Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[8.5] [Security Solution][Endpoint][Response Actions] Do fuzzy search on given usernames for Actions Log (#141239) #141429

Merged
merged 6 commits into from
Sep 23, 2022
Merged

[8.5] [Security Solution][Endpoint][Response Actions] Do fuzzy search on given usernames for Actions Log (#141239) #141429

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
685eb7c
[Security Solution][Endpoint][Response Actions] Do fuzzy search on gi…
ashokaditya Sep 22, 2022
7680503
Merge branch '8.5' of github.com:elastic/kibana into backport/8.5/pr-…
Sep 22, 2022
b5ff4e1
Merge branch '8.5' into backport/8.5/pr-141239
Sep 22, 2022
6d6616b
Merge branch '8.5' into backport/8.5/pr-141239
kibanamachine Sep 22, 2022
4e90ce6
Merge branch '8.5' into backport/8.5/pr-141239
kibanamachine Sep 22, 2022
a1b1633
Merge branch '8.5' into backport/8.5/pr-141239
ashokaditya Sep 23, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...s/security_solution/public/management/hooks/endpoint/use_get_endpoint_action_list.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ describe('useGetEndpointActionList hook', () => {
page: 2,
pageSize: 20,
startDate: 'now-5d',
userIds: ['elastic', 'citsale'],
userIds: ['*elastic*', '*citsale*'],
},
});
});
Expand Down
10 changes: 9 additions & 1 deletion ...lugins/security_solution/public/management/hooks/endpoint/use_get_endpoint_action_list.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,14 @@ export const useGetEndpointActionList = (
): UseQueryResult<ActionListApiResponse, IHttpFetchError<ErrorType>> => {
const http = useHttp();

// prepend and append * to userIds for fuzzy search
let userIds = query.userIds;
if (typeof query.userIds === 'string') {
userIds = `*${query.userIds}*`;
} else if (Array.isArray(query.userIds)) {
userIds = query.userIds.map((userId) => `*${userId}*`);
}

return useQuery<ActionListApiResponse, IHttpFetchError<ErrorType>>({
queryKey: ['get-action-list', query],
...options,
Expand All @@ -37,7 +45,7 @@ export const useGetEndpointActionList = (
pageSize: query.pageSize,
startDate: query.startDate,
statuses: query.statuses,
userIds: query.userIds,
userIds,
},
});
},
Expand Down
187 changes: 151 additions & 36 deletions x-pack/plugins/security_solution/server/endpoint/services/actions/action_list.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,53 +225,171 @@ describe('When using `getActionList()', () => {
startDate: 'now-10d',
endDate: 'now',
commands: ['isolate', 'unisolate', 'get-file'],
userIds: ['elastic'],
userIds: ['*elastic*'],
});

expect(esClient.search).toHaveBeenNthCalledWith(
1,
expect.objectContaining({
{
body: {
query: {
bool: {
filter: [
{
term: {
input_type: 'endpoint',
},
},
{
term: {
type: 'INPUT_ACTION',
},
},
must: [
{
range: {
'@timestamp': {
gte: 'now-10d',
},
bool: {
filter: [
{
term: {
input_type: 'endpoint',
},
},
{
term: {
type: 'INPUT_ACTION',
},
},
{
range: {
'@timestamp': {
gte: 'now-10d',
},
},
},
{
range: {
'@timestamp': {
lte: 'now',
},
},
},
{
terms: {
'data.command': ['isolate', 'unisolate', 'get-file'],
},
},
{
terms: {
agents: ['123'],
},
},
],
},
},
{
range: {
'@timestamp': {
lte: 'now',
},
},
},
{
terms: {
'data.command': ['isolate', 'unisolate', 'get-file'],
bool: {
should: [
{
query_string: {
fields: ['user_id'],
query: '*elastic*',
},
},
],
minimum_should_match: 1,
},
},
],
},
},
sort: [
{
'@timestamp': {
order: 'desc',
},
},
],
},
from: 0,
index: '.logs-endpoint.actions-default',
size: 20,
},
{ ignore: [404], meta: true }
);
});

it('should call search with exact usernames when no wildcards are present', async () => {
// mock metadataService.findHostMetadataForFleetAgents resolved value
(endpointAppContextService.getEndpointMetadataService as jest.Mock) = jest
.fn()
.mockReturnValue({
findHostMetadataForFleetAgents: jest.fn().mockResolvedValue([]),
});
await getActionList({
esClient,
logger,
metadataService: endpointAppContextService.getEndpointMetadataService(),
pageSize: 10,
startDate: 'now-1d',
endDate: 'now',
userIds: ['elastic', 'kibana'],
});

expect(esClient.search).toHaveBeenNthCalledWith(
1,
{
body: {
query: {
bool: {
must: [
{
terms: {
user_id: ['elastic'],
bool: {
filter: [
{
term: {
input_type: 'endpoint',
},
},
{
term: {
type: 'INPUT_ACTION',
},
},
{
range: {
'@timestamp': {
gte: 'now-1d',
},
},
},
{
range: {
'@timestamp': {
lte: 'now',
},
},
},
],
},
},
{
terms: {
agents: ['123'],
bool: {
should: [
{
bool: {
should: [
{
match: {
user_id: 'elastic',
},
},
],
minimum_should_match: 1,
},
},
{
bool: {
should: [
{
match: {
user_id: 'kibana',
},
},
],
minimum_should_match: 1,
},
},
],
minimum_should_match: 1,
},
},
],
Expand All @@ -287,12 +405,9 @@ describe('When using `getActionList()', () => {
},
from: 0,
index: '.logs-endpoint.actions-default',
size: 20,
}),
expect.objectContaining({
ignore: [404],
meta: true,
})
size: 10,
},
{ ignore: [404], meta: true }
);
});

Expand Down
Loading