Skip to content

Commit

Permalink
[Security Solution][Detection Rules] Update prebuilt rule threats to …
Browse files Browse the repository at this point in the history 
…match schema (#92281) (#92722)

Co-authored-by: Kibana Machine <[email protected]>
  • Loading branch information
@dplumlee @kibanamachine
dplumlee and kibanamachine authored Feb 25, 2021
1 parent 8346c53 commit 562c444
Show file tree
Hide file tree
Showing 10 changed files with 137 additions and 98 deletions.
20 changes: 13 additions & 7 deletions x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -444,13 +444,19 @@ export const threat_technique = t.intersection([
]);
export type ThreatTechnique = t.TypeOf<typeof threat_technique>;
export const threat_techniques = t.array(threat_technique);
export const threat = t.exact(
t.type({
framework: threat_framework,
tactic: threat_tactic,
technique: threat_techniques,
})
);
export const threat = t.intersection([
t.exact(
t.type({
framework: threat_framework,
tactic: threat_tactic,
})
),
t.exact(
t.partial({
technique: threat_techniques,
})
),
]);
export type Threat = t.TypeOf<typeof threat>;

export const threats = t.array(threat);
Expand Down
21 changes: 16 additions & 5 deletions ...rity_solution/common/detection_engine/schemas/request/add_prepackged_rules_schema.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -924,7 +924,7 @@ describe('add prepackaged rules schema', () => {
expect(message.schema).toEqual({});
});

test('You cannot send in an array of threat that are missing "technique"', () => {
test('You can send in an array of threat that are missing "technique"', () => {
const payload: Omit<AddPrepackagedRulesSchema, 'threat'> & {
threat: Array<Partial<Omit<AddPrepackagedRulesSchema['threat'], 'technique'>>>;
} = {
Expand All @@ -944,10 +944,21 @@ describe('add prepackaged rules schema', () => {
const decoded = addPrepackagedRulesSchema.decode(payload);
const checked = exactCheck(payload, decoded);
const message = pipe(checked, foldLeftRight);
expect(getPaths(left(message.errors))).toEqual([
'Invalid value "undefined" supplied to "threat,technique"',
]);
expect(message.schema).toEqual({});
expect(getPaths(left(message.errors))).toEqual([]);
const expected: AddPrepackagedRulesSchemaDecoded = {
...getAddPrepackagedRulesSchemaDecodedMock(),
threat: [
{
framework: 'fake',
tactic: {
id: 'fakeId',
name: 'fakeName',
reference: 'fakeRef',
},
},
],
};
expect(message.schema).toEqual(expected);
});

test('You can optionally send in an array of false positives', () => {
Expand Down
21 changes: 16 additions & 5 deletions ...ins/security_solution/common/detection_engine/schemas/request/import_rules_schema.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -926,7 +926,7 @@ describe('import rules schema', () => {
expect(message.schema).toEqual({});
});

test('You cannot send in an array of threat that are missing "technique"', () => {
test('You can send in an array of threat that are missing "technique"', () => {
const payload: Omit<ImportRulesSchema, 'threat'> & {
threat: Array<Partial<Omit<ImportRulesSchema['threat'], 'technique'>>>;
} = {
Expand All @@ -946,10 +946,21 @@ describe('import rules schema', () => {
const decoded = importRulesSchema.decode(payload);
const checked = exactCheck(payload, decoded);
const message = pipe(checked, foldLeftRight);
expect(getPaths(left(message.errors))).toEqual([
'Invalid value "undefined" supplied to "threat,technique"',
]);
expect(message.schema).toEqual({});
expect(getPaths(left(message.errors))).toEqual([]);
const expected: ImportRulesSchemaDecoded = {
...getImportRulesSchemaDecodedMock(),
threat: [
{
framework: 'fake',
tactic: {
id: 'fakeId',
name: 'fakeName',
reference: 'fakeRef',
},
},
],
};
expect(message.schema).toEqual(expected);
});

test('You can optionally send in an array of false positives', () => {
Expand Down
8 changes: 3 additions & 5 deletions ...gins/security_solution/common/detection_engine/schemas/request/patch_rules_schema.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -973,7 +973,7 @@ describe('patch_rules_schema', () => {
expect(message.schema).toEqual({});
});

test('threat is invalid when updated with missing technique', () => {
test('threat is valid when updated with missing technique', () => {
const threat: Omit<PatchRulesSchema['threat'], 'technique'> = [
{
framework: 'fake',
Expand All @@ -993,10 +993,8 @@ describe('patch_rules_schema', () => {
const decoded = patchRulesSchema.decode(payload);
const checked = exactCheck(payload, decoded);
const message = pipe(checked, foldLeftRight);
expect(getPaths(left(message.errors))).toEqual([
'Invalid value "undefined" supplied to "threat,technique"',
]);
expect(message.schema).toEqual({});
expect(getPaths(left(message.errors))).toEqual([]);
expect(message.schema).toEqual(payload);
});

