[Security Solution] Refactor Network KPI to use search strategy (#77410…

…) (#77518)

x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts

@@ -39,6 +39,17 @@ import {
   NetworkTopNFlowRequestOptions,
   NetworkUsersStrategyResponse,
   NetworkUsersRequestOptions,
+  NetworkKpiQueries,
+  NetworkKpiDnsStrategyResponse,
+  NetworkKpiDnsRequestOptions,
+  NetworkKpiNetworkEventsStrategyResponse,
+  NetworkKpiNetworkEventsRequestOptions,
+  NetworkKpiTlsHandshakesStrategyResponse,
+  NetworkKpiTlsHandshakesRequestOptions,
+  NetworkKpiUniqueFlowsStrategyResponse,
+  NetworkKpiUniqueFlowsRequestOptions,
+  NetworkKpiUniquePrivateIpsStrategyResponse,
+  NetworkKpiUniquePrivateIpsRequestOptions,
 } from './network';
 import {
   MatrixHistogramQuery,
@@ -57,7 +68,11 @@ export * from './hosts';
 export * from './matrix_histogram';
 export * from './network';
 
-export type FactoryQueryTypes = HostsQueries | NetworkQueries | typeof MatrixHistogramQuery;
+export type FactoryQueryTypes =
+  | HostsQueries
+  | NetworkQueries
+  | NetworkKpiQueries
+  | typeof MatrixHistogramQuery;
 
 export interface RequestBasicOptions extends IEsSearchRequest {
   timerange: TimerangeInput;
@@ -107,6 +122,16 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
   ? NetworkTopNFlowStrategyResponse
   : T extends NetworkQueries.users
   ? NetworkUsersStrategyResponse
+  : T extends NetworkKpiQueries.dns
+  ? NetworkKpiDnsStrategyResponse
+  : T extends NetworkKpiQueries.networkEvents
+  ? NetworkKpiNetworkEventsStrategyResponse
+  : T extends NetworkKpiQueries.tlsHandshakes
+  ? NetworkKpiTlsHandshakesStrategyResponse
+  : T extends NetworkKpiQueries.uniqueFlows
+  ? NetworkKpiUniqueFlowsStrategyResponse
+  : T extends NetworkKpiQueries.uniquePrivateIps
+  ? NetworkKpiUniquePrivateIpsStrategyResponse
   : T extends typeof MatrixHistogramQuery
   ? MatrixHistogramStrategyResponse
   : never;
@@ -139,6 +164,16 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
   ? NetworkTopNFlowRequestOptions
   : T extends NetworkQueries.users
   ? NetworkUsersRequestOptions
+  : T extends NetworkKpiQueries.dns
+  ? NetworkKpiDnsRequestOptions
+  : T extends NetworkKpiQueries.networkEvents
+  ? NetworkKpiNetworkEventsRequestOptions
+  : T extends NetworkKpiQueries.tlsHandshakes
+  ? NetworkKpiTlsHandshakesRequestOptions
+  : T extends NetworkKpiQueries.uniqueFlows
+  ? NetworkKpiUniqueFlowsRequestOptions
+  : T extends NetworkKpiQueries.uniquePrivateIps
+  ? NetworkKpiUniquePrivateIpsRequestOptions
   : T extends typeof MatrixHistogramQuery
   ? MatrixHistogramRequestOptions
   : never;

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts

@@ -8,6 +8,7 @@ export * from './common';
 export * from './details';
 export * from './dns';
 export * from './http';
+export * from './kpi';
 export * from './overview';
 export * from './tls';
 export * from './top_countries';

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/dns/index.ts

@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../../common';
+import { RequestBasicOptions } from '../../..';
+
+export type NetworkKpiDnsRequestOptions = RequestBasicOptions;
+
+export interface NetworkKpiDnsStrategyResponse extends IEsSearchResponse {
+  dnsQueries: number;
+  inspect?: Maybe<Inspect>;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/index.ts

@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export * from './dns';
+export * from './network_events';
+export * from './tls_handshakes';
+export * from './unique_flows';
+export * from './unique_private_ips';
+
+import { NetworkKpiDnsStrategyResponse } from './dns';
+import { NetworkKpiNetworkEventsStrategyResponse } from './network_events';
+import { NetworkKpiTlsHandshakesStrategyResponse } from './tls_handshakes';
+import { NetworkKpiUniqueFlowsStrategyResponse } from './unique_flows';
+import { NetworkKpiUniquePrivateIpsStrategyResponse } from './unique_private_ips';
+
+export enum NetworkKpiQueries {
+  dns = 'networkKpiDns',
+  networkEvents = 'networkKpiNetworkEvents',
+  tlsHandshakes = 'networkKpiTlsHandshakes',
+  uniqueFlows = 'networkKpiUniqueFlows',
+  uniquePrivateIps = 'networkKpiUniquePrivateIps',
+}
+
+export type NetworkKpiStrategyResponse =
+  | Omit<NetworkKpiDnsStrategyResponse, 'rawResponse'>
+  | Omit<NetworkKpiNetworkEventsStrategyResponse, 'rawResponse'>
+  | Omit<NetworkKpiTlsHandshakesStrategyResponse, 'rawResponse'>
+  | Omit<NetworkKpiUniqueFlowsStrategyResponse, 'rawResponse'>
+  | Omit<NetworkKpiUniquePrivateIpsStrategyResponse, 'rawResponse'>;

