[Security Solution] [Endpoint] Add by policy to event filters generator

x-pack/plugins/security_solution/common/endpoint/data_generators/event_filter_generator.ts

@@ -10,14 +10,15 @@ import { ENDPOINT_EVENT_FILTERS_LIST_ID } from '@kbn/securitysolution-list-const
 import { BaseDataGenerator } from './base_data_generator';
 import { getCreateExceptionListItemSchemaMock } from '../../../../lists/common/schemas/request/create_exception_list_item_schema.mock';
 
+const EFFECT_SCOPE_TYPES = ['policy:', 'policy:all'];
 export class EventFilterGenerator extends BaseDataGenerator<CreateExceptionListItemSchema> {
   generate(): CreateExceptionListItemSchema {
     const overrides: Partial<CreateExceptionListItemSchema> = {
       name: `generator event ${this.randomString(5)}`,
       list_id: ENDPOINT_EVENT_FILTERS_LIST_ID,
       item_id: `generator_endpoint_event_filter_${this.randomUUID()}`,
       os_types: [this.randomOSFamily()] as CreateExceptionListItemSchema['os_types'],
-      tags: ['policy:all'],
+      tags: [this.randomChoice(EFFECT_SCOPE_TYPES)],
       namespace_type: 'agnostic',
       meta: undefined,
     };

x-pack/plugins/security_solution/scripts/endpoint/common/random_policy_id_generator.ts

@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ToolingLog } from '@kbn/dev-utils';
+import { KbnClient } from '@kbn/test';
+import { AxiosResponse } from 'axios';
+import { indexFleetEndpointPolicy } from '../../../common/endpoint/data_loaders/index_fleet_endpoint_policy';
+import {
+  PACKAGE_POLICY_API_ROUTES,
+  PACKAGE_POLICY_SAVED_OBJECT_TYPE,
+} from '../../../../fleet/common/constants';
+import { setupFleetForEndpoint } from '../../../common/endpoint/data_loaders/setup_fleet_for_endpoint';
+import { GetPolicyListResponse } from '../../../public/management/pages/policy/types';
+
+const fetchEndpointPolicies = (
+  kbnClient: KbnClient
+): Promise<AxiosResponse<GetPolicyListResponse>> => {
+  return kbnClient.request<GetPolicyListResponse>({
+    method: 'GET',
+    path: PACKAGE_POLICY_API_ROUTES.LIST_PATTERN,
+    query: {
+      perPage: 100,
+      kuery: `${PACKAGE_POLICY_SAVED_OBJECT_TYPE}.package.name: endpoint`,
+    },
+  });
+};
+
+// Setup a list of real endpoint policies and return a method to randomly select one
+export const randomPolicyIdGenerator: (
+  kbn: KbnClient,
+  log: ToolingLog
+) => Promise<() => string> = async (kbn, log) => {
+  log.info('Setting up fleet');
+  const fleetResponse = await setupFleetForEndpoint(kbn);
+
+  log.info('Generarting test policies...');
+  const randomN = (max: number): number => Math.floor(Math.random() * max);
+  const policyIds: string[] =
+    (await fetchEndpointPolicies(kbn)).data.items.map((policy) => policy.id) || [];
+
+  // If the number of existing policies is less than 5, then create some more policies
+  if (policyIds.length < 5) {
+    for (let i = 0, t = 5 - policyIds.length; i < t; i++) {
+      policyIds.push(
+        (
+          await indexFleetEndpointPolicy(
+            kbn,
+            `Policy for exceptions assignment ${i + 1}`,
+            fleetResponse.endpointPackage.version
+          )
+        ).integrationPolicies[0].id
+      );
+    }
+  }
+
+  return () => policyIds[randomN(policyIds.length)];
+};

x-pack/plugins/security_solution/scripts/endpoint/event_filters/index.ts

@@ -18,6 +18,7 @@ import {
   EXCEPTION_LIST_URL,
 } from '@kbn/securitysolution-list-constants';
 import { EventFilterGenerator } from '../../../common/endpoint/data_generators/event_filter_generator';
+import { randomPolicyIdGenerator } from '../common/random_policy_id_generator';
 
 export const cli = () => {
   run(
@@ -70,16 +71,26 @@ const createEventFilters: RunFn = async ({ flags, log }) => {
 
   await ensureCreateEndpointEventFiltersList(kbn);
 
