Skip to content

Commit

Permalink
[Security Solution][Platform] - Exceptions imports (#118816)
Browse files Browse the repository at this point in the history
## Summary

Addresses #92613 and #117399

Goal is to allow users to import their exception lists and items alongside their rules. This PR does not complete all the UI updates needed, but does tackle the majority of use cases. The bulk of the changes occur in `import_rules_route` and the new `import_exceptions_route`.

- Adds exceptions import endpoint in `lists` plugin
- Adds exceptions import logic in import rules route in `security_solution` plugin
- Adds integration tests for exception import endpoint
- Adds integration tests for rules import endpoint to account for new functionality
- Purposely not yet adding an import modal in the exceptions table UI until further list management features added (checked with product on this front)
  • Loading branch information
yctercero authored Dec 8, 2021
1 parent 0a2b96b commit fccdcb6
Show file tree
Hide file tree
Showing 77 changed files with 6,499 additions and 394 deletions.
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0 and the Server Side Public License, v 1; you may not use this file except
* in compliance with, at your election, the Elastic License 2.0 or the Server
* Side Public License, v 1.
*/

import { ENTRIES } from '../../constants/index.mock';
import { ImportExceptionListItemSchema, ImportExceptionListItemSchemaDecoded } from '.';

export const getImportExceptionsListItemSchemaMock = (
itemId = 'item_id_1',
listId = 'detection_list_id'
): ImportExceptionListItemSchema => ({
description: 'some description',
entries: ENTRIES,
item_id: itemId,
list_id: listId,
name: 'Query with a rule id',
type: 'simple',
});

export const getImportExceptionsListItemSchemaDecodedMock = (
itemId = 'item_id_1',
listId = 'detection_list_id'
): ImportExceptionListItemSchemaDecoded => ({
...getImportExceptionsListItemSchemaMock(itemId, listId),
comments: [],
meta: undefined,
namespace_type: 'single',
os_types: [],
tags: [],
});
Original file line number Diff line number Diff line change
@@ -0,0 +1,143 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0 and the Server Side Public License, v 1; you may not use this file except
* in compliance with, at your election, the Elastic License 2.0 or the Server
* Side Public License, v 1.
*/

import { left } from 'fp-ts/lib/Either';
import { pipe } from 'fp-ts/lib/pipeable';
import { exactCheck, foldLeftRight, getPaths } from '@kbn/securitysolution-io-ts-utils';

import { importExceptionListItemSchema, ImportExceptionListItemSchema } from '.';
import {
getImportExceptionsListItemSchemaDecodedMock,
getImportExceptionsListItemSchemaMock,
} from './index.mock';

describe('import_list_item_schema', () => {
test('it should validate a typical item request', () => {
const payload = getImportExceptionsListItemSchemaMock();
const decoded = importExceptionListItemSchema.decode(payload);
const checked = exactCheck(payload, decoded);
const message = pipe(checked, foldLeftRight);

expect(getPaths(left(message.errors))).toEqual([]);
expect(message.schema).toEqual(getImportExceptionsListItemSchemaDecodedMock());
});

test('it should NOT accept an undefined for "item_id"', () => {
const payload: Partial<ReturnType<typeof getImportExceptionsListItemSchemaMock>> =
getImportExceptionsListItemSchemaMock();
delete payload.item_id;
const decoded = importExceptionListItemSchema.decode(payload);
const checked = exactCheck(payload, decoded);
const message = pipe(checked, foldLeftRight);
expect(getPaths(left(message.errors))).toEqual([
'Invalid value "undefined" supplied to "item_id"',
]);
expect(message.schema).toEqual({});
});

test('it should NOT accept an undefined for "list_id"', () => {
const payload: Partial<ReturnType<typeof getImportExceptionsListItemSchemaMock>> =
getImportExceptionsListItemSchemaMock();
delete payload.list_id;
const decoded = importExceptionListItemSchema.decode(payload);
const checked = exactCheck(payload, decoded);
const message = pipe(checked, foldLeftRight);
expect(getPaths(left(message.errors))).toEqual([
'Invalid value "undefined" supplied to "list_id"',
]);
expect(message.schema).toEqual({});
});

