Display node 75% view submenus

x-pack/plugins/endpoint/common/models/event.ts

@@ -5,6 +5,7 @@
  */
 
 import { LegacyEndpointEvent, ResolverEvent } from '../types';
+import { EventCategory } from '../../public/embeddables/resolver/types';
 
 export function isLegacyEvent(event: ResolverEvent): event is LegacyEndpointEvent {
   return (event as LegacyEndpointEvent).endgame !== undefined;
@@ -46,3 +47,42 @@ export function parentEntityId(event: ResolverEvent): string | undefined {
   }
   return event.process.parent?.entity_id;
 }
+
+export function eventCategoryDisplayName(event: ResolverEvent): EventCategory {
+  const eventTypeToNameMap = new Map<string, EventCategory | undefined>([
+    ['process', 'Process'],
+    ['alert', 'Alert'],
+    ['security', 'Security'],
+    ['file', 'File'],
+    ['network', 'Network'],
+    ['registry', 'Registry'],
+    ['dns', 'DNS'],
+    ['clr', 'CLR'],
+    ['image_load', 'Image Load'],
+    ['powershell', 'Powershell'],
+    ['wmi', 'WMI'],
+    ['api', 'API'],
+    ['user', 'User'],
+  ]);
+
+  // Returning "Process" as a catch-all here because it seems pretty general
+  let eventCategoryToReturn: EventCategory = 'Process';
+  if (isLegacyEvent(event)) {
+    const legacyFullType = event.endgame.event_type_full;
+    if (legacyFullType) {
+      const mappedLegacyCategory = eventTypeToNameMap.get(legacyFullType);
+      if (mappedLegacyCategory) {
+        eventCategoryToReturn = mappedLegacyCategory;
+      }
+    }
+  } else {
+    const eventCategories = event.event.category;
+    const eventCategory =
+      typeof eventCategories === 'string' ? eventCategories : eventCategories[0] || '';
+    const mappedCategoryValue = eventTypeToNameMap.get(eventCategory);
+    if (mappedCategoryValue) {
+      eventCategoryToReturn = mappedCategoryValue;
+    }
+  }
+  return eventCategoryToReturn;
+}

x-pack/plugins/endpoint/public/embeddables/resolver/store/actions.ts

@@ -44,6 +44,15 @@ interface AppRequestedResolverData {
   readonly type: 'appRequestedResolverData';
 }
 
+/**
+ * The action dispatched when the app requests related event data for one or more
+ * subjects (whose ids should be included as an array @ `payload`)
+ */
+interface UserRequestedRelatedEventData {
+  readonly type: 'userRequestedRelatedEventData';
+  readonly payload: ResolverEvent;
+}
+
 /**
  * When the user switches the "active descendant" of the Resolver.
  * The "active descendant" (from the point of view of the parent element)
@@ -77,11 +86,27 @@ interface UserSelectedResolverNode {
   };
 }
 
+interface UserSelectedRelatedEventCategory {
+  readonly type: 'userSelectedRelatedEventCategory';
+  readonly payload: {
+    subject: ResolverEvent;
+    category: string;
+  };
+}
+
+interface UserSelectedRelatedAlerts {
+  readonly type: 'userSelectedRelatedAlerts';
+  readonly payload: ResolverEvent;
+}
+
 export type ResolverAction =
   | CameraAction
   | DataAction
   | UserBroughtProcessIntoView
   | UserChangedSelectedEvent
   | AppRequestedResolverData
   | UserFocusedOnResolverNode
-  | UserSelectedResolverNode;
+  | UserSelectedResolverNode
+  | UserRequestedRelatedEventData
+  | UserSelectedRelatedEventCategory
+  | UserSelectedRelatedAlerts;

x-pack/plugins/endpoint/public/embeddables/resolver/store/data/action.ts

@@ -5,6 +5,7 @@
  */
 
 import { ResolverEvent } from '../../../../../common/types';
+import { RelatedEventDataEntry } from '../../types';
 
 interface ServerReturnedResolverData {
   readonly type: 'serverReturnedResolverData';
@@ -15,4 +16,24 @@ interface ServerFailedToReturnResolverData {
   readonly type: 'serverFailedToReturnResolverData';
 }
 
