-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Security Solution][Platform] - Exceptions imports (#118816)
## Summary Addresses #92613 and #117399 Goal is to allow users to import their exception lists and items alongside their rules. This PR does not complete all the UI updates needed, but does tackle the majority of use cases. The bulk of the changes occur in `import_rules_route` and the new `import_exceptions_route`. - Adds exceptions import endpoint in `lists` plugin - Adds exceptions import logic in import rules route in `security_solution` plugin - Adds integration tests for exception import endpoint - Adds integration tests for rules import endpoint to account for new functionality - Purposely not yet adding an import modal in the exceptions table UI until further list management features added (checked with product on this front)
- Loading branch information
Showing
77 changed files
with
6,499 additions
and
394 deletions.
There are no files selected for viewing
34 changes: 34 additions & 0 deletions
34
...-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.mock.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,34 @@ | ||
/* | ||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
* or more contributor license agreements. Licensed under the Elastic License | ||
* 2.0 and the Server Side Public License, v 1; you may not use this file except | ||
* in compliance with, at your election, the Elastic License 2.0 or the Server | ||
* Side Public License, v 1. | ||
*/ | ||
|
||
import { ENTRIES } from '../../constants/index.mock'; | ||
import { ImportExceptionListItemSchema, ImportExceptionListItemSchemaDecoded } from '.'; | ||
|
||
export const getImportExceptionsListItemSchemaMock = ( | ||
itemId = 'item_id_1', | ||
listId = 'detection_list_id' | ||
): ImportExceptionListItemSchema => ({ | ||
description: 'some description', | ||
entries: ENTRIES, | ||
item_id: itemId, | ||
list_id: listId, | ||
name: 'Query with a rule id', | ||
type: 'simple', | ||
}); | ||
|
||
export const getImportExceptionsListItemSchemaDecodedMock = ( | ||
itemId = 'item_id_1', | ||
listId = 'detection_list_id' | ||
): ImportExceptionListItemSchemaDecoded => ({ | ||
...getImportExceptionsListItemSchemaMock(itemId, listId), | ||
comments: [], | ||
meta: undefined, | ||
namespace_type: 'single', | ||
os_types: [], | ||
tags: [], | ||
}); |
143 changes: 143 additions & 0 deletions
143
...-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.test.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,143 @@ | ||
/* | ||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
* or more contributor license agreements. Licensed under the Elastic License | ||
* 2.0 and the Server Side Public License, v 1; you may not use this file except | ||
* in compliance with, at your election, the Elastic License 2.0 or the Server | ||
* Side Public License, v 1. | ||
*/ | ||
|
||
import { left } from 'fp-ts/lib/Either'; | ||
import { pipe } from 'fp-ts/lib/pipeable'; | ||
import { exactCheck, foldLeftRight, getPaths } from '@kbn/securitysolution-io-ts-utils'; | ||
|
||
import { importExceptionListItemSchema, ImportExceptionListItemSchema } from '.'; | ||
import { | ||
getImportExceptionsListItemSchemaDecodedMock, | ||
getImportExceptionsListItemSchemaMock, | ||
} from './index.mock'; | ||
|
||
describe('import_list_item_schema', () => { | ||
test('it should validate a typical item request', () => { | ||
const payload = getImportExceptionsListItemSchemaMock(); | ||
const decoded = importExceptionListItemSchema.decode(payload); | ||
const checked = exactCheck(payload, decoded); | ||
const message = pipe(checked, foldLeftRight); | ||
|
||
expect(getPaths(left(message.errors))).toEqual([]); | ||
expect(message.schema).toEqual(getImportExceptionsListItemSchemaDecodedMock()); | ||
}); | ||
|
||
test('it should NOT accept an undefined for "item_id"', () => { | ||
const payload: Partial<ReturnType<typeof getImportExceptionsListItemSchemaMock>> = | ||
getImportExceptionsListItemSchemaMock(); | ||
delete payload.item_id; | ||
const decoded = importExceptionListItemSchema.decode(payload); | ||
const checked = exactCheck(payload, decoded); | ||
const message = pipe(checked, foldLeftRight); | ||
expect(getPaths(left(message.errors))).toEqual([ | ||
'Invalid value "undefined" supplied to "item_id"', | ||
]); | ||
expect(message.schema).toEqual({}); | ||
}); | ||
|
||
test('it should NOT accept an undefined for "list_id"', () => { | ||
const payload: Partial<ReturnType<typeof getImportExceptionsListItemSchemaMock>> = | ||
getImportExceptionsListItemSchemaMock(); | ||
delete payload.list_id; | ||
