Skip to content

Commit f0269b4

Browse files
kfirpeledkfirpeled
committed
Moved related.entity to security's alerts only
1 parent 1ef6253 commit f0269b4

File tree

11 files changed

+484
-48
lines changed

11 files changed

+484
-48
lines changed

‎src/platform/packages/shared/kbn-alerts-as-data-utils/src/field_maps/alert_field_map.ts‎

Lines changed: 8 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,15 @@
1010
import {
1111
ALERT_ACTION_GROUP,
1212
ALERT_CASE_IDS,
13-
ALERT_CONSECUTIVE_MATCHES,
1413
ALERT_DURATION,
1514
ALERT_END,
16-
ALERT_FLAPPING_HISTORY,
1715
ALERT_FLAPPING,
18-
ALERT_INSTANCE_ID,
19-
ALERT_INTENDED_TIMESTAMP,
20-
ALERT_LAST_DETECTED,
16+
ALERT_FLAPPING_HISTORY,
2117
ALERT_MAINTENANCE_WINDOW_IDS,
18+
ALERT_CONSECUTIVE_MATCHES,
2219
ALERT_PENDING_RECOVERED_COUNT,
20+
ALERT_INSTANCE_ID,
21+
ALERT_LAST_DETECTED,
2322
ALERT_PREVIOUS_ACTION_GROUP,
2423
ALERT_REASON,
2524
ALERT_RULE_CATEGORY,
@@ -46,14 +45,14 @@ import {
4645
ALERT_WORKFLOW_ASSIGNEE_IDS,
4746
ALERT_WORKFLOW_STATUS,
4847
ALERT_WORKFLOW_TAGS,
48+
SPACE_IDS,
49+
TIMESTAMP,
50+
VERSION,
4951
EVENT_ACTION,
5052
EVENT_KIND,
5153
EVENT_ORIGINAL,
52-
RELATED_ENTITY,
53-
SPACE_IDS,
5454
TAGS,
55-
TIMESTAMP,
56-
VERSION,
55+
ALERT_INTENDED_TIMESTAMP,
5756
} from '@kbn/rule-data-utils';
5857
import type { MultiField } from './types';
5958

@@ -277,11 +276,6 @@ export const alertFieldMap = {
277276
required: false,
278277
ignore_above: 1024,
279278
},
280-
[RELATED_ENTITY]: {
281-
type: 'keyword',
282-
array: true,
283-
required: false,
284-
},
285279
[SPACE_IDS]: {
286280
type: 'keyword',
287281
array: true,

‎src/platform/packages/shared/kbn-rule-data-utils/src/default_alerts_as_data.ts‎

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
import type { ValuesType } from 'utility-types';
1111

1212
const TIMESTAMP = '@timestamp' as const;
13-
const RELATED_ENTITY = 'related.entity';
1413

