Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] [Cases] Swimlane Connector for Cases #100086

Merged
merged 119 commits into from
Jun 23, 2021
Merged

[Security Solution] [Cases] Swimlane Connector for Cases #100086

merged 119 commits into from
Jun 23, 2021

Conversation

stephmilovic
Copy link
Contributor

@stephmilovic stephmilovic commented May 13, 2021 •
edited by cnasikas
Loading

Summary

Adapted from an unmerged PR: #95109
Depends on: #101145

Two parter:

  1. New action connector, type of .swimlane
  2. Add .swimlane as a case connector type

Schema

params

Property Description Type
subAction The subaction to perform. It can be pushToService. string
subActionParams The parameters of the subaction. object

subActionParams (pushToService)

Property Description Type
incident The Swimlane incident. object
comments The comments of the case. A comment is of the form { commentId: string, version: string, comment: string }. object[] (optional)

The following table describes the properties of the incident object.

Property Description Type
alertId The alert id. string (optional)
ruleName The rule name. string (optional)
caseId The case id of the incident. string (optional)
caseName The case name of the incident. string (optional)
description The description of the incident. string (optional)
severity The severity of the incident. string (optional)

Cases

  • 'cases-connector-mappings' are saved to map to caseName for title, description for description and comments for comments
  • Actual field mappings are done at runtime by referencing the action config id values for caseName, description, and comments

Screenshots

List of connectors

Screenshot 2021-06-22 at 8 32 03 PM

Create connector: Instance configuration

Screenshot 2021-06-22 at 8 32 20 PM

Create connector: Mapping configuration

Screenshot 2021-06-22 at 8 32 48 PM

Create connector: Type Alerts

Screenshot 2021-06-22 at 8 33 13 PM

Create connector: Type Cases

Screenshot 2021-06-22 at 8 33 25 PM

Create alert

Screenshot 2021-06-22 at 8 34 50 PM

Error message on cases

Screenshot 2021-06-22 at 8 35 52 PM

Warning message on alerts

Screenshot 2021-06-22 at 8 36 12 PM

Checklist

Delete any items that are not applicable to this PR.

@stephmilovic stephmilovic added v8.0.0 Feature:Actions Team:Threat Hunting Security Solution Threat Hunting Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Feature:Cases Cases feature v7.14.0 labels May 13, 2021
@cnasikas
Copy link
Member

@elasticmachine merge upstream

@cnasikas
Copy link
Member

@elasticmachine merge upstream

pmuellr
pmuellr approved these changes Jun 21, 2021
View reviewed changes
Copy link
Member

@pmuellr pmuellr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - I made a few comments for things that looked like they weren't quite finished, or provide more diagnostic data, and a note about the DX on the SwimlaneMappingConfig type

x-pack/plugins/actions/server/builtin_action_types/swimlane/service.ts Outdated Show resolved Hide resolved
x-pack/plugins/cases/server/client/cases/utils.ts Outdated Show resolved Hide resolved
.../alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/swimlane.ts Show resolved Hide resolved
x-pack/plugins/cases/public/components/connectors/swimlane/validator.ts Outdated Show resolved Hide resolved
...ins/triggers_actions_ui/public/application/components/builtin_action_types/swimlane/types.ts Outdated Show resolved Hide resolved
jonathan-buttner
jonathan-buttner approved these changes Jun 22, 2021
View reviewed changes
Copy link
Contributor

@jonathan-buttner jonathan-buttner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work Christos, Steph, and Xavier! I noticed when testing a swimlane connector configured for alerts that it sends over {{rule.name}} and {{alert.id}} (testing through the creation page UI)

image

The actual values get populated though when a rule runs though:

image

Mostly just nit comments, and a few questions.

x-pack/plugins/actions/README.md Outdated Show resolved Hide resolved
x-pack/plugins/actions/server/builtin_action_types/swimlane/helpers.ts

if (value) {
switch (fieldType) {
case 'numeric': {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I might have missed them but should we add some tests for this case?

x-pack/plugins/actions/server/builtin_action_types/swimlane/index.ts Outdated Show resolved Hide resolved
x-pack/plugins/actions/server/builtin_action_types/swimlane/service.test.ts Outdated Show resolved Hide resolved
x-pack/plugins/cases/public/components/connectors/swimlane/validator.ts Outdated Show resolved Hide resolved
x-pack/plugins/cases/public/components/utils.ts
validator: ({ value: connectorId }) => {
const connector = getConnectorById(connectorId as string, connectors);
if (connector != null) {
return validators[connector.actionTypeId]?.(connector);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: we could probably get rid of this if by doing return validators[connector.actionTypeId]?.(connector); and have connectorValidator handle undefined | null as input.

