wazuh · Desvelao · Jan 9, 2023 · Jan 5, 2023 · Jan 5, 2023 · Jan 9, 2023
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -28,7 +28,7 @@ All notable changes to the Wazuh app project will be documented in this file.
 ### Changed
 
 - Changed the HTTP verb from `GET` to `POST` in the requests to login to the Wazuh API [#4103](https://github.com/wazuh/wazuh-kibana-app/pull/4103)
-- Improved alerts summary performance [#4376](https://github.com/wazuh/wazuh-kibana-app/pull/4376)
+- Improved alerts summary performance [#4376](https://github.com/wazuh/wazuh-kibana-app/pull/4376) [#5071](https://github.com/wazuh/wazuh-kibana-app/pull/5071)
 - Improved Agents Overview performance [#4363](https://github.com/wazuh/wazuh-kibana-app/pull/4363) [#5076](https://github.com/wazuh/wazuh-kibana-app/pull/5076)
 - Improved the message displayed when there is a versions mismatch between the Wazuh API and the Wazuh APP [#4529](https://github.com/wazuh/wazuh-kibana-app/pull/4529) [#4964](https://github.com/wazuh/wazuh-kibana-app/pull/4964)
 - Independently load each dashboard from the `Agents Overview` page [#4363](https://github.com/wazuh/wazuh-kibana-app/pull/4363)

diff --git a/public/components/common/welcome/components/agent-sections.ts b/public/components/common/welcome/components/agent-sections.ts
@@ -57,7 +57,7 @@ export const getAgentSections = (menuAgent) => {
     github: {
       id: WAZUH_MODULES_ID.GITHUB,
       text: 'GitHub',
-      isPin: menuAgent.github ? this.menuAgent.github : false
+      isPin: menuAgent.github ? menuAgent.github : false
     },
     pm: {
       id: WAZUH_MODULES_ID.POLICY_MONITORING,

diff --git a/server/lib/reporting/extended-information.ts b/server/lib/reporting/extended-information.ts
@@ -53,11 +53,11 @@ import { getSettingDefaultValue } from '../../../common/services/settings';
           const { data: { data: { affected_items: [agent] } } } = await context.wazuh.api.client.asCurrentUser.request(
             'GET',
             `/agents`,
-            { 
+            {
               params: {
                 q: `id=${agentID}`,
                 select: 'dateAdd,id,ip,lastKeepAlive,manager,name,os.name,os.version,version',
-              } 
+              }
             },
             { apiHostID: apiId }
           );
@@ -85,14 +85,16 @@ import { getSettingDefaultValue } from '../../../common/services/settings';
           { id: 'dateAdd', label: 'Registration date' },
           { id: 'lastKeepAlive', label: 'Last keep alive' },
         ],
-        items: agentsData.map((agent) => {
-          return {
-            ...agent,
-            os: (agent.os && agent.os.name && agent.os.version) ? `${agent.os.name} ${agent.os.version}` : '',
-            lastKeepAlive: moment(agent.lastKeepAlive).format(dateFormat),
-            dateAdd: moment(agent.dateAdd).format(dateFormat)
-          }
-        }),
+        items: agentsData
+          .filter(agent => agent) // Remove undefined agents when Wazuh API no longer finds and agentID
+          .map((agent) => {
+            return {
+              ...agent,
+              os: (agent.os && agent.os.name && agent.os.version) ? `${agent.os.name} ${agent.os.version}` : '',
+              lastKeepAlive: moment(agent.lastKeepAlive).format(dateFormat),
+              dateAdd: moment(agent.dateAdd).format(dateFormat)
+            }
+          }),
       });
     }else if(!agentsData.length && groupID){
       // For group reports when there is no agents in the group
@@ -101,7 +103,7 @@ import { getSettingDefaultValue } from '../../../common/services/settings';
         style: { fontSize: 12, color: '#000' },
       });
     }
-    
+
   } catch (error) {
     log('reporting:buildAgentsTable', error.message || error);
     return Promise.reject(error);
@@ -287,7 +289,7 @@ export async function extendedInformation(
         });
       }
     }
-    
+
     //--- OVERVIEW - GENERAL
     if (section === 'overview' && tab === 'general') {
       log('reporting:extendedInformation', 'Fetching top 3 agents with level 15 alerts', 'debug');
@@ -865,32 +867,21 @@ export async function extendedInformation(
     }
 
