Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution][Endpoint] get-file response action kibana download file API #143708

Merged

Conversation

paul-tavares
Copy link
Contributor

@paul-tavares paul-tavares commented Oct 19, 2022

Summary

  • Adds a new API that allows for a user to download a file retrieved from a host (via response actions console)
    • Note: this PR adds a new required dependency to the security solution plugin's kibana.json
  • Adds a download button to the success message of get-file console command
  • Adds additional mocks to the Files plugin for testing

Also, It addresses the following issues against the get-file command in the response console:

  • Windows path (which use a backslash \) are not being handled correctly. Backslash is being stripped out
  • The help panel should display the required param (--path) and that should also be pre-populated to the console's input area when user clicks the + button
  • The output of get-file --help should have a similar syntax pattern as other commands that have a required argument (ex. kill-process)

olm-4662-file-download-and-ui-download-link

@paul-tavares paul-tavares added release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.6.0 labels Oct 19, 2022
@paul-tavares paul-tavares self-assigned this Oct 19, 2022
@paul-tavares paul-tavares marked this pull request as ready for review October 19, 2022 22:21
@paul-tavares paul-tavares requested review from a team as code owners October 19, 2022 22:21
@paul-tavares paul-tavares requested review from pzl and joeypoon October 19, 2022 22:21
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt)

fileName,
mimeType,
};
} catch (error) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we know what error comes back if the metadata document exists, but no chunks exist?

Should probably also be a 404? or 410.

Although if this is a "fetched-too-soon" situation and it's still uploading, then 410 wouldn't be correct.

Post-deletion, that's a great status code. but 404 is ok for the unknown, and general purpose here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll test that out by deleting the chunks. I don't think we get an error here - I thin the error comes in when you start to actually read the chunks and they are not found.

the "fetched-too-soon" is not a real issue from our use case via Kibana UI, but could happen via API only if someone called it manually. if that was to occur, the Files service returns a NoDownloadAvailableError (here) which I think would translate into a 500 API error on our side

Copy link
Member

@joeypoon joeypoon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔥 🔥

Copy link
Contributor

@jloleysens jloleysens left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great job @paul-tavares ! Nice that you created a file mock that can be readily used too

@paul-tavares paul-tavares enabled auto-merge (squash) October 20, 2022 18:34
@kibana-ci
Copy link
Collaborator

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] Security Solution Tests #1 / Changing alert status Changing alert status with read only role Closes alerts
  • [job] [logs] FTR Configs #39 / Reporting APIs Reporting error codes places error_code in report output
  • [job] [logs] Security Solution Tests #4 / Timeline search and filters Update kqlMode for timeline "before all" hook for "should be able to update timeline kqlMode with filter"

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 3198 3201 +3

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 10.0MB 10.0MB +7.8KB
Unknown metric groups

ESLint disabled in files

id before after diff
securitySolution 76 77 +1

Total ESLint disabled count

id before after diff
securitySolution 490 491 +1

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @paul-tavares

@paul-tavares paul-tavares merged commit e53f438 into elastic:main Oct 20, 2022
@kibanamachine kibanamachine added the backport:skip This commit does not require backporting label Oct 20, 2022
jloleysens added a commit to jloleysens/kibana that referenced this pull request Oct 24, 2022
* main: (57 commits)
  [Files] Filepicker (elastic#143111)
  [Infrastructure UI] Replace Lens table with EUI table and own api (elastic#142871)
  [api-docs] Daily api_docs build (elastic#143829)
  [api-docs] Daily api_docs build (elastic#143825)
  [api-docs] Daily api_docs build (elastic#143823)
  [Security Solution] Restructuring folders of Detection Engine + refactoring Rule Management (elastic#142950)
  [Dev tools] Fix performance issue with autocomplete suggestions (elastic#143428)
  [Security Solution] Disable ML rule's edit button link under basic license (elastic#143260)
  [Lens]  Use the language-documentation package for formula (elastic#143649)
  [api-docs] Daily api_docs build (elastic#143811)
  [Security Solution] Fix missing title on inspect pop-up (elastic#143601)
  fix incorrect filters being passed to events table causing duplicate entries in our inpsect tool request tab (elastic#143239)
  [Security Solution][Endpoint] `get-file` response action kibana download file API (elastic#143708)
  Rely on refresh context to update stats independently of overview cards. (elastic#143308)
  [RAM] Rule event log - Fix incorrect results when filtering by message and outcome simultaneously (elastic#143119)
  [ML] Display link to create data view from error cases in data frame analytics results pages (elastic#143596)
  Update links in README :) (elastic#143675)
  Add more tests for ml_inference_logic (elastic#143764)
  skip failing test suite (elastic#143717)
  [DOCS] Add assignees to case APIs (elastic#143610)
  ...
@paul-tavares paul-tavares deleted the task/olm-4662-get-file-download-api branch October 24, 2022 14:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport:skip This commit does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.6.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants