Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution][Detections] Await promises to ensure promise rejection does not crash kibana #88564

Merged
merged 3 commits into from
Jan 19, 2021
Merged

[Security Solution][Detections] Await promises to ensure promise rejection does not crash kibana #88564

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ea75eda
Await promises to ensure promise rejection does not crash kibana
marshallmain Jan 17, 2021
9f61c08
Fix test
marshallmain Jan 17, 2021
1a33924
Merge branch 'master' into search-after-reject
kibanamachine Jan 19, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...ns/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,7 +225,7 @@ describe('searchAfterAndBulkCreate', () => {
buildRuleMessage,
});
expect(success).toEqual(true);
expect(mockService.callCluster).toHaveBeenCalledTimes(8);
expect(mockService.callCluster).toHaveBeenCalledTimes(7);
expect(createdSignalsCount).toEqual(3);
expect(lastLookBackDate).toEqual(new Date('2020-04-20T21:27:45+0000'));
});
Expand Down
40 changes: 18 additions & 22 deletions ...plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,25 +87,14 @@ export const searchAfterAndBulkCreate = async ({
let mergedSearchResults = createSearchResultReturnType();
logger.debug(buildRuleMessage(`sortIds: ${sortId}`));

// perform search_after with optionally undefined sortId
const singleSearchAfterPromise = singleSearchAfter({
buildRuleMessage,
searchAfterSortId: sortId,
index: inputIndexPattern,
from: tuple.from.toISOString(),
to: tuple.to.toISOString(),
services,
logger,
filter,
pageSize: tuple.maxSignals < pageSize ? Math.ceil(tuple.maxSignals) : pageSize, // maximum number of docs to receive per search result.
timestampOverride: ruleParams.timestampOverride,
excludeDocsWithTimestampOverride: false,
});

// if there is a timestampOverride param we always want to do a secondary search against @timestamp
if (ruleParams.timestampOverride != null && hasBackupSortId) {
// only execute search if we have something to sort on or if it is the first search
const singleSearchAfterDefaultTimestamp = singleSearchAfter({
const {
searchResult: searchResultB,
searchDuration: searchDurationB,
searchErrors: searchErrorsB,
} = await singleSearchAfter({
buildRuleMessage,
searchAfterSortId: backupSortId,
index: inputIndexPattern,
Expand All @@ -118,11 +107,6 @@ export const searchAfterAndBulkCreate = async ({
timestampOverride: ruleParams.timestampOverride,
excludeDocsWithTimestampOverride: true,
});
const {
searchResult: searchResultB,
searchDuration: searchDurationB,
searchErrors: searchErrorsB,
} = await singleSearchAfterDefaultTimestamp;

// call this function setSortIdOrExit()
const lastSortId = searchResultB?.hits?.hits[searchResultB.hits.hits.length - 1]?.sort;
Expand Down Expand Up @@ -153,7 +137,19 @@ export const searchAfterAndBulkCreate = async ({

if (hasSortId) {
// only execute search if we have something to sort on or if it is the first search
const { searchResult, searchDuration, searchErrors } = await singleSearchAfterPromise;
const { searchResult, searchDuration, searchErrors } = await singleSearchAfter({
buildRuleMessage,
searchAfterSortId: sortId,
index: inputIndexPattern,
from: tuple.from.toISOString(),
to: tuple.to.toISOString(),
services,
logger,
filter,
pageSize: tuple.maxSignals < pageSize ? Math.ceil(tuple.maxSignals) : pageSize, // maximum number of docs to receive per search result.
timestampOverride: ruleParams.timestampOverride,
excludeDocsWithTimestampOverride: false,
});
mergedSearchResults = mergeSearchResults([mergedSearchResults, searchResult]);
toReturn = mergeReturns([
toReturn,
Expand Down