[Security Solution] Webhook - Case Management Connector #131762

stephmilovic · 2022-05-06T19:06:30Z

Webhook - Case Management Connector

Webhook - Case Management is a new connector that allows user to add any third party case management system and have it work within the Cases app. This connector is available in Cases, Stack Management > Connectors, but is not available in Rule Actions. It requires the user to fill out endpoint and JSON data to send to the third party system. The endpoints covered are create incident, get incident, update incident, and create comment. The only non-required endpoint is create comment.

Create Connector

Connector Validation

Connector Test

Case Flow

Connector Test - No Comments

Case Flow - No Comments

Test credentials

Jira
ServiceNow

Fields

The configuration for each connector requires the following fields (* indicates required):

Connector name*
- name of connector
- ex: Jira Webhook
Require authentication*
- If true, a username and password for login type authentication must be provided.
Username (only required if require authentication is true*)
- Username for HTTP basic authentication.
Password (only required if require authentication is true*)
- Password for HTTP basic authentication.
Headers
- A set of key-value pairs sent as headers with the request
- For given examples, content-type: application/json is needed
Create Incident Method
- Rest API Method to create incident in third party system
- ex: POST
Create Incident URL*
- Rest API URL to create incident in third party system
- ex: https://siem-kibana.atlassian.net/rest/api/2/issue

Create Incident Object*

JSON object to create incident (case.tags field not required)

ex:

{
  "fields": {
    "labels": {{{case.tags}}},
    "summary": {{{case.title}}},
    "description": {{{case.description}}},
    "project":{"key":"ROC"},
    "issuetype":{"id":"10024"}
  }
}

Create Incident Response Incident Key*
- JSON key in create incident response that contains the external incident id
- ex: id
Get Incident URL*
- API URL to GET incident details JSON from external system.
- ex: https://siem-kibana.atlassian.net/rest/api/2/issue/{{{external.system.id}}}
Get Incident Response External Title Key*
- JSON key in get incident response that contains the external incident title
- ex: key
Get Incident Response Created Date Key*
- JSON key in get incident response that contains the date the incident was created.
- ex: fields.created
Get Incident Response Updated Date Key*
- JSON key in get incident response that contains the date the incident was updated.
- ex: fields.updated
External Incident View URL*
- URL to view incident in external system.
- ex: https://siem-kibana.atlassian.net/browse/{{{external.system.title}}}
Update Incident Method
- Rest API Method to update incident in third party system
- ex: PUT
Update Incident URL*
- API URL to update incident.
- ex: https://siem-kibana.atlassian.net/rest/api/2/issue/{{{external.system.id}}}

Update Incident Object*

JSON object to update incident. (case.tags field not required)

ex:

{
  "fields": {
    "labels": {{{case.tags}}},
    "summary": {{{case.title}}},
    "description": {{{case.description}}},
    "project":{"key":"ROC"},
    "issuetype":{"id":"10024"}
  }
}

Create Comment Method
- Rest API Method to update incident in third party system
- ex: POST
Create Comment URL
- API URL to add comment to incident.
- ex: https://siem-kibana.atlassian.net/rest/api/2/issue/{{{external.system.id}}}/comment
Create Comment Object
- JSON object to update incident
- ex:
```
{
  "body": {{{case.comment}}}
}
```

Links

RFC: https://docs.google.com/document/d/16qvY3TmjAiokubAABBf_CVZNH9lFAwU9UXYdfW1M7L0/edit?usp=sharing
Epic: #124687
Customer enhancement requests: https://github.com/elastic/enhancements/issues/15899, https://github.com/elastic/enhancements/issues/14938

…-fix'

stephmilovic · 2022-07-25T23:57:29Z

@elasticmachine merge upstream

stephmilovic · 2022-07-26T00:58:36Z

@elasticmachine merge upstream

stephmilovic · 2022-07-26T02:05:12Z

@elasticmachine merge upstream

kibana-ci · 2022-07-26T03:21:11Z

💛 Build succeeded, but was flaky

Failed CI Steps

Security Solution Tests #1

Test Failures

[job] [logs] Security Solution Tests #1 / Alerts timeline Privileges: can crud "before each" hook for "should allow a user with crud privileges to attach alerts to cases"

