-
Notifications
You must be signed in to change notification settings - Fork 8.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[SIEM] [Cases] Shell scripts and unit tests #60183
Merged
Merged
Changes from all commits
Commits
Show all changes
31 commits
Select commit
Hold shift + click to select a range
b9dd690
shouldve committed earlier damnit
stephmilovic 354d94b
individual deleting complete
stephmilovic 27a08cc
comment count implemented
stephmilovic 20cfc98
add comment works
stephmilovic cc4d506
action reducer cleanup
stephmilovic f2abf92
more cleanups
stephmilovic 7e98271
cleaning
stephmilovic 65d0a36
Merge branch 'master' into delete-cases-cleanups
stephmilovic b7ce857
bulk delete
stephmilovic 9b27a3b
clean up
stephmilovic 48d49ff
fix plural on button text
stephmilovic 4616822
fix tests and types
stephmilovic 5b66897
merge in master
stephmilovic 9965750
fixing
stephmilovic f625f5c
Merge branch 'master' into delete-cases-cleanups
stephmilovic 3688b32
merge in master
stephmilovic ff6ff36
pr changes
stephmilovic b6731d5
init
stephmilovic 3d33b41
fix conflicts
stephmilovic cfcb63d
Merge branch 'master' into delete-tests
stephmilovic ec39d4a
few more tests
stephmilovic d34e3cd
WIP on sh
stephmilovic e4573aa
mege in master
stephmilovic 48a62cc
shell scripts added
stephmilovic d30b85d
shell scripts added
stephmilovic 41f7334
add readme
stephmilovic d170148
fix test
stephmilovic c22ddcc
Merge branch 'master' into delete-tests
elasticmachine 4b82a39
revert all cases tests
stephmilovic a950a03
Merge branch 'delete-tests' of github.com:stephmilovic/kibana into de…
stephmilovic 314f7fa
Merge branch 'master' into delete-tests
elasticmachine File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,90 @@ | ||
README.md for developers working on the Case API on how to get started | ||
using the CURL scripts in the scripts folder. | ||
|
||
The scripts rely on CURL and jq: | ||
|
||
- [CURL](https://curl.haxx.se) | ||
- [jq](https://stedolan.github.io/jq/) | ||
|
||
Install curl and jq | ||
|
||
```sh | ||
brew update | ||
brew install curl | ||
brew install jq | ||
``` | ||
|
||
Open `$HOME/.zshrc` or `${HOME}.bashrc` depending on your SHELL output from `echo $SHELL` | ||
and add these environment variables: | ||
|
||
```sh | ||
export ELASTICSEARCH_USERNAME=${user} | ||
export ELASTICSEARCH_PASSWORD=${password} | ||
export ELASTICSEARCH_URL=https://${ip}:9200 | ||
export KIBANA_URL=http://localhost:5601 | ||
export TASK_MANAGER_INDEX=.kibana-task-manager-${your user id} | ||
export KIBANA_INDEX=.kibana-${your user id} | ||
``` | ||
|
||
source `$HOME/.zshrc` or `${HOME}.bashrc` to ensure variables are set: | ||
|
||
```sh | ||
source ~/.zshrc | ||
``` | ||
|
||
Restart Kibana and ensure that you are using `--no-base-path` as changing the base path is a feature but will | ||
get in the way of the CURL scripts written as is. | ||
|
||
Go to the scripts folder `cd kibana/x-pack/plugins/case/server/scripts` and run: | ||
|
||
```sh | ||
./hard_reset.sh | ||
``` | ||
|
||
which will: | ||
|
||
- Delete any existing cases you have | ||
- Delete any existing comments you have | ||
- Posts the sample case from `./mock/case/post_case.json` | ||
- Posts the sample comment from `./mock/comment/post_comment.json` to the new case | ||
|
||
Now you can run | ||
|
||
```sh | ||
./find_cases.sh | ||
``` | ||
|
||
You should see the new case created like so: | ||
|
||
```sh | ||
{ | ||
"page": 1, | ||
