-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Cloud Security] Host Name Misconfiguration Datagrid & Refactor CSP P…
…lugin PHASE 2 (#192535) In an attempt to make Reviewing easier and more accurate, the implementation of Misconfiguration Data grid on Host.name flyout in Alerts Page will be split into 2 Phases Phase 1: Move Functions, Utils or Helpers, Hooks, constants to Package Phase 2: Implementing the feature This is **Phase 2** of the process <img width="1712" alt="Screenshot 2024-09-11 at 2 16 20 PM" src="https://github.com/user-attachments/assets/29ab56db-8561-486c-ae8d-c254b932cea4"> How to test: Pre req: In order to test this, you need to generate some fake alerts. This [repo](https://github.com/elastic/security-documents-generator) will help you do that 1. Generate Some Alerts 2. Use the Reindex API to get some Findings data in (change the host.name field to match the host.name from alerts generated if you want to test Findings table in the left panel flyout) 3. Turn on Risky Entity Score if you want to test if both Risk Contribution and Insights tabs shows up, follow this [guide](https://www.elastic.co/guide/en/security/current/turn-on-risk-engine.html) to turn on Risk Entity Score
- Loading branch information
Showing
14 changed files
with
636 additions
and
134 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
60 changes: 60 additions & 0 deletions
60
x-pack/packages/kbn-cloud-security-posture/src/hooks/use_misconfiguration_findings.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
| import { useQuery } from '@tanstack/react-query'; | ||
| import { lastValueFrom } from 'rxjs'; | ||
| import { CspFinding } from '@kbn/cloud-security-posture-common'; | ||
| import { useKibana } from '@kbn/kibana-react-plugin/public'; | ||
| import type { CoreStart } from '@kbn/core/public'; | ||
| import { showErrorToast } from '../..'; | ||
| import type { | ||
| CspClientPluginStartDeps, | ||
| LatestFindingsRequest, | ||
| LatestFindingsResponse, | ||
| UseMisconfigurationOptions, | ||
| } from '../../type'; | ||
|
|
||
| import { useGetCspBenchmarkRulesStatesApi } from './use_get_benchmark_rules_state_api'; | ||
| import { | ||
| buildMisconfigurationsFindingsQuery, | ||
| getMisconfigurationAggregationCount, | ||
| } from '../utils/hooks_utils'; | ||
|
|
||
| export const useMisconfigurationFindings = (options: UseMisconfigurationOptions) => { | ||
| const { | ||
| data, | ||
| notifications: { toasts }, | ||
| } = useKibana<CoreStart & CspClientPluginStartDeps>().services; | ||
| const { data: rulesStates } = useGetCspBenchmarkRulesStatesApi(); | ||
|
|
||
| return useQuery( | ||
| ['csp_misconfiguration_findings', { params: options }, rulesStates], | ||
| async () => { | ||
| const { | ||
| rawResponse: { hits, aggregations }, | ||
| } = await lastValueFrom( | ||
| data.search.search<LatestFindingsRequest, LatestFindingsResponse>({ | ||
| params: buildMisconfigurationsFindingsQuery(options, rulesStates!), | ||
| }) | ||
| ); | ||
| if (!aggregations) throw new Error('expected aggregations to be defined'); | ||
|
|
||
| return { | ||
| count: getMisconfigurationAggregationCount(aggregations.count.buckets), | ||
| rows: hits.hits.map((finding) => ({ | ||
| result: finding._source?.result, | ||
| rule: finding?._source?.rule, | ||
| resource: finding?._source?.resource, | ||
| })) as Array<Pick<CspFinding, 'result' | 'rule' | 'resource'>>, | ||
| }; | ||
| }, | ||
| { | ||
| enabled: options.enabled && !!rulesStates, | ||
| keepPreviousData: true, | ||
| onError: (err: Error) => showErrorToast(toasts, err), | ||