const decoded = importExceptionListItemSchema.decode(payload); | ||
const checked = exactCheck(payload, decoded); | ||
const message = pipe(checked, foldLeftRight); | ||
expect(getPaths(left(message.errors))).toEqual([ | ||
'Invalid value "undefined" supplied to "list_id"', | ||
]); | ||
expect(message.schema).toEqual({}); | ||
}); | ||
|
||
test('it should NOT accept an undefined for "description"', () => { | ||
const payload: Partial<ReturnType<typeof getImportExceptionsListItemSchemaMock>> = | ||
getImportExceptionsListItemSchemaMock(); | ||
delete payload.description; | ||
const decoded = importExceptionListItemSchema.decode(payload); | ||
const checked = exactCheck(payload, decoded); | ||
const message = pipe(checked, foldLeftRight); | ||
expect(getPaths(left(message.errors))).toEqual([ | ||
'Invalid value "undefined" supplied to "description"', | ||
]); | ||
expect(message.schema).toEqual({}); | ||
}); | ||
|
||
test('it should NOT accept an undefined for "name"', () => { | ||
const payload: Partial<ReturnType<typeof getImportExceptionsListItemSchemaMock>> = | ||
getImportExceptionsListItemSchemaMock(); | ||
delete payload.name; | ||
const decoded = importExceptionListItemSchema.decode(payload); | ||
const checked = exactCheck(payload, decoded); | ||
const message = pipe(checked, foldLeftRight); | ||
expect(getPaths(left(message.errors))).toEqual([ | ||
'Invalid value "undefined" supplied to "name"', | ||
]); | ||
expect(message.schema).toEqual({}); | ||
}); | ||
|
||
test('it should NOT accept an undefined for "type"', () => { | ||
const payload: Partial<ReturnType<typeof getImportExceptionsListItemSchemaMock>> = | ||
getImportExceptionsListItemSchemaMock(); | ||
delete payload.type; | ||
const decoded = importExceptionListItemSchema.decode(payload); | ||
const checked = exactCheck(payload, decoded); | ||
const message = pipe(checked, foldLeftRight); | ||
expect(getPaths(left(message.errors))).toEqual([ | ||
'Invalid value "undefined" supplied to "type"', | ||
]); | ||
expect(message.schema).toEqual({}); | ||
}); | ||
|
||
test('it should NOT accept an undefined for "entries"', () => { | ||
const payload: Partial<ReturnType<typeof getImportExceptionsListItemSchemaMock>> = | ||
getImportExceptionsListItemSchemaMock(); | ||
delete payload.entries; | ||
const decoded = importExceptionListItemSchema.decode(payload); | ||
const checked = exactCheck(payload, decoded); | ||
const message = pipe(checked, foldLeftRight); | ||
expect(getPaths(left(message.errors))).toEqual([ | ||
'Invalid value "undefined" supplied to "entries"', | ||
]); | ||
expect(message.schema).toEqual({}); | ||
}); | ||
|
||
test('it should accept any partial fields', () => { | ||
const payload: ImportExceptionListItemSchema = { | ||
...getImportExceptionsListItemSchemaMock(), | ||
id: '123', | ||
namespace_type: 'single', | ||
comments: [], | ||
os_types: [], | ||
tags: ['123'], | ||
created_at: '2018-08-24T17:49:30.145142000', | ||
created_by: 'elastic', | ||
updated_at: '2018-08-24T17:49:30.145142000', | ||
updated_by: 'elastic', | ||
tie_breaker_id: '123', | ||
_version: '3', | ||
meta: undefined, | ||
}; | ||
|
||
const decoded = importExceptionListItemSchema.decode(payload); | ||
const checked = exactCheck(payload, decoded); | ||
const message = pipe(checked, foldLeftRight); | ||
expect(getPaths(left(message.errors))).toEqual([]); | ||
expect(message.schema).toEqual(payload); | ||
}); | ||
|
||
test('it should not allow an extra key to be sent in', () => { | ||
const payload: ImportExceptionListItemSchema & { | ||
extraKey?: string; | ||
} = getImportExceptionsListItemSchemaMock(); | ||
payload.extraKey = 'some new value'; | ||
const decoded = importExceptionListItemSchema.decode(payload); | ||
const checked = exactCheck(payload, decoded); | ||
const message = pipe(checked, foldLeftRight); | ||
expect(getPaths(left(message.errors))).toEqual(['invalid keys "extraKey"']); | ||
expect(message.schema).toEqual({}); | ||
}); | ||
}); |
87 changes: 87 additions & 0 deletions
87
...s/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,87 @@ | ||
/* | ||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
* or more contributor license agreements. Licensed under the Elastic License | ||
* 2.0 and the Server Side Public License, v 1; you may not use this file except | ||
* in compliance with, at your election, the Elastic License 2.0 or the Server | ||
* Side Public License, v 1. | ||
*/ | ||
|
||
import * as t from 'io-ts'; | ||
|
||
import { OsTypeArray, osTypeArrayOrUndefined } from '../../common/os_type'; | ||
import { Tags } from '../../common/tags'; | ||
import { NamespaceType } from '../../common/default_namespace'; | ||