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/network_events/index.ts

@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../../common';
+import { RequestBasicOptions } from '../../..';
+
+export type NetworkKpiNetworkEventsRequestOptions = RequestBasicOptions;
+
+export interface NetworkKpiNetworkEventsStrategyResponse extends IEsSearchResponse {
+  networkEvents: number;
+  inspect?: Maybe<Inspect>;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/tls_handshakes/index.ts

@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../../common';
+import { RequestBasicOptions } from '../../..';
+
+export type NetworkKpiTlsHandshakesRequestOptions = RequestBasicOptions;
+
+export interface NetworkKpiTlsHandshakesStrategyResponse extends IEsSearchResponse {
+  tlsHandshakes: number;
+  inspect?: Maybe<Inspect>;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/unique_flows/index.ts

@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../../common';
+import { RequestBasicOptions } from '../../..';
+
+export type NetworkKpiUniqueFlowsRequestOptions = RequestBasicOptions;
+
+export interface NetworkKpiUniqueFlowsStrategyResponse extends IEsSearchResponse {
+  uniqueFlowId: number;
+  inspect?: Maybe<Inspect>;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/unique_private_ips/index.ts

@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../../common';
+import { RequestBasicOptions } from '../../..';
+
+export interface NetworkKpiHistogramData {
+  x?: Maybe<number>;
+  y?: Maybe<number>;
+}
+
+export type NetworkKpiUniquePrivateIpsRequestOptions = RequestBasicOptions;
+
+export interface NetworkKpiUniquePrivateIpsStrategyResponse extends IEsSearchResponse {
+  uniqueSourcePrivateIps: number;
+  uniqueSourcePrivateIpsHistogram: NetworkKpiHistogramData[] | null;
+  uniqueDestinationPrivateIps: number;
+  uniqueDestinationPrivateIpsHistogram: NetworkKpiHistogramData[] | null;
+  inspect?: Maybe<Inspect>;
+}
+
+export type UniquePrivateAttributeQuery = 'source' | 'destination';

x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx

@@ -23,7 +23,7 @@ import {
 import { BarChart } from '../charts/barchart';
 import { AreaChart } from '../charts/areachart';
 import { EuiHorizontalRule } from '@elastic/eui';
-import { fieldTitleChartMapping } from '../../../network/components/kpi_network';
+import { fieldsMapping as fieldTitleChartMapping } from '../../../network/components/kpi_network/unique_private_ips';
 import {
   mockData,
   mockEnableChartsData,
@@ -39,7 +39,8 @@ import {
 } from '../../mock';
 import { State, createStore } from '../../store';
 import { Provider as ReduxStoreProvider } from 'react-redux';
-import { KpiNetworkData, KpiHostsData } from '../../../graphql/types';
+import { KpiHostsData } from '../../../graphql/types';
+import { NetworkKpiStrategyResponse } from '../../../../common/search_strategy';
 
 const from = '2019-06-15T06:00:00.000Z';
 const to = '2019-06-18T06:00:00.000Z';
@@ -74,7 +75,6 @@ describe('Stat Items Component', () => {
               fields={[{ key: 'hosts', value: null, color: '#6092C0', icon: 'cross' }]}
               from={from}
               id="statItems"
-              index={0}
               key="mock-keys"
               to={to}
               narrowDateRange={mockNarrowDateRange}
@@ -94,7 +94,6 @@ describe('Stat Items Component', () => {
               fields={[{ key: 'hosts', value: null, color: '#6092C0', icon: 'cross' }]}
               from={from}
               id="statItems"
-              index={0}
               key="mock-keys"
               to={to}
               narrowDateRange={mockNarrowDateRange}
@@ -176,7 +175,6 @@ describe('Stat Items Component', () => {
       ],
       from,
       id: 'statItems',
-      index: 0,
       key: 'mock-keys',
       to,
       narrowDateRange: mockNarrowDateRange,
@@ -214,41 +212,37 @@ describe('Stat Items Component', () => {
 
 describe('addValueToFields', () => {
   const mockNetworkMappings = fieldTitleChartMapping[0];
-  const mockKpiNetworkData = mockData.KpiNetwork;
   test('should update value from data', () => {
-    const result = addValueToFields(mockNetworkMappings.fields, mockKpiNetworkData);
+    const result = addValueToFields(mockNetworkMappings.fields, mockData);
     expect(result).toEqual(mockEnableChartsData.fields);
   });
 });
 
 describe('addValueToAreaChart', () => {
   const mockNetworkMappings = fieldTitleChartMapping[0];
-  const mockKpiNetworkData = mockData.KpiNetwork;
   test('should add areaChart from data', () => {
-    const result = addValueToAreaChart(mockNetworkMappings.fields, mockKpiNetworkData);
+    const result = addValueToAreaChart(mockNetworkMappings.fields, mockData);
     expect(result).toEqual(mockEnableChartsData.areaChart);
   });
 });
 
