[Security Solution] Refactor Network Details to use Search Strategy (#…

…76928)

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts

@@ -23,6 +23,8 @@ import {
 } from './hosts';
 import {
   NetworkQueries,
+  NetworkDetailsStrategyResponse,
+  NetworkDetailsRequestOptions,
   NetworkDnsStrategyResponse,
   NetworkDnsRequestOptions,
   NetworkTlsStrategyResponse,
@@ -35,6 +37,8 @@ import {
   NetworkTopCountriesRequestOptions,
   NetworkTopNFlowStrategyResponse,
   NetworkTopNFlowRequestOptions,
+  NetworkUsersStrategyResponse,
+  NetworkUsersRequestOptions,
 } from './network';
 import {
   MatrixHistogramQuery,
@@ -87,6 +91,8 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
   ? HostFirstLastSeenStrategyResponse
   : T extends HostsQueries.uncommonProcesses
   ? HostUncommonProcessesStrategyResponse
+  : T extends NetworkQueries.details
+  ? NetworkDetailsStrategyResponse
   : T extends NetworkQueries.dns
   ? NetworkDnsStrategyResponse
   : T extends NetworkQueries.http
@@ -99,6 +105,8 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
   ? NetworkTopCountriesStrategyResponse
   : T extends NetworkQueries.topNFlow
   ? NetworkTopNFlowStrategyResponse
+  : T extends NetworkQueries.users
+  ? NetworkUsersStrategyResponse
   : T extends typeof MatrixHistogramQuery
   ? MatrixHistogramStrategyResponse
   : never;
@@ -115,6 +123,8 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
   ? HostFirstLastSeenRequestOptions
   : T extends HostsQueries.uncommonProcesses
   ? HostUncommonProcessesRequestOptions
+  : T extends NetworkQueries.details
+  ? NetworkDetailsRequestOptions
   : T extends NetworkQueries.dns
   ? NetworkDnsRequestOptions
   : T extends NetworkQueries.http
@@ -127,6 +137,8 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
   ? NetworkTopCountriesRequestOptions
   : T extends NetworkQueries.topNFlow
   ? NetworkTopNFlowRequestOptions
+  : T extends NetworkQueries.users
+  ? NetworkUsersRequestOptions
   : T extends typeof MatrixHistogramQuery
   ? MatrixHistogramRequestOptions
   : never;

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/common/index.ts

@@ -15,6 +15,13 @@ export enum NetworkTopTablesFields {
   source_ips = 'source_ips',
 }
 
+export enum FlowTarget {
+  client = 'client',
+  destination = 'destination',
+  server = 'server',
+  source = 'source',
+}
+
 export enum FlowTargetSourceDest {
   destination = 'destination',
   source = 'source',

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/details/index.ts

@@ -0,0 +1,109 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { HostEcs } from '../../../../ecs/host';
+import { GeoEcs } from '../../../../ecs/geo';
+import { Inspect, Maybe, TotalValue, Hit, ShardsResponse } from '../../../common';
+import { RequestBasicOptions } from '../..';
+
+export interface NetworkDetailsRequestOptions extends Omit<RequestBasicOptions, 'timerange'> {
+  ip: string;
+}
+
+export interface NetworkDetailsStrategyResponse extends IEsSearchResponse {
+  networkDetails: {
+    client?: Maybe<NetworkDetails>;
+    destination?: Maybe<NetworkDetails>;
+    host?: HostEcs;
+    server?: Maybe<NetworkDetails>;
+    source?: Maybe<NetworkDetails>;
+  };
+  inspect?: Maybe<Inspect>;
+}
+
+export interface NetworkDetails {
+  firstSeen?: Maybe<string>;
+  lastSeen?: Maybe<string>;
+  autonomousSystem: AutonomousSystem;
+  geo: GeoEcs;
+}
+
+export interface AutonomousSystem {
+  number?: Maybe<number>;
+  organization?: Maybe<AutonomousSystemOrganization>;
+}
+
+export interface AutonomousSystemOrganization {
+  name?: Maybe<string>;
+}
+
+interface ResultHit<T> {
+  doc_count: number;
+  results: {
+    hits: {
+      total: TotalValue | number;
+      max_score: number | null;
+      hits: Array<{
+        _source: T;
+        sort?: [number];
+        _index?: string;
+        _type?: string;
+        _id?: string;
+        _score?: number | null;
+      }>;
+    };
+  };
+}
+
+export interface NetworkHit {
+  took?: number;
+  timed_out?: boolean;
+  _scroll_id?: string;
+  _shards?: ShardsResponse;
+  timeout?: number;
+  hits?: {
+    total: number;
+    hits: Hit[];
+  };
+  doc_count: number;
+  geo: ResultHit<object>;
+  autonomousSystem: ResultHit<object>;
+  firstSeen: {
+    value: number;
+    value_as_string: string;
+  };
+  lastSeen: {
+    value: number;
+    value_as_string: string;
+  };
+}
+
+export type NetworkDetailsHostHit = ResultHit<object>;
+
+export interface NetworkDetailsHit {
+  aggregations: {
+    destination?: NetworkHit;
+    source?: NetworkHit;
+    host: ResultHit<object>;
+  };
+  _shards: {
+    total: number;
+    successful: number;
+    skipped: number;
+    failed: number;
+  };
+  hits: {
+    total: {
+      value: number;
+      relation: string;
+    };
+    max_score: number | null;
+    hits: [];
+  };
+  took: number;
+  timeout: number;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/http/index.ts

