[Security Solution] Refactor OverviewHost and OverviewNetwork to use …

…Search Strategy (#76409)

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/all/index.ts

@@ -12,7 +12,6 @@ import { RequestOptionsPaginated } from '../..';
 
 export interface HostsEdges {
  node: HostItem;
-
  cursor: CursorType;
 }
 

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/details/index.ts

@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+
+import { Inspect, Maybe, TimerangeInput } from '../../../common';
+import { HostItem, HostsFields } from '../common';
+import { RequestOptionsPaginated } from '../..';
+
+export interface HostDetailsStrategyResponse extends IEsSearchResponse {
+ hostDetails: HostItem;
+ inspect?: Maybe<Inspect>;
+}
+
+export interface HostDetailsRequestOptions extends Partial<RequestOptionsPaginated<HostsFields>> {
+ hostName: string;
+ skip?: boolean;
+ timerange: TimerangeInput;
+ inspect?: Maybe<Inspect>;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/index.ts

@@ -7,14 +7,16 @@
 export * from './all';
 export * from './authentications';
 export * from './common';
+export * from './details';
 export * from './first_last_seen';
 export * from './overview';
 export * from './uncommon_processes';
 
 export enum HostsQueries {
  authentications = 'authentications',
+ details = 'details',
  firstLastSeen = 'firstLastSeen',
  hosts = 'hosts',
- hostOverview = 'hostOverview',
+ overview = 'overviewHost',
  uncommonProcesses = 'uncommonProcesses',
 }

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/overview/index.ts

@@ -5,18 +5,83 @@
  */
 
 import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
-import { Inspect, Maybe, TimerangeInput } from '../../../common';
-import { HostItem, HostsFields } from '../common';
-import { RequestOptionsPaginated } from '../..';
+import { Inspect, Maybe, SearchHit } from '../../../common';
+import { RequestBasicOptions } from '../..';
+
+export type HostOverviewRequestOptions = RequestBasicOptions;
 
 export interface HostOverviewStrategyResponse extends IEsSearchResponse {
- hostOverview: HostItem;
  inspect?: Maybe<Inspect>;
+ overviewHost: {
+ auditbeatAuditd?: Maybe<number>;
+ auditbeatFIM?: Maybe<number>;
+ auditbeatLogin?: Maybe<number>;
+ auditbeatPackage?: Maybe<number>;
+ auditbeatProcess?: Maybe<number>;
+ auditbeatUser?: Maybe<number>;
+ endgameDns?: Maybe<number>;
+ endgameFile?: Maybe<number>;
+ endgameImageLoad?: Maybe<number>;
+ endgameNetwork?: Maybe<number>;
+ endgameProcess?: Maybe<number>;
+ endgameRegistry?: Maybe<number>;
+ endgameSecurity?: Maybe<number>;
+ filebeatSystemModule?: Maybe<number>;
+ winlogbeatSecurity?: Maybe<number>;
+ winlogbeatMWSysmonOperational?: Maybe<number>;
+ };
 }
 
-export interface HostOverviewRequestOptions extends Partial<RequestOptionsPaginated<HostsFields>> {
- hostName: string;
- skip?: boolean;
- timerange: TimerangeInput;
- inspect?: Maybe<Inspect>;
+export interface OverviewHostHit extends SearchHit {
+ aggregations: {
+ auditd_count: {
+ doc_count: number;
+ };
+ endgame_module: {
+ dns_event_count: {
+ doc_count: number;
+ };
+ file_event_count: {
+ doc_count: number;
+ };
+ image_load_event_count: {
+ doc_count: number;
+ };
+ network_event_count: {
+ doc_count: number;
+ };
+ process_event_count: {
+ doc_count: number;
+ };
+ registry_event: {
+ doc_count: number;
+ };
+ security_event_count: {
+ doc_count: number;
+ };
+ };
+ fim_count: {
+ doc_count: number;
+ };
+ system_module: {
+ login_count: {
+ doc_count: number;
+ };
+ package_count: {
+ doc_count: number;
+ };
+ process_count: {
+ doc_count: number;
+ };
+ user_count: {
+ doc_count: number;
+ };
+ filebeat_count: {
+ doc_count: number;
+ };
+ };
+ winlog_count: {
+ doc_count: number;
+ };
+ };
 }