 describe('addValueToBarChart', () => {
   const mockNetworkMappings = fieldTitleChartMapping[0];
-  const mockKpiNetworkData = mockData.KpiNetwork;
   test('should add areaChart from data', () => {
-    const result = addValueToBarChart(mockNetworkMappings.fields, mockKpiNetworkData);
+    const result = addValueToBarChart(mockNetworkMappings.fields, mockData);
     expect(result).toEqual(mockEnableChartsData.barChart);
   });
 });
 
 describe('useKpiMatrixStatus', () => {
   const mockNetworkMappings = fieldTitleChartMapping;
-  const mockKpiNetworkData = mockData.KpiNetwork;
   const MockChildComponent = (mappedStatItemProps: StatItemsProps) => <span />;
   const MockHookWrapperComponent = ({
     fieldsMapping,
     data,
   }: {
     fieldsMapping: Readonly<StatItems[]>;
-    data: KpiNetworkData | KpiHostsData;
+    data: NetworkKpiStrategyResponse | KpiHostsData;
   }) => {
     const statItemsProps: StatItemsProps[] = useKpiMatrixStatus(
       fieldsMapping,
@@ -271,7 +265,7 @@ describe('useKpiMatrixStatus', () => {
   test('it updates status correctly', () => {
     const wrapper = mount(
       <>
-        <MockHookWrapperComponent fieldsMapping={mockNetworkMappings} data={mockKpiNetworkData} />
+        <MockHookWrapperComponent fieldsMapping={mockNetworkMappings} data={mockData} />
       </>
     );
 
@@ -281,7 +275,7 @@ describe('useKpiMatrixStatus', () => {
   test('it should not append areaChart if enableAreaChart is off', () => {
     const wrapper = mount(
       <>
-        <MockHookWrapperComponent fieldsMapping={mockNoChartMappings} data={mockKpiNetworkData} />
+        <MockHookWrapperComponent fieldsMapping={mockNoChartMappings} data={mockData} />
       </>
     );
 
@@ -291,7 +285,7 @@ describe('useKpiMatrixStatus', () => {
   test('it should not append barChart if enableBarChart is off', () => {
     const wrapper = mount(
       <>
-        <MockHookWrapperComponent fieldsMapping={mockNoChartMappings} data={mockKpiNetworkData} />
+        <MockHookWrapperComponent fieldsMapping={mockNoChartMappings} data={mockData} />
       </>
     );
 

x-pack/plugins/security_solution/public/common/components/stat_items/index.tsx

@@ -18,7 +18,8 @@ import { get, getOr } from 'lodash/fp';
 import React, { useState, useEffect } from 'react';
 import styled from 'styled-components';
 
-import { KpiHostsData, KpiNetworkData } from '../../../graphql/types';
+import { NetworkKpiStrategyResponse } from '../../../../common/search_strategy';
+import { KpiHostsData } from '../../../graphql/types';
 import { AreaChart } from '../charts/areachart';
 import { BarChart } from '../charts/barchart';
 import { ChartSeriesData, ChartData, ChartSeriesConfigs, UpdateDateRange } from '../charts/common';
@@ -58,7 +59,7 @@ export interface StatItems {
   enableBarChart?: boolean;
   fields: StatItem[];
   grow?: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | true | false | null;
-  index: number;
+  index?: number;
   key: string;
   statKey?: string;
 }
@@ -112,12 +113,12 @@ export const barchartConfigs = (config?: { onElementClick?: ElementClickListener
 
 export const addValueToFields = (
   fields: StatItem[],
-  data: KpiHostsData | KpiNetworkData
+  data: KpiHostsData | NetworkKpiStrategyResponse
 ): StatItem[] => fields.map((field) => ({ ...field, value: get(field.key, data) }));
 
 export const addValueToAreaChart = (
   fields: StatItem[],
-  data: KpiHostsData | KpiNetworkData
+  data: KpiHostsData | NetworkKpiStrategyResponse
 ): ChartSeriesData[] =>
   fields
     .filter((field) => get(`${field.key}Histogram`, data) != null)
@@ -129,7 +130,7 @@ export const addValueToAreaChart = (
 
 export const addValueToBarChart = (
   fields: StatItem[],
-  data: KpiHostsData | KpiNetworkData
+  data: KpiHostsData | NetworkKpiStrategyResponse
 ): ChartSeriesData[] => {
   if (fields.length === 0) return [];
   return fields.reduce((acc: ChartSeriesData[], field: StatItem, idx: number) => {
@@ -158,7 +159,7 @@ export const addValueToBarChart = (
 
 export const useKpiMatrixStatus = (
   mappings: Readonly<StatItems[]>,
-  data: KpiHostsData | KpiNetworkData,
+  data: KpiHostsData | NetworkKpiStrategyResponse,
   id: string,
   from: string,
   to: string,