Merge branch 'main' of github.com:elastic/kibana into rename-synthetics

package.json

@@ -226,7 +226,7 @@
     "chokidar": "^3.4.3",
     "chroma-js": "^1.4.1",
     "classnames": "2.2.6",
-    "color": "1.0.3",
+    "color": "^4.2.3",
     "commander": "^4.1.1",
     "compare-versions": "3.5.1",
     "constate": "^1.3.2",
@@ -539,7 +539,7 @@
     "@types/chromedriver": "^81.0.1",
     "@types/classnames": "^2.2.9",
     "@types/cmd-shim": "^2.0.0",
-    "@types/color": "^3.0.0",
+    "@types/color": "^3.0.3",
     "@types/compression-webpack-plugin": "^2.0.2",
     "@types/cypress-cucumber-preprocessor": "^1.14.1",
     "@types/cytoscape": "^3.14.0",

src/plugins/charts/public/services/active_cursor/use_active_cursor.test.ts

@@ -5,8 +5,6 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
-
-import { from, of, delay, concatMap } from 'rxjs';
 import { renderHook } from '@testing-library/react-hooks';
 import type { RefObject } from 'react';
 
@@ -17,59 +15,69 @@ import type { ActiveCursorSyncOption, ActiveCursorPayload } from './types';
 import type { Chart, PointerEvent } from '@elastic/charts';
 import type { Datatable } from '@kbn/expressions-plugin/public';
 
-/** @internal **/
-type DispatchExternalPointerEventFn = (pointerEvent: PointerEvent) => void;
+// FLAKY: https://github.com/elastic/kibana/issues/130177
+describe.skip('useActiveCursor', () => {
+  let cursor: ActiveCursorPayload['cursor'];
+  let dispatchExternalPointerEvent: jest.Mock;
 
-describe('useActiveCursor', () => {
-  const act = async (
+  const act = (
     syncOption: ActiveCursorSyncOption,
     events: Array<Partial<ActiveCursorPayload>>,
-    eventsTimeout = 5
-  ): Promise<{ dispatchExternalPointerEvent: DispatchExternalPointerEventFn }> => {
-    const activeCursor = new ActiveCursor();
-    const cursor = {} as ActiveCursorPayload['cursor'];
-    const dispatchExternalPointerEvent: DispatchExternalPointerEventFn = jest.fn();
-    const debounce = syncOption.debounce ?? 5;
-
-    activeCursor.setup();
-
-    renderHook(() =>
-      useActiveCursor(
-        activeCursor,
-        {
-          current: {
-            dispatchExternalPointerEvent,
-          },
-        } as RefObject<Chart>,
-        { ...syncOption, debounce }
-      )
-    );
-
-    return new Promise((res, rej) =>
-      from(events)
-        .pipe(concatMap((x) => of(x).pipe(delay(eventsTimeout))))
-        .subscribe({
-          next: (item) => {
-            activeCursor.activeCursor$!.next({
-              cursor,
-              ...item,
-            });
-          },
-          complete: () => {
-            /** We have to wait before resolving the promise to make sure the debouncedEvent gets fired.  **/
-            setTimeout(() => res({ dispatchExternalPointerEvent }), eventsTimeout + debounce + 30);
-          },
-          error: (error) => {
-            rej(error);
-          },
-        })
-    );
-  };
+    eventsTimeout = 1
+  ) =>
+    new Promise(async (resolve, reject) => {
+      try {
+        const activeCursor = new ActiveCursor();
+        let allEventsExecuted = false;
+        activeCursor.setup();
+        dispatchExternalPointerEvent.mockImplementation((pointerEvent) => {
+          if (allEventsExecuted) {
+            resolve(pointerEvent);
+          }
+        });
+        renderHook(() =>
+          useActiveCursor(
+            activeCursor,
+            {
+              current: {
+                dispatchExternalPointerEvent: dispatchExternalPointerEvent as (
+                  pointerEvent: PointerEvent
+                ) => void,
+              },
+            } as RefObject<Chart>,
+            { ...syncOption, debounce: syncOption.debounce ?? 1 }
+          )
+        );
+
+        for (const e of events) {
+          await new Promise((eventResolve) =>
+            setTimeout(() => {
+              if (e === events[events.length - 1]) {
+                allEventsExecuted = true;
+              }
+
+              activeCursor.activeCursor$!.next({
+                cursor,
+                ...e,
+              });
+              eventResolve(null);
+            }, eventsTimeout)
+          );
+        }
+      } catch (error) {
+        reject(error);
+      }
+    });
+
+  beforeEach(() => {
+    cursor = {} as ActiveCursorPayload['cursor'];
+    dispatchExternalPointerEvent = jest.fn();
+  });
 
   test('should debounce events', async () => {
-    const { dispatchExternalPointerEvent } = await act(
+    await act(
       {
-        debounce: 10,
+        debounce: 50,
         datatables: [
           {
             columns: [
@@ -95,15 +103,13 @@ describe('useActiveCursor', () => {
   });
 
   test('should trigger cursor pointer update (chart type: time, event type: time)', async () => {
-    const { dispatchExternalPointerEvent } = await act({ isDateHistogram: true }, [
-      { isDateHistogram: true },
-    ]);
+    await act({ isDateHistogram: true }, [{ isDateHistogram: true }]);
 
     expect(dispatchExternalPointerEvent).toHaveBeenCalledTimes(1);
   });
 
   test('should trigger cursor pointer update (chart type: datatable - time based, event type: time)', async () => {
-    const { dispatchExternalPointerEvent } = await act(
+    await act(
       {
         datatables: [
           {
@@ -128,7 +134,7 @@ describe('useActiveCursor', () => {
   });
 