     //--- SUMMARY TABLES
-    const extraSummaryTables = [];
-    if (summaryTablesDefinitions?.[`${section}Summary`]?.[`${tab}AlertsSummary`]) {
-      log('reporting:AlertsSummaryTable', 'Fetching Alerts Summary Table', 'debug');
-      const alertsSummaryTable = new SummaryTable(
-        context,
-        from,
-        to,
-        filters,
-        summaryTablesDefinitions[`${section}Summary`][`${tab}AlertsSummary`],
-        pattern
-      );
-      const alertsSummaryData = await alertsSummaryTable.fetch();
-      extraSummaryTables.push(alertsSummaryData);
-    }
-    if (summaryTablesDefinitions?.[`${section}Summary`]?.[`${tab}GroupsSummary`]) {
-      log('reporting:GroupsSummaryTable', 'Fetching Groups Summary Table', 'debug');
-      const groupsSummaryTable = new SummaryTable(
-        context,
-        from,
-        to,
-        filters,
-        summaryTablesDefinitions[`${section}Summary`][`${tab}GroupsSummary`],
-        pattern
-      );
-      const groupsSummaryData = await groupsSummaryTable.fetch();
-      extraSummaryTables.push(groupsSummaryData);
+    let extraSummaryTables = [];
+    if (Array.isArray(summaryTablesDefinitions[section][tab])) {
+      const tablesPromises = summaryTablesDefinitions[section][tab].map((summaryTable) => {
+        log('reporting:AlertsTable', `Fetching ${summaryTable.title} Table`, 'debug');
+        const alertsSummaryTable = new SummaryTable(
+          context,
+          from,
+          to,
+          filters,
+          summaryTable,
+          pattern
+        );
+        return alertsSummaryTable.fetch();
+      });
+      extraSummaryTables = await Promise.all(tablesPromises);
     }
 
     return extraSummaryTables;

diff --git a/server/lib/reporting/summary-table.ts b/server/lib/reporting/summary-table.ts
@@ -43,14 +43,14 @@ export default class SummaryTable {
 
   /**
    * Parse the summary table setup to build the query
-   * @param summarySetup 
+   * @param summarySetup
    */
   _parseSummarySetup(summarySetup: SummarySetup) {
     let baseAggRef = this._base.aggs;
     summarySetup.aggs.forEach(( agg, key) => {
       this._columns.push(agg.customLabel);
       this._parseAggregation(baseAggRef,agg, key);
-      
+
       if (summarySetup.aggs.length > key + 1) {
         baseAggRef[`${key + 2}`].aggs = {};
         baseAggRef = baseAggRef[`${key + 2}`].aggs;
@@ -59,16 +59,16 @@ export default class SummaryTable {
       }
     },this);
   }
-  
+
   /**
    * Parse each aggregation to build the query
-   * @param baseAggRef 
-   * @param agg 
-   * @param key 
+   * @param baseAggRef
+   * @param agg
+   * @param key
    */
   _parseAggregation(baseAggRef: any, agg: any, key: string) {
-    const { field, size, order } = agg;
-    
+    const { field, size, order, missing } = agg;
+
     baseAggRef[`${key + 2}`] = {
       terms: {
         field,
@@ -78,6 +78,9 @@ export default class SummaryTable {
         size
       }
     };
+    if (missing) {
+      baseAggRef[`${key + 2}`].terms.missing = missing;
+    }
   }
 
   /**
@@ -90,7 +93,7 @@ export default class SummaryTable {
    *    ['502', 'Ossec server started', 3, 22],
    *  ]
    * }
-   * @param rawResponse 
+   * @param rawResponse
    */
   _formatResponseToTable(rawResponse) {
     const firstKey = parseInt(Object.keys(rawResponse)[0]);
@@ -110,15 +113,15 @@ export default class SummaryTable {
 
 /**
  * Makes a row from the response
- * @param bucket 
- * @param nextAggKey 
- * @param row 
+ * @param bucket
+ * @param nextAggKey
+ * @param row
  */
   _buildRow(bucket: any, nextAggKey: number, row: any[] = []): any[] {
     // Push the column value to the row
     row.push(bucket.key);
     // If there is a next aggregation, repeat the process
-    if (bucket[nextAggKey.toString()]?.buckets) {
+    if (bucket[nextAggKey.toString()]?.buckets?.length) {
       const newBucket = bucket[nextAggKey.toString()].buckets[0];
       row = this._buildRow(newBucket, (nextAggKey + 1), row);
     }
@@ -144,5 +147,5 @@ export default class SummaryTable {
       return Promise.reject(error);
     }
   }
-  
-}
+
+}
diff --git a/server/lib/reporting/summary-tables-definitions/agents/index.ts b/server/lib/reporting/summary-tables-definitions/agents/index.ts
@@ -10,7 +10,7 @@ const generalAlertsSummary = {
 }
 
