Skip to content

Commit 27ea969

Browse files
bkimmeloatkillerelasticmachine
authored
[Security Solution][Resolver] 2 new functions to DAL (#78477) (#78534)
* Added 2 new functions to DAL, adjusted old one to use new API * update mocks to work with interface * change to optional params Co-authored-by: oatkiller <robert.austin@elastic.co> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
1 parent 6d0257a commit 27ea969

7 files changed

Lines changed: 155 additions & 9 deletions

File tree

‎x-pack/plugins/security_solution/public/resolver/data_access_layer/factory.ts‎

Lines changed: 46 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ import {
1111
ResolverRelatedEvents,
1212
ResolverTree,
1313
ResolverEntityIndex,
14+
ResolverPaginatedEvents,
15+
SafeResolverEvent,
1416
} from '../../../common/endpoint/types';
1517

1618
/**
@@ -22,12 +24,54 @@ export function dataAccessLayerFactory(
2224
const dataAccessLayer: DataAccessLayer = {
2325
/**
2426
* Used to get non-process related events for a node.
27+
* @deprecated use the new API (eventsWithEntityIDAndCategory & event) instead
2528
*/
2629
async relatedEvents(entityID: string): Promise<ResolverRelatedEvents> {
27-
return context.services.http.post(`/api/endpoint/resolver/${entityID}/events`, {
28-
query: { events: 100 },
30+
const response: ResolverPaginatedEvents = await context.services.http.post(
31+
'/api/endpoint/resolver/events',
32+
{
33+
query: {},
34+
body: JSON.stringify({
35+
filter: `process.entity_id:"${entityID}" and not event.category:"process"`,
36+
}),
37+
}
38+
);
39+
40+
return { ...response, entityID };
41+
},
42+
43+
/**
44+
* Return events that have `process.entity_id` that includes `entityID` and that have
45+
* a `event.category` that includes `category`.
46+
*/
47+
async eventsWithEntityIDAndCategory(
48+
entityID: string,
49+
category: string,
50+
after?: string
51+
): Promise<ResolverPaginatedEvents> {
52+
return context.services.http.post('/api/endpoint/resolver/events', {
53+
query: { afterEvent: after },
54+
body: JSON.stringify({
55+
filter: `process.entity_id:"${entityID}" and event.category:"${category}"`,
56+
}),
2957
});
3058
},
59+
60+
/**
61+
* Return up to one event that has an `event.id` that includes `eventID`.
62+
*/
63+
async event(eventID: string): Promise<SafeResolverEvent | null> {
64+
const response: ResolverPaginatedEvents = await context.services.http.post(
65+
'/api/endpoint/resolver/events',
66+
{
67+
query: {},
68+
body: JSON.stringify({ filter: `event.id:"${eventID}"` }),
69+
}
70+
);
71+
const [oneEvent] = response.events;
72+
return oneEvent ?? null;
73+
},
74+
3175
/**
3276
* Used to get descendant and ancestor process events for a node.
3377
*/

‎x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/emptify_mock.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ export function emptifyMock<T>(
4444
return {
4545
metadata,
4646
dataAccessLayer: {
47+
...dataAccessLayer,
4748
/**
4849
* Fetch related events for an entity ID
4950
*/

‎x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children.ts‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
import {
88
ResolverRelatedEvents,
9+
SafeResolverEvent,
910
ResolverTree,
1011
ResolverEntityIndex,
1112
} from '../../../../common/endpoint/types';
@@ -58,6 +59,29 @@ export function noAncestorsTwoChildren(): { dataAccessLayer: DataAccessLayer; me
5859
});
5960
},
6061

62+
/**
63+
* Return events that have `process.entity_id` that includes `entityID` and that have
64+
* a `event.category` that includes `category`.
65+
*/
66+
async eventsWithEntityIDAndCategory(
67+
entityID: string,
68+
category: string,
69+
after?: string
70+
): Promise<{
71+
events: SafeResolverEvent[];
72+
nextEvent: string | null;
73+
}> {
74+
const events: SafeResolverEvent[] = [];
75+
return {
76+
events,
77+
nextEvent: null,
78+
};
79+
},
80+
81+
async event(_eventID: string): Promise<SafeResolverEvent | null> {
82+
return null;
83+
},
84+
6185
/**
6286
* Fetch a ResolverTree for a entityID
6387
*/

‎x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children_in_index_called_awesome_index.ts‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import {
88
ResolverRelatedEvents,
99
ResolverTree,
1010
ResolverEntityIndex,
11+
SafeResolverEvent,
1112
} from '../../../../common/endpoint/types';
1213
import { mockEndpointEvent } from '../../mocks/endpoint_event';
1314
import { mockTreeWithNoAncestorsAnd2Children } from '../../mocks/resolver_tree';
@@ -69,6 +70,32 @@ export function noAncestorsTwoChildenInIndexCalledAwesomeIndex(): {
6970
});
7071
},
7172

