[Security Solution][Detections] Update signals template if outdated and rollover indices

x-pack/plugins/security_solution/public/detections/components/user_info/index.test.tsx

@@ -43,6 +43,7 @@ describe('useUserInfo', () => {
         isSignalIndexExists: null,
         loading: true,
         signalIndexName: null,
+        signalIndexTemplateOutdated: null,
       },
       error: undefined,
     });

x-pack/plugins/security_solution/public/detections/components/user_info/index.tsx

@@ -20,6 +20,7 @@ export interface State {
   hasEncryptionKey: boolean | null;
   loading: boolean;
   signalIndexName: string | null;
+  signalIndexTemplateOutdated: boolean | null;
 }
 
 export const initialState: State = {
@@ -31,6 +32,7 @@ export const initialState: State = {
   hasEncryptionKey: null,
   loading: true,
   signalIndexName: null,
+  signalIndexTemplateOutdated: null,
 };
 
 export type Action =
@@ -62,6 +64,10 @@ export type Action =
   | {
       type: 'updateSignalIndexName';
       signalIndexName: string | null;
+    }
+  | {
+      type: 'updateSignalIndexTemplateOutdated';
+      signalIndexTemplateOutdated: boolean | null;
     };
 
 export const userInfoReducer = (state: State, action: Action): State => {
@@ -114,6 +120,12 @@ export const userInfoReducer = (state: State, action: Action): State => {
         signalIndexName: action.signalIndexName,
       };
     }
+    case 'updateSignalIndexTemplateOutdated': {
+      return {
+        ...state,
+        signalIndexTemplateOutdated: action.signalIndexTemplateOutdated,
+      };
+    }
     default:
       return state;
   }
@@ -144,6 +156,7 @@ export const useUserInfo = (): State => {
       hasEncryptionKey,
       loading,
       signalIndexName,
+      signalIndexTemplateOutdated,
     },
     dispatch,
   ] = useUserData();
@@ -158,6 +171,7 @@ export const useUserInfo = (): State => {
     loading: indexNameLoading,
     signalIndexExists: isApiSignalIndexExists,
     signalIndexName: apiSignalIndexName,
+    signalIndexTemplateOutdated: apiSignalIndexTemplateOutdated,
     createDeSignalIndex: createSignalIndex,
   } = useSignalIndex();
 
@@ -217,18 +231,38 @@ export const useUserInfo = (): State => {
     }
   }, [dispatch, loading, signalIndexName, apiSignalIndexName]);
 
+  useEffect(() => {
+    if (
+      !loading &&
+      signalIndexTemplateOutdated !== apiSignalIndexTemplateOutdated &&
+      apiSignalIndexTemplateOutdated != null
+    ) {
+      dispatch({
+        type: 'updateSignalIndexTemplateOutdated',
+        signalIndexTemplateOutdated: apiSignalIndexTemplateOutdated,
+      });
+    }
+  }, [dispatch, loading, signalIndexTemplateOutdated, apiSignalIndexTemplateOutdated]);
+
   useEffect(() => {
     if (
       isAuthenticated &&
       hasEncryptionKey &&
       hasIndexManage &&
-      isSignalIndexExists != null &&
-      !isSignalIndexExists &&
+      ((isSignalIndexExists != null && !isSignalIndexExists) ||
+        (signalIndexTemplateOutdated != null && signalIndexTemplateOutdated)) &&
       createSignalIndex != null
     ) {
       createSignalIndex();
     }
-  }, [createSignalIndex, isAuthenticated, hasEncryptionKey, isSignalIndexExists, hasIndexManage]);
+  }, [
+    createSignalIndex,
+    isAuthenticated,
+    hasEncryptionKey,
+    isSignalIndexExists,
+    hasIndexManage,
+    signalIndexTemplateOutdated,
+  ]);
 
   return {
     loading,
@@ -239,5 +273,6 @@ export const useUserInfo = (): State => {
     hasIndexManage,
     hasIndexWrite,
     signalIndexName,
+    signalIndexTemplateOutdated,
   };
 };

x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/mock.ts

@@ -980,6 +980,7 @@ export const mockStatusAlertQuery: object = {
 
 export const mockSignalIndex: AlertsIndex = {
   name: 'mock-signal-index',
+  template_outdated: false,
 };
 
 export const mockUserPrivilege: Privilege = {

x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/types.ts

@@ -44,6 +44,7 @@ export interface UpdateAlertStatusProps {
 
 export interface AlertsIndex {
   name: string;
+  template_outdated: boolean;
 }
 
 export interface Privilege {

x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx

@@ -26,6 +26,7 @@ describe('useSignalIndex', () => {
         loading: true,
         signalIndexExists: null,
         signalIndexName: null,
+        signalIndexTemplateOutdated: null,
       });
     });
   });
@@ -42,6 +43,7 @@ describe('useSignalIndex', () => {
         loading: false,
         signalIndexExists: true,
         signalIndexName: 'mock-signal-index',
+        signalIndexTemplateOutdated: false,
       });
     });
   });
@@ -62,6 +64,7 @@ describe('useSignalIndex', () => {
         loading: false,
         signalIndexExists: true,
         signalIndexName: 'mock-signal-index',
+        signalIndexTemplateOutdated: false,
       });
     });
   });
@@ -101,6 +104,7 @@ describe('useSignalIndex', () => {
         loading: false,
         signalIndexExists: false,
         signalIndexName: null,
+        signalIndexTemplateOutdated: null,
       });
     });
   });
@@ -121,6 +125,7 @@ describe('useSignalIndex', () => {
         loading: false,
         signalIndexExists: false,
         signalIndexName: null,
+        signalIndexTemplateOutdated: null,
       });
     });
   });

x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.tsx

@@ -17,6 +17,7 @@ export interface ReturnSignalIndex {
   loading: boolean;
   signalIndexExists: boolean | null;
   signalIndexName: string | null;
+  signalIndexTemplateOutdated: boolean | null;
   createDeSignalIndex: Func | null;
 }
 