@@ -8,6 +8,16 @@ import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/comm
 import { Maybe, CursorType, Inspect, PageInfoPaginated, GenericBuckets } from '../../../common';
 import { RequestOptionsPaginated } from '../..';
 
+export enum NetworkHttpFields {
+  domains = 'domains',
+  lastHost = 'lastHost',
+  lastSourceIp = 'lastSourceIp',
+  methods = 'methods',
+  path = 'path',
+  requestCount = 'requestCount',
+  statuses = 'statuses',
+}
+
 export interface NetworkHttpRequestOptions extends RequestOptionsPaginated {
   ip?: string;
   defaultIndex: string[];

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts

@@ -5,18 +5,22 @@
  */
 
 export * from './common';
+export * from './details';
 export * from './dns';
 export * from './http';
 export * from './overview';
 export * from './tls';
 export * from './top_countries';
 export * from './top_n_flow';
+export * from './users';
 
 export enum NetworkQueries {
+  details = 'networkDetails',
   dns = 'dns',
   http = 'http',
   overview = 'overviewNetwork',
   tls = 'tls',
   topCountries = 'topCountries',
   topNFlow = 'topNFlow',
+  users = 'users',
 }

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/tls/index.ts

@@ -9,7 +9,7 @@ import { CursorType, Inspect, Maybe, PageInfoPaginated } from '../../../common';
 import { RequestOptionsPaginated } from '../..';
 import { FlowTargetSourceDest } from '../common';
 
-export interface TlsBuckets {
+export interface NetworkTlsBuckets {
   key: string;
   timestamp?: {
     value: number;
@@ -29,7 +29,7 @@ export interface TlsBuckets {
   };
 }
 
-export interface TlsNode {
+export interface NetworkTlsNode {
   _id?: Maybe<string>;
   timestamp?: Maybe<string>;
   notAfter?: Maybe<string[]>;
@@ -38,23 +38,23 @@ export interface TlsNode {
   issuers?: Maybe<string[]>;
 }
 
-export enum TlsFields {
+export enum NetworkTlsFields {
   _id = '_id',
 }
 
-export interface TlsEdges {
-  node: TlsNode;
+export interface NetworkTlsEdges {
+  node: NetworkTlsNode;
   cursor: CursorType;
 }
 
-export interface NetworkTlsRequestOptions extends RequestOptionsPaginated<TlsFields> {
+export interface NetworkTlsRequestOptions extends RequestOptionsPaginated<NetworkTlsFields> {
   ip: string;
   flowTarget: FlowTargetSourceDest;
   defaultIndex: string[];
 }
 
 export interface NetworkTlsStrategyResponse extends IEsSearchResponse {
-  edges: TlsEdges[];
+  edges: NetworkTlsEdges[];
   totalCount: number;
   pageInfo: PageInfoPaginated;
   inspect?: Maybe<Inspect>;