1514
// namespaces
1615
const KIBANA_NAMESPACE = 'kibana' as const;
@@ -147,22 +146,22 @@ const namespaces = {
147146
export const fields = {
148147
ALERT_ACTION_GROUP,
149148
ALERT_CASE_IDS,
150-
ALERT_CONSECUTIVE_MATCHES,
151149
ALERT_DURATION,
152150
ALERT_END,
153-
ALERT_FLAPPING_HISTORY,
154151
ALERT_FLAPPING,
155-
ALERT_INSTANCE_ID,
156-
ALERT_INTENDED_TIMESTAMP,
157-
ALERT_LAST_DETECTED,
152+
ALERT_FLAPPING_HISTORY,
158153
ALERT_MAINTENANCE_WINDOW_IDS,
159154
ALERT_PENDING_RECOVERED_COUNT,
155+
ALERT_CONSECUTIVE_MATCHES,
156+
ALERT_INSTANCE_ID,
157+
ALERT_LAST_DETECTED,
160158
ALERT_PREVIOUS_ACTION_GROUP,
161159
ALERT_REASON,
162160
ALERT_RULE_CATEGORY,
163161
ALERT_RULE_CONSUMER,
164162
ALERT_RULE_EXECUTION_TIMESTAMP,
165163
ALERT_RULE_EXECUTION_TYPE,
164+
ALERT_INTENDED_TIMESTAMP,
166165
ALERT_RULE_EXECUTION_UUID,
167166
ALERT_RULE_NAME,
168167
ALERT_RULE_PARAMETERS,
@@ -183,7 +182,6 @@ export const fields = {
183182
ALERT_WORKFLOW_ASSIGNEE_IDS,
184183
ALERT_WORKFLOW_STATUS,
185184
ALERT_WORKFLOW_TAGS,
186-
RELATED_ENTITY,
187185
SPACE_IDS,
188186
TIMESTAMP,
189187
VERSION,
@@ -198,22 +196,22 @@ export {
198196
// fields
199197
ALERT_ACTION_GROUP,
200198
ALERT_CASE_IDS,
201-
ALERT_CONSECUTIVE_MATCHES,
202199
ALERT_DURATION,
203200
ALERT_END,
204-
ALERT_FLAPPING_HISTORY,
205201
ALERT_FLAPPING,
206-
ALERT_INSTANCE_ID,
207-
ALERT_INTENDED_TIMESTAMP,
208-
ALERT_LAST_DETECTED,
202+
ALERT_FLAPPING_HISTORY,
209203
ALERT_MAINTENANCE_WINDOW_IDS,
204+
ALERT_CONSECUTIVE_MATCHES,
210205
ALERT_PENDING_RECOVERED_COUNT,
206+
ALERT_INSTANCE_ID,
207+
ALERT_LAST_DETECTED,
211208
ALERT_PREVIOUS_ACTION_GROUP,
212209
ALERT_REASON,
213210
ALERT_RULE_CATEGORY,
214211
ALERT_RULE_CONSUMER,
215212
ALERT_RULE_EXECUTION_TIMESTAMP,
216213
ALERT_RULE_EXECUTION_TYPE,
214+
ALERT_INTENDED_TIMESTAMP,
217215
ALERT_RULE_EXECUTION_UUID,
218216
ALERT_RULE_NAME,
219217
ALERT_RULE_PARAMETERS,
@@ -234,7 +232,6 @@ export {
234232
ALERT_WORKFLOW_ASSIGNEE_IDS,
235233
ALERT_WORKFLOW_STATUS,
236234
ALERT_WORKFLOW_TAGS,
237-
RELATED_ENTITY,
238235
SPACE_IDS,
239236
TIMESTAMP,
240237
VERSION,

‎x-pack/platform/plugins/shared/alerting/common/alert_schema/field_maps/mapping_from_field_map.test.ts‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -368,13 +368,6 @@ describe('mappingFromFieldMap', () => {
368368
},
369369
},
370370
},
371-
related: {
372-
properties: {
373-
entity: {
374-
type: 'keyword',
375-
},
376-
},
377-
},
378371
tags: {
379372
type: 'keyword',
380373
},

‎x-pack/platform/plugins/shared/alerting/server/integration_tests/__snapshots__/alert_as_data_fields.test.ts.snap‎

Lines changed: 0 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎x-pack/platform/plugins/shared/rule_registry/common/assets/field_maps/technical_rule_field_map.test.ts‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -391,11 +391,6 @@ it('matches snapshot', () => {
391391
"required": false,
392392
"type": "version",
393393
},
394-
"related.entity": Object {
395-
"array": true,
396-
"required": false,
397-
"type": "keyword",
398-
},
399394
"tags": Object {
400395
"array": true,
401396
"required": false,

‎x-pack/platform/test/alerting_api_integration/spaces_only/tests/alerting/group4/alerts_as_data/alerts_as_data_dynamic_templates.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -69,9 +69,9 @@ export default function createAlertsAsDataDynamicTemplatesTest({ getService }: F
6969
const numberOfExistingFields = Object.keys(existingFields).length;
7070
// there is no way to get the real number of fields from ES.
7171
// Eventhough we have only as many as alertFieldMap fields,
72-
// ES counts each child of the nested objects and multi_fields as separate fields.
73-
// therefore we add 12 to get the real number.
74-
const nestedObjectsAndMultiFields = 12;
72+
// ES counts the each childs of the nested objects and multi_fields as seperate fields.
73+
// therefore we add 11 to get the real number.
74+
const nestedObjectsAndMultiFields = 11;
7575
// Number of free slots that we want to have, so we can add dynamic fields as many
7676
const numberofFreeSlots = 2;
7777
const totalFields =