@@ -27,11 +28,10 @@ export interface ReturnSignalIndex {
  */
 export const useSignalIndex = (): ReturnSignalIndex => {
   const [loading, setLoading] = useState(true);
-  const [signalIndex, setSignalIndex] = useState<
-    Pick<ReturnSignalIndex, 'signalIndexExists' | 'signalIndexName' | 'createDeSignalIndex'>
-  >({
+  const [signalIndex, setSignalIndex] = useState<Omit<ReturnSignalIndex, 'loading'>>({
     signalIndexExists: null,
     signalIndexName: null,
+    signalIndexTemplateOutdated: null,
     createDeSignalIndex: null,
   });
   const [, dispatchToaster] = useStateToaster();
@@ -49,6 +49,7 @@ export const useSignalIndex = (): ReturnSignalIndex => {
           setSignalIndex({
             signalIndexExists: true,
             signalIndexName: signal.name,
+            signalIndexTemplateOutdated: signal.template_outdated,
             createDeSignalIndex: createIndex,
           });
         }
@@ -57,6 +58,7 @@ export const useSignalIndex = (): ReturnSignalIndex => {
           setSignalIndex({
             signalIndexExists: false,
             signalIndexName: null,
+            signalIndexTemplateOutdated: null,
             createDeSignalIndex: createIndex,
           });
           if (isSecurityAppError(error) && error.body.status_code !== 404) {
@@ -87,6 +89,7 @@ export const useSignalIndex = (): ReturnSignalIndex => {
             setSignalIndex({
               signalIndexExists: false,
               signalIndexName: null,
+              signalIndexTemplateOutdated: null,
               createDeSignalIndex: createIndex,
             });
             errorToToaster({ title: i18n.SIGNAL_POST_FAILURE, error, dispatchToaster });

x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/check_template_version.ts

@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { get } from 'lodash';
+import { LegacyAPICaller } from '../../../../../../../../src/core/server';
+import { getSignalsTemplate } from './get_signals_template';
+import { getTemplateExists } from '../../index/get_template_exists';
+
+export const templateNeedsUpdate = async (callCluster: LegacyAPICaller, index: string) => {
+  const templateExists = await getTemplateExists(callCluster, index);
+  let existingTemplateVersion: number | undefined;
+  if (templateExists) {
+    const existingTemplate: unknown = await callCluster('indices.getTemplate', {
+      name: index,
+    });
+    existingTemplateVersion = get(existingTemplate, [index, 'version']);
+  }
+  const newTemplate = getSignalsTemplate(index);
+  if (existingTemplateVersion === undefined || existingTemplateVersion < newTemplate.version) {
+    return true;
+  }
+  return false;
+};

x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/create_index_route.ts

@@ -12,9 +12,9 @@ import { getPolicyExists } from '../../index/get_policy_exists';
 import { setPolicy } from '../../index/set_policy';
 import { setTemplate } from '../../index/set_template';
 import { getSignalsTemplate } from './get_signals_template';
-import { getTemplateExists } from '../../index/get_template_exists';
 import { createBootstrapIndex } from '../../index/create_bootstrap_index';
 import signalsPolicy from './signals_policy.json';
+import { templateNeedsUpdate } from './check_template_version';
 
 export const createIndexRoute = (router: IRouter) => {
   router.post(
@@ -39,24 +39,20 @@ export const createIndexRoute = (router: IRouter) => {
 
         const index = siemClient.getSignalsIndex();
         const indexExists = await getIndexExists(callCluster, index);
-        if (indexExists) {
-          return siemResponse.error({
-            statusCode: 409,
-            body: `index: "${index}" already exists`,
-          });
-        } else {
+        if (await templateNeedsUpdate(callCluster, index)) {
           const policyExists = await getPolicyExists(callCluster, index);
           if (!policyExists) {
             await setPolicy(callCluster, index, signalsPolicy);
           }
-          const templateExists = await getTemplateExists(callCluster, index);
-          if (!templateExists) {
-            const template = getSignalsTemplate(index);
-            await setTemplate(callCluster, index, template);
+          await setTemplate(callCluster, index, getSignalsTemplate(index));
+          if (indexExists) {
+            await callCluster('indices.rollover', { alias: index });
           }
+        }
+        if (!indexExists) {
           await createBootstrapIndex(callCluster, index);
-          return response.ok({ body: { acknowledged: true } });
         }
+        return response.ok({ body: { acknowledged: true } });
       } catch (err) {
         const error = transformError(err);
         return siemResponse.error({

x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/read_index_route.ts

@@ -8,6 +8,7 @@ import { IRouter } from '../../../../../../../../src/core/server';
 import { DETECTION_ENGINE_INDEX_URL } from '../../../../../common/constants';
 import { transformError, buildSiemResponse } from '../utils';
 import { getIndexExists } from '../../index/get_index_exists';
+import { templateNeedsUpdate } from './check_template_version';
 
 export const readIndexRoute = (router: IRouter) => {
   router.get(
@@ -31,9 +32,10 @@ export const readIndexRoute = (router: IRouter) => {
 
         const index = siemClient.getSignalsIndex();
         const indexExists = await getIndexExists(clusterClient.callAsCurrentUser, index);
+        const templateOutdated = await templateNeedsUpdate(clusterClient.callAsCurrentUser, index);
 
         if (indexExists) {
-          return response.ok({ body: { name: index } });
+          return response.ok({ body: { name: index, template_outdated: templateOutdated } });
         } else {
           return siemResponse.error({
             statusCode: 404,