[Endpoint] Recursive resolver children

x-pack/plugins/endpoint/common/generate_data.ts

@@ -298,7 +298,7 @@ export class EndpointDocGenerator {
       process: {
         entity_id: options.entityID ? options.entityID : this.randomString(10),
         parent: options.parentEntityID ? { entity_id: options.parentEntityID } : undefined,
-        name: options.processName ? options.processName : 'powershell.exe',
+        name: options.processName ? options.processName : randomProcessName(),
       },
     };
   }
@@ -530,3 +530,16 @@ export class EndpointDocGenerator {
     return uuid.v4({ random: [...this.randomNGenerator(255, 16)] });
   }
 }
+
+const fakeProcessNames = [
+  'lsass.exe',
+  'notepad.exe',
+  'mimikatz.exe',
+  'powershell.exe',
+  'iexlorer.exe',
+  'explorer.exe',
+];
+/** Return a random fake process name */
+function randomProcessName(): string {
+  return fakeProcessNames[Math.floor(Math.random() * fakeProcessNames.length)];
+}

x-pack/plugins/endpoint/common/models/event.ts

@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EndpointEvent, LegacyEndpointEvent } from '../types';
+import { EndpointEvent, LegacyEndpointEvent, ResolverEvent } from '../types';
 
 export function isLegacyEvent(
   event: EndpointEvent | LegacyEndpointEvent
@@ -22,10 +22,33 @@ export function eventTimestamp(
   }
 }
 
+/** TODO, seems wrong */
 export function eventName(event: EndpointEvent | LegacyEndpointEvent): string {
   if (isLegacyEvent(event)) {
     return event.endgame.process_name ? event.endgame.process_name : '';
   } else {
     return event.process.name;
   }
 }
+
+export function eventId(event: ResolverEvent) {
+  if (isLegacyEvent(event)) {
+    return String(event.endgame.serial_event_id);
+  }
+  return event.event.id;
+}
+
+export function entityId(event: ResolverEvent) {
+  if (isLegacyEvent(event)) {
+    return String(event.endgame.unique_pid);
+  }
+  return event.process.entity_id;
+}
+
+export function parentEntityId(event: ResolverEvent) {
+  if (isLegacyEvent(event)) {
+    const ppid = event.endgame.unique_ppid;
+    return String(ppid); // if unique_ppid is undefined return undefined
+  }
+  return event.process.parent?.entity_id;
+}

x-pack/plugins/endpoint/common/types.ts

@@ -51,6 +51,29 @@ export class EndpointAppConstants {
   static MAX_LONG_INT = '9223372036854775807'; // 2^63-1
 }
 
+export interface NodeStats {
+  totalEvents: number;
+  totalAlerts: number;
+}
+
+export interface NodePagination {
+  nextChild?: string | null;
+  nextEvent?: string | null;
+  nextAncestor?: string | null;
+  nextAlert?: string | null;
+}
+
+export interface Node {
+  id: string;
+  children: Node[];
+  events: ResolverEvent[];
+  lifecycle: ResolverEvent[];
+  ancestors?: Node[];
+  parent?: Node | null;
+  pagination: NodePagination;
+  stats?: NodeStats;
+}
+
 export interface AlertResultList {
   /**
    * The alerts restricted by page size.

x-pack/plugins/endpoint/public/applications/endpoint/view/alerts/resolver.tsx

@@ -33,5 +33,6 @@ export const AlertDetailResolver = styled(
   width: 100%;
   display: flex;
   flex-grow: 1;
-  min-height: 500px;
+  /* gross demo hack */
+  min-height: calc(100vh - 505px);
 `;

x-pack/plugins/endpoint/public/embeddables/resolver/store/data/action.ts

@@ -17,4 +17,8 @@ interface ServerReturnedResolverData {
   };
 }
 
-export type DataAction = ServerReturnedResolverData;
+interface ServerFailedToReturnResolverData {
+  readonly type: 'serverFailedToReturnResolverData';
+}
+
+export type DataAction = ServerReturnedResolverData | ServerFailedToReturnResolverData;

x-pack/plugins/endpoint/public/embeddables/resolver/store/data/reducer.ts

@@ -11,6 +11,7 @@ function initialState(): DataState {
   return {
     results: [],
     isLoading: false,
+    hasError: false,
   };
 }
 