x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts

@@ -7,6 +7,8 @@
 import { IEsSearchRequest } from '../../../../../../src/plugins/data/common';
 import { ESQuery } from '../../typed_json';
 import {
+ HostDetailsStrategyResponse,
+ HostDetailsRequestOptions,
  HostOverviewStrategyResponse,
  HostAuthenticationsRequestOptions,
  HostAuthenticationsStrategyResponse,
@@ -27,6 +29,8 @@ import {
  NetworkTlsRequestOptions,
  NetworkHttpStrategyResponse,
  NetworkHttpRequestOptions,
+ NetworkOverviewStrategyResponse,
+ NetworkOverviewRequestOptions,
  NetworkTopCountriesStrategyResponse,
  NetworkTopCountriesRequestOptions,
  NetworkTopNFlowStrategyResponse,
@@ -73,7 +77,9 @@ export interface RequestOptionsPaginated<Field = string> extends RequestBasicOpt
 
 export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQueries.hosts
  ? HostsStrategyResponse
- : T extends HostsQueries.hostOverview
+ : T extends HostsQueries.details
+ ? HostDetailsStrategyResponse
+ : T extends HostsQueries.overview
  ? HostOverviewStrategyResponse
  : T extends HostsQueries.authentications
  ? HostAuthenticationsStrategyResponse
@@ -85,6 +91,8 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
  ? NetworkDnsStrategyResponse
  : T extends NetworkQueries.http
  ? NetworkHttpStrategyResponse
+ : T extends NetworkQueries.overview
+ ? NetworkOverviewStrategyResponse
  : T extends NetworkQueries.tls
  ? NetworkTlsStrategyResponse
  : T extends NetworkQueries.topCountries
@@ -97,7 +105,9 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
 
 export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQueries.hosts
  ? HostsRequestOptions
- : T extends HostsQueries.hostOverview
+ : T extends HostsQueries.details
+ ? HostDetailsRequestOptions
+ : T extends HostsQueries.overview
  ? HostOverviewRequestOptions
  : T extends HostsQueries.authentications
  ? HostAuthenticationsRequestOptions
@@ -109,6 +119,8 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
  ? NetworkDnsRequestOptions
  : T extends NetworkQueries.http
  ? NetworkHttpRequestOptions
+ : T extends NetworkQueries.overview
+ ? NetworkOverviewRequestOptions
  : T extends NetworkQueries.tls
  ? NetworkTlsRequestOptions
  : T extends NetworkQueries.topCountries

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts

@@ -7,13 +7,15 @@
 export * from './common';
 export * from './dns';
 export * from './http';
+export * from './overview';
 export * from './tls';
 export * from './top_countries';
 export * from './top_n_flow';
 
 export enum NetworkQueries {
  dns = 'dns',
  http = 'http',
+ overview = 'overviewNetwork',
  tls = 'tls',
  topCountries = 'topCountries',
  topNFlow = 'topNFlow',

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/overview/index.ts

@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe, SearchHit } from '../../../common';
+import { RequestBasicOptions } from '../..';
+
+export type NetworkOverviewRequestOptions = RequestBasicOptions;
+
+export interface NetworkOverviewStrategyResponse extends IEsSearchResponse {
+ inspect?: Maybe<Inspect>;
+ overviewNetwork: {
+ auditbeatSocket?: Maybe<number>;
+ filebeatCisco?: Maybe<number>;
+ filebeatNetflow?: Maybe<number>;
+ filebeatPanw?: Maybe<number>;
+ filebeatSuricata?: Maybe<number>;
+ filebeatZeek?: Maybe<number>;
+ packetbeatDNS?: Maybe<number>;
+ packetbeatFlow?: Maybe<number>;
+ packetbeatTLS?: Maybe<number>;
+ };
+}
+
+export interface OverviewNetworkHit extends SearchHit {
+ aggregations: {
+ unique_flow_count: {
+ doc_count: number;
+ };
+ unique_dns_count: {
+ doc_count: number;
+ };
+ unique_suricata_count: {
+ doc_count: number;
+ };
+ unique_zeek_count: {
+ doc_count: number;
+ };
+ unique_socket_count: {
+ doc_count: number;
+ };
+ unique_filebeat_count: {
+ unique_netflow_count: {
+ doc_count: number;
+ };
+ unique_panw_count: {
+ doc_count: number;
+ };
+ unique_cisco_count: {
+ doc_count: number;
+ };
+ };
+ unique_packetbeat_count: {
+ unique_tls_count: {
+ doc_count: number;
+ };
+ };
+ };
+}

