[SecuritySolution][EntityAnalytics] Risk Scoring Preview API

packages/kbn-securitysolution-io-ts-types/index.ts

@@ -25,6 +25,7 @@ export * from './src/non_empty_array';
 export * from './src/non_empty_or_nullable_string_array';
 export * from './src/non_empty_string_array';
 export * from './src/non_empty_string';
+export * from './src/number_between_zero_and_one_inclusive';
 export * from './src/only_false_allowed';
 export * from './src/operator';
 export * from './src/positive_integer_greater_than_zero';

packages/kbn-securitysolution-io-ts-types/src/number_between_zero_and_one_inclusive/index.test.ts

@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+import { NumberBetweenZeroAndOneInclusive } from '.';
+import { foldLeftRight, getPaths } from '@kbn/securitysolution-io-ts-utils';
+
+describe('NumberBetweenZeroAndOneInclusive', () => {
+  test('it should validate 1', () => {
+    const payload = 1;
+    const decoded = NumberBetweenZeroAndOneInclusive.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate a zero', () => {
+    const payload = 0;
+    const decoded = NumberBetweenZeroAndOneInclusive.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate a float between 0 and 1', () => {
+    const payload = 0.58;
+    const decoded = NumberBetweenZeroAndOneInclusive.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should NOT validate a negative number', () => {
+    const payload = -1;
+    const decoded = NumberBetweenZeroAndOneInclusive.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "-1" supplied to "NumberBetweenZeroAndOneInclusive"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate NaN', () => {
+    const payload = NaN;
+    const decoded = NumberBetweenZeroAndOneInclusive.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "NaN" supplied to "NumberBetweenZeroAndOneInclusive"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate Infinity', () => {
+    const payload = Infinity;
+    const decoded = NumberBetweenZeroAndOneInclusive.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "Infinity" supplied to "NumberBetweenZeroAndOneInclusive"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate a string', () => {
+    const payload = 'some string';
+    const decoded = NumberBetweenZeroAndOneInclusive.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "some string" supplied to "NumberBetweenZeroAndOneInclusive"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+});

packages/kbn-securitysolution-io-ts-types/src/number_between_zero_and_one_inclusive/index.ts

@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import * as t from 'io-ts';
+import { Either } from 'fp-ts/lib/Either';
+
+/**
+ * Types a number between 0 and 1 inclusive. Useful for specifying a probability, weighting, etc.
+ */
+export const NumberBetweenZeroAndOneInclusive = new t.Type<number, number, unknown>(
+  'NumberBetweenZeroAndOneInclusive',
+  t.number.is,
+  (input, context): Either<t.Errors, number> => {
+    return typeof input === 'number' &&
+      !Number.isNaN(input) &&
+      Number.isFinite(input) &&
+      input >= 0 &&
+      input <= 1
+      ? t.success(input)
+      : t.failure(input, context);
+  },
+  t.identity
+);

x-pack/plugins/security_solution/common/constants.ts

@@ -41,6 +41,7 @@ export const DEFAULT_SIGNALS_INDEX = '.siem-signals' as const;
 export const DEFAULT_PREVIEW_INDEX = '.preview.alerts-security.alerts' as const;
 export const DEFAULT_LISTS_INDEX = '.lists' as const;
 export const DEFAULT_ITEMS_INDEX = '.items' as const;
+export const DEFAULT_RISK_SCORE_PAGE_SIZE = 1000 as const;
 // The DEFAULT_MAX_SIGNALS value exists also in `x-pack/plugins/cases/common/constants.ts`
 // If either changes, engineer should ensure both values are updated
 export const DEFAULT_MAX_SIGNALS = 100 as const;
@@ -314,6 +315,8 @@ export const RISK_SCORE_CREATE_INDEX = `${INTERNAL_RISK_SCORE_URL}/indices/creat
 export const RISK_SCORE_DELETE_INDICES = `${INTERNAL_RISK_SCORE_URL}/indices/delete`;
 export const RISK_SCORE_CREATE_STORED_SCRIPT = `${INTERNAL_RISK_SCORE_URL}/stored_scripts/create`;
 export const RISK_SCORE_DELETE_STORED_SCRIPT = `${INTERNAL_RISK_SCORE_URL}/stored_scripts/delete`;
+export const RISK_SCORE_PREVIEW_URL = `${INTERNAL_RISK_SCORE_URL}/preview`;
+
 /**
  * Internal detection engine routes
  */

