Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Remove extra rule fields from kibana.alert.rule #121135

Merged
merged 7 commits into from
Dec 17, 2021
Merged

[Security Solution] Remove extra rule fields from kibana.alert.rule #121135

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
93d60fb
Remove kibana.alert.rule.risk_score and severity
marshallmain Dec 13, 2021
185be2c
Fix tests related to risk_score and severity
marshallmain Dec 14, 2021
e3effd3
Make translation a template
marshallmain Dec 14, 2021
c929144
Can't use expression in template literal
marshallmain Dec 14, 2021
5cfd00f
Remove commented line added by bad merge
marshallmain Dec 14, 2021
ca2d093
Fix linting
marshallmain Dec 14, 2021
bdd0b14
Merge branch 'main' into remove-extra-rule-fields
kibanamachine Dec 16, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 0 additions & 12 deletions packages/kbn-rule-data-utils/src/technical_field_names.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,12 +55,8 @@ const ALERT_RULE_NAME = `${ALERT_RULE_NAMESPACE}.name` as const;
const ALERT_RULE_NOTE = `${ALERT_RULE_NAMESPACE}.note` as const;
const ALERT_RULE_PARAMETERS = `${ALERT_RULE_NAMESPACE}.parameters` as const;
const ALERT_RULE_REFERENCES = `${ALERT_RULE_NAMESPACE}.references` as const;
const ALERT_RULE_RISK_SCORE = `${ALERT_RULE_NAMESPACE}.risk_score` as const;
const ALERT_RULE_RISK_SCORE_MAPPING = `${ALERT_RULE_NAMESPACE}.risk_score_mapping` as const;
const ALERT_RULE_RULE_ID = `${ALERT_RULE_NAMESPACE}.rule_id` as const;
const ALERT_RULE_RULE_NAME_OVERRIDE = `${ALERT_RULE_NAMESPACE}.rule_name_override` as const;
const ALERT_RULE_SEVERITY = `${ALERT_RULE_NAMESPACE}.severity` as const;
const ALERT_RULE_SEVERITY_MAPPING = `${ALERT_RULE_NAMESPACE}.severity_mapping` as const;
const ALERT_RULE_TAGS = `${ALERT_RULE_NAMESPACE}.tags` as const;
const ALERT_RULE_TO = `${ALERT_RULE_NAMESPACE}.to` as const;
const ALERT_RULE_TYPE = `${ALERT_RULE_NAMESPACE}.type` as const;
Expand Down Expand Up @@ -114,12 +110,8 @@ const fields = {
ALERT_RULE_NOTE,
ALERT_RULE_PARAMETERS,
ALERT_RULE_REFERENCES,
ALERT_RULE_RISK_SCORE,
ALERT_RULE_RISK_SCORE_MAPPING,
ALERT_RULE_RULE_ID,
ALERT_RULE_RULE_NAME_OVERRIDE,
ALERT_RULE_SEVERITY,
ALERT_RULE_SEVERITY_MAPPING,
ALERT_RULE_TAGS,
ALERT_RULE_TO,
ALERT_RULE_TYPE,
Expand Down Expand Up @@ -171,19 +163,15 @@ export {
ALERT_RULE_NOTE,
ALERT_RULE_PARAMETERS,
ALERT_RULE_REFERENCES,
ALERT_RULE_RISK_SCORE,
ALERT_RULE_RISK_SCORE_MAPPING,
ALERT_RULE_RULE_ID,
ALERT_RULE_RULE_NAME_OVERRIDE,
ALERT_RULE_SEVERITY_MAPPING,
ALERT_RULE_TAGS,
ALERT_RULE_TO,
ALERT_RULE_TYPE,
ALERT_RULE_TYPE_ID,
ALERT_RULE_UPDATED_AT,
ALERT_RULE_UPDATED_BY,
ALERT_RULE_VERSION,
ALERT_RULE_SEVERITY,
ALERT_SEVERITY,
ALERT_START,
ALERT_SYSTEM_STATUS,
Expand Down
55 changes: 0 additions & 55 deletions x-pack/plugins/rule_registry/common/assets/field_maps/technical_rule_field_map.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,16 +40,6 @@ export const technicalRuleFieldMap = {
array: false,
required: false,
},
[Fields.ALERT_RULE_SEVERITY]: {
type: 'keyword',
array: false,
required: false,
},
[Fields.ALERT_RULE_RISK_SCORE]: {
type: 'float',
array: false,
required: false,
},
[Fields.ALERT_RISK_SCORE]: {
type: 'float',
array: false,
Expand Down Expand Up @@ -150,26 +140,6 @@ export const technicalRuleFieldMap = {
array: true,
required: false,
},
[Fields.ALERT_RULE_RISK_SCORE_MAPPING]: {
type: 'object',
array: false,
required: false,
},
[`${Fields.ALERT_RULE_RISK_SCORE_MAPPING}.field`]: {
type: 'keyword',
array: false,
required: false,
},
[`${Fields.ALERT_RULE_RISK_SCORE_MAPPING}.operator`]: {
type: 'keyword',
array: false,
required: false,
},
[`${Fields.ALERT_RULE_RISK_SCORE_MAPPING}.value`]: {
type: 'keyword',
array: false,
required: false,
},
[Fields.ALERT_RULE_RULE_ID]: {
type: 'keyword',
array: false,
Expand All @@ -180,31 +150,6 @@ export const technicalRuleFieldMap = {
array: false,
required: false,
},
[Fields.ALERT_RULE_SEVERITY_MAPPING]: {
type: 'object',
array: false,
required: false,
},
[`${Fields.ALERT_RULE_SEVERITY_MAPPING}.field`]: {
type: 'keyword',
array: false,
required: false,
},
[`${Fields.ALERT_RULE_SEVERITY_MAPPING}.operator`]: {
type: 'keyword',
array: false,
required: false,
},
[`${Fields.ALERT_RULE_SEVERITY_MAPPING}.value`]: {
type: 'keyword',
array: false,
required: false,
},
[`${Fields.ALERT_RULE_SEVERITY_MAPPING}.severity`]: {
type: 'keyword',
array: false,
required: false,
},
[Fields.ALERT_RULE_TAGS]: {
type: 'keyword',
array: true,
Expand Down
2 changes: 1 addition & 1 deletion x-pack/plugins/rule_registry/common/field_map/runtime_type_from_fieldmap.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ const esFieldTypeMap = {
float: t.union([t.number, NumberFromString]),
scaled_float: t.union([t.number, NumberFromString]),
unsigned_long: t.union([t.number, NumberFromString]),
flattened: t.record(t.string, t.array(t.string)),
flattened: t.UnknownRecord,
};