+  const randomPolicyId = await randomPolicyIdGenerator(kbn, log);
+
   await pMap(
     Array.from({ length: flags.count as unknown as number }),
-    () =>
-      kbn
+    () => {
+      const body = eventGenerator.generate();
+      if (body.tags?.length && body.tags[0] !== 'policy:all') {
+        const nmExceptions = Math.floor(Math.random() * 3) || 1;
+        body.tags = Array.from({ length: nmExceptions }, () => {
+          return `policy:${randomPolicyId()}`;
+        });
+      }
+      return kbn
         .request({
           method: 'POST',
           path: EXCEPTION_LIST_ITEM_URL,
-          body: eventGenerator.generate(),
+          body,
         })
-        .catch((e) => handleThrowAxiosHttpError(e)),
+        .catch((e) => handleThrowAxiosHttpError(e));
+    },
     { concurrency: 10 }
   );
 };

x-pack/plugins/security_solution/scripts/endpoint/host_isolation_exceptions/index.ts

@@ -15,15 +15,9 @@ import {
   EXCEPTION_LIST_URL,
 } from '@kbn/securitysolution-list-constants';
 import { KbnClient } from '@kbn/test';
-import { AxiosError, AxiosResponse } from 'axios';
-import { indexFleetEndpointPolicy } from '../../../common/endpoint/data_loaders/index_fleet_endpoint_policy';
-import {
-  PACKAGE_POLICY_API_ROUTES,
-  PACKAGE_POLICY_SAVED_OBJECT_TYPE,
-} from '../../../../fleet/common/constants';
+import { AxiosError } from 'axios';
 import { HostIsolationExceptionGenerator } from '../../../common/endpoint/data_generators/host_isolation_exception_generator';
-import { setupFleetForEndpoint } from '../../../common/endpoint/data_loaders/setup_fleet_for_endpoint';
-import { GetPolicyListResponse } from '../../../public/management/pages/policy/types';
+import { randomPolicyIdGenerator } from '../common/random_policy_id_generator';
 
 export const cli = () => {
   run(
@@ -74,36 +68,10 @@ const createHostIsolationException: RunFn = async ({ flags, log }) => {
   const exceptionGenerator = new HostIsolationExceptionGenerator();
   const kbn = new KbnClient({ log, url: flags.kibana as string });
 
-  log.info('Setting up fleet');
-  const fleetResponse = await setupFleetForEndpoint(kbn);
-
   log.info('Creating Host isolation exceptions list');
   await ensureCreateEndpointHostIsolationExceptionList(kbn);
 
-  // Setup a list of real endpoint policies and return a method to randomly select one
-  const randomPolicyId: () => string = await (async () => {
-    log.info('Generarting test policies...');
-    const randomN = (max: number): number => Math.floor(Math.random() * max);
-    const policyIds: string[] =
-      (await fetchEndpointPolicies(kbn)).data.items.map((policy) => policy.id) || [];
-
-    // If the number of existing policies is less than 5, then create some more policies
-    if (policyIds.length < 5) {
-      for (let i = 0, t = 5 - policyIds.length; i < t; i++) {
-        policyIds.push(
-          (
-            await indexFleetEndpointPolicy(
-              kbn,
-              `Policy for Host Isolation Exceptions assignment ${i + 1}`,
-              fleetResponse.endpointPackage.version
-            )
-          ).integrationPolicies[0].id
-        );
-      }
-    }
-
-    return () => policyIds[randomN(policyIds.length)];
-  })();
+  const randomPolicyId = await randomPolicyIdGenerator(kbn, log);
 
   log.info('Generating exceptions....');
   await Promise.all(
@@ -154,16 +122,3 @@ const ensureCreateEndpointHostIsolationExceptionList = async (kbn: KbnClient) =>
       }
     });
 };
-
-const fetchEndpointPolicies = (
-  kbnClient: KbnClient
-): Promise<AxiosResponse<GetPolicyListResponse>> => {
-  return kbnClient.request<GetPolicyListResponse>({
-    method: 'GET',
-    path: PACKAGE_POLICY_API_ROUTES.LIST_PATTERN,
-    query: {
-      perPage: 100,
-      kuery: `${PACKAGE_POLICY_SAVED_OBJECT_TYPE}.package.name: endpoint`,
-    },
-  });
-};

