Revert "adds an 'owner' field to the siem-signals mapping, working au…

…thz get for security solution, need to work through rule registry changes" (#9)

This reverts commit f59c33c.

x-pack/plugins/rule_registry/server/index.ts

@@ -9,7 +9,7 @@ import { schema, TypeOf } from '@kbn/config-schema';
 import { PluginInitializerContext } from 'src/core/server';
 import { RuleRegistryPlugin } from './plugin';
 
-export { RuleRegistryPluginSetupContract } from './plugin';
+export { RacPluginSetupContract } from './plugin';
 export { createLifecycleRuleTypeFactory } from './rule_registry/rule_type_helpers/create_lifecycle_rule_type_factory';
 export { FieldMapOf } from './types';
 export { ScopedRuleRegistryClient } from './rule_registry/create_scoped_rule_registry_client/types';

x-pack/plugins/rule_registry/server/rac_client/rac_client.ts

@@ -15,8 +15,6 @@ import {
   GrantAPIKeyResult as SecurityPluginGrantAPIKeyResult,
   InvalidateAPIKeyResult as SecurityPluginInvalidateAPIKeyResult,
 } from '../../../security/server';
-import { SERVER_APP_ID } from '../../../security_solution/server';
-
 import {
   RacAuthorization,
   WriteOperations,
@@ -63,11 +61,6 @@ export interface FindOptions extends IndexType {
   filter?: string;
 }
 
-export interface createAlertParams {
-  esClient: ElasticsearchClient;
-  owner: 'observability' | 'securitySolution';
-}
-
 interface IndexType {
   [key: string]: unknown;
 }
@@ -124,8 +117,14 @@ export class RacClient {
     owner,
   }: {
     id: string;
-    owner: typeof SERVER_APP_ID | 'observability';
+    owner: 'securitySolution' | 'observability';
   }): Promise<unknown> {
+    // TODO: type alert for the get method
+    const result = await this.esClient.search({
+      index: '.siem*',
+      body: { query: { match_all: {} } },
+    });
+    console.error(`************\nRESULT ${JSON.stringify(result, null, 2)}\n************`);
     // .get<RawAlert>('alert', id);
     try {
       await this.authorization.ensureAuthorized(
@@ -134,37 +133,7 @@ export class RacClient {
         owner,
         ReadOperations.Get
       );
-      // TODO: type alert for the get method
-
-      try {
-        // const result = await this.esClient.get({
-        //   index: '.siem-signals-devin-hurley-default',
-        //   id: 'ecf1d03a9f3456bb28bf3af5ef9fd2ef441641f3b495d92112e5e76d8feae62e',
-        // });
-        const result = await this.esClient.search({
-          index: '.siem-signals*',
-          body: {
-            query: {
-              term: {
-                'signal.owner': {
-                  value: owner,
-                },
-              },
-            },
-          },
-        });
-        console.error(`************\nRESULT ${JSON.stringify(result, null, 2)}\n************`);
-        return result;
-      } catch (exc) {
-        console.error('THREW ERROR WHEN TRYING GET', JSON.stringify(exc, null, 2));
-      }
-
-      // const result = await this.esClient.search({
-      //   index: '.siem*',
-      //   body: { query: { match_all: {} } },
-      // });
     } catch (error) {
-      console.error('HERES THE ERROR', error);
       // this.auditLogger?.log(
       //   alertAuditEvent({
       //     action: AlertAuditAction.GET,
@@ -183,7 +152,7 @@ export class RacClient {
     // TODO: strip out owner field maybe?
     // this.getAlertFromRaw<Params>(result.id, result.attributes, result.references);
 
-    // return result;
+    return result;
 
     // return Promise.resolve({ id: 'hello world!!!' });
     // const result = await this.unsecuredSavedObjectsClient.get<RawAlert>('alert', id);
@@ -368,6 +337,4 @@ export class RacClient {
     // ]);
     // return updateResult;
   }
-
-  static async create({ esClient, owner, data }: createAlertParams) {}
 }

x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_lifecycle_rule_type_factory.ts

@@ -168,8 +168,7 @@ export function createLifecycleRuleTypeFactory(): CreateLifecycleRuleType<BaseRu
               ...alertData,
               '@timestamp': timestamp,
               'event.kind': 'state',
-              // 'owner': ''
-              // 'kibana.rac.alert.id': alertId,
+              'kibana.rac.alert.id': alertId,
             };
 
             const isNew = !state.trackedAlerts[alertId];

x-pack/plugins/security_solution/server/index.ts

@@ -8,7 +8,7 @@
 import { PluginInitializerContext, PluginConfigDescriptor } from '../../../../src/core/server';
 import { Plugin, PluginSetup, PluginStart } from './plugin';
 import { configSchema, ConfigType } from './config';
-import { SIGNALS_INDEX_KEY, SERVER_APP_ID } from '../common/constants';
+import { SIGNALS_INDEX_KEY } from '../common/constants';
 import { AppClient } from './types';
 
 export const plugin = (context: PluginInitializerContext) => {
@@ -46,7 +46,7 @@ export const config: PluginConfigDescriptor<ConfigType> = {
 };
 
 export { ConfigType, Plugin, PluginSetup, PluginStart };
-export { AppClient, SERVER_APP_ID };
+export { AppClient };
 
 // Exports to be shared with plugins such as x-pack/lists plugin
 export { deleteTemplate } from './lib/detection_engine/index/delete_template';

x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/signals_mapping.json

@@ -77,9 +77,6 @@
               }
             }
           },
-          "owner": {
-            "type": "keyword"
-          },
           "rule": {
             "properties": {
               "id": {

x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.ts

@@ -18,19 +18,17 @@ import {
 import { buildRuleWithoutOverrides, buildRuleWithOverrides } from './build_rule';
 import { additionalSignalFields, buildSignal } from './build_signal';
 import { buildEventTypeSignal } from './build_event_type_signal';
-import { SERVER_APP_ID } from '../../../../common/constants';
 import { EqlSequence } from '../../../../common/detection_engine/types';
 import { generateSignalId, wrapBuildingBlocks, wrapSignal } from './utils';
 
 // format search_after result for signals index.
 export const buildBulkBody = (
   ruleSO: SavedObject<AlertAttributes>,
-  doc: SignalSourceHit,
-  owner: typeof SERVER_APP_ID
+  doc: SignalSourceHit
 ): SignalHit => {
   const rule = buildRuleWithOverrides(ruleSO, doc._source!);
   const signal: Signal = {
-    ...buildSignal([doc], rule, owner),
+    ...buildSignal([doc], rule),
     ...additionalSignalFields(doc),
   };
   const event = buildEventTypeSignal(doc);

x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_signal.ts

@@ -6,7 +6,6 @@
  */
 
 import { SearchTypes } from '../../../../common/detection_engine/types';
-import { SERVER_APP_ID } from '../../../../common/constants';
 import { RulesSchema } from '../../../../common/detection_engine/schemas/response/rules_schema';
 import { SIGNALS_TEMPLATE_VERSION } from '../routes/index/get_signals_template';
 import { isEventTypeSignal } from './build_event_type_signal';
@@ -77,11 +76,7 @@ export const removeClashes = (doc: BaseSignalHit): BaseSignalHit => {
  * @param docs The parent signals/events of the new signal to be built.
  * @param rule The rule that is generating the new signal.
  */
-export const buildSignal = (
-  docs: BaseSignalHit[],
-  rule: RulesSchema,
-  owner: typeof SERVER_APP_ID
-): Signal => {
+export const buildSignal = (docs: BaseSignalHit[], rule: RulesSchema): Signal => {
   const _meta = {
     version: SIGNALS_TEMPLATE_VERSION,
   };
@@ -97,7 +92,6 @@ export const buildSignal = (
     parents,
     ancestors,
     status: 'open',
-    owner,
     rule,
     depth,
   };

x-pack/plugins/security_solution/server/lib/detection_engine/signals/single_bulk_create.ts

@@ -12,8 +12,6 @@ import {
   AlertInstanceState,
   AlertServices,
 } from '../../../../../alerting/server';
-
-import { SERVER_APP_ID } from '../../../../common/constants';
 import { AlertAttributes, SignalHit, SignalSearchResponse, WrappedSignalHit } from './types';
 import { RefreshTypes } from '../types';
 import { generateId, makeFloatString, errorAggregator } from './utils';
@@ -123,7 +121,7 @@ export const singleBulkCreate = async ({
         ),
       },
     },
-    buildBulkBody(ruleSO, doc, SERVER_APP_ID),
+    buildBulkBody(ruleSO, doc),
   ]);
   const start = performance.now();
   const { body: response } = await services.scopedClusterClient.asCurrentUser.bulk({
@@ -142,7 +140,7 @@ export const singleBulkCreate = async ({
     .map((doc, index) => ({
       _id: response.items[index].create?._id ?? '',
       _index: response.items[index].create?._index ?? '',
-      ...buildBulkBody(ruleSO, doc, SERVER_APP_ID),
+      ...buildBulkBody(ruleSO, doc),
     }))
     .filter((_, index) => get(response.items[index], 'create.status') === 201);
   const createdItemsCount = createdItems.length;

x-pack/plugins/security_solution/server/lib/detection_engine/signals/types.ts

@@ -211,7 +211,6 @@ export interface Signal {
   };
   original_time?: string;
   original_event?: SearchTypes;
-  owner?: string;
   status: Status;
   threshold_result?: ThresholdResult;
   original_signal?: SearchTypes;

x-pack/plugins/security_solution/server/plugin.ts

@@ -217,9 +217,9 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
     router.get({ path: '/security-myfakepath', validate: false }, async (context, req, res) => {
       try {
         const racClient = await context.ruleRegistry?.getRacClient();
-        const thing = await racClient?.get({ id: 'hello world', owner: SERVER_APP_ID });
-        console.error('hits?', JSON.stringify(thing.body.hits.hits, null, 2));
-        return res.ok({ body: { success: true, thing: thing.body.hits.hits } });
+        const thing = await racClient?.get({ id: 'hello world', owner: 'securitySolution' });
+        console.error('THE THING EXISTS??', JSON.stringify(thing.body, null, 2));
+        return res.ok({ body: { success: true } });
       } catch (err) {
         console.error('monitoring route threw an error');
         console.error(err);
@@ -236,12 +236,12 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       order: 1100,
       app: [...securitySubPlugins, 'kibana'],
       category: DEFAULT_APP_CATEGORIES.security,
-      rac: [SERVER_APP_ID],
+      rac: ['securitySolution'],
       privileges: {
         all: {
           app: [...securitySubPlugins, 'kibana'],
           rac: {
-            all: [SERVER_APP_ID],
+            all: ['securitySolution'],
           },
           savedObject: {
             all: [
@@ -275,11 +275,11 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
         insightsAndAlerting: ['triggersActions'],
       },
       alerting: ruleTypes,
-      rac: [SERVER_APP_ID],
+      rac: ['securitySolution'],
       privileges: {
         all: {
           rac: {
-            all: [SERVER_APP_ID],
+            all: ['securitySolution'],
           },
           app: [...securitySubPlugins, 'kibana'],
           catalogue: ['securitySolution'],
@@ -320,7 +320,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
             read: ruleTypes,
           },
           rac: {
-            all: [SERVER_APP_ID],
+            all: ['securitySolution'],
           },
           management: {
             insightsAndAlerting: ['triggersActions'],