test('validates with timeline_id and timeline_title', () => {
Expand Down
8 changes: 3 additions & 5 deletions ...ck/plugins/security_solution/common/detection_engine/schemas/request/rule_schemas.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -618,7 +618,7 @@ describe('create rules schema', () => {
expect(message.schema).toEqual({});
});

test('You cannot send in an array of threat that are missing "technique"', () => {
test('You can send in an array of threat that are missing "technique"', () => {
const payload = {
...getCreateRulesSchemaMock(),
threat: [
Expand All @@ -636,10 +636,8 @@ describe('create rules schema', () => {
const decoded = createRulesSchema.decode(payload);
const checked = exactCheck(payload, decoded);
const message = pipe(checked, foldLeftRight);
expect(getPaths(left(message.errors))).toEqual([
'Invalid value "undefined" supplied to "threat,technique"',
]);
expect(message.schema).toEqual({});
expect(getPaths(left(message.errors))).toEqual([]);
expect(message.schema).toEqual(payload);
});

test('You can optionally send in an array of false positives', () => {
Expand Down
89 changes: 47 additions & 42 deletions ...plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -157,49 +157,54 @@ export const buildThreatDescription = ({ label, threat }: BuildThreatDescription
: `${singleThreat.tactic.name} (${singleThreat.tactic.id})`}
</EuiLink>
<EuiFlexGroup gutterSize="none" alignItems="flexStart" direction="column">
{singleThreat.technique.map((technique, techniqueIndex) => {
const myTechnique = techniquesOptions.find((t) => t.id === technique.id);
return (
<EuiFlexItem key={myTechnique?.id ?? techniqueIndex}>
<TechniqueLinkItem
data-test-subj="threatTechniqueLink"
href={technique.reference}
target="_blank"
iconType={ListTreeIcon}
size="xs"
>
{myTechnique != null
? myTechnique.label
: `${technique.name} (${technique.id})`}
</TechniqueLinkItem>
<EuiFlexGroup gutterSize="none" alignItems="flexStart" direction="column">
{technique.subtechnique != null &&
technique.subtechnique.map((subtechnique, subtechniqueIndex) => {
const mySubtechnique = subtechniquesOptions.find(
(t) => t.id === subtechnique.id
);
return (
<SubtechniqueFlexItem
key={mySubtechnique?.id ?? subtechniqueIndex}
>
<TechniqueLinkItem
data-test-subj="threatSubtechniqueLink"
href={subtechnique.reference}
target="_blank"
iconType={ListTreeIcon}
size="xs"
{singleThreat.technique &&
singleThreat.technique.map((technique, techniqueIndex) => {
const myTechnique = techniquesOptions.find((t) => t.id === technique.id);
return (
<EuiFlexItem key={myTechnique?.id ?? techniqueIndex}>
<TechniqueLinkItem
data-test-subj="threatTechniqueLink"
href={technique.reference}
target="_blank"
iconType={ListTreeIcon}
size="xs"
>
{myTechnique != null
? myTechnique.label
: `${technique.name} (${technique.id})`}
</TechniqueLinkItem>
<EuiFlexGroup
gutterSize="none"
alignItems="flexStart"
direction="column"
>
{technique.subtechnique != null &&
technique.subtechnique.map((subtechnique, subtechniqueIndex) => {
const mySubtechnique = subtechniquesOptions.find(
(t) => t.id === subtechnique.id
);
return (
<SubtechniqueFlexItem
key={mySubtechnique?.id ?? subtechniqueIndex}
>
{mySubtechnique != null
? mySubtechnique.label
: `${subtechnique.name} (${subtechnique.id})`}
</TechniqueLinkItem>
</SubtechniqueFlexItem>
);
})}
</EuiFlexGroup>
</EuiFlexItem>
);
})}
<TechniqueLinkItem
data-test-subj="threatSubtechniqueLink"
href={subtechnique.reference}
target="_blank"
iconType={ListTreeIcon}
size="xs"
>
{mySubtechnique != null
? mySubtechnique.label
: `${subtechnique.name} (${subtechnique.id})`}
</TechniqueLinkItem>
</SubtechniqueFlexItem>
);
})}
</EuiFlexGroup>
</EuiFlexItem>
);
})}
</EuiFlexGroup>
</EuiFlexItem>
);
Expand Down
2 changes: 1 addition & 1 deletion x-pack/plugins/security_solution/public/detections/components/rules/mitre/helpers.test.tsx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
import { getValidThreat } from '../../../mitre/valid_threat_mock';
import { hasSubtechniqueOptions } from './helpers';

const mockTechniques = getValidThreat()[0].technique;
const mockTechniques = getValidThreat()[0].technique ?? [];