type EsFieldTypeMap = typeof esFieldTypeMap;
Expand Down
4 changes: 2 additions & 2 deletions x-pack/plugins/rule_registry/server/routes/get_alert_by_id.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ import {
ALERT_RULE_CONSUMER,
ALERT_RULE_NAME,
ALERT_RULE_PRODUCER,
ALERT_RULE_RISK_SCORE,
ALERT_RISK_SCORE,
ALERT_RULE_TYPE_ID,
ALERT_RULE_UUID,
ALERT_STATUS,
Expand All @@ -35,7 +35,7 @@ const getMockAlert = (): ParsedTechnicalFields => ({
[ALERT_RULE_CONSUMER]: 'apm',
[ALERT_RULE_NAME]: 'Check error rate',
[ALERT_RULE_PRODUCER]: 'apm',
[ALERT_RULE_RISK_SCORE]: 20,
[ALERT_RISK_SCORE]: 20,
[ALERT_RULE_TYPE_ID]: 'fake-rule-type-id',
[ALERT_RULE_UUID]: 'fake-rule-uuid',
[ALERT_STATUS]: ALERT_STATUS_ACTIVE,
Expand Down
10 changes: 4 additions & 6 deletions ...lugins/security_solution/cypress/integration/detection_rules/indicator_match_rule.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,8 @@ import {

import {
ALERT_RULE_NAME,
ALERT_RULE_RISK_SCORE,
ALERT_RULE_SEVERITY,
ALERT_RISK_SCORE,
ALERT_SEVERITY,
NUMBER_OF_ALERTS,
} from '../../screens/alerts';
import {
Expand Down Expand Up @@ -505,12 +505,10 @@ describe('indicator match', () => {

