Merge branch 'master' into ingest-node/grok/new-patterns-component-us…

…e-array

package.json

@@ -350,7 +350,7 @@
     "babel-eslint": "^10.0.3",
     "babel-jest": "^25.5.1",
     "babel-plugin-istanbul": "^6.0.0",
-    "backport": "5.5.1",
+    "backport": "5.6.0",
     "brace": "0.11.1",
     "chai": "3.5.0",
     "chance": "1.0.18",

x-pack/plugins/actions/common/types.ts

@@ -24,3 +24,13 @@ export interface ActionResult {
   config: Record<string, any>;
   isPreconfigured: boolean;
 }
+
+// the result returned from an action type executor function
+export interface ActionTypeExecutorResult<Data> {
+  actionId: string;
+  status: 'ok' | 'error';
+  message?: string;
+  serviceMessage?: string;
+  data?: Data;
+  retry?: null | boolean | Date;
+}

x-pack/plugins/actions/server/builtin_action_types/es_index.test.ts

@@ -284,4 +284,47 @@ describe('execute()', () => {
           ]
     `);
   });
+
+  test('resolves with an error when an error occurs in the indexing operation', async () => {
+    const secrets = {};
+    // minimal params
+    const config = { index: 'index-value', refresh: false, executionTimeField: null };
+    const params = {
+      documents: [{ '': 'bob' }],
+    };
+
+    const actionId = 'some-id';
+
+    services.callCluster.mockResolvedValue({
+      took: 0,
+      errors: true,
+      items: [
+        {
+          index: {
+            _index: 'indexme',
+            _id: '7buTjHQB0SuNSiS9Hayt',
+            status: 400,
+            error: {
+              type: 'mapper_parsing_exception',
+              reason: 'failed to parse',
+              caused_by: {
+                type: 'illegal_argument_exception',
+                reason: 'field name cannot be an empty string',
+              },
+            },
+          },
+        },
+      ],
+    });
+
+    expect(await actionType.executor({ actionId, config, secrets, params, services }))
+      .toMatchInlineSnapshot(`
+      Object {
+        "actionId": "some-id",
+        "message": "error indexing documents",
+        "serviceMessage": "failed to parse (field name cannot be an empty string)",
+        "status": "error",
+      }
+    `);
+  });
 });

x-pack/plugins/actions/server/builtin_action_types/es_index.ts

@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { curry } from 'lodash';
+import { curry, find } from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { schema, TypeOf } from '@kbn/config-schema';
 
@@ -85,21 +85,39 @@ async function executor(
     refresh: config.refresh,
   };
 
-  let result;
   try {
-    result = await services.callCluster('bulk', bulkParams);
+    const result = await services.callCluster('bulk', bulkParams);
+
+    const err = find(result.items, 'index.error.reason');
+    if (err) {
+      return wrapErr(
+        `${err.index.error!.reason}${
+          err.index.error?.caused_by ? ` (${err.index.error?.caused_by?.reason})` : ''
+        }`,
+        actionId,
+        logger
+      );
+    }
+
+    return { status: 'ok', data: result, actionId };
   } catch (err) {
-    const message = i18n.translate('xpack.actions.builtin.esIndex.errorIndexingErrorMessage', {
-      defaultMessage: 'error indexing documents',
-    });
-    logger.error(`error indexing documents: ${err.message}`);
-    return {
-      status: 'error',
-      actionId,
-      message,
-      serviceMessage: err.message,
-    };
+    return wrapErr(err.message, actionId, logger);
   }
+}
 