@@ -25,11 +26,18 @@ export const dataReducer: Reducer<DataState, ResolverAction> = (state = initialS
       ...state,
       results: search_results,
       isLoading: false,
+      hasError: false,
     };
   } else if (action.type === 'appRequestedResolverData') {
     return {
       ...state,
       isLoading: true,
+      hasError: false,
+    };
+  } else if (action.type === 'serverFailedToReturnResolverData') {
+    return {
+      ...state,
+      hasError: true,
     };
   } else {
     return state;

x-pack/plugins/endpoint/public/embeddables/resolver/store/data/selectors.ts

@@ -34,6 +34,10 @@ export function isLoading(state: DataState) {
   return state.isLoading;
 }
 
+export function hasError(state: DataState) {
+  return state.hasError;
+}
+
 /**
  * An isometric projection is a method for representing three dimensional objects in 2 dimensions.
  * More information about isometric projections can be found here https://en.wikipedia.org/wiki/Isometric_projection.
@@ -293,7 +297,7 @@ function* levelOrderWithWidths(
         metadata.firstChildWidth = width;
       } else {
         const firstChildWidth = widths.get(siblings[0]);
-        const lastChildWidth = widths.get(siblings[0]);
+        const lastChildWidth = widths.get(siblings[siblings.length - 1]);
         if (firstChildWidth === undefined || lastChildWidth === undefined) {
           /**
            * All widths have been precalcluated, so this will not happen.

x-pack/plugins/endpoint/public/embeddables/resolver/store/middleware.ts

@@ -8,26 +8,26 @@ import { Dispatch, MiddlewareAPI } from 'redux';
 import { KibanaReactContextValue } from '../../../../../../../src/plugins/kibana_react/public';
 import { EndpointPluginServices } from '../../../plugin';
 import { ResolverState, ResolverAction } from '../types';
-import { ResolverEvent } from '../../../../common/types';
+import { ResolverEvent, Node } from '../../../../common/types';
 import * as event from '../../../../common/models/event';
 
 type MiddlewareFactory<S = ResolverState> = (
   context?: KibanaReactContextValue<EndpointPluginServices>
 ) => (
   api: MiddlewareAPI<Dispatch<ResolverAction>, S>
 ) => (next: Dispatch<ResolverAction>) => (action: ResolverAction) => unknown;
-interface Lifecycle {
-  lifecycle: ResolverEvent[];
-}
-type ChildResponse = [Lifecycle];
 
-function flattenEvents(events: ChildResponse): ResolverEvent[] {
-  return events
-    .map((child: Lifecycle) => child.lifecycle)
-    .reduce(
-      (accumulator: ResolverEvent[], value: ResolverEvent[]) => accumulator.concat(value),
-      []
-    );
+function flattenEvents(children: Node[], events: ResolverEvent[] = []): ResolverEvent[] {
+  return children.reduce((flattenedEvents, currentNode) => {
+    if (currentNode.lifecycle && currentNode.lifecycle.length > 0) {
+      flattenedEvents.push(...currentNode.lifecycle);
+    }
+    if (currentNode.children && currentNode.children.length > 0) {
+      return flattenEvents(currentNode.children, events);
+    } else {
+      return flattenedEvents;
+    }
+  }, events);
 }
 