import { name } from '../../common/name'; | ||
import { description } from '../../common/description'; | ||
import { namespace_type } from '../../common/namespace_type'; | ||
import { tags } from '../../common/tags'; | ||
import { meta } from '../../common/meta'; | ||
import { list_id } from '../../common/list_id'; | ||
import { item_id } from '../../common/item_id'; | ||
import { id } from '../../common/id'; | ||
import { created_at } from '../../common/created_at'; | ||
import { created_by } from '../../common/created_by'; | ||
import { updated_at } from '../../common/updated_at'; | ||
import { updated_by } from '../../common/updated_by'; | ||
import { _version } from '../../common/underscore_version'; | ||
import { tie_breaker_id } from '../../common/tie_breaker_id'; | ||
import { nonEmptyEntriesArray } from '../../common/non_empty_entries_array'; | ||
import { exceptionListItemType } from '../../common/exception_list_item_type'; | ||
import { ItemId } from '../../common/item_id'; | ||
import { EntriesArray } from '../../common/entries'; | ||
import { CreateCommentsArray } from '../../common/create_comment'; | ||
import { DefaultCreateCommentsArray } from '../../common/default_create_comments_array'; | ||
|
||
/** | ||
* Differences from this and the createExceptionsListItemSchema are | ||
* - item_id is required | ||
* - id is optional (but ignored in the import code - item_id is exclusively used for imports) | ||
* - immutable is optional but if it is any value other than false it will be rejected | ||
* - created_at is optional (but ignored in the import code) | ||
* - updated_at is optional (but ignored in the import code) | ||
* - created_by is optional (but ignored in the import code) | ||
* - updated_by is optional (but ignored in the import code) | ||
*/ | ||
export const importExceptionListItemSchema = t.intersection([ | ||
t.exact( | ||
t.type({ | ||
description, | ||
entries: nonEmptyEntriesArray, | ||
item_id, | ||
list_id, | ||
name, | ||
type: exceptionListItemType, | ||
}) | ||
), | ||
t.exact( | ||
t.partial({ | ||
id, // defaults to undefined if not set during decode | ||
comments: DefaultCreateCommentsArray, // defaults to empty array if not set during decode | ||
created_at, // defaults undefined if not set during decode | ||
updated_at, // defaults undefined if not set during decode | ||
created_by, // defaults undefined if not set during decode | ||
updated_by, // defaults undefined if not set during decode | ||
_version, // defaults to undefined if not set during decode | ||
tie_breaker_id, | ||
meta, // defaults to undefined if not set during decode | ||
namespace_type, // defaults to 'single' if not set during decode | ||
os_types: osTypeArrayOrUndefined, // defaults to empty array if not set during decode | ||
tags, // defaults to empty array if not set during decode | ||
}) | ||
), | ||
]); | ||
|
||
export type ImportExceptionListItemSchema = t.OutputOf<typeof importExceptionListItemSchema>; | ||
|
||
// This type is used after a decode since some things are defaults after a decode. | ||
export type ImportExceptionListItemSchemaDecoded = Omit< | ||
ImportExceptionListItemSchema, | ||
'tags' | 'item_id' | 'entries' | 'namespace_type' | 'comments' | ||
> & { | ||
comments: CreateCommentsArray; | ||
tags: Tags; | ||
item_id: ItemId; | ||
entries: EntriesArray; | ||
namespace_type: NamespaceType; | ||
os_types: OsTypeArray; | ||
}; |
30 changes: 30 additions & 0 deletions
30
...-securitysolution-io-ts-list-types/src/request/import_exception_list_schema/index.mock.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,30 @@ | ||
/* | ||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
* or more contributor license agreements. Licensed under the Elastic License | ||
* 2.0 and the Server Side Public License, v 1; you may not use this file except | ||
* in compliance with, at your election, the Elastic License 2.0 or the Server | ||
* Side Public License, v 1. | ||
*/ | ||
|
||
import { ImportExceptionListSchemaDecoded, ImportExceptionsListSchema } from '.'; | ||
|
||
export const getImportExceptionsListSchemaMock = ( | ||
listId = 'detection_list_id' | ||
): ImportExceptionsListSchema => ({ | ||
description: 'some description', | ||
list_id: listId, | ||
name: 'Query with a rule id', | ||
type: 'detection', | ||
}); | ||
|
||
export const getImportExceptionsListSchemaDecodedMock = ( | ||
listId = 'detection_list_id' | ||
): ImportExceptionListSchemaDecoded => ({ | ||
...getImportExceptionsListSchemaMock(listId), | ||
immutable: false, | ||
meta: undefined, | ||
namespace_type: 'single', | ||
os_types: [], | ||
tags: [], | ||
version: 1, | ||
}); |
Oops, something went wrong.