[Endpoint] Recursive resolver children

x-pack/plugins/endpoint/common/generate_data.ts

@@ -298,7 +298,7 @@ export class EndpointDocGenerator {
       process: {
         entity_id: options.entityID ? options.entityID : this.randomString(10),
         parent: options.parentEntityID ? { entity_id: options.parentEntityID } : undefined,
-        name: options.processName ? options.processName : 'powershell.exe',
+        name: options.processName ? options.processName : randomProcessName(),
       },
     };
   }
@@ -530,3 +530,16 @@ export class EndpointDocGenerator {
     return uuid.v4({ random: [...this.randomNGenerator(255, 16)] });
   }
 }
+
+const fakeProcessNames = [
+  'lsass.exe',
+  'notepad.exe',
+  'mimikatz.exe',
+  'powershell.exe',
+  'iexlorer.exe',
+  'explorer.exe',
+];
+/** Return a random fake process name */
+function randomProcessName(): string {
+  return fakeProcessNames[Math.floor(Math.random() * fakeProcessNames.length)];
+}

x-pack/plugins/endpoint/common/models/event.ts

@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EndpointEvent, LegacyEndpointEvent } from '../types';
+import { EndpointEvent, LegacyEndpointEvent, ResolverEvent } from '../types';
 
 export function isLegacyEvent(
   event: EndpointEvent | LegacyEndpointEvent
@@ -22,10 +22,33 @@ export function eventTimestamp(
   }
 }
 
+/** TODO, seems wrong */
 export function eventName(event: EndpointEvent | LegacyEndpointEvent): string {
   if (isLegacyEvent(event)) {
     return event.endgame.process_name ? event.endgame.process_name : '';
   } else {
     return event.process.name;
   }
 }
+
+export function eventId(event: ResolverEvent) {
+  if (isLegacyEvent(event)) {
+    return String(event.endgame.serial_event_id);
+  }
+  return event.event.id;
+}
+
+export function entityId(event: ResolverEvent) {
+  if (isLegacyEvent(event)) {
+    return String(event.endgame.unique_pid);
+  }
+  return event.process.entity_id;
+}
+
+export function parentEntityId(event: ResolverEvent) {
+  if (isLegacyEvent(event)) {
+    const ppid = event.endgame.unique_ppid;
+    return String(ppid); // if unique_ppid is undefined return undefined
+  }
+  return event.process.parent?.entity_id;
+}

x-pack/plugins/endpoint/common/schema/tree.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+
+export const validateTree = {
+  params: schema.object({ id: schema.string() }),
+  query: schema.object({
+    children: schema.number({ defaultValue: 10, min: 0, max: 100 }),
+    generations: schema.number({ defaultValue: 3, min: 0, max: 3 }),
+    ancestors: schema.number({ defaultValue: 3, min: 0, max: 5 }),
+    events: schema.number({ defaultValue: 100, min: 0, max: 1000 }),
+    afterEvent: schema.maybe(schema.string()),
+    afterChild: schema.maybe(schema.string()),
+    legacyEndpointID: schema.maybe(schema.string()),
+  }),
+};

x-pack/plugins/endpoint/common/types.ts

@@ -51,6 +51,29 @@ export class EndpointAppConstants {
   static MAX_LONG_INT = '9223372036854775807'; // 2^63-1
 }
 
+export interface ResolverNodeStats {
+  totalEvents: number;
+  totalAlerts: number;
+}
+
+export interface ResolverNodePagination {
+  nextChild?: string | null;
+  nextEvent?: string | null;
+  nextAncestor?: string | null;
+  nextAlert?: string | null;
+}
+
+export interface ResolverNode {
+  id: string;
+  children: ResolverNode[];
+  events: ResolverEvent[];
+  lifecycle: ResolverEvent[];
+  ancestors?: ResolverNode[];
+  parent?: ResolverNode | null;
+  pagination: ResolverNodePagination;
+  stats?: ResolverNodeStats;
+}
+
 export interface AlertResultList {
   /**
    * The alerts restricted by page size.

x-pack/plugins/endpoint/public/applications/endpoint/view/alerts/resolver.tsx

@@ -33,5 +33,6 @@ export const AlertDetailResolver = styled(
   width: 100%;
   display: flex;
   flex-grow: 1;
-  min-height: 500px;
+  /* gross demo hack */
+  min-height: calc(100vh - 505px);
 `;

x-pack/plugins/endpoint/public/embeddables/resolver/store/data/action.ts

@@ -8,13 +8,11 @@ import { ResolverEvent } from '../../../../../common/types';
 
 interface ServerReturnedResolverData {
   readonly type: 'serverReturnedResolverData';
-  readonly payload: {
-    readonly data: {
-      readonly result: {
-        readonly search_results: readonly ResolverEvent[];
-      };
-    };
-  };
+  readonly payload: ResolverEvent[];
 }
 