"per_page": 20, | ||
"total": 1, | ||
"cases": [ | ||
{ | ||
"id": "2e0afbc0-658c-11ea-85c8-1d8f792cbc08", | ||
"version": "Wzc5NSwxXQ==", | ||
"comments": [], | ||
"comment_ids": [ | ||
"2ecec0f0-658c-11ea-85c8-1d8f792cbc08" | ||
], | ||
"created_at": "2020-03-14T00:38:53.004Z", | ||
"created_by": { | ||
"full_name": "Steph Milovic", | ||
"username": "smilovic" | ||
}, | ||
"updated_at": null, | ||
"updated_by": null, | ||
"description": "This looks not so good", | ||
"title": "Bad meanie defacing data", | ||
"status": "open", | ||
"tags": [ | ||
"defacement" | ||
] | ||
} | ||
], | ||
"count_open_cases": 1, | ||
"count_closed_cases": 1 | ||
} | ||
``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,41 @@ | ||
#!/bin/sh | ||
|
||
# | ||
# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
# or more contributor license agreements. Licensed under the Elastic License; | ||
# you may not use this file except in compliance with the Elastic License. | ||
# | ||
|
||
# Add this to the start of any scripts to detect if env variables are set | ||
|
||
set -e | ||
|
||
if [ -z "${ELASTICSEARCH_USERNAME}" ]; then | ||
echo "Set ELASTICSEARCH_USERNAME in your environment" | ||
exit 1 | ||
fi | ||
|
||
if [ -z "${ELASTICSEARCH_PASSWORD}" ]; then | ||
echo "Set ELASTICSEARCH_PASSWORD in your environment" | ||
exit 1 | ||
fi | ||
|
||
if [ -z "${ELASTICSEARCH_URL}" ]; then | ||
echo "Set ELASTICSEARCH_URL in your environment" | ||
exit 1 | ||
fi | ||
|
||
if [ -z "${KIBANA_URL}" ]; then | ||
echo "Set KIBANA_URL in your environment" | ||
exit 1 | ||
fi | ||
|
||
if [ -z "${TASK_MANAGER_INDEX}" ]; then | ||
echo "Set TASK_MANAGER_INDEX in your environment" | ||
exit 1 | ||
fi | ||
|
||
if [ -z "${KIBANA_INDEX}" ]; then | ||
echo "Set KIBANA_INDEX in your environment" | ||
exit 1 | ||
fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,51 @@ | ||
#!/bin/sh | ||
|
||
# | ||
# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
# or more contributor license agreements. Licensed under the Elastic License; | ||
# you may not use this file except in compliance with the Elastic License. | ||
# | ||
|
||
# Creates a new case and then gets it if no CASE_ID is specified | ||
|
||
# Example: | ||
# ./delete_cases.sh | ||
|
||
# Example with CASE_ID args: | ||
# ./delete_cases.sh 1234-example-id 5678-example-id | ||
|
||
set -e | ||
./check_env_variables.sh | ||
|
||
if [ "$1" ]; then | ||
ALL=("$@") | ||
i=0 | ||
|
||
COUNT=${#ALL[@]} | ||
IDS="" | ||
for ID in "${ALL[@]}" | ||
do | ||
let i=i+1 | ||
if [ $i -eq $COUNT ]; then | ||
IDS+="%22${ID}%22" | ||
else | ||
IDS+="%22${ID}%22," | ||
fi | ||
done | ||
|
||
curl -s -k \ | ||
-H 'kbn-xsrf: 123' \ | ||
-u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \ | ||
-X DELETE "${KIBANA_URL}${SPACE_URL}/api/cases?ids=\[${IDS}\]" \ | ||
| jq .; | ||
exit 1 | ||
else | ||
CASE_ID=("$(./generate_case_data.sh | jq '.id' -j)") | ||
curl -s -k \ | ||
-H 'Content-Type: application/json' \ | ||
-H 'kbn-xsrf: 123' \ | ||
-u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \ | ||
-X DELETE "${KIBANA_URL}${SPACE_URL}/api/cases?ids=\[%22${CASE_ID}%22\]" \ | ||
| jq .; | ||
exit 1 | ||
fi |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I followed the step here but was unable to complete this. Would like to know if we need to set
SPACE_URL
in .bashrc as well?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Had another try, and it was done successfully!