-  return { status: 'ok', data: result, actionId };
+function wrapErr(
+  errMessage: string,
+  actionId: string,
+  logger: Logger
+): ActionTypeExecutorResult<unknown> {
+  const message = i18n.translate('xpack.actions.builtin.esIndex.errorIndexingErrorMessage', {
+    defaultMessage: 'error indexing documents',
+  });
+  logger.error(`error indexing documents: ${errMessage}`);
+  return {
+    status: 'error',
+    actionId,
+    message,
+    serviceMessage: errMessage,
+  };
 }

x-pack/plugins/actions/server/types.ts

@@ -15,6 +15,8 @@ import {
   SavedObjectsClientContract,
   SavedObjectAttributes,
 } from '../../../../src/core/server';
+import { ActionTypeExecutorResult } from '../common';
+export { ActionTypeExecutorResult } from '../common';
 
 export type WithoutQueryAndParams<T> = Pick<T, Exclude<keyof T, 'query' | 'params'>>;
 export type GetServicesFunction = (request: KibanaRequest) => Services;
@@ -80,16 +82,6 @@ export interface FindActionResult extends ActionResult {
   referencedByCount: number;
 }
 
-// the result returned from an action type executor function
-export interface ActionTypeExecutorResult<Data> {
-  actionId: string;
-  status: 'ok' | 'error';
-  message?: string;
-  serviceMessage?: string;
-  data?: Data;
-  retry?: null | boolean | Date;
-}
-
 // signature of the action type executor function
 export type ExecutorType<Config, Secrets, Params, ResultData> = (
   options: ActionTypeExecutorOptions<Config, Secrets, Params>

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/index.ts

@@ -9,6 +9,7 @@ export * from './authentications';
 export * from './common';
 export * from './details';
 export * from './first_last_seen';
+export * from './kpi';
 export * from './overview';
 export * from './uncommon_processes';
 

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/kpi/authentications/index.ts

@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../../common';
+import { RequestBasicOptions } from '../../..';
+import { HostsKpiHistogramData } from '../common';
+
+export interface HostsKpiAuthenticationsHistogramCount {
+  doc_count: number;
+}
+
+export type HostsKpiAuthenticationsRequestOptions = RequestBasicOptions;
+
+export interface HostsKpiAuthenticationsStrategyResponse extends IEsSearchResponse {
+  authenticationsSuccess: Maybe<number>;
+  authenticationsSuccessHistogram: Maybe<HostsKpiHistogramData[]>;
+  authenticationsFailure: Maybe<number>;
+  authenticationsFailureHistogram: Maybe<HostsKpiHistogramData[]>;
+  inspect?: Maybe<Inspect>;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/kpi/common/index.ts

@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Maybe } from '../../../../common';
+
+export interface HostsKpiHistogramData {
+  x?: Maybe<number>;
+  y?: Maybe<number>;
+}
+
+export interface HostsKpiHistogram<T> {
+  key_as_string: string;
+  key: number;
+  doc_count: number;
+  count: T;
+}
+
+export interface HostsKpiGeneralHistogramCount {
+  value: number;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/kpi/hosts/index.ts

@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../../common';
+import { RequestBasicOptions } from '../../..';
+import { HostsKpiHistogramData } from '../common';
+
+export type HostsKpiHostsRequestOptions = RequestBasicOptions;
+
+export interface HostsKpiHostsStrategyResponse extends IEsSearchResponse {
+  hosts: Maybe<number>;
+  hostsHistogram: Maybe<HostsKpiHistogramData[]>;
+  inspect?: Maybe<Inspect>;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/kpi/index.ts

@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export * from './authentications';
+export * from './common';
+export * from './hosts';
+export * from './unique_ips';
+
+import { HostsKpiAuthenticationsStrategyResponse } from './authentications';
+import { HostsKpiHostsStrategyResponse } from './hosts';
+import { HostsKpiUniqueIpsStrategyResponse } from './unique_ips';
+
+export enum HostsKpiQueries {
+  kpiAuthentications = 'hostsKpiAuthentications',
+  kpiHosts = 'hostsKpiHosts',
+  kpiUniqueIps = 'hostsKpiUniqueIps',
+}
+
+export type HostsKpiStrategyResponse =
+  | Omit<HostsKpiAuthenticationsStrategyResponse, 'rawResponse'>
+  | Omit<HostsKpiHostsStrategyResponse, 'rawResponse'>
+  | Omit<HostsKpiUniqueIpsStrategyResponse, 'rawResponse'>;