cy.get(NUMBER_OF_ALERTS).should('have.text', expectedNumberOfAlerts);
cy.get(ALERT_RULE_NAME).first().should('have.text', getNewThreatIndicatorRule().name);
cy.get(ALERT_RULE_SEVERITY)
cy.get(ALERT_SEVERITY)
.first()
.should('have.text', getNewThreatIndicatorRule().severity.toLowerCase());
cy.get(ALERT_RULE_RISK_SCORE)
.first()
.should('have.text', getNewThreatIndicatorRule().riskScore);
cy.get(ALERT_RISK_SCORE).first().should('have.text', getNewThreatIndicatorRule().riskScore);
});

it.skip('Investigate alert in timeline', () => {
Expand Down
2 changes: 1 addition & 1 deletion x-pack/plugins/security_solution/cypress/integration/detection_rules/override.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,7 +139,7 @@ describe('Detection rules, override', () => {
getDetails(RISK_SCORE_DETAILS).should('have.text', this.rule.riskScore);
getDetails(RISK_SCORE_OVERRIDE_DETAILS).should(
'have.text',
`${this.rule.riskOverride}kibana.alert.rule.risk_score`
`${this.rule.riskOverride}kibana.alert.risk_score`
);
getDetails(RULE_NAME_OVERRIDE_DETAILS).should('have.text', this.rule.nameOverride);
getDetails(REFERENCE_URLS_DETAILS).should((details) => {
Expand Down
7 changes: 3 additions & 4 deletions x-pack/plugins/security_solution/cypress/screens/alerts.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,14 +15,13 @@ export const ALERT_CHECKBOX = '[data-test-subj~="select-event"].euiCheckbox__inp
export const ALERT_GRID_CELL = '[data-test-subj="dataGridRowCell"]';

export const ALERT_RISK_SCORE_HEADER =
'[data-test-subj="dataGridHeaderCell-kibana.alert.rule.risk_score"]';
'[data-test-subj="dataGridHeaderCell-kibana.alert.risk_score"]';

export const ALERT_RULE_NAME = '[data-test-subj="formatted-field-kibana.alert.rule.name"]';

export const ALERT_RULE_RISK_SCORE =
'[data-test-subj="formatted-field-kibana.alert.rule.risk_score"]';
export const ALERT_RISK_SCORE = '[data-test-subj="formatted-field-kibana.alert.risk_score"]';

export const ALERT_RULE_SEVERITY = '[data-test-subj="formatted-field-kibana.alert.rule.severity"]';
export const ALERT_SEVERITY = '[data-test-subj="formatted-field-kibana.alert.severity"]';

export const ALERT_DATA_GRID = '[data-test-subj="dataGridWrapper"]';

Expand Down
4 changes: 2 additions & 2 deletions x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,10 +161,10 @@ export const allowTopN = ({
'kibana.alert.rule.output_index',
'kibana.alert.rule.query',
'kibana.alert.rule.references',
'kibana.alert.rule.risk_score',
'kibana.alert.risk_score',
'kibana.alert.rule.rule_id',
'kibana.alert.rule.saved_id',
'kibana.alert.rule.severity',
'kibana.alert.severity',
'kibana.alert.rule.size',
'kibana.alert.rule.tags',
'kibana.alert.rule.threat',
Expand Down
4 changes: 2 additions & 2 deletions x-pack/plugins/security_solution/public/common/components/event_details/__mocks__/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -392,7 +392,7 @@ export const mockAlertDetailsData = [
originalValue: 'http://localhost:5601/app/security',
},
{ category: 'kibana', field: 'kibana.alert.rule.max_signals', values: [100], originalValue: 100 },
{ category: 'kibana', field: 'kibana.alert.rule.risk_score', values: [21], originalValue: 21 },
{ category: 'kibana', field: 'kibana.alert.risk_score', values: [21], originalValue: 21 },
{
category: 'kibana',
field: 'kibana.alert.rule.risk_score_mapping',
Expand Down Expand Up @@ -459,7 +459,7 @@ export const mockAlertDetailsData = [
{ category: 'kibana', field: 'kibana.alert.rule.references', values: [], originalValue: [] },
{
category: 'kibana',
field: 'kibana.alert.rule.severity',
field: 'kibana.alert.severity',
values: ['low'],
originalValue: 'low',
},
Expand Down
32 changes: 16 additions & 16 deletions ...ion/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions ...olution/public/common/components/event_details/overview/__snapshots__/index.test.tsx.snap
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading