-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into security/siem-migrations/11283-install-rules
- Loading branch information
Showing
26 changed files
with
369 additions
and
37 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
5 changes: 1 addition & 4 deletions
5
x-pack/plugins/observability_solution/apm_data_access/kibana.jsonc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 1 addition & 1 deletion
2
x-pack/plugins/observability_solution/logs_data_access/kibana.jsonc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
5 changes: 1 addition & 4 deletions
5
x-pack/plugins/observability_solution/metrics_data_access/kibana.jsonc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
17 changes: 17 additions & 0 deletions
17
x-pack/plugins/security_solution/docs/siem_migration/README.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| # SIEM Migration Library | ||
|
|
||
| ## Migration Process | ||
|
|
||
| The SIEM migration library defines a set of UI components and services that are used to migrate third party SIEM resources like detection rules and translate them into resources that can be used in the Elastic Security app. | ||
|
|
||
| ## Graphs: | ||
|
|
||
| The below images are generated by running the following command from the security_solution directory: | ||
|
|
||
| ```bash | ||
| yarn siem-migrations:graph:draw | ||
| ``` | ||
|
|
||
| Main agent graph: | ||
|
|
||
|  |
Binary file added
BIN
+22.8 KB
x-pack/plugins/security_solution/docs/siem_migration/img/agent_graph.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
9 changes: 9 additions & 0 deletions
9
x-pack/plugins/security_solution/scripts/siem_migration/draw_graphs.js
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| require('../../../../../src/setup_node_env'); | ||
| require('./draw_graphs_script').draw(); |
80 changes: 80 additions & 0 deletions
80
x-pack/plugins/security_solution/scripts/siem_migration/draw_graphs_script.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| import type { InferenceClient } from '@kbn/inference-plugin/server'; | ||
| import type { | ||
| ActionsClientChatOpenAI, | ||
| ActionsClientSimpleChatModel, | ||
| } from '@kbn/langchain/server/language_models'; | ||
| import type { Logger } from '@kbn/logging'; | ||
| import { ToolingLog } from '@kbn/tooling-log'; | ||
| import { FakeLLM } from '@langchain/core/utils/testing'; | ||
| import fs from 'fs/promises'; | ||
| import path from 'path'; | ||
| import { getRuleMigrationAgent } from '../../server/lib/siem_migrations/rules/task/agent'; | ||
| import type { IntegrationRetriever } from '../../server/lib/siem_migrations/rules/task/util/integration_retriever'; | ||
| import type { PrebuiltRulesMapByName } from '../../server/lib/siem_migrations/rules/task/util/prebuilt_rules'; | ||
| import type { RuleResourceRetriever } from '../../server/lib/siem_migrations/rules/task/util/rule_resource_retriever'; | ||
|
|
||
| interface Drawable { | ||
| drawMermaidPng: () => Promise<Blob>; | ||
| } | ||
|
|
||
| const mockLlm = new FakeLLM({ | ||
| response: JSON.stringify({}, null, 2), | ||
| }) as unknown as ActionsClientChatOpenAI | ActionsClientSimpleChatModel; | ||
|
|
||
| const inferenceClient = {} as InferenceClient; | ||
| const connectorId = 'draw_graphs'; | ||
| const prebuiltRulesMap = {} as PrebuiltRulesMapByName; | ||
| const resourceRetriever = {} as RuleResourceRetriever; | ||
| const integrationRetriever = {} as IntegrationRetriever; | ||
|
|
||
| const createLlmInstance = () => { | ||
| return mockLlm; | ||
| }; | ||
|
|
||
| async function getAgentGraph(logger: Logger): Promise<Drawable> { | ||
| const model = createLlmInstance(); | ||
| const graph = getRuleMigrationAgent({ | ||
| model, | ||
| inferenceClient, | ||
| prebuiltRulesMap, | ||
| resourceRetriever, | ||
| integrationRetriever, | ||
| connectorId, | ||
| logger, | ||
| }); | ||
| return graph.getGraphAsync({ xray: true }); | ||
| } | ||
|
|
||
| export const drawGraph = async ({ | ||
| getGraphAsync, | ||
| outputFilename, | ||
| }: { | ||
| getGraphAsync: (logger: Logger) => Promise<Drawable>; | ||
| outputFilename: string; | ||
| }) => { | ||
| const logger = new ToolingLog({ | ||
| level: 'info', | ||
| writeTo: process.stdout, | ||
| }) as unknown as Logger; | ||
| logger.info('Compiling graph'); | ||
| const outputPath = path.join(__dirname, outputFilename); | ||
| const graph = await getGraphAsync(logger); | ||
| const output = await graph.drawMermaidPng(); | ||
| const buffer = Buffer.from(await output.arrayBuffer()); | ||
| logger.info(`Writing graph to ${outputPath}`); | ||
| await fs.writeFile(outputPath, buffer); | ||
| }; | ||
|
|
||
| export const draw = async () => { | ||
| await drawGraph({ | ||
| getGraphAsync: getAgentGraph, | ||
| outputFilename: '../../docs/siem_migration/img/agent_graph.png', | ||
| }); | ||
| }; |
Oops, something went wrong.