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/kpi/unique_ips/index.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../../common';
+import { RequestBasicOptions } from '../../..';
+import { HostsKpiHistogramData } from '../common';
+
+export type HostsKpiUniqueIpsRequestOptions = RequestBasicOptions;
+
+export interface HostsKpiUniqueIpsStrategyResponse extends IEsSearchResponse {
+  uniqueSourceIps: Maybe<number>;
+  uniqueSourceIpsHistogram: Maybe<HostsKpiHistogramData[]>;
+  uniqueDestinationIps: Maybe<number>;
+  uniqueDestinationIpsHistogram: Maybe<HostsKpiHistogramData[]>;
+  inspect?: Maybe<Inspect>;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts

@@ -20,6 +20,13 @@ import {
   HostsStrategyResponse,
   HostUncommonProcessesStrategyResponse,
   HostUncommonProcessesRequestOptions,
+  HostsKpiQueries,
+  HostsKpiAuthenticationsStrategyResponse,
+  HostsKpiAuthenticationsRequestOptions,
+  HostsKpiHostsStrategyResponse,
+  HostsKpiHostsRequestOptions,
+  HostsKpiUniqueIpsStrategyResponse,
+  HostsKpiUniqueIpsRequestOptions,
 } from './hosts';
 import {
   NetworkQueries,
@@ -70,6 +77,7 @@ export * from './network';
 
 export type FactoryQueryTypes =
   | HostsQueries
+  | HostsKpiQueries
   | NetworkQueries
   | NetworkKpiQueries
   | typeof MatrixHistogramQuery;
@@ -106,6 +114,12 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
   ? HostFirstLastSeenStrategyResponse
   : T extends HostsQueries.uncommonProcesses
   ? HostUncommonProcessesStrategyResponse
+  : T extends HostsKpiQueries.kpiAuthentications
+  ? HostsKpiAuthenticationsStrategyResponse
+  : T extends HostsKpiQueries.kpiHosts
+  ? HostsKpiHostsStrategyResponse
+  : T extends HostsKpiQueries.kpiUniqueIps
+  ? HostsKpiUniqueIpsStrategyResponse
   : T extends NetworkQueries.details
   ? NetworkDetailsStrategyResponse
   : T extends NetworkQueries.dns
@@ -148,6 +162,12 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
   ? HostFirstLastSeenRequestOptions
   : T extends HostsQueries.uncommonProcesses
   ? HostUncommonProcessesRequestOptions
+  : T extends HostsKpiQueries.kpiAuthentications
+  ? HostsKpiAuthenticationsRequestOptions
+  : T extends HostsKpiQueries.kpiHosts
+  ? HostsKpiHostsRequestOptions
+  : T extends HostsKpiQueries.kpiUniqueIps
+  ? HostsKpiUniqueIpsRequestOptions
   : T extends NetworkQueries.details
   ? NetworkDetailsRequestOptions
   : T extends NetworkQueries.dns

x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx

@@ -39,8 +39,10 @@ import {
 } from '../../mock';
 import { State, createStore } from '../../store';
 import { Provider as ReduxStoreProvider } from 'react-redux';
-import { KpiHostsData } from '../../../graphql/types';
-import { NetworkKpiStrategyResponse } from '../../../../common/search_strategy';
+import {
+  HostsKpiStrategyResponse,
+  NetworkKpiStrategyResponse,
+} from '../../../../common/search_strategy';
 
 const from = '2019-06-15T06:00:00.000Z';
 const to = '2019-06-18T06:00:00.000Z';
@@ -242,7 +244,7 @@ describe('useKpiMatrixStatus', () => {
     data,
   }: {
     fieldsMapping: Readonly<StatItems[]>;
-    data: NetworkKpiStrategyResponse | KpiHostsData;
+    data: NetworkKpiStrategyResponse | HostsKpiStrategyResponse;
   }) => {
     const statItemsProps: StatItemsProps[] = useKpiMatrixStatus(
       fieldsMapping,