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`cases`	489	492	+3
`triggersActionsUi`	575	591	+16
total			+19

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`actions`	259	261	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`cases`	355.6KB	358.2KB	+2.6KB
`triggersActionsUi`	927.8KB	1014.0KB	+86.1KB
total			+88.7KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`cases`	122.3KB	122.4KB	+121.0B
`triggersActionsUi`	90.6KB	91.6KB	+1.0KB
total			+1.2KB

Unknown metric groups

API count

id	before	after	diff
`actions`	264	266	+2

async chunk count

id	before	after	diff
`cases`	15	16	+1
`triggersActionsUi`	92	95	+3
total			+4

ESLint disabled in files

id	before	after	diff
`triggersActionsUi`	4	5	+1

ESLint disabled line counts

id	before	after	diff
`cases`	73	74	+1
`triggersActionsUi`	184	188	+4
total			+5

Total ESLint disabled count

id	before	after	diff
`cases`	89	90	+1
`triggersActionsUi`	188	193	+5
total			+6

History

💔 Build #60669 failed 92672bf
💔 Build #60654 failed 3dc2aaf
💔 Build #60638 failed 0fd363f
💔 Build #60569 failed 219018c
💚 Build #60491 succeeded 31f1303

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

angorayc

Thanks Steph, followed the steps and ran it locally, all worked as expected!

jonathan-buttner

Great work Steph!

cnasikas

Great work Steph! Thank you for addressing our feedback. Some items can be done in another PR. Could you please open an issue for that:

The method and the URL are not properly aligned in step 4:

Docs
Add more unit tests for React components and utility functions
Remove real URLs from tests
By introducing the isExperimental flag we show the experimental badge. There are some parts in the framework that do not show the experimental flag even though the flag is set. This is a bug in the framework. For example the edit connector flyout or in the connector add flyout

cnasikas · 2022-07-26T12:23:18Z

x-pack/plugins/actions/server/builtin_action_types/cases_webhook/service.test.ts

+    '{"fields":{"title":{{{case.title}}},"description":{{{case.description}}},"tags":{{{case.tags}}},"project":{"key":"ROC"},"issuetype":{"id":"10024"}}}',
+  createIncidentMethod: CasesWebhookMethods.POST,
+  createIncidentResponseKey: 'id',
+  createIncidentUrl: 'https://siem-kibana.atlassian.net/rest/api/2/issue',


We should not commit real URLs in tests.

cnasikas · 2022-07-26T15:10:23Z

...ions_ui/public/application/sections/action_connector_form/create_connector_flyout/header.tsx

@@ -85,9 +96,17 @@ const FlyoutHeaderComponent: React.FC<{
            </EuiTitle>
          )}
        </EuiFlexItem>
+        {actionTypeName && isExperimental && (


A unit test is missing for this case.

cnasikas · 2022-07-26T15:10:42Z

...s/triggers_actions_ui/public/application/sections/action_connector_form/action_type_menu.tsx

@@ -91,6 +93,7 @@ export const ActionTypeMenu = ({
      const checkEnabledResult = checkActionTypeEnabled(item.actionType);
      const card = (
        <EuiCard
+          betaBadgeProps={item.isExperimental ? betaBadgeProps : undefined}


A unit test is missing for this case

elasticmachine · 2022-08-01T13:45:33Z

Pinging @elastic/response-ops (Team:ResponseOps)

stephmilovic added 8 commits April 12, 2022 15:17

bootstrap cases webhook

2fed291

Merge branch 'main' into cases_webhook

d981f51

Merge branch 'main' into cases_webhook

2c6a233

wip

78907b6

Merge branch 'main' into cases_webhook

b18270e

wip'

094ff9b

Merge branch 'main' into cases_webhook

74361d3

wip

ff959a4

stephmilovic mentioned this pull request May 6, 2022

[Security Solution] Research cases webhook connector #129921

Closed

kibanamachine and others added 21 commits May 6, 2022 19:55

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

85e3d97

…-fix'

Merge branch 'main' into cases_webhook

b63647a

make work in cases

9b6bf56

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

0cd8127

…-fix'