-export type DataAction = ServerReturnedResolverData | ServerFailedToReturnResolverData;
+/**
+ * Will occur when a request for related event data is fulfilled by the API.
+ */
+interface ServerReturnedRelatedEventData {
+  readonly type: 'serverReturnedRelatedEventData';
+  readonly payload: Map<ResolverEvent, RelatedEventDataEntry>;
+}
+
+/**
+ * Will occur when a request for related event data is unsuccessful.
+ */
+interface ServerFailedToReturnRelatedEventData {
+  readonly type: 'serverFailedToReturnRelatedEventData';
+  readonly payload: [ResolverEvent, Error];
+}
+
+export type DataAction =
+  | ServerReturnedResolverData
+  | ServerFailedToReturnResolverData
+  | ServerReturnedRelatedEventData
+  | ServerFailedToReturnRelatedEventData;

x-pack/plugins/endpoint/public/embeddables/resolver/store/data/reducer.ts

@@ -5,13 +5,22 @@
  */
 
 import { Reducer } from 'redux';
-import { DataState, ResolverAction } from '../../types';
+import {
+  DataState,
+  ResolverAction,
+  resultsEnrichedWithRelatedEventInfo,
+  RelatedEventDataEntryWithStats,
+  RelatedEventType,
+  RelatedEventData,
+  waitingForRelatedEventData,
+} from '../../types';
 
 function initialState(): DataState {
   return {
     results: [],
     isLoading: false,
     hasError: false,
+    [resultsEnrichedWithRelatedEventInfo]: new Map(),
   };
 }
 
@@ -23,6 +32,63 @@ export const dataReducer: Reducer<DataState, ResolverAction> = (state = initialS
       isLoading: false,
       hasError: false,
     };
+  } else if (action.type === 'userRequestedRelatedEventData') {
+    const resolverEvent = action.payload;
+    const statsMap = state[resultsEnrichedWithRelatedEventInfo];
+    if (statsMap) {
+      const currentStatsMap = new Map(statsMap);
+      /**
+       * Set the waiting indicator for this event to indicate that related event results are pending.
+       * It will be replaced by the actual results from the API when they are returned.
+       */
+      currentStatsMap.set(resolverEvent, waitingForRelatedEventData);
+      return { ...state, [resultsEnrichedWithRelatedEventInfo]: currentStatsMap };
+    }
+    return state;
+  } else if (action.type === 'serverFailedToReturnRelatedEventData') {
+    const statsMap = state[resultsEnrichedWithRelatedEventInfo];
+    if (statsMap) {
+      const currentStatsMap = new Map(statsMap);
+      const [resolverEvent, apiError] = action.payload;
+      currentStatsMap.set(resolverEvent, apiError);
+      return { ...state, [resultsEnrichedWithRelatedEventInfo]: currentStatsMap };
+    }
+    return state;
+  } else if (action.type === 'serverReturnedRelatedEventData') {
+    /**
+     * REMOVE: pending resolution of https://github.com/elastic/endpoint-app-team/issues/379
+     * When this data is inlined with results, there won't be a need for this.
+     */
+    const statsMap = state[resultsEnrichedWithRelatedEventInfo];
+
+    if (statsMap && typeof statsMap?.set === 'function') {
+      const currentStatsMap: RelatedEventData = new Map(statsMap);
+      for (const updatedEvent of action.payload.keys()) {
+        const newStatsEntry = action.payload.get(updatedEvent);
+
+        if (newStatsEntry) {
+          // do stats
+          const statsForEntry = newStatsEntry?.relatedEvents.reduce(
+            (
+              compiledStats: Partial<Record<RelatedEventType, number>>,
+              relatedEvent: { relatedEventType: RelatedEventType }
+            ) => {
+              compiledStats[relatedEvent.relatedEventType] =
+                (compiledStats[relatedEvent.relatedEventType] || 0) + 1;
+              return compiledStats;
+            },
+            {}
+          );
+          const newRelatedEventStats: RelatedEventDataEntryWithStats = Object.assign(
+            newStatsEntry,
+            { stats: statsForEntry }
+          );
+          currentStatsMap.set(updatedEvent, newRelatedEventStats);
+        }
+      }
+      return { ...state, [resultsEnrichedWithRelatedEventInfo]: currentStatsMap };
+    }
+    return state;
   } else if (action.type === 'appRequestedResolverData') {
     return {
       ...state,

x-pack/plugins/endpoint/public/embeddables/resolver/store/data/selectors.ts

@@ -14,6 +14,8 @@ import {
   ProcessWithWidthMetadata,
   Matrix3,
   AdjacentProcessMap,
+  RelatedEventData,
+  resultsEnrichedWithRelatedEventInfo,
 } from '../../types';
 import { ResolverEvent } from '../../../../../common/types';
 import { Vector2 } from '../../types';
@@ -405,6 +407,38 @@ export const indexedProcessTree = createSelector(graphableProcesses, function in
   return indexedProcessTreeFactory(graphableProcesses);
 });
 
