Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Refactor duplicated rule schemas #135479

Merged
merged 10 commits into from
Jul 7, 2022
Merged

[Security Solution] Refactor duplicated rule schemas #135479

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
751d300
Replace patch, patch bulk, import rules schemas
marshallmain Jun 27, 2022
d0959ec
Remove more duplicated schemas
marshallmain Jun 29, 2022
a88867c
Fix update rules output_index, patch rules type specific schema, prep…
marshallmain Jun 29, 2022
d2b6d79
Fix import exceptions, add back threshold type dependent validation, …
marshallmain Jun 29, 2022
c0bcbfe
Remove unused variable
marshallmain Jun 30, 2022
34edd1d
Merge branch 'main' into replace-rule-schemas
marshallmain Jun 30, 2022
388a1df
Fix export rule test
marshallmain Jun 30, 2022
0e743b0
Fix TODOs, add rule converter tests, consistent throw/return error be…
marshallmain Jun 30, 2022
1cd27b0
Merge branch 'main' into replace-rule-schemas
marshallmain Jul 5, 2022
f302f4e
Remove schema cast by adding individual rule type patch schemas
marshallmain Jul 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
106 changes: 16 additions & 90 deletions ...ity_solution/common/detection_engine/schemas/request/add_prepackaged_rules_schema.mock.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,7 @@
* 2.0.
*/

import {
AddPrepackagedRulesSchema,
AddPrepackagedRulesSchemaDecoded,
} from './add_prepackaged_rules_schema';
import { DEFAULT_MAX_SIGNALS } from '../../../constants';
import { AddPrepackagedRulesSchema } from './add_prepackaged_rules_schema';

export const getAddPrepackagedRulesSchemaMock = (): AddPrepackagedRulesSchema => ({
description: 'some description',
Expand All @@ -23,33 +19,6 @@ export const getAddPrepackagedRulesSchemaMock = (): AddPrepackagedRulesSchema =>
version: 1,
});

export const getAddPrepackagedRulesSchemaDecodedMock = (): AddPrepackagedRulesSchemaDecoded => ({
author: [],
description: 'some description',
name: 'Query with a rule id',
query: 'user.name: root or user.name: admin',
severity: 'high',
severity_mapping: [],
type: 'query',
risk_score: 55,
risk_score_mapping: [],
language: 'kuery',
references: [],
actions: [],
enabled: false,
false_positives: [],
from: 'now-6m',
interval: '5m',
max_signals: DEFAULT_MAX_SIGNALS,
tags: [],
to: 'now',
threat: [],
throttle: null,
version: 1,
exceptions_list: [],
rule_id: 'rule-1',
});

export const getAddPrepackagedThreatMatchRulesSchemaMock = (): AddPrepackagedRulesSchema => ({
description: 'some description',
name: 'Query with a rule id',
Expand Down Expand Up @@ -93,61 +62,18 @@ export const getAddPrepackagedThreatMatchRulesSchemaMock = (): AddPrepackagedRul
],
});

export const getAddPrepackagedThreatMatchRulesSchemaDecodedMock =
(): AddPrepackagedRulesSchemaDecoded => ({
author: [],
description: 'some description',
name: 'Query with a rule id',
query: 'user.name: root or user.name: admin',
severity: 'high',
severity_mapping: [],
type: 'threat_match',
risk_score: 55,
risk_score_mapping: [],
language: 'kuery',
references: [],
actions: [],
enabled: false,
false_positives: [],
from: 'now-6m',
interval: '5m',
max_signals: DEFAULT_MAX_SIGNALS,
tags: [],
to: 'now',
threat: [],
throttle: null,
version: 1,
exceptions_list: [],
rule_id: 'rule-1',
threat_query: '*:*',
threat_index: ['list-index'],
threat_mapping: [
{
entries: [
{
field: 'host.name',
value: 'host.name',
type: 'mapping',
},
],
},
],
threat_filters: [
{
bool: {
must: [
{
query_string: {
query: 'host.name: linux',
analyze_wildcard: true,
time_zone: 'Zulu',
},
},
],
filter: [],
should: [],
must_not: [],
},
},
],
});
export const getAddPrepackagedThresholdRulesSchemaMock = (): AddPrepackagedRulesSchema => ({
description: 'some description',
name: 'Query with a rule id',
query: 'user.name: root or user.name: admin',
severity: 'high',
risk_score: 55,
language: 'kuery',
rule_id: 'rule-1',
version: 1,
type: 'threshold',
threshold: {
field: ['field-1', 'field-2', 'field-3', 'field-4'],
value: 1,
},
});
Loading