Skip to content

Commit 4888af6

Browse files
dej611dej611
authored
Merge branch 'main' into fix/lodash-imports
2 parents fe7869d + d9477a7 commit 4888af6

131 files changed

Lines changed: 4517 additions & 1251 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/CODEOWNERS‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2745,6 +2745,9 @@ src/platform/testfunctional/page_objects/solution_navigation.ts @elastic/appex-s
27452745
/x-pack/test_serverless/functional/page_objects/svl_sec_landing_page.ts @elastic/appex-sharedux
27462746
/x-pack/test_serverless/functional/test_suites/security/ftr/navigation.ts @elastic/appex-sharedux
27472747

2748+
# Root package.json file
2749+
/package.json @elastic/kibana-security
2750+
27482751
# OpenAPI spec files
27492752
oas_docs/.spectral.yaml @elastic/platform-docs
27502753
oas_docs/kibana.info.serverless.yaml @elastic/platform-docs

‎dev_docs/contributing/third_party_dependencies.mdx‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,74 @@ on Github:
6767
[Permitted Open Source Licenses list](https://github.com/elastic/open-source/blob/main/elastic-product-policy.md#permitted-licenses-list).
6868
</DocCallOut>
6969

70+
### Dependency evaluation
71+
72+
To manage workload effectively during this stopgap period, the evaluation is applicable only to new third-party dependencies.
73+
Dependency upgrades are not considered, as reviewing them would be excessively time-consuming.
74+
75+
1. **Justification and context**.
76+
- What is this dependency used for? Briefly explain its role in your changes and the problem it solves.
77+
- Why is adding this specific external dependency the best approach compared to other solutions?
78+
- Were other options considered (e.g., using existing internal libraries/utilities, implementing the functionality directly)? If so, why was this dependency chosen over them?
79+
- Does Kibana have a dependency providing similar functionality? If so, why is the new one preferred?
80+
81+
Responsible: PR author
82+
83+
2. **Snyk health check**. Setting the healthy threshold at 70 provides pragmatic balance: prioritizes maintenance, filters out major security risks and indicates acceptable quality. Score is calculated as a weighted mean based on maintenance, security, quality and popularity.
84+
- Ensure a minimum health score is >= 70 in [Snyk Advisor](https://snyk.io/advisor).
85+
- If the health score is below 70, a valid business justification must be provided.
86+
87+
Responsible: PR author
88+
89+
3. **Vulnerability assessment**. Check vulnerability reports from Snyk for the exact dependency version, available through [Snyk Advisor](https://snyk.io/advisor).
90+
If vulnerabilities are present:
91+
92+
- **Critical (CVSS 9.0 - 10.0)**:
93+
- **False positive:** Proceed to Step 4.
94+
- **Confirmed vulnerability:** Reject dependency.
95+
96+
- **High (CVSS 7.0 - 8.9)**:
97+
- **False positive:** Proceed to Step 4.
98+
- **Confirmed vulnerability:** Reject dependency.
99+
100+
- **Medium/Low (CVSS 0.0 - 6.9)**:
101+
- **False positive:** Proceed to Step 4.
102+
- **Confirmed vulnerability:** Exception can be granted if the vulnerability is confirmed to be impossible to exploit and and there is no better alternative.
103+
104+
Responsible: PR author
105+
106+
4. **Handling false positives**. If a vulnerability is considered to be a false positive:
107+
- Clearly document why the vulnerability is considered a false positive.
108+
- Submit an exception request following the Vulnerability Exception Policy and Procedures.
109+
- The exception request must be created **before merging** the dependency.
110+
- Initial exception timeframe is suggested to be 30 days. If there would be no upgrade path available after a month, longer exception timeframe can be requested.
111+
112+
Responsible: PR author
113+
114+
5. **Approval**. Document the entire assessment clearly, including:
115+
- Final health score.
116+
- CVSS scores of identified issues if applicable.
117+
- Justification for any accepted false positives if applicable.
118+
119+
Responsible: AppEx Platform Security team
120+
121+
```
122+
## Approval Summary
123+
124+
| **Dependency Name** | `<dependency-name>` |
125+
|-----------------------|--------------------------------|
126+
| **Version** | `<version>` |
127+
| **Snyk Health Score** | `95/100` |
128+
| **CVSS Issues** | None / High (CVSS 7.5, CVE-XXXX-XXXX) |
129+
| **False Positives** | [Yes/No](justification below) |
130+
131+
### Justification / Notes:
132+
- Brief justification or context here
133+
- Submitted CVE exception(s)? [Yes/No]
134+
135+
Status: [approved/rejected]
136+
```
137+
70138
## Using existing dependencies
71139

