[Security Solution] Resolver retrieve entity id of documents without field mapped

x-pack/plugins/security_solution/public/resolver/data_access_layer/factory.ts

@@ -12,7 +12,6 @@ import {
   ResolverTree,
   ResolverEntityIndex,
 } from '../../../common/endpoint/types';
-import { DEFAULT_INDEX_KEY as defaultIndexKey } from '../../../common/constants';
 
 /**
  * The data access layer for resolver. All communication with the Kibana server is done through this object. This object is provided to Resolver. In tests, a mock data access layer can be used instead.
@@ -38,13 +37,6 @@ export function dataAccessLayerFactory(
       });
     },
 
-    /**
-     * Used to get the default index pattern from the SIEM application.
-     */
-    indexPatterns(): string[] {
-      return context.services.uiSettings.get(defaultIndexKey);
-    },
-
     /**
      * Used to get the entity_id for an _id.
      */

x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/emptify_mock.ts

@@ -12,7 +12,7 @@ import {
 import { mockTreeWithNoProcessEvents } from '../../mocks/resolver_tree';
 import { DataAccessLayer } from '../../types';
 
-type EmptiableRequests = 'relatedEvents' | 'resolverTree' | 'entities' | 'indexPatterns';
+type EmptiableRequests = 'relatedEvents' | 'resolverTree' | 'entities';
 
 interface Metadata<T> {
   /**
@@ -66,15 +66,6 @@ export function emptifyMock<T>(
           : dataAccessLayer.resolverTree(...args);
       },
 
-      /**
-       * Get an array of index patterns that contain events.
-       */
-      indexPatterns(...args): string[] {
-        return dataShouldBeEmpty.includes('indexPatterns')
-          ? []
-          : dataAccessLayer.indexPatterns(...args);
-      },
-
       /**
        * Get entities matching a document.
        */

x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children.ts

@@ -78,13 +78,6 @@ export function noAncestorsTwoChildren(): { dataAccessLayer: DataAccessLayer; me
         );
       },
 
-      /**
-       * Get an array of index patterns that contain events.
-       */
-      indexPatterns(): string[] {
-        return ['index pattern'];
-      },
-
       /**
        * Get entities matching a document.
        */

x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children_with_related_events_on_origin.ts

@@ -76,13 +76,6 @@ export function noAncestorsTwoChildrenWithRelatedEventsOnOrigin(): {
         return Promise.resolve(tree);
       },
 
-      /**
-       * Get an array of index patterns that contain events.
-       */
-      indexPatterns(): string[] {
-        return ['index pattern'];
-      },
-
       /**
        * Get entities matching a document.
        */

x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_indices_two_children.ts

@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  ResolverRelatedEvents,
+  ResolverTree,
+  ResolverEntityIndex,
+} from '../../../../common/endpoint/types';
+import { mockEndpointEvent } from '../../mocks/endpoint_event';
+import { mockTreeWithNoAncestorsAnd2Children } from '../../mocks/resolver_tree';
+import { DataAccessLayer } from '../../types';
+
+interface Metadata {
+  /**
+   * The `_id` of the document being analyzed.
+   */
+  databaseDocumentID: string;
+  /**
+   * A record of entityIDs to be used in tests assertions.
+   */
+  entityIDs: {
+    /**
+     * The entityID of the node related to the document being analyzed.
+     */
+    origin: 'origin';
+    /**
+     * The entityID of the first child of the origin.
+     */
+    firstChild: 'firstChild';
+    /**
+     * The entityID of the second child of the origin.
+     */
+    secondChild: 'secondChild';
+  };
+}
+
+/**
+ * A simple mock dataAccessLayer possible that returns a tree with 0 ancestors and 2 direct children. 1 related event is returned. The parameter to `entities` is ignored.
+ */
+export function handleNoIndices(): { dataAccessLayer: DataAccessLayer; metadata: Metadata } {
+  const metadata: Metadata = {
+    databaseDocumentID: '_id',
+    entityIDs: { origin: 'origin', firstChild: 'firstChild', secondChild: 'secondChild' },
+  };
+  return {
+    metadata,
+    dataAccessLayer: {
+      /**
+       * Fetch related events for an entity ID
+       */
+      relatedEvents(entityID: string): Promise<ResolverRelatedEvents> {
+        return Promise.resolve({
+          entityID,
+          events: [
+            mockEndpointEvent({
+              entityID,
+              name: 'event',
+              timestamp: 0,
+            }),
+          ],
+          nextEvent: null,
+        });
+      },
+
+      /**
+       * Fetch a ResolverTree for a entityID
+       */
+      resolverTree(): Promise<ResolverTree> {
+        return Promise.resolve(
+          mockTreeWithNoAncestorsAnd2Children({
+            originID: metadata.entityIDs.origin,
+            firstChildID: metadata.entityIDs.firstChild,
+            secondChildID: metadata.entityIDs.secondChild,
+          })
+        );
+      },
+
+      /**
+       * Get entities matching a document.
+       */
+      entities({ indices }): Promise<ResolverEntityIndex> {
+        if (indices.length === 1 && indices[0] === 'awesome_index') {
+          return Promise.resolve([{ entity_id: metadata.entityIDs.origin }]);
+        }
+        return Promise.resolve([]);
+      },
+    },
+  };
+}

x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/pausify_mock.ts

@@ -105,13 +105,6 @@ export function pausifyMock<T>({
         return dataAccessLayer.resolverTree(...args);
       },
 
-      /**
-       * Get an array of index patterns that contain events.
-       */
-      indexPatterns(...args): string[] {
-        return dataAccessLayer.indexPatterns(...args);
-      },
-
       /**
        * Get entities matching a document.
        */

x-pack/plugins/security_solution/public/resolver/models/database_parameters.ts

@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import _ from 'lodash';
+import { DatabaseParameters } from '../types';
+
+export function equal(param1: DatabaseParameters, param2?: DatabaseParameters) {
+  return _.isEqual(param1, param2);
+}

x-pack/plugins/security_solution/public/resolver/store/actions.ts

@@ -115,7 +115,7 @@ interface AppReceivedNewExternalProperties {
     /**
      * the `_id` of an ES document. This defines the origin of the Resolver graph.
      */
-    databaseDocumentID?: string;
+    databaseDocumentID: string;
     /**
      * An ID that uniquely identifies this Resolver instance from other concurrent Resolvers.
      */
@@ -125,6 +125,11 @@ interface AppReceivedNewExternalProperties {
      * The `search` part of the URL of this page.
      */
     locationSearch: string;
+
+    /**
+     * Indices that the backend will use to find the document.
+     */
+    indices: string[];
   };
 }
 

x-pack/plugins/security_solution/public/resolver/store/data/action.ts

@@ -5,6 +5,7 @@
  */
 
 import { ResolverRelatedEvents, ResolverTree } from '../../../../common/endpoint/types';
+import { DatabaseParameters } from '../../types';
 
 interface ServerReturnedResolverData {
   readonly type: 'serverReturnedResolverData';
@@ -14,9 +15,9 @@ interface ServerReturnedResolverData {
      */
     result: ResolverTree;
     /**
-     * The database document ID that was used to fetch the resolver tree
+     * The database parameters that was used to fetch the resolver tree
      */
-    databaseDocumentID: string;
+    parameters: DatabaseParameters;
   };
 }
 
@@ -25,31 +26,31 @@ interface AppRequestedResolverData {
   /**
    * entity ID used to make the request.
    */
-  readonly payload: string;
+  readonly payload: DatabaseParameters;
 }
 
 interface ServerFailedToReturnResolverData {
   readonly type: 'serverFailedToReturnResolverData';
   /**
    * entity ID used to make the failed request
    */
-  readonly payload: string;
+  readonly payload: DatabaseParameters;
 }
 
 interface AppAbortedResolverDataRequest {
   readonly type: 'appAbortedResolverDataRequest';
   /**
    * entity ID used to make the aborted request
    */
-  readonly payload: string;
+  readonly payload: DatabaseParameters;
 }
 
 /**
  * Will occur when a request for related event data is unsuccessful.
  */
 interface ServerFailedToReturnRelatedEventData {
   readonly type: 'serverFailedToReturnRelatedEventData';
-  readonly payload: string;
+  readonly payload: DatabaseParameters;
 }
 
 /**

x-pack/plugins/security_solution/public/resolver/store/data/reducer.ts

@@ -7,6 +7,7 @@
 import { Reducer } from 'redux';
 import { DataState } from '../../types';
 import { ResolverAction } from '../actions';
+import * as databaseParameters from '../../models/database_parameters';
 
 const initialState: DataState = {
   relatedEvents: new Map(),
@@ -18,22 +19,28 @@ export const dataReducer: Reducer<DataState, ResolverAction> = (state = initialS
   if (action.type === 'appReceivedNewExternalProperties') {
     const nextState: DataState = {
       ...state,
-      databaseDocumentID: action.payload.databaseDocumentID,
+      currentParameters: {
+        databaseDocumentID: action.payload.databaseDocumentID,
+        indices: action.payload.indices,
+      },
       resolverComponentInstanceID: action.payload.resolverComponentInstanceID,
     };
     return nextState;
   } else if (action.type === 'appRequestedResolverData') {
     // keep track of what we're requesting, this way we know when to request and when not to.
     return {
       ...state,
-      pendingRequestDatabaseDocumentID: action.payload,
+      pendingRequestParameters: {
+        databaseDocumentID: action.payload.databaseDocumentID,
+        indices: action.payload.indices,
+      },
     };
   } else if (action.type === 'appAbortedResolverDataRequest') {
-    if (action.payload === state.pendingRequestDatabaseDocumentID) {
+    if (databaseParameters.equal(action.payload, state.pendingRequestParameters)) {
       // the request we were awaiting was aborted
       return {
         ...state,
-        pendingRequestDatabaseDocumentID: undefined,
+        pendingRequestParameters: undefined,
       };
     } else {
       return state;
@@ -48,23 +55,23 @@ export const dataReducer: Reducer<DataState, ResolverAction> = (state = initialS
        */
       lastResponse: {
         result: action.payload.result,
-        databaseDocumentID: action.payload.databaseDocumentID,
+        parameters: action.payload.parameters,
         successful: true,
       },
 
       // This assumes that if we just received something, there is no longer a pending request.
       // This cannot model multiple in-flight requests
-      pendingRequestDatabaseDocumentID: undefined,
+      pendingRequestParameters: undefined,
     };
     return nextState;
   } else if (action.type === 'serverFailedToReturnResolverData') {
     /** Only handle this if we are expecting a response */
-    if (state.pendingRequestDatabaseDocumentID !== undefined) {
+    if (state.pendingRequestParameters !== undefined) {
       const nextState: DataState = {
         ...state,
-        pendingRequestDatabaseDocumentID: undefined,
+        pendingRequestParameters: undefined,
         lastResponse: {
-          databaseDocumentID: state.pendingRequestDatabaseDocumentID,
+          parameters: state.pendingRequestParameters,
           successful: false,
         },
       };