-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[SIEM] [Cases] Shell scripts and unit tests (#60183)
- Loading branch information
1 parent
923de46
commit 4fc89ae
Showing
31 changed files
with
801 additions
and
11 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| README.md for developers working on the Case API on how to get started | ||
| using the CURL scripts in the scripts folder. | ||
|
|
||
| The scripts rely on CURL and jq: | ||
|
|
||
| - [CURL](https://curl.haxx.se) | ||
| - [jq](https://stedolan.github.io/jq/) | ||
|
|
||
| Install curl and jq | ||
|
|
||
| ```sh | ||
| brew update | ||
| brew install curl | ||
| brew install jq | ||
| ``` | ||
|
|
||
| Open `$HOME/.zshrc` or `${HOME}.bashrc` depending on your SHELL output from `echo $SHELL` | ||
| and add these environment variables: | ||
|
|
||
| ```sh | ||
| export ELASTICSEARCH_USERNAME=${user} | ||
| export ELASTICSEARCH_PASSWORD=${password} | ||
| export ELASTICSEARCH_URL=https://${ip}:9200 | ||
| export KIBANA_URL=http://localhost:5601 | ||
| export TASK_MANAGER_INDEX=.kibana-task-manager-${your user id} | ||
| export KIBANA_INDEX=.kibana-${your user id} | ||
| ``` | ||
|
|
||
| source `$HOME/.zshrc` or `${HOME}.bashrc` to ensure variables are set: | ||
|
|
||
| ```sh | ||
| source ~/.zshrc | ||
| ``` | ||
|
|
||
| Restart Kibana and ensure that you are using `--no-base-path` as changing the base path is a feature but will | ||
| get in the way of the CURL scripts written as is. | ||
|
|
||
| Go to the scripts folder `cd kibana/x-pack/plugins/case/server/scripts` and run: | ||
|
|
||
| ```sh | ||
| ./hard_reset.sh | ||
| ``` | ||
|
|
||
| which will: | ||
|
|
||
| - Delete any existing cases you have | ||
| - Delete any existing comments you have | ||
| - Posts the sample case from `./mock/case/post_case.json` | ||
| - Posts the sample comment from `./mock/comment/post_comment.json` to the new case | ||
|
|
||
| Now you can run | ||
|
|
||
| ```sh | ||
| ./find_cases.sh | ||
| ``` | ||
|
|
||
| You should see the new case created like so: | ||
|
|
||
| ```sh | ||
| { | ||
| "page": 1, | ||
| "per_page": 20, | ||
| "total": 1, | ||
| "cases": [ | ||
| { | ||
| "id": "2e0afbc0-658c-11ea-85c8-1d8f792cbc08", | ||
| "version": "Wzc5NSwxXQ==", | ||
| "comments": [], | ||
| "comment_ids": [ | ||
| "2ecec0f0-658c-11ea-85c8-1d8f792cbc08" | ||
| ], | ||
| "created_at": "2020-03-14T00:38:53.004Z", | ||
| "created_by": { | ||
| "full_name": "Steph Milovic", | ||
| "username": "smilovic" | ||
| }, | ||
| "updated_at": null, | ||
| "updated_by": null, | ||
| "description": "This looks not so good", | ||
| "title": "Bad meanie defacing data", | ||
| "status": "open", | ||
| "tags": [ | ||
| "defacement" | ||
| ] | ||
| } | ||
| ], | ||
| "count_open_cases": 1, | ||
| "count_closed_cases": 1 | ||
| } | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| #!/bin/sh | ||
|
|
||
| # | ||
| # Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| # or more contributor license agreements. Licensed under the Elastic License; | ||
| # you may not use this file except in compliance with the Elastic License. | ||
| # | ||
|
|
||
| # Add this to the start of any scripts to detect if env variables are set | ||
|
|
||
| set -e | ||
|
|
||
| if [ -z "${ELASTICSEARCH_USERNAME}" ]; then | ||
| echo "Set ELASTICSEARCH_USERNAME in your environment" | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -z "${ELASTICSEARCH_PASSWORD}" ]; then | ||
| echo "Set ELASTICSEARCH_PASSWORD in your environment" | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -z "${ELASTICSEARCH_URL}" ]; then | ||
| echo "Set ELASTICSEARCH_URL in your environment" | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -z "${KIBANA_URL}" ]; then | ||
| echo "Set KIBANA_URL in your environment" | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -z "${TASK_MANAGER_INDEX}" ]; then | ||
| echo "Set TASK_MANAGER_INDEX in your environment" | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -z "${KIBANA_INDEX}" ]; then | ||
| echo "Set KIBANA_INDEX in your environment" | ||
| exit 1 | ||
| fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| #!/bin/sh | ||
|
|
||
| # | ||
| # Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| # or more contributor license agreements. Licensed under the Elastic License; | ||
| # you may not use this file except in compliance with the Elastic License. | ||
| # | ||
|
|
||
| # Creates a new case and then gets it if no CASE_ID is specified | ||
|
|
||
| # Example: | ||
| # ./delete_cases.sh | ||
|
|
||
| # Example with CASE_ID args: | ||
| # ./delete_cases.sh 1234-example-id 5678-example-id | ||
|
|
||
| set -e | ||
| ./check_env_variables.sh | ||
|
|
||
| if [ "$1" ]; then | ||
| ALL=("$@") | ||
| i=0 | ||
|
|
||
| COUNT=${#ALL[@]} | ||
| IDS="" | ||
| for ID in "${ALL[@]}" | ||
| do | ||
| let i=i+1 | ||
| if [ $i -eq $COUNT ]; then | ||
| IDS+="%22${ID}%22" | ||
| else | ||
| IDS+="%22${ID}%22," | ||
| fi | ||
| done | ||
|
|
||
| curl -s -k \ | ||
| -H 'kbn-xsrf: 123' \ | ||
| -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \ | ||
| -X DELETE "${KIBANA_URL}${SPACE_URL}/api/cases?ids=\[${IDS}\]" \ | ||
| | jq .; | ||
| exit 1 | ||
| else | ||
| CASE_ID=("$(./generate_case_data.sh | jq '.id' -j)") | ||
| curl -s -k \ | ||
| -H 'Content-Type: application/json' \ | ||
| -H 'kbn-xsrf: 123' \ | ||
| -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \ | ||
| -X DELETE "${KIBANA_URL}${SPACE_URL}/api/cases?ids=\[%22${CASE_ID}%22\]" \ | ||
| | jq .; | ||
| exit 1 | ||
| fi |
Oops, something went wrong.