test('it should NOT accept an undefined for "description"', () => {
const payload: Partial<ReturnType<typeof getImportExceptionsListItemSchemaMock>> =
getImportExceptionsListItemSchemaMock();
delete payload.description;
const decoded = importExceptionListItemSchema.decode(payload);
const checked = exactCheck(payload, decoded);
const message = pipe(checked, foldLeftRight);
expect(getPaths(left(message.errors))).toEqual([
'Invalid value "undefined" supplied to "description"',
]);
expect(message.schema).toEqual({});
});

test('it should NOT accept an undefined for "name"', () => {
const payload: Partial<ReturnType<typeof getImportExceptionsListItemSchemaMock>> =
getImportExceptionsListItemSchemaMock();
delete payload.name;
const decoded = importExceptionListItemSchema.decode(payload);
const checked = exactCheck(payload, decoded);
const message = pipe(checked, foldLeftRight);
expect(getPaths(left(message.errors))).toEqual([
'Invalid value "undefined" supplied to "name"',
]);
expect(message.schema).toEqual({});
});

test('it should NOT accept an undefined for "type"', () => {
const payload: Partial<ReturnType<typeof getImportExceptionsListItemSchemaMock>> =
getImportExceptionsListItemSchemaMock();
delete payload.type;
const decoded = importExceptionListItemSchema.decode(payload);
const checked = exactCheck(payload, decoded);
const message = pipe(checked, foldLeftRight);
expect(getPaths(left(message.errors))).toEqual([
'Invalid value "undefined" supplied to "type"',
]);
expect(message.schema).toEqual({});
});

test('it should NOT accept an undefined for "entries"', () => {
const payload: Partial<ReturnType<typeof getImportExceptionsListItemSchemaMock>> =
getImportExceptionsListItemSchemaMock();
delete payload.entries;
const decoded = importExceptionListItemSchema.decode(payload);
const checked = exactCheck(payload, decoded);
const message = pipe(checked, foldLeftRight);
expect(getPaths(left(message.errors))).toEqual([
'Invalid value "undefined" supplied to "entries"',
]);
expect(message.schema).toEqual({});
});

test('it should accept any partial fields', () => {
const payload: ImportExceptionListItemSchema = {
...getImportExceptionsListItemSchemaMock(),
id: '123',
namespace_type: 'single',
comments: [],
os_types: [],
tags: ['123'],
created_at: '2018-08-24T17:49:30.145142000',
created_by: 'elastic',
updated_at: '2018-08-24T17:49:30.145142000',
updated_by: 'elastic',
tie_breaker_id: '123',
_version: '3',
meta: undefined,
};

const decoded = importExceptionListItemSchema.decode(payload);
const checked = exactCheck(payload, decoded);
const message = pipe(checked, foldLeftRight);
expect(getPaths(left(message.errors))).toEqual([]);
expect(message.schema).toEqual(payload);
});

test('it should not allow an extra key to be sent in', () => {
const payload: ImportExceptionListItemSchema & {
extraKey?: string;
} = getImportExceptionsListItemSchemaMock();
payload.extraKey = 'some new value';
const decoded = importExceptionListItemSchema.decode(payload);
const checked = exactCheck(payload, decoded);
const message = pipe(checked, foldLeftRight);
expect(getPaths(left(message.errors))).toEqual(['invalid keys "extraKey"']);
expect(message.schema).toEqual({});
});
});
Original file line number Diff line number Diff line change
@@ -0,0 +1,87 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0 and the Server Side Public License, v 1; you may not use this file except
* in compliance with, at your election, the Elastic License 2.0 or the Server
* Side Public License, v 1.
*/