x-pack/plugins/security_solution/common/experimental_features.ts

@@ -116,6 +116,11 @@ export const allowedExperimentalValues = Object.freeze({
    * The flag doesn't have to be documented and has to be removed after the feature is ready to release.
    */
   detectionsCoverageOverview: false,
+
+  /**
+   * Enables experimental Entity Analytics HTTP endpoints
+   */
+  riskScoringRoutesEnabled: false,
 });
 
 type ExperimentalConfigKeys = Array<keyof ExperimentalFeatures>;

x-pack/plugins/security_solution/common/risk_engine/after_keys.test.ts

@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+import { foldLeftRight, getPaths } from '@kbn/securitysolution-io-ts-utils';
+
+import { afterKeysSchema } from './after_keys';
+
+describe('after_keys schema', () => {
+  it('allows an empty object', () => {
+    const payload = {};
+    const decoded = afterKeysSchema.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  it('allows a valid host key', () => {
+    const payload = { host: { 'host.name': 'hello' } };
+    const decoded = afterKeysSchema.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  it('allows a valid user key', () => {
+    const payload = { user: { 'user.name': 'hello' } };
+    const decoded = afterKeysSchema.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  it('allows both valid host and user keys', () => {
+    const payload = { user: { 'user.name': 'hello' }, host: { 'host.name': 'hello' } };
+    const decoded = afterKeysSchema.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  it('removes an unknown identifier key if used', () => {
+    const payload = { bad: 'key' };
+    const decoded = afterKeysSchema.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual({});
+  });
+});

x-pack/plugins/security_solution/common/risk_engine/after_keys.ts

@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+
+const afterKeySchema = t.record(t.string, t.string);
+export type AfterKeySchema = t.TypeOf<typeof afterKeySchema>;
+export type AfterKey = AfterKeySchema;
+
+export const afterKeysSchema = t.exact(
+  t.partial({
+    host: afterKeySchema,
+    user: afterKeySchema,
+  })
+);
+export type AfterKeysSchema = t.TypeOf<typeof afterKeysSchema>;
+export type AfterKeys = AfterKeysSchema;

x-pack/plugins/security_solution/common/risk_engine/identifier_types.ts

@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+
+export const identifierTypeSchema = t.keyof({ user: null, host: null });
+export type IdentifierTypeSchema = t.TypeOf<typeof identifierTypeSchema>;
+export type IdentifierType = IdentifierTypeSchema;

x-pack/plugins/security_solution/common/risk_engine/index.ts

@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './after_keys';
+export * from './risk_weights';
+export * from './identifier_types';

x-pack/plugins/security_solution/common/risk_engine/risk_score_preview/request_schema.ts

@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+import { DataViewId } from '../../detection_engine/rule_schema';
+import { afterKeysSchema } from '../after_keys';
+import { identifierTypeSchema } from '../identifier_types';
+import { riskWeightsSchema } from '../risk_weights/schema';
+
+export const riskScorePreviewRequestSchema = t.exact(
+  t.partial({
+    after_keys: afterKeysSchema,
+    data_view_id: DataViewId,
+    debug: t.boolean,
+    filter: t.unknown,
+    page_size: t.number,
+    identifier_type: identifierTypeSchema,
+    range: t.type({
+      start: t.string,
+      end: t.string,
+    }),
+    weights: riskWeightsSchema,
+  })
+);
+export type RiskScorePreviewRequestSchema = t.TypeOf<typeof riskScorePreviewRequestSchema>;

x-pack/plugins/security_solution/common/risk_engine/risk_weights/index.ts

@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './types';
+export type { RiskWeight, RiskWeights, GlobalRiskWeight, RiskCategoryRiskWeight } from './schema';