Merge branch 'main' into cases_webhook

6bd36f7

werk better

959e689

add api file

b84e705

type cleanup

823c1fa

fix types more

ef6e12e

add all fields to form

4017aa8

add in new fields

8067c34

fix cases push

c958685

add patch to fe

2e8a899

merge in main

ba1ac12

make link back url work

fe108a5

type cleaning

db286dd

Merge branch 'main' into cases_webhook

53a09fa

add update and create comment

9de1167

support jira

211c24b

labels

5709c8c

Merge branch 'main' into cases_webhook

490e4bb

Merge branch 'main' into cases_webhook

3dc2aaf

Merge branch 'main' into cases_webhook

92672bf

Merge branch 'main' into cases_webhook

b9a23fa

angorayc approved these changes Jul 26, 2022

View reviewed changes

stephmilovic requested review from jonathan-buttner and cnasikas and removed request for mikecote and cnasikas July 26, 2022 13:38

jonathan-buttner approved these changes Jul 26, 2022

View reviewed changes

cnasikas approved these changes Jul 26, 2022

View reviewed changes

stephmilovic merged commit 4f3e554 into elastic:main Jul 26, 2022

kibanamachine added the backport:skip This commit does not require backporting label Jul 26, 2022

MadameSheema deleted the cases_webhook branch July 26, 2022 16:10

This was referenced Jul 26, 2022

Cases Webhook Connector Follow Ups #137218

Closed

[Security Solution] Webhook - Case Management Connector Follow Ups #137227

Merged

lcawl added the Feature:Actions/ConnectorTypes Issues related to specific Connector Types on the Actions Framework label Jul 28, 2022

nastasha-solomon added the Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) label Aug 1, 2022

nastasha-solomon mentioned this pull request Aug 5, 2022

[DOCS] Add Webhook connector to case and connector docs elastic/security-docs#2221

Closed

stephmilovic mentioned this pull request Aug 23, 2022

[DOCS] 8.4 release notes elastic/security-docs#2314

Merged

KOTungseth mentioned this pull request Aug 23, 2022

[DOCS] Adds 131762 to the 8.4.0 release notes #139311

Merged

cnasikas mentioned this pull request Oct 13, 2022

[Security Solution][Case] Support of web hooks #93936

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Webhook - Case Management Connector #131762

[Security Solution] Webhook - Case Management Connector #131762

stephmilovic commented May 6, 2022 •

edited

Loading

stephmilovic commented Jul 25, 2022

stephmilovic commented Jul 26, 2022

stephmilovic commented Jul 26, 2022

kibana-ci commented Jul 26, 2022

API count

async chunk count

ESLint disabled in files

ESLint disabled line counts

Total ESLint disabled count

angorayc left a comment

jonathan-buttner left a comment

cnasikas left a comment

cnasikas Jul 26, 2022

cnasikas Jul 26, 2022

cnasikas Jul 26, 2022

elasticmachine commented Aug 1, 2022

[Security Solution] Webhook - Case Management Connector #131762

[Security Solution] Webhook - Case Management Connector #131762

Conversation

stephmilovic commented May 6, 2022 • edited Loading

Webhook - Case Management Connector

Create Connector

Connector Validation

Connector Test

Case Flow

Connector Test - No Comments

Case Flow - No Comments

Test credentials

Fields

Links

stephmilovic commented Jul 25, 2022

stephmilovic commented Jul 26, 2022

stephmilovic commented Jul 26, 2022

kibana-ci commented Jul 26, 2022

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Page load bundle

API count

async chunk count

ESLint disabled in files

ESLint disabled line counts

Total ESLint disabled count

History

angorayc left a comment

Choose a reason for hiding this comment

jonathan-buttner left a comment

Choose a reason for hiding this comment

cnasikas left a comment

Choose a reason for hiding this comment

cnasikas Jul 26, 2022

Choose a reason for hiding this comment

cnasikas Jul 26, 2022

Choose a reason for hiding this comment

cnasikas Jul 26, 2022

Choose a reason for hiding this comment

elasticmachine commented Aug 1, 2022

stephmilovic commented May 6, 2022 •

edited

Loading