x-pack/plugins/security_solution/cypress/fixtures/overview.json

@@ -2,37 +2,6 @@
  "data": {
  "source": {
  "id": "default",
- "OverviewNetwork": {
- "auditbeatSocket": 578502,
- "filebeatCisco": 999,
- "filebeatNetflow": 2544,
- "filebeatPanw": 678,
- "filebeatSuricata": 303699,
- "filebeatZeek": 71129,
- "packetbeatDNS": 1090,
- "packetbeatFlow": 722153,
- "packetbeatTLS": 340,
- "__typename": "OverviewNetworkData"
- },
- "OverviewHost": {
- "auditbeatAuditd": 123,
- "auditbeatFIM": 345,
- "auditbeatLogin": 456,
- "auditbeatPackage": 567,
- "auditbeatProcess": 678,
- "auditbeatUser": 789,
- "endgameDns": 391,
- "endgameFile": 392,
- "endgameImageLoad": 393,
- "endgameNetwork": 394,
- "endgameProcess": 395,
- "endgameRegistry": 396,
- "endgameSecurity": 397,
- "filebeatSystemModule": 890,
- "winlogbeatSecurity": 70,
- "winlogbeatMWSysmonOperational": 30,
- "__typename": "OverviewHostData"
- },
  "status": {
  "indicesExist": true,
  "indexFields": [],

x-pack/plugins/security_solution/cypress/fixtures/overview_search_strategy.json

@@ -0,0 +1,33 @@
+{
+ "overviewNetwork": {
+ "auditbeatSocket": 578502,
+ "filebeatCisco": 999,
+ "filebeatNetflow": 2544,
+ "filebeatPanw": 678,
+ "filebeatSuricata": 303699,
+ "filebeatZeek": 71129,
+ "packetbeatDNS": 1090,
+ "packetbeatFlow": 722153,
+ "packetbeatTLS": 340,
+ "__typename": "OverviewNetworkData"
+ },
+ "overviewHost": {
+ "auditbeatAuditd": 123,
+ "auditbeatFIM": 345,
+ "auditbeatLogin": 456,
+ "auditbeatPackage": 567,
+ "auditbeatProcess": 678,
+ "auditbeatUser": 789,
+ "endgameDns": 391,
+ "endgameFile": 392,
+ "endgameImageLoad": 393,
+ "endgameNetwork": 394,
+ "endgameProcess": 395,
+ "endgameRegistry": 396,
+ "endgameSecurity": 397,
+ "filebeatSystemModule": 890,
+ "winlogbeatSecurity": 70,
+ "winlogbeatMWSysmonOperational": 30,
+ "__typename": "OverviewHostData"
+ }
+}

x-pack/plugins/security_solution/cypress/integration/overview.spec.ts

@@ -14,6 +14,7 @@ import { OVERVIEW_URL } from '../urls/navigation';
 describe('Overview Page', () => {
  before(() => {
  cy.stubSecurityApi('overview');
+ cy.stubSearchStrategyApi('overview_search_strategy');
  loginAndWaitForPage(OVERVIEW_URL);
  });
 

x-pack/plugins/security_solution/cypress/support/commands.js

@@ -39,6 +39,15 @@ Cypress.Commands.add('stubSecurityApi', function (dataFileName) {
  cy.route('POST', 'api/solutions/security/graphql', `@${dataFileName}JSON`);
 });
 
+Cypress.Commands.add('stubSearchStrategyApi', function (dataFileName) {
+ cy.on('window:before:load', (win) => {
+ win.fetch = null;
+ });
+ cy.server();
+ cy.fixture(dataFileName).as(`${dataFileName}JSON`);
+ cy.route('POST', 'internal/search/securitySolutionSearchStrategy', `@${dataFileName}JSON`);
+});
+
 Cypress.Commands.add(
  'attachFile',
  {

x-pack/plugins/security_solution/cypress/support/index.d.ts

@@ -7,6 +7,7 @@
 declare namespace Cypress {
  interface Chainable<Subject> {
  stubSecurityApi(dataFileName: string): Chainable<Subject>;
+ stubSearchStrategyApi(dataFileName: string): Chainable<Subject>;
  attachFile(fileName: string, fileType?: string): Chainable<JQuery>;
  }
 }