[Endpoint] Using the stats provided by the backend for resolver UI

x-pack/plugins/security_solution/common/endpoint/models/event.ts

@@ -52,23 +52,3 @@ export function parentEntityId(event: ResolverEvent): string | undefined {
   }
   return event.process.parent?.entity_id;
 }
-
-export function eventType(event: ResolverEvent): string {
-  // Returning "Process" as a catch-all here because it seems pretty general
-  let eventCategoryToReturn: string = 'Process';
-  if (isLegacyEvent(event)) {
-    const legacyFullType = event.endgame.event_type_full;
-    if (legacyFullType) {
-      return legacyFullType;
-    }
-  } else {
-    const eventCategories = event.event.category;
-    const eventCategory =
-      typeof eventCategories === 'string' ? eventCategories : eventCategories[0] || '';
-
-    if (eventCategory) {
-      eventCategoryToReturn = eventCategory;
-    }
-  }
-  return eventCategoryToReturn;
-}

x-pack/plugins/security_solution/public/resolver/store/data/action.ts

@@ -4,26 +4,18 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ResolverEvent } from '../../../../common/endpoint/types';
-import { RelatedEventDataEntry } from '../../types';
+import { ResolverEvent, ResolverNodeStats } from '../../../../common/endpoint/types';
 
 interface ServerReturnedResolverData {
   readonly type: 'serverReturnedResolverData';
-  readonly payload: ResolverEvent[];
+  readonly events: ResolverEvent[];
+  readonly stats: Map<string, ResolverNodeStats>;
 }
 
 interface ServerFailedToReturnResolverData {
   readonly type: 'serverFailedToReturnResolverData';
 }
 
-/**
- * Will occur when a request for related event data is fulfilled by the API.
- */
-interface ServerReturnedRelatedEventData {
-  readonly type: 'serverReturnedRelatedEventData';
-  readonly payload: Map<ResolverEvent, RelatedEventDataEntry>;
-}
-
 /**
  * Will occur when a request for related event data is unsuccessful.
  */
@@ -35,5 +27,4 @@ interface ServerFailedToReturnRelatedEventData {
 export type DataAction =
   | ServerReturnedResolverData
   | ServerFailedToReturnResolverData
-  | ServerReturnedRelatedEventData
   | ServerFailedToReturnRelatedEventData;

x-pack/plugins/security_solution/public/resolver/store/data/graphing.test.ts

@@ -113,8 +113,8 @@ describe('resolver graph layout', () => {
   });
   describe('when rendering no nodes', () => {
     beforeEach(() => {
-      const payload: ResolverEvent[] = [];
-      const action: DataAction = { type: 'serverReturnedResolverData', payload };
+      const events: ResolverEvent[] = [];
+      const action: DataAction = { type: 'serverReturnedResolverData', events, stats: new Map() };
       store.dispatch(action);
     });
     it('the graphableProcesses list should only include nothing', () => {
@@ -127,8 +127,8 @@ describe('resolver graph layout', () => {
   });
   describe('when rendering one node', () => {
     beforeEach(() => {
-      const payload = [processA];
-      const action: DataAction = { type: 'serverReturnedResolverData', payload };
+      const events = [processA];
+      const action: DataAction = { type: 'serverReturnedResolverData', events, stats: new Map() };
       store.dispatch(action);
     });
     it('the graphableProcesses list should only include nothing', () => {
@@ -141,8 +141,8 @@ describe('resolver graph layout', () => {
   });
   describe('when rendering two nodes, one being the parent of the other', () => {
     beforeEach(() => {
-      const payload = [processA, processB];
-      const action: DataAction = { type: 'serverReturnedResolverData', payload };
+      const events = [processA, processB];
+      const action: DataAction = { type: 'serverReturnedResolverData', events, stats: new Map() };
       store.dispatch(action);
     });
     it('the graphableProcesses list should only include nothing', () => {
@@ -155,7 +155,7 @@ describe('resolver graph layout', () => {
   });
   describe('when rendering two forks, and one fork has an extra long tine', () => {
     beforeEach(() => {
-      const payload = [
+      const events = [
         processA,
         processB,
         processC,
@@ -166,7 +166,7 @@ describe('resolver graph layout', () => {
         processH,
         processI,
       ];
-      const action: DataAction = { type: 'serverReturnedResolverData', payload };
+      const action: DataAction = { type: 'serverReturnedResolverData', events, stats: new Map() };
       store.dispatch(action);
     });
     it("the graphableProcesses list should only include events with 'processCreated' an 'processRan' eventType", () => {

x-pack/plugins/security_solution/public/resolver/store/data/reducer.ts

@@ -10,40 +10,21 @@ import { DataState, ResolverAction } from '../../types';
 function initialState(): DataState {
   return {
     results: [],
+    relatedEventsStats: new Map(),
     isLoading: false,
     hasError: false,
-    resultsEnrichedWithRelatedEventInfo: new Map(),
   };
 }
 