73+
async eventsWithEntityIDAndCategory(
74+
entityID: string,
75+
category,
76+
after?: string
77+
): Promise<{
78+
events: SafeResolverEvent[];
79+
nextEvent: string | null;
80+
}> {
81+
return {
82+
events: [
83+
mockEndpointEvent({
84+
entityID,
85+
eventCategory: category,
86+
}),
87+
],
88+
nextEvent: null,
89+
};
90+
},
91+
92+
async event(eventID: string): Promise<SafeResolverEvent | null> {
93+
return mockEndpointEvent({
94+
entityID: metadata.entityIDs.origin,
95+
eventID,
96+
});
97+
},
98+
7299
/**
73100
* Fetch a ResolverTree for a entityID
74101
*/

‎x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/no_ancestors_two_children_with_related_events_on_origin.ts‎

Lines changed: 40 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,9 @@ import {
1010
ResolverRelatedEvents,
1111
ResolverTree,
1212
ResolverEntityIndex,
13+
SafeResolverEvent,
1314
} from '../../../../common/endpoint/types';
15+
import * as eventModel from '../../../../common/endpoint/models/event';
1416

1517
interface Metadata {
1618
/**
@@ -56,31 +58,62 @@ export function noAncestorsTwoChildrenWithRelatedEventsOnOrigin(): {
5658
/**
5759
* Fetch related events for an entity ID
5860
*/
59-
relatedEvents(entityID: string): Promise<ResolverRelatedEvents> {
61+
async relatedEvents(entityID: string): Promise<ResolverRelatedEvents> {
6062
/**
6163
* Respond with the mocked related events when the origin's related events are fetched.
6264
**/
6365
const events = entityID === metadata.entityIDs.origin ? tree.relatedEvents.events : [];
6466

65-
return Promise.resolve({
67+
return {
6668
entityID,
6769
events,
6870
nextEvent: null,
69-
});
71+
};
72+
},
73+
74+
/**
75+
* Any of the origin's related events by category.
76+
* `entityID` must match the origin node's `process.entity_id`.
77+
* Does not respect the `_after` parameter.
78+
*/
79+
async eventsWithEntityIDAndCategory(
80+
entityID: string,
81+
category: string,
82+
after?: string
83+
): Promise<{ events: SafeResolverEvent[]; nextEvent: string | null }> {
84+
const events =
85+
entityID === metadata.entityIDs.origin
86+
? tree.relatedEvents.events.filter((event) =>
87+
eventModel.eventCategory(event).includes(category)
88+
)
89+
: [];
90+
return {
91+
events,
92+
nextEvent: null,
93+
};
94+
},
95+
96+
/**
97+
* Any of the origin's related events by event.id
98+
*/
99+
async event(eventID: string): Promise<SafeResolverEvent | null> {
100+
return (
101+
tree.relatedEvents.events.find((event) => eventModel.eventID(event) === eventID) ?? null
102+
);
70103
},
71104

72105
/**
73106
* Fetch a ResolverTree for a entityID
74107
*/
75-
resolverTree(): Promise<ResolverTree> {
76-
return Promise.resolve(tree);
108+
async resolverTree(): Promise<ResolverTree> {
109+
return tree;
77110
},
78111

79112
/**
80113
* Get entities matching a document.
81114
*/
82-
entities(): Promise<ResolverEntityIndex> {
83-
return Promise.resolve([{ entity_id: metadata.entityIDs.origin }]);
115+
async entities(): Promise<ResolverEntityIndex> {
116+
return [{ entity_id: metadata.entityIDs.origin }];
84117
},
85118
},
86119
};

‎x-pack/plugins/security_solution/public/resolver/data_access_layer/mocks/pausify_mock.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ export function pausifyMock<T>({
8989
}
9090
},
9191
dataAccessLayer: {
92+
...dataAccessLayer,
9293
/**
9394
* Fetch related events for an entity ID
9495
*/

‎x-pack/plugins/security_solution/public/resolver/types.ts‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import {
1616
ResolverTree,
1717
ResolverEntityIndex,
1818
SafeResolverEvent,
19+
ResolverPaginatedEvents,
1920
} from '../../common/endpoint/types';
2021

2122
/**
@@ -503,6 +504,21 @@ export interface DataAccessLayer {
503504
*/
504505
relatedEvents: (entityID: string) => Promise<ResolverRelatedEvents>;
505506

507+
/**
508+
* Return events that have `process.entity_id` that includes `entityID` and that have
509+
* a `event.category` that includes `category`.
510+
*/
511+
eventsWithEntityIDAndCategory: (
512+
entityID: string,
513+
category: string,
514+
after?: string
515+
) => Promise<ResolverPaginatedEvents>;
516+
517+
/**
518+
* Return up to one event that has an `event.id` that includes `eventID`.
519+
*/
520+
event: (eventID: string) => Promise<SafeResolverEvent | null>;
521+
506522
/**
507523
* Fetch a ResolverTree for a entityID
508524
*/

0 commit comments

Comments
 (0)