-export type DataAction = ServerReturnedResolverData;
+interface ServerFailedToReturnResolverData {
+  readonly type: 'serverFailedToReturnResolverData';
+}
+
+export type DataAction = ServerReturnedResolverData | ServerFailedToReturnResolverData;

x-pack/plugins/endpoint/public/embeddables/resolver/store/data/graphing.test.ts

@@ -8,7 +8,7 @@ import { Store, createStore } from 'redux';
 import { DataAction } from './action';
 import { dataReducer } from './reducer';
 import { DataState } from '../../types';
-import { LegacyEndpointEvent } from '../../../../../common/types';
+import { LegacyEndpointEvent, ResolverEvent } from '../../../../../common/types';
 import { graphableProcesses, processNodePositionsAndEdgeLineSegments } from './selectors';
 import { mockProcessEvent } from '../../models/process_event_test_helpers';
 
@@ -113,13 +113,7 @@ describe('resolver graph layout', () => {
   });
   describe('when rendering no nodes', () => {
     beforeEach(() => {
-      const payload = {
-        data: {
-          result: {
-            search_results: [],
-          },
-        },
-      };
+      const payload: ResolverEvent[] = [];
       const action: DataAction = { type: 'serverReturnedResolverData', payload };
       store.dispatch(action);
     });
@@ -133,13 +127,7 @@ describe('resolver graph layout', () => {
   });
   describe('when rendering one node', () => {
     beforeEach(() => {
-      const payload = {
-        data: {
-          result: {
-            search_results: [processA],
-          },
-        },
-      };
+      const payload = [processA];
       const action: DataAction = { type: 'serverReturnedResolverData', payload };
       store.dispatch(action);
     });
@@ -153,13 +141,7 @@ describe('resolver graph layout', () => {
   });
   describe('when rendering two nodes, one being the parent of the other', () => {
     beforeEach(() => {
-      const payload = {
-        data: {
-          result: {
-            search_results: [processA, processB],
-          },
-        },
-      };
+      const payload = [processA, processB];
       const action: DataAction = { type: 'serverReturnedResolverData', payload };
       store.dispatch(action);
     });
@@ -173,23 +155,17 @@ describe('resolver graph layout', () => {
   });
   describe('when rendering two forks, and one fork has an extra long tine', () => {
     beforeEach(() => {
-      const payload = {
-        data: {
-          result: {
-            search_results: [
-              processA,
-              processB,
-              processC,
-              processD,
-              processE,
-              processF,
-              processG,
-              processH,
-              processI,
-            ],
-          },
-        },
-      };
+      const payload = [
+        processA,
+        processB,
+        processC,
+        processD,
+        processE,
+        processF,
+        processG,
+        processH,
+        processI,
+      ];
       const action: DataAction = { type: 'serverReturnedResolverData', payload };
       store.dispatch(action);
     });

x-pack/plugins/endpoint/public/embeddables/resolver/store/data/reducer.ts

@@ -11,25 +11,28 @@ function initialState(): DataState {
   return {
     results: [],
     isLoading: false,
+    hasError: false,
   };
 }
 
 export const dataReducer: Reducer<DataState, ResolverAction> = (state = initialState(), action) => {
   if (action.type === 'serverReturnedResolverData') {
-    const {
-      data: {
-        result: { search_results },
-      },
-    } = action.payload;
     return {
       ...state,
-      results: search_results,
+      results: action.payload,
       isLoading: false,
+      hasError: false,
     };
   } else if (action.type === 'appRequestedResolverData') {
     return {
       ...state,
       isLoading: true,
+      hasError: false,
+    };
+  } else if (action.type === 'serverFailedToReturnResolverData') {
+    return {
+      ...state,
+      hasError: true,
     };
   } else {
     return state;

x-pack/plugins/endpoint/public/embeddables/resolver/store/data/selectors.ts

@@ -34,6 +34,10 @@ export function isLoading(state: DataState) {
   return state.isLoading;
 }
 
+export function hasError(state: DataState) {
+  return state.hasError;
+}
+
 /**
  * An isometric projection is a method for representing three dimensional objects in 2 dimensions.
  * More information about isometric projections can be found here https://en.wikipedia.org/wiki/Isometric_projection.
@@ -293,7 +297,7 @@ function* levelOrderWithWidths(
         metadata.firstChildWidth = width;
       } else {
         const firstChildWidth = widths.get(siblings[0]);
-        const lastChildWidth = widths.get(siblings[0]);
+        const lastChildWidth = widths.get(siblings[siblings.length - 1]);
         if (firstChildWidth === undefined || lastChildWidth === undefined) {
           /**
            * All widths have been precalcluated, so this will not happen.