‎x-pack/solutions/security/plugins/cloud_security_posture/server/routes/graph/fetch_graph.ts‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License
4+
* 2.0; you may not use this file except in compliance with the Elastic License
5+
* 2.0.
6+
*/
7+
8+
import type { Logger, IScopedClusterClient } from '@kbn/core/server';
9+
import {
10+
DOCUMENT_TYPE_ALERT,
11+
DOCUMENT_TYPE_EVENT,
12+
} from '@kbn/cloud-security-posture-common/types/graph/v1';
13+
import type { EsqlToRecords } from '@elastic/elasticsearch/lib/helpers';
14+
import type { EsQuery, GraphEdge, OriginEventId } from './types';
15+
16+
export const fetchGraph = async ({
17+
esClient,
18+
logger,
19+
start,
20+
end,
21+
originEventIds,
22+
showUnknownTarget,
23+
esQuery,
24+
}: {
25+
esClient: IScopedClusterClient;
26+
logger: Logger;
27+
start: string | number;
28+
end: string | number;
29+
originEventIds: OriginEventId[];
30+
showUnknownTarget: boolean;
31+
esQuery?: EsQuery;
32+
}): Promise<EsqlToRecords<GraphEdge>> => {
33+
const originAlertIds = originEventIds.filter((originEventId) => originEventId.isAlert);
34+
const query = `FROM logs-* METADATA _id, _index
35+
| WHERE event.action IS NOT NULL AND actor.entity.id IS NOT NULL
36+
// Origin event and alerts allow us to identify the start position of graph traversal
37+
| EVAL isOrigin = ${
38+
originEventIds.length > 0
39+
? `event.id in (${originEventIds.map((_id, idx) => `?og_id${idx}`).join(', ')})`
40+
: 'false'
41+
}
42+
| EVAL isOriginAlert = isOrigin AND ${
43+
originAlertIds.length > 0
44+
? `event.id in (${originAlertIds.map((_id, idx) => `?og_alrt_id${idx}`).join(', ')})`
45+
: 'false'
46+
}
47+
// Aggregate document's data for popover expansion and metadata enhancements
48+
// We format it as JSON string, the best alternative so far. Tried to use tuple using MV_APPEND
49+
// but it flattens the data and we lose the structure
50+
| EVAL docType = CASE (_index LIKE "*.alerts-security.alerts-*", "${DOCUMENT_TYPE_ALERT}", "${DOCUMENT_TYPE_EVENT}")
51+
| EVAL docData = CONCAT("{",
52+
"\\"id\\":\\"", _id, "\\"",
53+
",\\"type\\":\\"", docType, "\\"",
54+
",\\"index\\":\\"", _index, "\\"",
55+
"}")
56+
| STATS badge = COUNT(*),
57+
docs = VALUES(docData),
58+
ips = VALUES(related.ip),
59+
// hosts = VALUES(related.hosts),
60+
users = VALUES(related.user)
61+
BY actorIds = actor.entity.id,
62+
action = event.action,
63+
targetIds = target.entity.id,
64+
isOrigin,
65+
isOriginAlert
66+
| LIMIT 1000
67+
| SORT isOrigin DESC, action`;
68+
69+
logger.trace(`Executing query [${query}]`);
70+
71+
const eventIds = originEventIds.map((originEventId) => originEventId.id);
72+
return await esClient.asCurrentUser.helpers
73+
.esql({
74+
columnar: false,
75+
filter: buildDslFilter(eventIds, showUnknownTarget, start, end, esQuery),
76+
query,
77+
// @ts-ignore - types are not up to date
78+
params: [
79+
...originEventIds.map((originEventId, idx) => ({ [`og_id${idx}`]: originEventId.id })),
80+
...originEventIds
81+
.filter((originEventId) => originEventId.isAlert)
82+
.map((originEventId, idx) => ({ [`og_alrt_id${idx}`]: originEventId.id })),
83+
],
84+
})
85+
.toRecords<GraphEdge>();
86+
};
87+
88+
const buildDslFilter = (
89+
eventIds: string[],
90+
showUnknownTarget: boolean,
91+
start: string | number,
92+
end: string | number,
93+
esQuery?: EsQuery
94+
) => ({
95+
bool: {
96+
filter: [
97+
{
98+
range: {
99+
'@timestamp': {
100+
gte: start,
101+
lte: end,
102+
},
103+
},
104+
},
105+
...(showUnknownTarget
106+
? []
107+
: [
108+
{
109+
exists: {
110+
field: 'target.entity.id',
111+
},
112+
},
113+
]),
114+
{
115+
bool: {
116+
should: [
117+
...(esQuery?.bool.filter?.length ||
118+
esQuery?.bool.must?.length ||
119+
esQuery?.bool.should?.length ||
120+
esQuery?.bool.must_not?.length
121+
? [esQuery]
122+
: []),
123+
{
124+
terms: {
125+
'event.id': eventIds,
126+
},
127+
},
128+
],
129+
minimum_should_match: 1,
130+
},
131+
},
132+
],
133+
},
134+
});

0 commit comments

Comments
 (0)