 const generalGroupsSummary = {
-  title: 'Alerts summary',
+  title: 'Groups summary',
   aggs: [
     AggregationFields['rule.groups'],
   ]
@@ -62,7 +62,7 @@ const osqueryAlertsSummary = {
 }
 
 const mitreAlertsSummary = {
-  itle: 'Alerts summary',
+  title: 'Alerts summary',
   aggs: [
     AggregationFields['rule.id'],
     AggregationFields['rule.description'],
@@ -105,37 +105,90 @@ const githubAlertsSummary = {
   ]
 }
 
-const hipaaAlertsSummary = {
+// 'Wazuh-App-Agents-GDPR-Last-alerts'
+const gdprLastAlerts = {
+  title: 'Last alerts',
+  aggs: [
+    AggregationFields['rule.gdpr'],
+    AggregationFields['rule.description'],
+  ]
+
+}
+
+// 'Wazuh-App-Agents-PCI-Last-alerts'
+const pciLastAlerts = {
+  title: 'Last alerts',
+  aggs: [
+    AggregationFields['rule.pci_dss'],
+    AggregationFields['rule.description'],
+  ]
+}
+
+// 'Wazuh-App-Agents-NIST-Last-alerts'
+const nistLastAlerts = {
   title: 'Alerts summary',
   aggs: [
-    AggregationFields['rule.hipaa'],
+    AggregationFields['rule.nist_800_53'],
     AggregationFields['rule.level'],
     AggregationFields['rule.description'],
   ]
 }
 
-const nistAlertsSummary = {
+// 'Wazuh-App-Agents-HIPAA-Last-alerts'
+const hipaaLastAlerts = {
   title: 'Alerts summary',
   aggs: [
-    AggregationFields['rule.nist_800_53'],
+    AggregationFields['rule.hipaa'],
     AggregationFields['rule.level'],
     AggregationFields['rule.description'],
   ]
 }
 
+// 'Wazuh-App-Agents-OSCAP-Last-alerts'
+const oscapLastAlerts = {
+  title: 'Last alerts',
+  aggs: [
+    AggregationFields['data.oscap.check.title'],
+    AggregationFields['data.oscap.scan.profile.title'],
+  ]
+}
+
+// 'Wazuh-App-Agents-Audit-Last-alerts'
+const auditLastAlerts = {
+  title: 'Last alerts',
+  aggs: [
+    AggregationFields['rule.description'],
+    AggregationFields['data.audit.exe'],
+    AggregationFields['data.audit.type'],
+  ]
+}
+
+const dockerAlertsSummary = {
+  title: 'Events summary',
+  aggs: [
+    AggregationFields['data.docker.Actor.Attributes.name'],
+    AggregationFields['data.docker.Action'],
+    AggregationFields['timestamp'],
+  ]
+}
+
 export default {
-  generalAlertsSummary,
-  generalGroupsSummary,
-  awsAlertsSummary,
-  fimAlertsSummary,
-  githubAlertsSummary,
-  hipaaAlertsSummary,
-  nistAlertsSummary,
-  gcpAlertsSummary,
-  tscAlertsSummary,
-  virustotalAlertsSummary,
-  osqueryAlertsSummary,
-  mitreAlertsSummary,
-  ciscatAlertsSummary,
-  pmAlertsSummary,
-}
+  general: [generalAlertsSummary, generalGroupsSummary],
+  aws: [awsAlertsSummary],
+  fim: [fimAlertsSummary],
+  github: [githubAlertsSummary],
+  hipaa: [hipaaLastAlerts],
+  nist: [nistLastAlerts],
+  gcp: [gcpAlertsSummary],
+  tsc: [tscAlertsSummary],
+  virustotal: [virustotalAlertsSummary],
+  osquery: [osqueryAlertsSummary],
+  mitre: [mitreAlertsSummary],
+  ciscat: [ciscatAlertsSummary],
+  pm: [pmAlertsSummary],
+  audit: [auditLastAlerts],
+  oscap: [oscapLastAlerts],
+  gdpr: [gdprLastAlerts],
+  pci: [pciLastAlerts],
+  docker: [dockerAlertsSummary],
+}