+/**
+ * Process events that will be graphed.
+ */
+export const relatedEventStats = createSelector(
+  (data: DataState) => data,
+  function(data) {
+    return data[resultsEnrichedWithRelatedEventInfo];
+  }
+);
+
+export const relatedEvents = createSelector(
+  graphableProcesses,
+  relatedEventStats,
+  function getRelatedEvents(
+    /* eslint-disable no-shadow */
+    graphableProcesses,
+    relatedEventStats
+    /* eslint-enable no-shadow */
+  ) {
+    const eventsRelatedByProcess: RelatedEventData = new Map();
+    /* eslint-disable no-shadow */
+    return graphableProcesses.reduce((relatedEvents, graphableProcess) => {
+      /* eslint-enable no-shadow */
+      const relatedEventDataEntry = relatedEventStats?.get(graphableProcess);
+      if (relatedEventDataEntry) {
+        relatedEvents.set(graphableProcess, relatedEventDataEntry);
+      }
+      return relatedEvents;
+    }, eventsRelatedByProcess);
+  }
+);
+
 export const processAdjacencies = createSelector(
   indexedProcessTree,
   graphableProcesses,

x-pack/plugins/endpoint/public/embeddables/resolver/store/middleware.ts

@@ -5,9 +5,10 @@
  */
 
 import { Dispatch, MiddlewareAPI } from 'redux';
+import { HttpHandler } from 'kibana/public';
 import { KibanaReactContextValue } from '../../../../../../../src/plugins/kibana_react/public';
 import { EndpointPluginServices } from '../../../plugin';
-import { ResolverState, ResolverAction } from '../types';
+import { ResolverState, ResolverAction, RelatedEventDataEntry, RelatedEventType } from '../types';
 import { ResolverEvent, ResolverNode } from '../../../../common/types';
 import * as event from '../../../../common/models/event';
 
@@ -30,6 +31,26 @@ function flattenEvents(children: ResolverNode[], events: ResolverEvent[] = []):
   }, events);
 }
 
+type RelatedEventAPIResponse = Error | { events: ResolverEvent[] };
+async function* getEachRelatedEventsResult(
+  eventsToFetch: ResolverEvent[],
+  httpGetter: HttpHandler
+): AsyncGenerator<[ResolverEvent, RelatedEventAPIResponse], any, any> {
+  for (const eventToQueryForRelateds of eventsToFetch) {
+    const id = event.entityId(eventToQueryForRelateds);
+    const relatedEventError = new Error(`Error fetching related events for entity=${id}`);
+    let result: RelatedEventAPIResponse = relatedEventError;
+    try {
+      result = await httpGetter(`/api/endpoint/resolver/${id}/events`, {
+        query: { events: 100 },
+      });
+    } catch (e) {
+      result = relatedEventError;
+    }
+    yield [eventToQueryForRelateds, result];
+  }
+}
+
 export const resolverMiddlewareFactory: MiddlewareFactory = context => {
   return api => next => async (action: ResolverAction) => {
     next(action);
@@ -78,5 +99,42 @@ export const resolverMiddlewareFactory: MiddlewareFactory = context => {
         }
       }
     }
+    /**
+     * REMOVE: pending resolution of https://github.com/elastic/endpoint-app-team/issues/379
+     * When this data is inlined with results, there won't be a need for this.
+     */
+    if (action.type === 'userRequestedRelatedEventData') {
+      if (typeof context !== 'undefined') {
+        for await (const results of getEachRelatedEventsResult(
+          [action.payload],
+          context.services.http.get
+        )) {
+          const apiResults = results[1];
+          if (apiResults instanceof Error) {
+            api.dispatch({
+              type: 'serverFailedToReturnRelatedEventData',
+              payload: [results[0], apiResults],
+            });
+          }
+          const response: Map<ResolverEvent, RelatedEventDataEntry> = new Map();
+          const baseEvent = results[0];
+          const fetchedResults = (results[1] as { events: ResolverEvent[] }).events;
+          // pack up the results into response
+          const relatedEventEntry = fetchedResults.map(relatedEvent => {
+            return {
+              relatedEvent,
+              relatedEventType: event.eventCategoryDisplayName(relatedEvent) as RelatedEventType,
+            };
+          });
+
+          response.set(baseEvent, { relatedEvents: relatedEventEntry });
+
+          api.dispatch({
+            type: 'serverReturnedRelatedEventData',
+            payload: response,
+          });
+        }
+      }
+    }
   };
 };

x-pack/plugins/endpoint/public/embeddables/resolver/store/selectors.ts

@@ -60,6 +60,11 @@ export const processAdjacencies = composeSelectors(
   dataSelectors.processAdjacencies
 );
 
+/**
+ * Returns a map of `ResolverEvent`s to their related `ResolverEvent`s
+ */
+export const relatedEvents = composeSelectors(dataStateSelector, dataSelectors.relatedEvents);
+
 /**
  * Returns the id of the "current" tree node (fake-focused)
  */