   test('should not trigger cursor pointer update (chart type: datatable, event type: time)', async () => {
-    const { dispatchExternalPointerEvent } = await act(
+    await act(
       {
         datatables: [
           {
@@ -150,7 +156,7 @@ describe('useActiveCursor', () => {
   });
 
   test('should works with multi datatables (intersection)', async () => {
-    const { dispatchExternalPointerEvent } = await act(
+    await act(
       {
         datatables: [
           {

x-pack/plugins/cloud_security_posture/common/constants.ts

@@ -13,11 +13,15 @@ export const UPDATE_RULES_CONFIG_ROUTE_PATH =
 
 export const CSP_FINDINGS_INDEX_NAME = 'findings';
 export const CIS_KUBERNETES_PACKAGE_NAME = 'cis_kubernetes_benchmark';
+export const FINDINGS_DATA_STREAM_NAME =
+  // Currently 'cis_kubernetes_benchmark.findings', To be refactored to 'cloud_security_posture.findings'
+  CIS_KUBERNETES_PACKAGE_NAME + '.' + CSP_FINDINGS_INDEX_NAME;
 export const LATEST_FINDINGS_INDEX_NAME = 'cloud_security_posture.findings_latest';
 export const BENCHMARK_SCORE_INDEX_NAME = 'cloud_security_posture.scores';
 
 export const AGENT_LOGS_INDEX_PATTERN = '.logs-cis_kubernetes_benchmark.metadata*';
-export const CSP_KUBEBEAT_INDEX_PATTERN = 'logs-cis_kubernetes_benchmark.findings*';
+export const CSP_KUBEBEAT_INDEX_PATTERN = 'logs-cis_kubernetes_benchmark.findings-*';
+export const FINDINGS_INDEX_PATTERN = 'logs-' + FINDINGS_DATA_STREAM_NAME + '-default';
 export const LATEST_FINDINGS_INDEX_PATTERN = 'logs-' + LATEST_FINDINGS_INDEX_NAME + '-default';
 export const BENCHMARK_SCORE_INDEX_PATTERN = 'logs-' + BENCHMARK_SCORE_INDEX_NAME + '-default';
 

x-pack/plugins/cloud_security_posture/server/create_indices/create_transforms_indices.ts

@@ -21,20 +21,22 @@ export const initializeCspTransformsIndices = async (
   esClient: ElasticsearchClient,
   logger: Logger
 ) => {
-  createIndexIfNotExists(
-    esClient,
-    LATEST_FINDINGS_INDEX_NAME,
-    LATEST_FINDINGS_INDEX_PATTERN,
-    latestFindingsMapping,
-    logger
-  );
-  createIndexIfNotExists(
-    esClient,
-    BENCHMARK_SCORE_INDEX_NAME,
-    BENCHMARK_SCORE_INDEX_PATTERN,
-    benchmarkScoreMapping,
-    logger
-  );
+  return Promise.all([
+    createIndexIfNotExists(
+      esClient,
+      LATEST_FINDINGS_INDEX_NAME,
+      LATEST_FINDINGS_INDEX_PATTERN,
+      latestFindingsMapping,
+      logger
+    ),
+    createIndexIfNotExists(
+      esClient,
+      BENCHMARK_SCORE_INDEX_NAME,
+      BENCHMARK_SCORE_INDEX_PATTERN,
+      benchmarkScoreMapping,
+      logger
+    ),
+  ]);
 };
 
 export const createIndexIfNotExists = async (

x-pack/plugins/cloud_security_posture/server/create_transforms/benchmark_score_transform.ts

@@ -0,0 +1,96 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { TransformPutTransformRequest } from '@elastic/elasticsearch/lib/api/types';
+import {
+  LATEST_FINDINGS_INDEX_PATTERN,
+  BENCHMARK_SCORE_INDEX_PATTERN,
+} from '../../common/constants';
+
+export const benchmarkScoreTransform: TransformPutTransformRequest = {
+  transform_id: 'cloud_security_posture.score-default-0.0.1',
+  description: 'Calculate latest findings score',
+  source: {
+    index: LATEST_FINDINGS_INDEX_PATTERN,
+  },
+  dest: {
+    index: BENCHMARK_SCORE_INDEX_PATTERN,
+  },
+  frequency: '30m',
+  sync: {
+    time: {
+      field: 'event.ingested',
+      delay: '60s',
+    },
+  },
+  retention_policy: {
+    time: {
+      field: '@timestamp',
+      max_age: '30d',
+    },
+  },
+  pivot: {
+    group_by: {
+      '@timestamp': {
+        date_histogram: {
+          field: '@timestamp',
+          calendar_interval: '1m',
+        },
+      },
+    },
+    aggregations: {
+      total_findings: {
+        value_count: {
+          field: 'result.evaluation.keyword',
+        },
+      },
+      passed_findings: {
+        filter: {
+          term: {
+            'result.evaluation.keyword': 'passed',
+          },
+        },
+      },
+      failed_findings: {
+        filter: {
+          term: {
+            'result.evaluation.keyword': 'failed',
+          },
+        },
+      },
+      score_by_cluster_id: {
+        terms: {
+          field: 'cluster_id.keyword',
+        },
+        aggregations: {
+          total_findings: {
+            value_count: {
+              field: 'result.evaluation.keyword',
+            },
+          },
+          passed_findings: {
+            filter: {
+              term: {
+                'result.evaluation.keyword': 'passed',
+              },
+            },
+          },
+          failed_findings: {
+            filter: {
+              term: {
+                'result.evaluation.keyword': 'failed',
+              },
+            },
+          },
+        },
+      },
+    },
+  },
+  _meta: {
+    managed: 'true',
+  },
+};