72140
Using an existing dependency is typically preferred over adding a new one.

‎src/platform/packages/shared/kbn-alerts-as-data-utils/src/schemas/generated/security_attack_discovery_schema.ts‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,11 +75,13 @@ const SecurityAttackDiscoveryAlertRequired = rt.type({
7575
'kibana.alert.attack_discovery.api_config': schemaUnknown,
7676
'kibana.alert.attack_discovery.details_markdown': schemaString,
7777
'kibana.alert.attack_discovery.details_markdown_with_replacements': schemaString,
78+
'kibana.alert.attack_discovery.replacements.uuid': schemaString,
79+
'kibana.alert.attack_discovery.replacements.value': schemaString,
7880
'kibana.alert.attack_discovery.summary_markdown': schemaString,
7981
'kibana.alert.attack_discovery.summary_markdown_with_replacements': schemaString,
8082
'kibana.alert.attack_discovery.title': schemaString,
8183
'kibana.alert.attack_discovery.title_with_replacements': schemaString,
82-
'kibana.alert.attack_discovery.users.id': schemaString,
84+
'kibana.alert.attack_discovery.users.name': schemaString,
8385
'kibana.alert.instance.id': schemaString,
8486
'kibana.alert.rule.category': schemaString,
8587
'kibana.alert.rule.consumer': schemaString,
@@ -105,9 +107,10 @@ const SecurityAttackDiscoveryAlertOptional = rt.partial({
105107
'kibana.alert.attack_discovery.mitre_attack_tactics': schemaStringArray,
106108
'kibana.alert.attack_discovery.replacements': schemaUnknown,
107109
'kibana.alert.attack_discovery.user.id': schemaString,
110+
'kibana.alert.attack_discovery.user.name': schemaString,
108111
'kibana.alert.attack_discovery.users': rt.array(
109112
rt.partial({
110-
name: schemaString,
113+
id: schemaString,
111114
})
112115
),
113116
'kibana.alert.case_ids': schemaStringArray,

‎src/platform/packages/shared/kbn-apm-synthtrace-client/index.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,5 +50,6 @@ export type {
5050
SynthtraceDynamicTemplate,
5151
} from './src/types';
5252
export { log, type LogDocument, LONG_FIELD_NAME } from './src/lib/logs';
53+
export { otelLog, type OtelLogDocument } from './src/lib/otel_logs';
5354
export { syntheticsMonitor, type SyntheticsMonitorDocument } from './src/lib/synthetics';
5455
export { type EntityFields, entities } from './src/lib/entities';

‎src/platform/packages/shared/kbn-apm-synthtrace-client/src/lib/otel_logs/index.ts‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
import { Fields } from '../entity';
10+
import { Serializable } from '../serializable';
11+
12+
export const LONG_FIELD_NAME =
13+
'thisisaverylongfieldnamethatevendoesnotcontainanyspaceswhyitcouldpotentiallybreakouruiinseveralplaces';
14+
15+
export type OtelLogDocument = Fields &
16+
Partial<{
17+
_index?: string;
18+
trace_id?: string;
19+
attributes?: Record<string, unknown>;
20+
severity_text?: string;
21+
resource?: {
22+
attributes?: Record<string, unknown>;
23+
};
24+
body?: {
25+
text?: string;
26+
structured?: Record<string, unknown>;
27+
};
28+
}>;
29+
30+
class OtelLog extends Serializable<OtelLogDocument> {
31+
constructor(fields: OtelLogDocument) {
32+
super({
33+
...fields,
34+
});
35+
}
36+
37+
private setResourceAttributeField(fieldName: string, value: string | number | boolean | null) {
38+
this.fields.resource = {
39+
...this.fields.resource,
40+
attributes: {
41+
...this.fields.resource?.attributes,
42+
[fieldName]: value,
43+
},
44+
};
45+
}
46+
47+
service(name: string) {
48+
this.setResourceAttributeField('service.name', name);
49+
return this;
50+
}
51+
52+
hostName(name: string) {
53+
this.setResourceAttributeField('host.name', name);
54+
return this;
55+
}
56+
57+
containerId(id: string) {
58+
this.setResourceAttributeField('container.id', id);
59+
return this;
60+
}
61+
62+
logLevel(level: string) {
63+
this.fields.severity_text = level;
64+
return this;
65+
}
66+
67+
message(message: string) {
68+
this.fields.body = {
69+
...this.fields.body,
70+
text: message,
71+
};
72+
return this;
73+
}
74+
75+
setHostIp(hostIp: string) {
76+
this.setResourceAttributeField('host.ip', hostIp);
77+
return this;
78+
}
79+
80+
timestamp(time: number) {
81+
super.timestamp(time);
82+
return this;
83+
}
84+
85+
addAttributes(attributes: Record<string, unknown>) {
86+
this.fields.attributes = {
87+
...this.fields.attributes,
88+
...attributes,
89+
};
90+
return this;
91+
}
92+
93+
addResourceAttributes(attributes: Record<string, unknown>) {
94+
this.fields.resource = {
95+
...this.fields.resource,
96+
attributes: {
97+
...this.fields.resource?.attributes,
98+
...attributes,
99+
},
100+
};
101+
return this;
102+
}
103+
104+
deleteField(fieldName: keyof OtelLogDocument) {
105+
delete this.fields[fieldName];
106+
return this;
107+
}
108+
}
109+
110+
function create(): OtelLog {
111+
return new OtelLog({
112+
_index: 'logs-generic.otel-default',
113+
});
114+
}
115+
116+
function createForIndex(index: string): OtelLog {
117+
return new OtelLog({
118+
_index: index,
119+
});
120+
}
121+
122+
export const otelLog = {
123+
create,
124+
createForIndex,
125+
};

0 commit comments

Comments
 (0)