 export const resolverMiddlewareFactory: MiddlewareFactory = context => {
@@ -39,53 +39,38 @@ export const resolverMiddlewareFactory: MiddlewareFactory = context => {
        */
       if (context?.services.http && action.payload.selectedEvent) {
         api.dispatch({ type: 'appRequestedResolverData' });
-        let response = [];
-        let lifecycle: ResolverEvent[];
-        let childEvents: ResolverEvent[];
-        let relatedEvents: ResolverEvent[];
-        let children = [];
-        const ancestors: ResolverEvent[] = [];
-        const maxAncestors = 5;
-        if (event.isLegacyEvent(action.payload.selectedEvent)) {
-          const uniquePid = action.payload.selectedEvent?.endgame?.unique_pid;
-          const legacyEndpointID = action.payload.selectedEvent?.agent?.id;
-          [{ lifecycle }, { children }, { events: relatedEvents }] = await Promise.all([
-            context.services.http.get(`/api/endpoint/resolver/${uniquePid}`, {
-              query: { legacyEndpointID },
-            }),
-            context.services.http.get(`/api/endpoint/resolver/${uniquePid}/children`, {
-              query: { legacyEndpointID },
-            }),
-            context.services.http.get(`/api/endpoint/resolver/${uniquePid}/related`, {
-              query: { legacyEndpointID },
-            }),
-          ]);
-          childEvents = children.length > 0 ? flattenEvents(children) : [];
-        } else {
-          const uniquePid = action.payload.selectedEvent.process.entity_id;
-          const ppid = action.payload.selectedEvent.process.parent?.entity_id;
-          async function getAncestors(pid: string | undefined) {
-            if (ancestors.length < maxAncestors && pid !== undefined) {
-              const parent = await context?.services.http.get(`/api/endpoint/resolver/${pid}`);
-              ancestors.push(parent.lifecycle[0]);
-              if (parent.lifecycle[0].process?.parent?.entity_id) {
-                await getAncestors(parent.lifecycle[0].process.parent.entity_id);
-              }
-            }
+        try {
+          let lifecycle: ResolverEvent[];
+          let children: Node[];
+          let ancestors: Node[];
+          if (event.isLegacyEvent(action.payload.selectedEvent)) {
+            const entityId = action.payload.selectedEvent?.endgame?.unique_pid;
+            const legacyEndpointID = action.payload.selectedEvent?.agent?.id;
+            [{ lifecycle, children, ancestors }] = await Promise.all([
+              context.services.http.get(`/api/endpoint/resolver/${entityId}`, {
+                query: { legacyEndpointID },
+              }),
+            ]);
+          } else {
+            const entityId = action.payload.selectedEvent.process.entity_id;
+            [{ lifecycle, children, ancestors }] = await Promise.all([
+              context.services.http.get(`/api/endpoint/resolver/${entityId}`),
+            ]);
           }
-          [{ lifecycle }, { children }, { events: relatedEvents }] = await Promise.all([
-            context.services.http.get(`/api/endpoint/resolver/${uniquePid}`),
-            context.services.http.get(`/api/endpoint/resolver/${uniquePid}/children`),
-            context.services.http.get(`/api/endpoint/resolver/${uniquePid}/related`),
-            getAncestors(ppid),
-          ]);
+          const response: ResolverEvent[] = [
+            ...lifecycle,
+            ...flattenEvents(children),
+            ...flattenEvents(ancestors),
+          ];
+          api.dispatch({
+            type: 'serverReturnedResolverData',
+            payload: { data: { result: { search_results: response } } },
+          });
+        } catch (error) {
+          api.dispatch({
+            type: 'serverFailedToReturnResolverData',
+          });
         }
-        childEvents = children.length > 0 ? flattenEvents(children) : [];
-        response = [...lifecycle, ...childEvents, ...relatedEvents, ...ancestors];
-        api.dispatch({
-          type: 'serverReturnedResolverData',
-          payload: { data: { result: { search_results: response } } },
-        });
       }
     }
   };

x-pack/plugins/endpoint/public/embeddables/resolver/store/selectors.ts

@@ -102,6 +102,8 @@ function uiStateSelector(state: ResolverState) {
  */
 export const isLoading = composeSelectors(dataStateSelector, dataSelectors.isLoading);
 
