Add possibility to update threat_indicator_path for prebuilt rule (#1…

…16583) * Add possibility to update threat_indicator_path for prebuiltt rule * Fix types * adds update_prepacked_rules test Co-authored-by: Kibana Machine <[email protected]> Co-authored-by: Ece Ozalp <[email protected]>
elastic · Nov 29, 2021 · b5a30fc · b5a30fc
1 parent b2cc0b3
commit b5a30fc
Show file tree

Hide file tree

Showing 10 changed files with 56 additions and 0 deletions.
diff --git a/.../plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts b/.../plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
@@ -326,6 +326,7 @@ export const importRulesRoute = (
                           threshold,
                           threatFilters,
                           threatIndex,
+                          threatIndicatorPath,
                           threatQuery,
                           threatMapping,
                           threatLanguage,

diff --git a/...gins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts b/...gins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts
@@ -98,6 +98,7 @@ export const patchRulesBulkRoute = (
             threshold,
             threat_filters: threatFilters,
             threat_index: threatIndex,
+            threat_indicator_path: threatIndicatorPath,
             threat_query: threatQuery,
             threat_mapping: threatMapping,
             threat_language: threatLanguage,
@@ -178,6 +179,7 @@ export const patchRulesBulkRoute = (
               threshold,
               threatFilters,
               threatIndex,
+              threatIndicatorPath,
               threatQuery,
               threatMapping,
               threatLanguage,

diff --git a/...k/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts b/...k/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts
@@ -86,6 +86,7 @@ export const patchRulesRoute = (
         threshold,
         threat_filters: threatFilters,
         threat_index: threatIndex,
+        threat_indicator_path: threatIndicatorPath,
         threat_query: threatQuery,
         threat_mapping: threatMapping,
         threat_language: threatLanguage,
@@ -179,6 +180,7 @@ export const patchRulesRoute = (
           threshold,
           threatFilters,
           threatIndex,
+          threatIndicatorPath,
           threatQuery,
           threatMapping,
           threatLanguage,

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.mock.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.mock.ts
@@ -49,6 +49,7 @@ export const getPatchRulesOptionsMock = (isRuleRegistryEnabled: boolean): PatchR
   threshold: undefined,
   threatFilters: undefined,
   threatIndex: undefined,
+  threatIndicatorPath: undefined,
   threatQuery: undefined,
   threatMapping: undefined,
   threatLanguage: undefined,
@@ -103,6 +104,7 @@ export const getPatchMlRulesOptionsMock = (isRuleRegistryEnabled: boolean): Patc
   threshold: undefined,
   threatFilters: undefined,
   threatIndex: undefined,
+  threatIndicatorPath: undefined,
   threatQuery: undefined,
   threatMapping: undefined,
   threatLanguage: undefined,

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.ts
@@ -71,6 +71,7 @@ export const patchRules = async ({
   threshold,
   threatFilters,
   threatIndex,
+  threatIndicatorPath,
   threatQuery,
   threatMapping,
   threatLanguage,
@@ -123,6 +124,7 @@ export const patchRules = async ({
     threshold,
     threatFilters,
     threatIndex,
+    threatIndicatorPath,
     threatQuery,
     threatMapping,
     threatLanguage,
@@ -170,6 +172,7 @@ export const patchRules = async ({
       threshold: threshold ? normalizeThresholdObject(threshold) : undefined,
       threatFilters,
       threatIndex,
+      threatIndicatorPath,
       threatQuery,
       threatMapping,
       threatLanguage,

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/types.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/types.ts
@@ -310,6 +310,7 @@ export interface PatchRulesOptions {
   threshold: ThresholdOrUndefined;
   threatFilters: ThreatFiltersOrUndefined;
   threatIndex: ThreatIndexOrUndefined;
+  threatIndicatorPath: ThreatIndicatorPathOrUndefined;
   threatQuery: ThreatQueryOrUndefined;
   threatMapping: ThreatMappingOrUndefined;
   threatLanguage: ThreatLanguageOrUndefined;

diff --git a/...lugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.test.ts b/...lugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.test.ts
@@ -63,4 +63,42 @@ describe.each([
       })
     );
   });
+
+  it('should update threat match rules', async () => {
+    const updatedThreatParams = {
+      threat_index: ['test-index'],
+      threat_indicator_path: 'test.path',
+      threat_query: 'threat:*',
+    };
+    const prepackagedRule = getAddPrepackagedRulesSchemaDecodedMock();
+    rulesClient.find.mockResolvedValue(getFindResultWithSingleHit(isRuleRegistryEnabled));
+
+    await updatePrepackagedRules(
+      rulesClient,
+      savedObjectsClient,
+      'default',
+      ruleStatusClient,
+      [{ ...prepackagedRule, ...updatedThreatParams }],
+      'output-index',
+      isRuleRegistryEnabled
+    );
+
+    expect(patchRules).toHaveBeenCalledWith(
+      expect.objectContaining({
+        threatIndicatorPath: 'test.path',
+      })
+    );
+
+    expect(patchRules).toHaveBeenCalledWith(
+      expect.objectContaining({
+        threatIndex: ['test-index'],
+      })
+    );
+
+    expect(patchRules).toHaveBeenCalledWith(
+      expect.objectContaining({
+        threatQuery: 'threat:*',
+      })
+    );
+  });
 });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.ts
@@ -124,6 +124,7 @@ export const createPromises = (
       threshold,
       threat_filters: threatFilters,
       threat_index: threatIndex,
+      threat_indicator_path: threatIndicatorPath,
       threat_query: threatQuery,
       threat_mapping: threatMapping,
       threat_language: threatLanguage,
@@ -195,6 +196,7 @@ export const createPromises = (
       threshold,
       threatFilters,
       threatIndex,
+      threatIndicatorPath,
       threatQuery,
       threatMapping,
       threatLanguage,

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.test.ts
@@ -75,6 +75,7 @@ describe('utils', () => {
           threshold: undefined,
           threatFilters: undefined,
           threatIndex: undefined,
+          threatIndicatorPath: undefined,
           threatQuery: undefined,
           threatMapping: undefined,
           threatLanguage: undefined,
@@ -126,6 +127,7 @@ describe('utils', () => {
           threshold: undefined,
           threatFilters: undefined,
           threatIndex: undefined,
+          threatIndicatorPath: undefined,
           threatQuery: undefined,
           threatMapping: undefined,
           threatLanguage: undefined,
@@ -177,6 +179,7 @@ describe('utils', () => {
           threshold: undefined,
           threatFilters: undefined,
           threatIndex: undefined,
+          threatIndicatorPath: undefined,
           threatQuery: undefined,
           threatMapping: undefined,
           threatLanguage: undefined,

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.ts
@@ -15,6 +15,7 @@ import type {
   ItemsPerSearchOrUndefined,
   ThreatFiltersOrUndefined,
   ThreatIndexOrUndefined,
+  ThreatIndicatorPathOrUndefined,
   ThreatLanguageOrUndefined,
   ThreatMappingOrUndefined,
   ThreatQueryOrUndefined,
@@ -113,6 +114,7 @@ export interface UpdateProperties {
   threshold: ThresholdOrUndefined;
   threatFilters: ThreatFiltersOrUndefined;
   threatIndex: ThreatIndexOrUndefined;
+  threatIndicatorPath: ThreatIndicatorPathOrUndefined;
   threatQuery: ThreatQueryOrUndefined;
   threatMapping: ThreatMappingOrUndefined;
   threatLanguage: ThreatLanguageOrUndefined;