 export const dataReducer: Reducer<DataState, ResolverAction> = (state = initialState(), action) => {
   if (action.type === 'serverReturnedResolverData') {
     return {
       ...state,
-      results: action.payload,
+      results: action.events,
+      relatedEventsStats: action.stats,
       isLoading: false,
       hasError: false,
     };
-  } else if (action.type === 'userRequestedRelatedEventData') {
-    const resolverEvent = action.payload;
-    const currentStatsMap = new Map(state.resultsEnrichedWithRelatedEventInfo);
-    /**
-     * Set the waiting indicator for this event to indicate that related event results are pending.
-     * It will be replaced by the actual results from the API when they are returned.
-     */
-    currentStatsMap.set(resolverEvent, 'waitingForRelatedEventData');
-    return { ...state, resultsEnrichedWithRelatedEventInfo: currentStatsMap };
-  } else if (action.type === 'serverFailedToReturnRelatedEventData') {
-    const currentStatsMap = new Map(state.resultsEnrichedWithRelatedEventInfo);
-    const resolverEvent = action.payload;
-    currentStatsMap.set(resolverEvent, 'error');
-    return { ...state, resultsEnrichedWithRelatedEventInfo: currentStatsMap };
-  } else if (action.type === 'serverReturnedRelatedEventData') {
-    const relatedDataEntries = new Map([
-      ...state.resultsEnrichedWithRelatedEventInfo,
-      ...action.payload,
-    ]);
-    return { ...state, resultsEnrichedWithRelatedEventInfo: relatedDataEntries };
   } else if (action.type === 'appRequestedResolverData') {
     return {
       ...state,

x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts

@@ -15,8 +15,6 @@ import {
   Matrix3,
   AdjacentProcessMap,
   Vector2,
-  RelatedEventData,
-  RelatedEventDataEntryWithStats,
 } from '../../types';
 import { ResolverEvent } from '../../../../common/endpoint/types';
 
@@ -410,85 +408,11 @@ export const indexedProcessTree = createSelector(graphableProcesses, function in
 });
 
 /**
- * Process events that will be graphed.
+ * This returns a map of entity_ids to stats about the related events and alerts.
  */
-export const relatedEventResults = function (data: DataState) {
-  return data.resultsEnrichedWithRelatedEventInfo;
-};
-
-/**
- * This selector compiles the related event data attached in `relatedEventResults`
- * into a `RelatedEventData` map of ResolverEvents to statistics about their related events
- */
-export const relatedEventStats = createSelector(relatedEventResults, function getRelatedEvents(
-  /* eslint-disable no-shadow */
-  relatedEventResults
-  /* eslint-enable no-shadow */
-) {
-  /* eslint-disable no-shadow */
-  const relatedEventStats: RelatedEventData = new Map();
-  /* eslint-enable no-shadow */
-  if (!relatedEventResults) {
-    return relatedEventStats;
-  }
-
-  for (const updatedEvent of relatedEventResults.keys()) {
-    const newStatsEntry = relatedEventResults.get(updatedEvent);
-    if (newStatsEntry === 'error') {
-      // If the entry is an error, return it as is
-      relatedEventStats.set(updatedEvent, newStatsEntry);
-      // eslint-disable-next-line no-continue
-      continue;
-    }
-    if (typeof newStatsEntry === 'object') {
-      /**
-       * Otherwise, it should be a valid stats entry.
-       * Do the work to compile the stats.
-       * Folowing reduction, this will be a record like
-       * {DNS: 10, File: 2} etc.
-       */
-      const statsForEntry = newStatsEntry?.relatedEvents.reduce(
-        (compiledStats: Record<string, number>, relatedEvent: { relatedEventType: string }) => {
-          compiledStats[relatedEvent.relatedEventType] =
-            (compiledStats[relatedEvent.relatedEventType] || 0) + 1;
-          return compiledStats;
-        },
-        {}
-      );
-
-      const newRelatedEventStats: RelatedEventDataEntryWithStats = Object.assign(newStatsEntry, {
-        stats: statsForEntry,
-      });
-      relatedEventStats.set(updatedEvent, newRelatedEventStats);
-    }
-  }
-  return relatedEventStats;
-});
-
-/**
- * This selects `RelatedEventData` maps specifically for graphable processes
- */
-export const relatedEvents = createSelector(
-  graphableProcesses,
-  relatedEventStats,
-  function getRelatedEvents(
-    /* eslint-disable no-shadow */
-    graphableProcesses,
-    relatedEventStats
-    /* eslint-enable no-shadow */
-  ) {
-    const eventsRelatedByProcess: RelatedEventData = new Map();
-    /* eslint-disable no-shadow */
-    return graphableProcesses.reduce((relatedEvents, graphableProcess) => {
-      /* eslint-enable no-shadow */
-      const relatedEventDataEntry = relatedEventStats?.get(graphableProcess);
-      if (relatedEventDataEntry) {
-        relatedEvents.set(graphableProcess, relatedEventDataEntry);
-      }
-      return relatedEvents;
-    }, eventsRelatedByProcess);
-  }
-);
+export function relatedEventsStats(data: DataState) {
+  return data.relatedEventsStats;
+}
 
 export const processAdjacencies = createSelector(
   indexedProcessTree,