refine type information for related events

x-pack/plugins/endpoint/public/embeddables/resolver/store/actions.ts

@@ -7,6 +7,7 @@ import { CameraAction } from './camera';
 import { DataAction } from './data';
 import { ResolverEvent } from '../../../../common/types';
 
+
 /**
  * When the user wants to bring a process node front-and-center on the map.
  */
@@ -44,6 +45,16 @@ interface AppRequestedResolverData {
   readonly type: 'appRequestedResolverData';
 }
 
+
+/**
+ * The action dispatched when the app requests related event data for one or more
+ * subjects (whose ids should be included as an array @ `payload`)
+ */
+interface AppRequestedRelatedEventData {
+  readonly type: 'appRequestedRelatedEventData';
+  readonly payload: Array<string>;
+}
+
 /**
  * When the user switches the "active descendant" of the Resolver.
  * The "active descendant" (from the point of view of the parent element)
@@ -84,4 +95,5 @@ export type ResolverAction =
   | UserChangedSelectedEvent
   | AppRequestedResolverData
   | UserFocusedOnResolverNode
-  | UserSelectedResolverNode;
+  | UserSelectedResolverNode
+  | AppRequestedRelatedEventData;

x-pack/plugins/endpoint/public/embeddables/resolver/store/data/action.ts

@@ -17,4 +17,15 @@ interface ServerReturnedResolverData {
   };
 }
 
-export type DataAction = ServerReturnedResolverData;
+/**
+ * Will occur when a request for related event data is fulfilled.
+ */
+interface ServerReturnedRelatedEventData {
+  readonly type: 'serverReturnedRelatedEventData';
+  readonly payload: {
+    //TODO: add type information when /related API is finalized
+    readonly data: object
+  };
+}
+
+export type DataAction = ServerReturnedResolverData | ServerReturnedRelatedEventData;

x-pack/plugins/endpoint/public/embeddables/resolver/types.ts

@@ -130,12 +130,53 @@ export type CameraState = {
     }
 );
 
-export const waitingForRelatedEventData = Symbol('The app has requested related event data for this entity ID, but has not yet receieved it');
-export type RelatedEventDataEntry = object;
+/**
+ * This is the current list of known related event types. It has been transcribed from the 
+ * v0 Endgame app.
+ */
+export type RelatedEventType =
+  | "Network"
+  | "File"
+  | "DNS"
+  | "Registry"
+  | "Powershell"
+  | "WMI"
+  | "API"
+  | "CLR"
+  | "Image Load"
+  | "User"
+/**
+ * This symbol indicates that the app is waiting for related event data for the subject
+ * of any particular request.
+ */
+export const waitingForRelatedEventData = Symbol(
+  'The app has requested related event data for this entity ID, but has not yet receieved it'
+);
+/**
+ * This represents all the raw data (sans statistics, metadata, etc.) 
+ * about a particular subject's related events
+ */
+export type RelatedEventDataEntry = {
+  related_events: {
+    related_event_id: string,
+    related_event_type: RelatedEventType,
+  }[]
+};
+/**
+ * This represents the raw related events data enhanced with statistics
+ * (e.g. counts of items grouped by their related event types)
+ */
 export type RelatedEventDataEntryWithStats = RelatedEventDataEntry & {
-  stats: object;
-}
-export type RelatedEventData = Record<string, RelatedEventDataEntryWithStats | typeof waitingForRelatedEventData>;
+  stats: Partial<Record<RelatedEventType, number>>
+};
+/**
+ * This represents a Record that will return either a `RelatedEventDataEntryWithStats`
+ * or a `waitingForRelatedEventData` symbol when called with a unique event id. 
+ */
+export type RelatedEventData = Record<
+  string,
+  RelatedEventDataEntryWithStats | typeof waitingForRelatedEventData
+>;
 
 /**
  * State for `data` reducer which handles receiving Resolver data from the backend.