+export const hasError = composeSelectors(dataStateSelector, dataSelectors.hasError);
+
 /**
  * Calls the `secondSelector` with the result of the `selector`. Use this when re-exporting a
  * concern-specific selector. `selector` should return the concern-specific state.

x-pack/plugins/endpoint/public/embeddables/resolver/types.ts

@@ -136,6 +136,7 @@ export type CameraState = {
 export interface DataState {
   readonly results: readonly ResolverEvent[];
   isLoading: boolean;
+  hasError: boolean;
 }
 
 export type Vector2 = readonly [number, number];

x-pack/plugins/endpoint/public/embeddables/resolver/view/defs.tsx

@@ -5,7 +5,7 @@
  */
 
 import React, { memo } from 'react';
-import { saturate } from 'polished';
+import { saturate, lighten } from 'polished';
 
 import {
   htmlIdGenerator,
@@ -87,6 +87,8 @@ const idGenerator = htmlIdGenerator();
  * Ids of paint servers to be referenced by fill and stroke attributes
  */
 export const PaintServerIds = {
+  runningProcess: idGenerator('psRunningProcess'),
+  runningTrigger: idGenerator('psRunningTrigger'),
   runningProcessCube: idGenerator('psRunningProcessCube'),
   runningTriggerCube: idGenerator('psRunningTriggerCube'),
   terminatedProcessCube: idGenerator('psTerminatedProcessCube'),
@@ -99,6 +101,46 @@ export const PaintServerIds = {
  */
 const PaintServers = memo(() => (
   <>
+    <linearGradient
+      id={PaintServerIds.runningProcess}
+      x1="0"
+      y1="0"
+      x2="1"
+      y2="0"
+      spreadMethod="reflect"
+      gradientUnits="objectBoundingBox"
+    >
+      <stop
+        offset="0%"
+        stopColor={saturate(0.7, lighten(0.05, NamedColors.runningProcessStart))}
+        stopOpacity="1"
+      />
+      <stop
+        offset="100%"
+        stopColor={saturate(0.7, lighten(0.05, NamedColors.runningProcessEnd))}
+        stopOpacity="1"
+      />
+    </linearGradient>
+    <linearGradient
+      id={PaintServerIds.runningTrigger}
+      x1="0"
+      y1="0"
+      x2="1"
+      y2="0"
+      spreadMethod="reflect"
+      gradientUnits="objectBoundingBox"
+    >
+      <stop
+        offset="0%"
+        stopColor={saturate(0.7, lighten(0.05, NamedColors.runningTriggerStart))}
+        stopOpacity="1"
+      />
+      <stop
+        offset="100%"
+        stopColor={saturate(0.7, lighten(0.05, NamedColors.runningTriggerEnd))}
+        stopOpacity="1"
+      />
+    </linearGradient>
     <linearGradient
       id={PaintServerIds.terminatedProcessCube}
       x1="-381.23752"

x-pack/plugins/endpoint/public/embeddables/resolver/view/index.tsx

@@ -59,6 +59,7 @@ export const Resolver = styled(
 
     const { projectionMatrix, ref, onMouseDown } = useCamera();
     const isLoading = useSelector(selectors.isLoading);
+    const hasError = useSelector(selectors.hasError);
     const activeDescendantId = useSelector(selectors.uiActiveDescendantId);
 
     useLayoutEffect(() => {
@@ -74,6 +75,10 @@ export const Resolver = styled(
           <div className="loading-container">
             <EuiLoadingSpinner size="xl" />
           </div>
+        ) : hasError ? (
+          <div className="loading-container">
+            <div>error occured fetching data</div>
+          </div>
         ) : (
           <StyledResolverContainer
             className="resolver-graph kbn-resetFocusState"