Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Tines action connector #140066

Closed
5 tasks
semd opened this issue Sep 6, 2022 · 1 comment
Closed
5 tasks

[Security Solution] Tines action connector #140066

semd opened this issue Sep 6, 2022 · 1 comment
Assignees
@semd
Labels
8.6 candidate Team:Threat Hunting:Explore Team:Threat Hunting Security Solution Threat Hunting Team

Comments

@semd
Copy link
Contributor

semd commented Sep 6, 2022 •
edited
Loading

Summary

Create a new action connector for Tines.

Description

Implement an out-of-the-box integration that customers can leverage to send alerts from Elastic to Tines. Users can then take actions or run playbooks (Tines calls them stories, example here) based on these alerts.

Tines provides a webhook action, which is the entry point from SIEMs or other applications. Relevant docs here.

It must provide a low friction/low effort approach to augmenting Elastic capabilities with Tines, eliminating the need for deduplication, formatting, and cleaning in the Tines workflow:

tines_actions

Tines pre-configured Elastic (or any custom) story will need to be created by the user in advance, in order to configure the connector parameters in Kibana:

elastic-template-tines

Connector definition

Configuration form:

  • Api url (tenant unique)

Auth:

  • Email
  • Api token

Parameters form:

  • Story dynamic selector
  • Webhook action dynamic selector (filtered by story id)
  • Deduplication fileds
  • Body template (use mustache)

Execution

The connector execution must:

  • Deduplicate the alerts by the fields specified (optional), adding a duplicate count
  • Clean trailing commas, line breaks, or any special character left by the Mustache parser in the values
  • Send data to Tines in plain JSON format

Tasks:

  • Create the Tines server connector, using the new sub_action framework
  • Configuration frontend form
  • Parameters frontend form
  • Execution logic
  • Testing
@semd semd self-assigned this Sep 6, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

@semd semd mentioned this issue Oct 3, 2022
Merged
@semd semd mentioned this issue Oct 18, 2022
Merged
3 tasks
@nastasha-solomon nastasha-solomon mentioned this issue Nov 8, 2022
Closed
semd added a commit that referenced this issue Nov 14, 2022
@semd @kibanamachine @jonathan-buttner
[Security Solution] Tines connector (#143505)
6bba30f 
## Summary

Issue: #140066
Doc:
https://docs.google.com/document/d/14BY-6CIin1CUH5bwJJgfrGl37hWO-CeNMdl_35agpvk/edit?usp=sharing

Create a new connector type that offers low friction/low effort approach
to augmenting Elastic capabilities with SOAR capabilities of Tines.

## Implementation

Tines connector implements subActionConnector. With 4 subActions
configured:

- **stories**: Retrieves the User available Story objects from Tines, to
render the Story selector options in the params form. It uses the
`email` and `token` authentication headers from the configuration.
It is requested only when the form opens and when the connector instance
changes.

- **webhooks**: Retrieves the Story available Webhooks objects from
Tines, to render the Webhook selector in the params form. It uses the
`email` and `token` authentication headers from the configuration and
the `story_id` parameter.
There is no filter for `type` in the actions (a.k.a. agents) endpoint,
so we have to request all actions and filter them by `type ===
'Agents::WebhookAgent'` on our side.
It is requested every time the selected story changes.

- **run**: The main action execution. It sends the alerts to the Tines
configured webhook, using webhook' `path` and `secret` values. There's
no template to render, the data coming from the execution is just pruned
(the `kibana` entry is removed from all `context.alerts`) and sent
directly using the same format to Tines.

- **test**: The test form execution. It ends up calling **run** but
using a parametrized body.

### Pagination
Both **stories** and **webhooks** subActions need pagination, since
Tines do not expose any search endpoint for them. The current hard limit
is 100 pages. The `paginatedRequest` function in the connector
implementation encapsulates this logic.

## Testing

1- Create a [Tines](https://www.tines.com/) free account.

2- Create a [new
Story](https://www.tines.com/docs/quickstart/simple-story) and attach a
[Webhook
Action](https://www.tines.com/docs/quickstart/creating-an-action) to
start receiving events.

3- Create an [API token](https://www.tines.com/api/authentication)

4- Configure the Tines Connector in Kibana using the Tines tenant URL
that has been generated in the Tines app, the email used to sign in, and
the API token generated.
[docs](https://github.com/semd/kibana/blob/140066_tines_connector/docs/management/connectors/action-types/tines.asciidoc#connector-configuration)

5- Attach the Tines Connector to a Detection Rule, selecting the Story
and Webhooks created.
[docs](https://github.com/semd/kibana/blob/140066_tines_connector/docs/management/connectors/action-types/tines.asciidoc#actions)

6- After each rule execution, events should appear in the Tines webhook
action.

## Screenshots

Configure a Tines connector


![tines_connector_selection](https://user-images.githubusercontent.com/17747913/196389019-820aff49-6ad6-442e-a69f-3c782cbd65e6.png)


![tines_connector_config](https://user-images.githubusercontent.com/17747913/198035138-e7f3bb25-ebd1-4cfd-9cc5-b0bfe434c25c.png)

Use the Tines connector 


![tines_rule_action](https://user-images.githubusercontent.com/17747913/196389010-c87045a4-2b74-4903-9a81-ccbcff09fbf1.png)


![tine_params_form](https://user-images.githubusercontent.com/17747913/198034501-7e9ad912-111e-48b6-8387-fcf6f0663511.png)

Tines events


![tines_events](https://user-images.githubusercontent.com/17747913/196734338-91e1a397-2d03-4ee6-8ad2-16cb39abe9bf.png)

### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common
scenarios(https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))

Co-authored-by: kibanamachine <[email protected]>
Co-authored-by: Jonathan Buttner <[email protected]>
@semd semd closed this as completed Dec 16, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@semd semd

Labels
8.6 candidate Team:Threat Hunting:Explore Team:Threat Hunting Security Solution Threat Hunting Team
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@elasticmachine @semd