Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SIEM][Detections Engine] - Add rule markdown field to rule create, detail, and edit flows #60108

Merged
merged 14 commits into from
Mar 17, 2020
Merged
Changes from 7 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions x-pack/legacy/plugins/siem/cypress/screens/rule_details.ts
Original file line number Diff line number Diff line change
@@ -25,10 +25,10 @@ export const ABOUT_TIMELINE = 3;
export const DEFINITION_CUSTOM_QUERY = 1;

export const DEFINITION_DESCRIPTION =
'[data-test-subj="definition"] .euiDescriptionList__description';
'[data-test-subj="listItemColumnStepRuleDescription"] .euiDescriptionList__description';

export const DEFINITION_INDEX_PATTERNS =
'[data-test-subj="definition"] .euiDescriptionList__description .euiBadge__text';
'[data-test-subj="listItemColumnStepRuleDescription"] .euiDescriptionList__description .euiBadge__text';

export const RULE_NAME_HEADER = '[data-test-subj="header-page-title"]';

Original file line number Diff line number Diff line change
@@ -33,6 +33,7 @@ export const NewRuleSchema = t.intersection([
threat: t.array(t.unknown),
to: t.string,
updated_by: t.string,
note: t.string,
}),
]);

@@ -86,6 +87,7 @@ export const RuleSchema = t.intersection([
status_date: t.string,
timeline_id: t.string,
timeline_title: t.string,
note: t.string,
version: t.number,
}),
]);
Original file line number Diff line number Diff line change
@@ -4,7 +4,40 @@
* you may not use this file except in compliance with the Elastic License.
*/

import { esFilters } from '../../../../../../../../../../src/plugins/data/public';
import { Rule, RuleError } from '../../../../../containers/detection_engine/rules';
import { AboutStepRule, DefineStepRule, ScheduleStepRule } from '../../types';
import { FieldValueQueryBar } from '../../components/query_bar';

export const mockQueryBar: FieldValueQueryBar = {
query: {
query: 'test query',
language: 'kuery',
},
filters: [
{
$state: {
store: esFilters.FilterStateStore.GLOBAL_STATE,
},
meta: {
alias: null,
disabled: false,
key: 'event.category',
negate: false,
params: {
query: 'file',
},
type: 'phrase',
},
query: {
match_phrase: {
'event.category': 'file',
},
},
},
],
saved_id: 'test123',
};

export const mockRule = (id: string): Rule => ({
created_at: '2020-01-10T21:11:45.839Z',
@@ -37,9 +70,129 @@ export const mockRule = (id: string): Rule => ({
to: 'now',
type: 'saved_query',
threat: [],
note: '# this is some markdown documentation',
version: 1,
});

export const mockRuleWithEverything = (id: string): Rule => ({
created_at: '2020-01-10T21:11:45.839Z',
updated_at: '2020-01-10T21:11:45.839Z',
created_by: 'elastic',
description: '24/7',
enabled: true,
false_positives: ['test'],
filters: [
{
$state: {
store: esFilters.FilterStateStore.GLOBAL_STATE,
},
meta: {
alias: null,
disabled: false,
key: 'event.category',
negate: false,
params: {
query: 'file',
},
type: 'phrase',
},
query: {
match_phrase: {
'event.category': 'file',
},
},
},
],
from: 'now-300s',
id,
immutable: false,
index: ['auditbeat-*'],
interval: '5m',
rule_id: 'b5ba41ab-aaf3-4f43-971b-bdf9434ce0ea',
language: 'kuery',
output_index: '.siem-signals-default',
max_signals: 100,
risk_score: 21,
name: 'Query with rule-id',
query: 'user.name: root or user.name: admin',
references: ['www.test.co'],
saved_id: 'test123',
timeline_id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
timeline_title: 'Titled timeline',
meta: { from: '0m' },
severity: 'low',
updated_by: 'elastic',
tags: ['tag1', 'tag2'],
to: 'now',
type: 'saved_query',
threat: [
{
framework: 'mockFramework',
tactic: {
id: '1234',
name: 'tactic1',
reference: 'reference1',
},
technique: [
{
id: '456',
name: 'technique1',
reference: 'technique reference',
},
],
},
],
note: '# this is some markdown documentation',
version: 1,
});

export const mockAboutStepRule = (isNew = false): AboutStepRule => ({
isNew,
name: 'Query with rule-id',
description: '24/7',
severity: 'low',
riskScore: 21,
references: ['www.test.co'],
falsePositives: ['test'],
tags: ['tag1', 'tag2'],
timeline: {
id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
title: 'Titled timeline',
},
threat: [
{
framework: 'mockFramework',
tactic: {
id: '1234',
name: 'tactic1',
reference: 'reference1',
},
technique: [
{
id: '456',
name: 'technique1',
reference: 'technique reference',
},
],
},
],
note: '# this is some markdown documentation',
});

export const mockDefineStepRule = (isNew = false): DefineStepRule => ({
isNew,
index: ['filebeat-'],
queryBar: mockQueryBar,
});

export const mockScheduleStepRule = (isNew = false, enabled = false): ScheduleStepRule => ({
isNew,
enabled,
interval: '5m',
from: '6m',
to: 'now',
});

export const mockRuleError = (id: string): RuleError => ({
rule_id: id,
error: { status_code: 404, message: `id: "${id}" not found` },
Loading