| } | ||
| ); | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
105 changes: 105 additions & 0 deletions
105
x-pack/packages/kbn-cloud-security-posture/src/utils/hooks_utils.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; | ||
| import { | ||
| CDR_MISCONFIGURATIONS_INDEX_PATTERN, | ||
| LATEST_FINDINGS_RETENTION_POLICY, | ||
| } from '@kbn/cloud-security-posture-common'; | ||
| import type { CspBenchmarkRulesStates } from '@kbn/cloud-security-posture-common/schema/rules/latest'; | ||
| import { buildMutedRulesFilter } from '@kbn/cloud-security-posture-common'; | ||
| import type { UseMisconfigurationOptions } from '../../type'; | ||
|
|
||
| const MISCONFIGURATIONS_SOURCE_FIELDS = ['result.*', 'rule.*', 'resource.*']; | ||
| interface AggregationBucket { | ||
| doc_count?: number; | ||
| } | ||
|
|
||
| type AggregationBuckets = Record<string, AggregationBucket>; | ||
|
|
||
| const RESULT_EVALUATION = { | ||
| PASSED: 'passed', | ||
| FAILED: 'failed', | ||
| UNKNOWN: 'unknown', | ||
| }; | ||
|
|
||
| export const getFindingsCountAggQueryMisconfiguration = () => ({ | ||
| count: { | ||
| filters: { | ||
| other_bucket_key: RESULT_EVALUATION.UNKNOWN, | ||
| filters: { | ||
| [RESULT_EVALUATION.PASSED]: { match: { 'result.evaluation': RESULT_EVALUATION.PASSED } }, | ||
| [RESULT_EVALUATION.FAILED]: { match: { 'result.evaluation': RESULT_EVALUATION.FAILED } }, | ||
| }, | ||
| }, | ||
| }, | ||
| }); | ||
|
|
||
| export const getMisconfigurationAggregationCount = ( | ||
| buckets?: estypes.AggregationsBuckets<estypes.AggregationsStringRareTermsBucketKeys> | ||
| ) => { | ||
| const defaultBuckets: AggregationBuckets = { | ||
| [RESULT_EVALUATION.PASSED]: { doc_count: 0 }, | ||
| [RESULT_EVALUATION.FAILED]: { doc_count: 0 }, | ||
| [RESULT_EVALUATION.UNKNOWN]: { doc_count: 0 }, | ||
| }; | ||
|
|
||
| // if buckets are undefined we will use default buckets | ||
| const usedBuckets = buckets || defaultBuckets; | ||
| return Object.entries(usedBuckets).reduce( | ||
| (evaluation, [key, value]) => { | ||
| evaluation[key] = (evaluation[key] || 0) + (value.doc_count || 0); | ||
| return evaluation; | ||
| }, | ||
| { | ||
| [RESULT_EVALUATION.PASSED]: 0, | ||
| [RESULT_EVALUATION.FAILED]: 0, | ||
| [RESULT_EVALUATION.UNKNOWN]: 0, | ||
| } | ||
| ); | ||
| }; | ||
|
|
||
| export const buildMisconfigurationsFindingsQuery = ( | ||
| { query }: UseMisconfigurationOptions, | ||
| rulesStates: CspBenchmarkRulesStates, | ||
| isPreview = false | ||
| ) => { | ||
| const mutedRulesFilterQuery = buildMutedRulesFilter(rulesStates); | ||
|
|
||
| return { | ||
| index: CDR_MISCONFIGURATIONS_INDEX_PATTERN, | ||
| size: isPreview ? 0 : 500, | ||
| aggs: getFindingsCountAggQueryMisconfiguration(), | ||
| ignore_unavailable: true, | ||
| query: buildMisconfigurationsFindingsQueryWithFilters(query, mutedRulesFilterQuery), | ||
| _source: MISCONFIGURATIONS_SOURCE_FIELDS, | ||
| }; | ||
| }; | ||
|
|
||
| const buildMisconfigurationsFindingsQueryWithFilters = ( | ||
| query: UseMisconfigurationOptions['query'], | ||
| mutedRulesFilterQuery: estypes.QueryDslQueryContainer[] | ||
| ) => { | ||
| return { | ||
| ...query, | ||
| bool: { | ||
| ...query?.bool, | ||
| filter: [ | ||
| ...(query?.bool?.filter ?? []), | ||
| { | ||
| range: { | ||
| '@timestamp': { | ||
| gte: `now-${LATEST_FINDINGS_RETENTION_POLICY}`, | ||
| lte: 'now', | ||
| }, | ||
| }, | ||
| }, | ||
| ], | ||
| must_not: [...mutedRulesFilterQuery], | ||
| }, | ||
| }; | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.