Import causes text field to have a newline character #111436

Closed

Bumping migration version for comment so

9aee194

jonathan-buttner linked an issue Sep 7, 2021 that may be closed by this pull request

Import and export Cases using saved-object management #82533

Closed

Merge branch 'master' into cases-import-export

f9e38b0

Merge branch 'master' into cases-import-export

fe6ba69

Merge branch 'master' into cases-import-export

559c6d3

cnasikas added the Team:Threat Hunting:Cases label Sep 13, 2021

cnasikas approved these changes Sep 13, 2021

View reviewed changes

jonathan-buttner merged commit 2567c4f into elastic:master Sep 14, 2021

jonathan-buttner deleted the cases-import-export branch September 14, 2021 17:42

kibanamachine mentioned this pull request Sep 14, 2021

[7.x] [Cases] Add import/export functionality (#110148) #112155

Merged

rudolf mentioned this pull request Sep 21, 2021

[Saved objects] Searching in Stack Management/Saved objects throws an error notification #112659

Closed

monina-n requested review from monina-n and removed request for monina-n October 5, 2021 01:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Cases] Add import/export functionality #110148

[Cases] Add import/export functionality #110148

jonathan-buttner commented Aug 25, 2021 •

edited

Loading

jonathan-buttner Sep 1, 2021

cnasikas Sep 13, 2021

jonathan-buttner Sep 13, 2021

jonathan-buttner Sep 1, 2021

jonathan-buttner Sep 1, 2021

jonathan-buttner Sep 1, 2021

elasticmachine commented Sep 1, 2021

jonathan-buttner commented Sep 7, 2021

jonathan-buttner commented Sep 8, 2021

jonathan-buttner commented Sep 9, 2021

jonathan-buttner commented Sep 13, 2021

jonathan-buttner commented Sep 13, 2021

kibanamachine commented Sep 13, 2021

cnasikas left a comment

jonathan-buttner commented Sep 14, 2021

kibanamachine commented Sep 14, 2021

kobelb commented Sep 14, 2021

[Cases] Add import/export functionality #110148

[Cases] Add import/export functionality #110148

Conversation

jonathan-buttner commented Aug 25, 2021 • edited Loading

What is exported?

Permissions

Issues

Release note

jonathan-buttner Sep 1, 2021

Choose a reason for hiding this comment

cnasikas Sep 13, 2021

Choose a reason for hiding this comment

jonathan-buttner Sep 13, 2021

Choose a reason for hiding this comment

jonathan-buttner Sep 1, 2021

Choose a reason for hiding this comment

jonathan-buttner Sep 1, 2021

Choose a reason for hiding this comment

jonathan-buttner Sep 1, 2021

Choose a reason for hiding this comment

elasticmachine commented Sep 1, 2021

jonathan-buttner commented Sep 7, 2021

jonathan-buttner commented Sep 8, 2021

jonathan-buttner commented Sep 9, 2021

jonathan-buttner commented Sep 13, 2021

jonathan-buttner commented Sep 13, 2021

kibanamachine commented Sep 13, 2021

💚 Build Succeeded

Metrics [docs]

History

cnasikas left a comment

Choose a reason for hiding this comment

jonathan-buttner commented Sep 14, 2021

kibanamachine commented Sep 14, 2021

💚 Backport successful

kobelb commented Sep 14, 2021

jonathan-buttner commented Aug 25, 2021 •

edited

Loading