x-pack/plugins/security_solution/scripts/endpoint/trusted_apps/index.ts

@@ -10,7 +10,6 @@ import { ToolingLog } from '@kbn/dev-utils';
 import { KbnClient } from '@kbn/test';
 import pMap from 'p-map';
 import { basename } from 'path';
-import { AxiosResponse } from 'axios';
 import {
   ENDPOINT_TRUSTED_APPS_LIST_DESCRIPTION,
   ENDPOINT_TRUSTED_APPS_LIST_ID,
@@ -21,14 +20,9 @@ import {
 import { CreateExceptionListSchema } from '@kbn/securitysolution-io-ts-list-types';
 import { TrustedApp } from '../../../common/endpoint/types';
 import { TrustedAppGenerator } from '../../../common/endpoint/data_generators/trusted_app_generator';
-import { indexFleetEndpointPolicy } from '../../../common/endpoint/data_loaders/index_fleet_endpoint_policy';
-import { setupFleetForEndpoint } from '../../../common/endpoint/data_loaders/setup_fleet_for_endpoint';
-import { GetPolicyListResponse } from '../../../public/management/pages/policy/types';
-import {
-  PACKAGE_POLICY_API_ROUTES,
-  PACKAGE_POLICY_SAVED_OBJECT_TYPE,
-} from '../../../../fleet/common';
+
 import { newTrustedAppToCreateExceptionListItem } from '../../../public/management/pages/trusted_apps/service/mappers';
+import { randomPolicyIdGenerator } from '../common/random_policy_id_generator';
 
 const defaultLogger = new ToolingLog({ level: 'info', writeTo: process.stdout });
 const separator = '----------------------------------------';
@@ -88,35 +82,9 @@ export const run: (options?: RunOptions) => Promise<TrustedApp[]> = async ({
   // and
   // and ensure the trusted apps list is created
   logger.info('setting up Fleet with endpoint and creating trusted apps list');
-  const [installedEndpointPackage] = await Promise.all([
-    setupFleetForEndpoint(kbnClient).then((response) => response.endpointPackage),
-
-    ensureCreateEndpointTrustedAppsList(kbnClient),
-  ]);
-
-  // Setup a list of real endpoint policies and return a method to randomly select one
-  const randomPolicyId: () => string = await (async () => {
-    const randomN = (max: number): number => Math.floor(Math.random() * max);
-    const policyIds: string[] =
-      (await fetchEndpointPolicies(kbnClient)).data.items.map((policy) => policy.id) || [];
-
-    // If the number of existing policies is less than 5, then create some more policies
-    if (policyIds.length < 5) {
-      for (let i = 0, t = 5 - policyIds.length; i < t; i++) {
-        policyIds.push(
-          (
-            await indexFleetEndpointPolicy(
-              kbnClient,
-              `Policy for Trusted App assignment ${i + 1}`,
-              installedEndpointPackage.version
-            )
-          ).integrationPolicies[0].id
-        );
-      }
-    }
+  ensureCreateEndpointTrustedAppsList(kbnClient);
 
-    return () => policyIds[randomN(policyIds.length)];
-  })();
+  const randomPolicyId = await randomPolicyIdGenerator(kbnClient, logger);
 
   return pMap(
     Array.from({ length: count }),
@@ -169,19 +137,6 @@ const createRunLogger = () => {
   });
 };
 
-const fetchEndpointPolicies = (
-  kbnClient: KbnClient
-): Promise<AxiosResponse<GetPolicyListResponse>> => {
-  return kbnClient.request<GetPolicyListResponse>({
-    method: 'GET',
-    path: PACKAGE_POLICY_API_ROUTES.LIST_PATTERN,
-    query: {
-      perPage: 100,
-      kuery: `${PACKAGE_POLICY_SAVED_OBJECT_TYPE}.package.name: endpoint`,
-    },
-  });
-};
-
 const ensureCreateEndpointTrustedAppsList = async (kbn: KbnClient) => {
   const newListDefinition: CreateExceptionListSchema = {
     description: ENDPOINT_TRUSTED_APPS_LIST_DESCRIPTION,