Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[7.x] [SIEM][Detection Engine] Adds signal to ECS event.kind and fixes status in signals (#51772) #51786

Merged
merged 1 commit into from
Nov 27, 2019

Conversation

FrankHassanabad
Copy link
Contributor

Backports the following commits to 7.x:

…us in signals (elastic#51772)

## Summary

* Adds signal to the ECS event.kind when it copies over a signal
* Creates a `original_event` if needed within signal so additional look ups don't have to happen
* Fixes a bug with `signal.status` where it was not plumbed correctly
* Adds extra unit tests around the filter
* Adds missing unit tests around utils I didn't add before
* Fixes a typing issue with output of a signal

Example signal output:

Original event turns into this:
```ts
  "event" : {
    "dataset" : "socket",
    "kind" : "signal",
    "action" : "existing_socket",
    "id" : "ffec6797-b92f-4436-bb40-69bac2c21874",
    "module" : "system"
  },
```

Signal amplification turns into this where it contains original_event looks like this:

```ts
  "signal" : {
    "parent" : {
      "id" : "xNRlqW4BHe9nqdOi2358",
      "type" : "event",
      "index" : "auditbeat",
      "depth" : 1
    },
    "original_time" : "2019-11-26T20:27:11.169Z",
    "status" : "open",
    "rule" : {
      "id" : "643fbd2f-a3c9-449e-ba95-e3d89000a72a",
      "rule_id" : "rule-1",
      "false_positives" : [ ],
      "max_signals" : 100,
      "risk_score" : 1,
      "description" : "Detecting root and admin users",
      "from" : "now-6m",
      "immutable" : false,
      "interval" : "5m",
      "language" : "kuery",
      "name" : "Detect Root/Admin Users",
      "query" : "user.name: root or user.name: admin",
      "references" : [
        "http://www.example.com",
        "https://ww.example.com"
      ],
      "severity" : "high",
      "tags" : [ ],
      "type" : "query",
      "to" : "now",
      "enabled" : true,
      "created_by" : "elastic_some_user",
      "updated_by" : "elastic_some_user"
    },
    "original_event" : {
      "dataset" : "socket",
      "kind" : "state",
      "action" : "existing_socket",
      "id" : "ffec6797-b92f-4436-bb40-69bac2c21874",
      "module" : "system"
    }
  }
```
### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

~~- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~~

~~- [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~~

~~- [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~~

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios

~~- [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~~

### For maintainers

~~- [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~

- [x] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)
@elasticmachine
Copy link
Contributor

💚 Build Succeeded

@FrankHassanabad FrankHassanabad merged commit c3727c5 into elastic:7.x Nov 27, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants