Skip to content

Commit 5aef9eb

Browse files
tsgtsg
committed
Use new ECS TLS fields
1 parent 6ef0960 commit 5aef9eb

13 files changed

Lines changed: 104 additions & 345 deletions

File tree

‎x-pack/legacy/plugins/siem/public/components/page/network/tls_table/__snapshots__/index.test.tsx.snap‎

Lines changed: 12 additions & 23 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎x-pack/legacy/plugins/siem/public/components/page/network/tls_table/columns.tsx‎

Lines changed: 10 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,11 @@ export const getTlsColumns = (tableId: string): TlsColumns => [
3232
truncateText: false,
3333
hideForMobile: false,
3434
sortable: false,
35-
render: ({ _id, issuerNames }) =>
35+
render: ({ _id, issuers }) =>
3636
getRowItemDraggables({
37-
rowItems: issuerNames,
38-
attrName: 'tls.server_certificate.issuer.common_name',
39-
idPrefix: `${tableId}-${_id}-table-issuerNames`,
37+
rowItems: issuers,
38+
attrName: 'tls.server.issuer',
39+
idPrefix: `${tableId}-${_id}-table-issuers`,
4040
}),
4141
},
4242
{
@@ -45,18 +45,12 @@ export const getTlsColumns = (tableId: string): TlsColumns => [
4545
truncateText: false,
4646
hideForMobile: false,
4747
sortable: false,
48-
render: ({ _id, alternativeNames, commonNames }) =>
49-
alternativeNames != null && alternativeNames.length > 0
50-
? getRowItemDraggables({
51-
rowItems: alternativeNames,
52-
attrName: 'tls.server_certificate.alternative_names',
53-
idPrefix: `${tableId}-${_id}-table-alternative-name`,
54-
})
55-
: getRowItemDraggables({
56-
rowItems: commonNames,
57-
attrName: 'tls.server_certificate.subject.common_name',
58-
idPrefix: `${tableId}-${_id}-table-common-name`,
59-
}),
48+
render: ({ _id, subjects }) =>
49+
getRowItemDraggables({
50+
rowItems: subjects,
51+
attrName: 'tls.server.subject',
52+
idPrefix: `${tableId}-${_id}-table-subjects`,
53+
}),
6054
},
6155
{
6256
field: 'node._id',

‎x-pack/legacy/plugins/siem/public/components/page/network/tls_table/mock.ts‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,9 @@ export const mockTlsData: TlsData = {
1212
{
1313
node: {
1414
_id: '2fe3bdf168af35b9e0ce5dc583bab007c40d47de',
15-
alternativeNames: ['*.elastic.co', 'elastic.co'],
16-
commonNames: ['*.elastic.co'],
15+
subjects: ['*.elastic.co'],
1716
ja3: ['7851693188210d3b271aa1713d8c68c2', 'fb4726d465c5f28b84cd6d14cedd13a7'],
18-
issuerNames: ['DigiCert SHA2 Secure Server CA'],
17+
issuers: ['DigiCert SHA2 Secure Server CA'],
1918
notAfter: ['2021-04-22T12:00:00.000Z'],
2019
},
2120
cursor: {
@@ -25,10 +24,9 @@ export const mockTlsData: TlsData = {
2524
{
2625
node: {
2726
_id: '61749734b3246f1584029deb4f5276c64da00ada',
28-
alternativeNames: ['api.snapcraft.io'],
29-
commonNames: ['api.snapcraft.io'],
27+
subjects: ['api.snapcraft.io'],
3028
ja3: ['839868ad711dc55bde0d37a87f14740d'],
31-
issuerNames: ['DigiCert SHA2 Secure Server CA'],
29+
issuers: ['DigiCert SHA2 Secure Server CA'],
3230
notAfter: ['2019-05-22T12:00:00.000Z'],
3331
},
3432
cursor: {
@@ -38,10 +36,9 @@ export const mockTlsData: TlsData = {
3836
{
3937
node: {
4038
_id: '6560d3b7dd001c989b85962fa64beb778cdae47a',
41-
alternativeNames: ['changelogs.ubuntu.com', 'manpages.ubuntu.com'],
42-
commonNames: ['changelogs.ubuntu.com'],
39+
subjects: ['changelogs.ubuntu.com'],
4340
ja3: ['da12c94da8021bbaf502907ad086e7bc'],
44-
issuerNames: ["Let's Encrypt Authority X3"],
41+
issuers: ["Let's Encrypt Authority X3"],
4542
notAfter: ['2019-06-27T01:09:59.000Z'],
4643
},
4744
cursor: {

‎x-pack/legacy/plugins/siem/public/components/page/network/tls_table/translations.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ export const TRANSPORT_LAYER_SECURITY = i18n.translate(
1616
export const UNIT = (totalCount: number) =>
1717
i18n.translate('xpack.siem.network.ipDetails.tlsTable.unit', {
1818
values: { totalCount },
19-
defaultMessage: `{totalCount, plural, =1 {issuer} other {issuers}}`,
19+
defaultMessage: `{totalCount, plural, =1 {server certificate} other {server certificates}}`,
2020
});
2121