import * as t from 'io-ts';

import { OsTypeArray, osTypeArrayOrUndefined } from '../../common/os_type';
import { Tags } from '../../common/tags';
import { NamespaceType } from '../../common/default_namespace';
import { name } from '../../common/name';
import { description } from '../../common/description';
import { namespace_type } from '../../common/namespace_type';
import { tags } from '../../common/tags';
import { meta } from '../../common/meta';
import { list_id } from '../../common/list_id';
import { item_id } from '../../common/item_id';
import { id } from '../../common/id';
import { created_at } from '../../common/created_at';
import { created_by } from '../../common/created_by';
import { updated_at } from '../../common/updated_at';
import { updated_by } from '../../common/updated_by';
import { _version } from '../../common/underscore_version';
import { tie_breaker_id } from '../../common/tie_breaker_id';
import { nonEmptyEntriesArray } from '../../common/non_empty_entries_array';
import { exceptionListItemType } from '../../common/exception_list_item_type';
import { ItemId } from '../../common/item_id';
import { EntriesArray } from '../../common/entries';
import { CreateCommentsArray } from '../../common/create_comment';
import { DefaultCreateCommentsArray } from '../../common/default_create_comments_array';

/**
* Differences from this and the createExceptionsListItemSchema are
* - item_id is required
* - id is optional (but ignored in the import code - item_id is exclusively used for imports)
* - immutable is optional but if it is any value other than false it will be rejected
* - created_at is optional (but ignored in the import code)
* - updated_at is optional (but ignored in the import code)
* - created_by is optional (but ignored in the import code)
* - updated_by is optional (but ignored in the import code)
*/
export const importExceptionListItemSchema = t.intersection([
t.exact(
t.type({
description,
entries: nonEmptyEntriesArray,
item_id,
list_id,
name,
type: exceptionListItemType,
})
),
t.exact(
t.partial({
id, // defaults to undefined if not set during decode
comments: DefaultCreateCommentsArray, // defaults to empty array if not set during decode
created_at, // defaults undefined if not set during decode
updated_at, // defaults undefined if not set during decode
created_by, // defaults undefined if not set during decode
updated_by, // defaults undefined if not set during decode
_version, // defaults to undefined if not set during decode
tie_breaker_id,
meta, // defaults to undefined if not set during decode
namespace_type, // defaults to 'single' if not set during decode
os_types: osTypeArrayOrUndefined, // defaults to empty array if not set during decode
tags, // defaults to empty array if not set during decode
})
),
]);

export type ImportExceptionListItemSchema = t.OutputOf<typeof importExceptionListItemSchema>;

// This type is used after a decode since some things are defaults after a decode.
export type ImportExceptionListItemSchemaDecoded = Omit<
ImportExceptionListItemSchema,
'tags' | 'item_id' | 'entries' | 'namespace_type' | 'comments'
> & {
comments: CreateCommentsArray;
tags: Tags;
item_id: ItemId;
entries: EntriesArray;
namespace_type: NamespaceType;
os_types: OsTypeArray;
};
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0 and the Server Side Public License, v 1; you may not use this file except
* in compliance with, at your election, the Elastic License 2.0 or the Server
* Side Public License, v 1.
*/

import { ImportExceptionListSchemaDecoded, ImportExceptionsListSchema } from '.';

export const getImportExceptionsListSchemaMock = (
listId = 'detection_list_id'
): ImportExceptionsListSchema => ({
description: 'some description',
list_id: listId,
name: 'Query with a rule id',
type: 'detection',
});

export const getImportExceptionsListSchemaDecodedMock = (
listId = 'detection_list_id'
): ImportExceptionListSchemaDecoded => ({
...getImportExceptionsListSchemaMock(listId),
immutable: false,
meta: undefined,
namespace_type: 'single',
os_types: [],
tags: [],
version: 1,
});
Loading

0 comments on commit fccdcb6

Please sign in to comment.