Copy link
Member

@cnasikas cnasikas Jun 23, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think is best to leave the check in a central place. I would like to avoid other developers to wonder what to return if the connector is null. If they return a message it will be a wrong return value.

...ui/public/application/components/builtin_action_types/swimlane/steps/swimlane_connection.tsx Outdated Show resolved Hide resolved
...ui/public/application/components/builtin_action_types/swimlane/steps/swimlane_connection.tsx
fullWidth
helpText={
<EuiLink
href={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/kibana/${docLinks.DOC_LINK_VERSION}/swimlane-action-type.html`}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a note, we need to talk to the docs team to create this right?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I assume it will be created automatically from docs/management/connectors/action-types/swimlane.asciidoc that is included in this PR.

...ons_ui/public/application/components/builtin_action_types/swimlane/steps/swimlane_fields.tsx
[editActionConfig, fieldIdMap, mappings]
);

/**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the comment!

@cnasikas
Copy link
Member

cnasikas commented Jun 23, 2021 •
edited
Loading

I noticed when testing a swimlane connector configured for alerts that it sends over {{rule.name}} and {{alert.id}} (testing through the creation page UI)

Hey @jonathan-buttner! This is the expected behaviour. When you test a connector there is no alert created so that's why you get the mustache variables instead of real values.

@cnasikas
Copy link
Member

@elasticmachine merge upstream

@kibanamachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
cases 255 261 +6
triggersActionsUi 372 385 +13
total +19

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
cases 507.8KB 516.9KB +9.1KB
triggersActionsUi 1.7MB 1.7MB +47.0KB
total +56.1KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
cases 126.8KB 129.1KB +2.3KB
securitySolution 197.7KB 197.7KB +12.0B
triggersActionsUi 71.3KB 87.5KB +16.2KB
total +18.5KB
Unknown metric groups

async chunk count

id before after diff
cases 14 15 +1
triggersActionsUi 60 64 +4
total +5

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@cnasikas cnasikas merged commit 2dc1715 into elastic:master Jun 23, 2021
@cnasikas cnasikas deleted the field_mapping_connector branch June 23, 2021 19:14
@cnasikas cnasikas mentioned this pull request Jun 23, 2021
Merged
cnasikas added a commit that referenced this pull request Jun 23, 2021
@cnasikas @stephmilovic
@joshswimlane @XavierM @jonathan-buttner @kibanamachine
[Security Solution] [Cases] Swimlane Connector for Cases (#100086) (#…
c6e6462 
…103165)

Co-authored-by: Josh <[email protected]>
Co-authored-by: Xavier Mouligneau <[email protected]>
Co-authored-by: Christos Nasikas <[email protected]>
Co-authored-by: Jonathan Buttner <[email protected]>
Co-authored-by: Kibana Machine <[email protected]>

Co-authored-by: Steph Milovic <[email protected]>
Co-authored-by: Josh <[email protected]>
Co-authored-by: Xavier Mouligneau <[email protected]>
Co-authored-by: Jonathan Buttner <[email protected]>
Co-authored-by: Kibana Machine <[email protected]>
@stephmilovic
Copy link
Contributor Author

yayyyy!!!

@cnasikas cnasikas mentioned this pull request Jul 27, 2021
Open
@gmmorris gmmorris mentioned this pull request Dec 1, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@YulNaumenko YulNaumenko YulNaumenko left review comments

@cnasikas cnasikas cnasikas left review comments

@XavierM XavierM XavierM left review comments

@pmuellr pmuellr pmuellr approved these changes

@jonathan-buttner jonathan-buttner jonathan-buttner approved these changes

@afharo afharo afharo approved these changes

@pgayvallet pgayvallet pgayvallet approved these changes

Assignees
No one assigned
Labels
Feature:Actions Feature:Cases Cases feature release_note:enhancement Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting Security Solution Threat Hunting Team v7.14.0 v8.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.