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/top_countries/index.ts

@@ -14,13 +14,6 @@ import {
   TopNetworkTablesEcsField,
 } from '../common';
 
-export enum FlowTarget {
-  client = 'client',
-  destination = 'destination',
-  server = 'server',
-  source = 'source',
-}
-
 export interface TopCountriesItemSource {
   country?: Maybe<string>;
   destination_ips?: Maybe<number>;

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/users/index.ts

@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { CursorType, Inspect, Maybe, PageInfoPaginated, SortField } from '../../../common';
+import { FlowTarget } from '../common';
+import { RequestOptionsPaginated } from '../..';
+
+export enum NetworkUsersFields {
+  name = 'name',
+  count = 'count',
+}
+
+export interface NetworkUsersRequestOptions extends RequestOptionsPaginated {
+  ip: string;
+  sort: SortField<NetworkUsersFields>;
+  flowTarget: FlowTarget;
+}
+
+export interface NetworkUsersStrategyResponse extends IEsSearchResponse {
+  edges: NetworkUsersEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface NetworkUsersEdges {
+  node: NetworkUsersNode;
+  cursor: CursorType;
+}
+
+export interface NetworkUsersNode {
+  _id?: Maybe<string>;
+  timestamp?: Maybe<string>;
+  user?: Maybe<NetworkUsersItem>;
+}
+
+export interface NetworkUsersItem {
+  name?: Maybe<string>;
+  id?: Maybe<string[] | string>;
+  groupId?: Maybe<string[] | string>;
+  groupName?: Maybe<string[] | string>;
+  count?: Maybe<number>;
+}
+
+export interface NetworkUsersBucketsItem {
+  key: string;
+  doc_count: number;
+  groupName?: NetworkUsersGroupName;
+  groupId?: NetworkUsersGroupId;
+  id?: Id;
+}
+
+export interface NetworkUsersGroupName {
+  doc_count_error_upper_bound: number;
+  sum_other_doc_count: number;
+  buckets: NetworkUsersBucketsItem[];
+}
+
+export interface NetworkUsersGroupId {
+  doc_count_error_upper_bound: number;
+  sum_other_doc_count: number;
+  buckets: NetworkUsersBucketsItem[];
+}
+
+interface Id {
+  doc_count_error_upper_bound: number;
+  sum_other_doc_count: number;
+  buckets: NetworkUsersBucketsItem[];
+}

x-pack/plugins/security_solution/public/common/components/link_to/__mocks__/index.ts

@@ -9,7 +9,7 @@ import { SecurityPageName } from '../../../../app/types';
 export { getDetectionEngineUrl } from '../redirect_to_detection_engine';
 export { getAppOverviewUrl } from '../redirect_to_overview';
 export { getHostDetailsUrl, getHostsUrl } from '../redirect_to_hosts';
-export { getNetworkUrl, getIPDetailsUrl } from '../redirect_to_network';
+export { getNetworkUrl, getNetworkDetailsUrl } from '../redirect_to_network';
 export { getTimelinesUrl, getTimelineTabsUrl } from '../redirect_to_timelines';
 export {
   getCaseDetailsUrl,

x-pack/plugins/security_solution/public/common/components/link_to/index.ts

@@ -15,7 +15,7 @@ import { useKibana } from '../../lib/kibana';
 export { getDetectionEngineUrl } from './redirect_to_detection_engine';
 export { getAppOverviewUrl } from './redirect_to_overview';
 export { getHostDetailsUrl, getHostsUrl } from './redirect_to_hosts';
-export { getNetworkUrl, getIPDetailsUrl } from './redirect_to_network';
+export { getNetworkUrl, getNetworkDetailsUrl } from './redirect_to_network';
 export { getTimelinesUrl, getTimelineTabsUrl } from './redirect_to_timelines';
 export {
   getCaseDetailsUrl,

x-pack/plugins/security_solution/public/common/components/link_to/redirect_to_network.tsx

@@ -13,7 +13,7 @@ import { appendSearch } from './helpers';
 
 export const getNetworkUrl = (search?: string) => `${appendSearch(search)}`;
 
-export const getIPDetailsUrl = (
+export const getNetworkDetailsUrl = (
   detailName: string,
   flowTarget?: FlowTarget | FlowTargetSourceDest,
   search?: string