Address pr comments

x-pack/plugins/endpoint/common/models/event.ts

@@ -4,51 +4,45 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EndpointEvent, LegacyEndpointEvent, ResolverEvent } from '../types';
+import { LegacyEndpointEvent, ResolverEvent } from '../types';
 
-export function isLegacyEvent(
-  event: EndpointEvent | LegacyEndpointEvent
-): event is LegacyEndpointEvent {
+export function isLegacyEvent(event: ResolverEvent): event is LegacyEndpointEvent {
   return (event as LegacyEndpointEvent).endgame !== undefined;
 }
 
-export function eventTimestamp(
-  event: EndpointEvent | LegacyEndpointEvent
-): string | undefined | number {
+export function eventTimestamp(event: ResolverEvent): string | undefined | number {
   if (isLegacyEvent(event)) {
     return event.endgame.timestamp_utc;
   } else {
     return event['@timestamp'];
   }
 }
 
-/** TODO, seems wrong */
-export function eventName(event: EndpointEvent | LegacyEndpointEvent): string {
+export function eventName(event: ResolverEvent): string {
   if (isLegacyEvent(event)) {
     return event.endgame.process_name ? event.endgame.process_name : '';
   } else {
     return event.process.name;
   }
 }
 
-export function eventId(event: ResolverEvent) {
+export function eventId(event: ResolverEvent): string {
   if (isLegacyEvent(event)) {
-    return String(event.endgame.serial_event_id);
+    return event.endgame.serial_event_id ? String(event.endgame.serial_event_id) : '';
   }
   return event.event.id;
 }
 
-export function entityId(event: ResolverEvent) {
+export function entityId(event: ResolverEvent): string {
   if (isLegacyEvent(event)) {
-    return String(event.endgame.unique_pid);
+    return event.endgame.unique_pid ? String(event.endgame.unique_pid) : '';
   }
   return event.process.entity_id;
 }
 
-export function parentEntityId(event: ResolverEvent) {
+export function parentEntityId(event: ResolverEvent): string | undefined {
   if (isLegacyEvent(event)) {
-    const ppid = event.endgame.unique_ppid;
-    return String(ppid); // if unique_ppid is undefined return undefined
+    return event.endgame.unique_ppid ? String(event.endgame.unique_ppid) : undefined;
   }
   return event.process.parent?.entity_id;
 }

x-pack/plugins/endpoint/common/types.ts

@@ -69,7 +69,6 @@ export interface ResolverNode {
   events: ResolverEvent[];
   lifecycle: ResolverEvent[];
   ancestors?: ResolverNode[];
-  parent?: ResolverNode | null;
   pagination: ResolverNodePagination;
   stats?: ResolverNodeStats;
 }

x-pack/plugins/endpoint/public/embeddables/resolver/store/middleware.ts

@@ -48,13 +48,18 @@ export const resolverMiddlewareFactory: MiddlewareFactory = context => {
             const legacyEndpointID = action.payload.selectedEvent?.agent?.id;
             [{ lifecycle, children, ancestors }] = await Promise.all([
               context.services.http.get(`/api/endpoint/resolver/${entityId}`, {
-                query: { legacyEndpointID },
+                query: { legacyEndpointID, children: 5, ancestors: 5 },
               }),
             ]);
           } else {
             const entityId = action.payload.selectedEvent.process.entity_id;
             [{ lifecycle, children, ancestors }] = await Promise.all([
-              context.services.http.get(`/api/endpoint/resolver/${entityId}`),
+              context.services.http.get(`/api/endpoint/resolver/${entityId}`, {
+                query: {
+                  children: 5,
+                  ancestors: 5,
+                },
+              }),
             ]);
           }
           const response: ResolverEvent[] = [

x-pack/plugins/endpoint/server/routes/resolver/queries/children.ts

@@ -66,10 +66,6 @@ export class ChildrenQuery extends ResolverQuery {
                 term: { 'event.kind': 'event' },
               },
               {
-                // Corner case, we could only have a process_running or process_terminated
-                // so to solve this we'll probably want to either search for all of them and only return one if that's
-                // possible in elastic search or in memory pull out a single event to return
-                // https://github.com/elastic/endpoint-app-team/issues/168
                 term: { 'event.type': 'start' },
               },
             ],

x-pack/plugins/endpoint/server/routes/resolver/utils/tree.ts

@@ -93,16 +93,13 @@ export class Tree {
       throw new Error('cannot merge trees with different roots');
     }
 
-    // our caches should be exclusive for everything but the root node so we can
-    // just merge them
     Object.entries(ancestors.cache).forEach(([id, node]) => {
       if (rootID !== id) {
         children.cache.set(id, node);
       }
     });
 
     children.root.lifecycle = ancestors.root.lifecycle;
-    children.root.parent = ancestors.root.parent;
     children.root.ancestors = ancestors.root.ancestors;
     children.root.events = events.root.events;