describe('helpers', () => {
describe('hasSubtechniqueOptions', () => {
Expand Down
51 changes: 29 additions & 22 deletions ...lugins/security_solution/public/detections/components/rules/mitre/subtechnique_fields.tsx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -51,45 +51,46 @@ export const MitreAttackSubtechniqueFields: React.FC<AddSubtechniqueProps> = ({
const values = field.value as Threats;

const technique = useMemo(() => {
return values[threatIndex].technique[techniqueIndex];
}, [values, threatIndex, techniqueIndex]);
return [...(values[threatIndex].technique ?? [])];
}, [values, threatIndex]);

const removeSubtechnique = useCallback(
(index: number) => {
const threats = [...(field.value as Threats)];
const subtechniques = threats[threatIndex].technique[techniqueIndex].subtechnique;
const subtechniques = technique[techniqueIndex].subtechnique ?? [];
if (subtechniques != null) {
subtechniques.splice(index, 1);

threats[threatIndex].technique[techniqueIndex] = {
...threats[threatIndex].technique[techniqueIndex],
technique[techniqueIndex] = {
...technique[techniqueIndex],
subtechnique: subtechniques,
};
threats[threatIndex].technique = technique;
onFieldChange(threats);
}
},
[field, threatIndex, onFieldChange, techniqueIndex]
[field, onFieldChange, techniqueIndex, technique, threatIndex]
);

const addMitreAttackSubtechnique = useCallback(() => {
const threats = [...(field.value as Threats)];

const subtechniques = threats[threatIndex].technique[techniqueIndex].subtechnique;
const subtechniques = technique[techniqueIndex].subtechnique;

if (subtechniques != null) {
threats[threatIndex].technique[techniqueIndex] = {
...threats[threatIndex].technique[techniqueIndex],
technique[techniqueIndex] = {
...technique[techniqueIndex],
subtechnique: [...subtechniques, { id: 'none', name: 'none', reference: 'none' }],
};
} else {
threats[threatIndex].technique[techniqueIndex] = {
...threats[threatIndex].technique[techniqueIndex],
technique[techniqueIndex] = {
...technique[techniqueIndex],
subtechnique: [{ id: 'none', name: 'none', reference: 'none' }],
};
}

threats[threatIndex].technique = technique;
onFieldChange(threats);
}, [field, threatIndex, onFieldChange, techniqueIndex]);
}, [field, onFieldChange, techniqueIndex, technique, threatIndex]);

const updateSubtechnique = useCallback(
(index: number, value: string) => {
Expand All @@ -99,17 +100,17 @@ export const MitreAttackSubtechniqueFields: React.FC<AddSubtechniqueProps> = ({
name: '',
reference: '',
};
const subtechniques = threats[threatIndex].technique[techniqueIndex].subtechnique;
const subtechniques = technique[techniqueIndex].subtechnique;

if (subtechniques != null) {
onFieldChange([
...threats.slice(0, threatIndex),
{
...threats[threatIndex],
technique: [
...threats[threatIndex].technique.slice(0, techniqueIndex),
...technique.slice(0, techniqueIndex),
{
...threats[threatIndex].technique[techniqueIndex],
...technique[techniqueIndex],
subtechnique: [
...subtechniques.slice(0, index),
{
Expand All @@ -120,19 +121,21 @@ export const MitreAttackSubtechniqueFields: React.FC<AddSubtechniqueProps> = ({
...subtechniques.slice(index + 1),
],
},
...threats[threatIndex].technique.slice(techniqueIndex + 1),
...technique.slice(techniqueIndex + 1),
],
},
...threats.slice(threatIndex + 1),
]);
}
},
[threatIndex, techniqueIndex, onFieldChange, field]
[threatIndex, techniqueIndex, onFieldChange, field, technique]
);

const getSelectSubtechnique = useCallback(
(index: number, disabled: boolean, subtechnique: ThreatSubtechnique) => {
const options = subtechniquesOptions.filter((t) => t.techniqueId === technique.id);
const options = subtechniquesOptions.filter(
(t) => t.techniqueId === technique[techniqueIndex].id
);

return (
<>
Expand Down Expand Up @@ -166,13 +169,17 @@ export const MitreAttackSubtechniqueFields: React.FC<AddSubtechniqueProps> = ({
</>
);
},
[field, updateSubtechnique, technique]
[field, updateSubtechnique, technique, techniqueIndex]
);

const subtechniques = useMemo(() => {
return technique[techniqueIndex].subtechnique;
}, [technique, techniqueIndex]);

return (
<SubtechniqueContainer>
{technique.subtechnique != null &&
technique.subtechnique.map((subtechnique, index) => (
{subtechniques != null &&
subtechniques.map((subtechnique, index) => (
<div key={index}>
<EuiSpacer size="s" />
<EuiFormRow
Expand Down
Loading

0 comments on commit 562c444

Please sign in to comment.