2222
// Columns

‎x-pack/legacy/plugins/siem/public/containers/tls/index.gql_query.ts‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,9 @@ export const tlsQuery = gql`
3333
edges {
3434
node {
3535
_id
36-
alternativeNames
37-
commonNames
36+
subjects
3837
ja3
39-
issuerNames
38+
issuers
4039
notAfter
4140
}
4241
cursor {

‎x-pack/legacy/plugins/siem/public/graphql/introspection.json‎

Lines changed: 2 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -9213,22 +9213,6 @@
92139213
"isDeprecated": false,
92149214
"deprecationReason": null
92159215
},
9216-
{
9217-
"name": "alternativeNames",
9218-
"description": "",
9219-
"args": [],
9220-
"type": {
9221-
"kind": "LIST",
9222-
"name": null,
9223-
"ofType": {
9224-
"kind": "NON_NULL",
9225-
"name": null,
9226-
"ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
9227-
}
9228-
},
9229-
"isDeprecated": false,
9230-
"deprecationReason": null
9231-
},
92329216
{
92339217
"name": "notAfter",
92349218
"description": "",
@@ -9246,7 +9230,7 @@
92469230
"deprecationReason": null
92479231
},
92489232
{
9249-
"name": "commonNames",
9233+
"name": "subjects",
92509234
"description": "",
92519235
"args": [],
92529236
"type": {
@@ -9278,7 +9262,7 @@
92789262
"deprecationReason": null
92799263
},
92809264
{
9281-
"name": "issuerNames",
9265+
"name": "issuers",
92829266
"description": "",
92839267
"args": [],
92849268
"type": {

‎x-pack/legacy/plugins/siem/public/graphql/types.ts‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1859,15 +1859,13 @@ export interface TlsNode {
18591859

18601860
timestamp?: Maybe<string>;
18611861

1862-
alternativeNames?: Maybe<string[]>;
1863-
18641862
notAfter?: Maybe<string[]>;
18651863

1866-
commonNames?: Maybe<string[]>;
1864+
subjects?: Maybe<string[]>;
18671865

18681866
ja3?: Maybe<string[]>;
18691867

1870-
issuerNames?: Maybe<string[]>;
1868+
issuers?: Maybe<string[]>;
18711869
}
18721870

18731871
export interface UncommonProcessesData {
@@ -5679,13 +5677,11 @@ export namespace GetTlsQuery {
56795677

56805678
_id: Maybe<string>;
56815679

5682-
alternativeNames: Maybe<string[]>;
5683-
5684-
commonNames: Maybe<string[]>;
5680+
subjects: Maybe<string[]>;
56855681

56865682
ja3: Maybe<string[]>;
56875683

5688-
issuerNames: Maybe<string[]>;
5684+
issuers: Maybe<string[]>;
56895685

56905686
notAfter: Maybe<string[]>;
56915687
};

‎x-pack/legacy/plugins/siem/server/graphql/tls/schema.gql.ts‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,10 @@ export const tlsSchema = gql`
1313
type TlsNode {
1414
_id: String
1515
timestamp: Date
16-
alternativeNames: [String!]
1716
notAfter: [String!]
18-
commonNames: [String!]
17+
subjects: [String!]
1918
ja3: [String!]
20-
issuerNames: [String!]
19+
issuers: [String!]
2120
}
2221
input TlsSortField {
2322
field: TlsFields!

‎x-pack/legacy/plugins/siem/server/graphql/types.ts‎

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1861,15 +1861,13 @@ export interface TlsNode {
18611861

18621862
timestamp?: Maybe<string>;
18631863

1864-
alternativeNames?: Maybe<string[]>;
1865-
18661864
notAfter?: Maybe<string[]>;
18671865

1868-
commonNames?: Maybe<string[]>;
1866+
subjects?: Maybe<string[]>;
18691867

18701868
ja3?: Maybe<string[]>;
18711869

1872-
issuerNames?: Maybe<string[]>;
1870+
issuers?: Maybe<string[]>;
18731871
}
18741872

18751873
export interface UncommonProcessesData {
@@ -7824,15 +7822,13 @@ export namespace TlsNodeResolvers {
78247822

78257823
timestamp?: TimestampResolver<Maybe<string>, TypeParent, TContext>;
78267824

7827-
alternativeNames?: AlternativeNamesResolver<Maybe<string[]>, TypeParent, TContext>;
7828-
78297825
notAfter?: NotAfterResolver<Maybe<string[]>, TypeParent, TContext>;
78307826

7831-
commonNames?: CommonNamesResolver<Maybe<string[]>, TypeParent, TContext>;
7827+
subjects?: SubjectsResolver<Maybe<string[]>, TypeParent, TContext>;
78327828

78337829
ja3?: Ja3Resolver<Maybe<string[]>, TypeParent, TContext>;
78347830

7835-
issuerNames?: IssuerNamesResolver<Maybe<string[]>, TypeParent, TContext>;
7831+
issuers?: IssuersResolver<Maybe<string[]>, TypeParent, TContext>;
78367832
}
78377833

78387834
export type _IdResolver<R = Maybe<string>, Parent = TlsNode, TContext = SiemContext> = Resolver<
@@ -7845,17 +7841,12 @@ export namespace TlsNodeResolvers {
78457841
Parent = TlsNode,
78467842
TContext = SiemContext
78477843
> = Resolver<R, Parent, TContext>;
7848-
export type AlternativeNamesResolver<
7849-
R = Maybe<string[]>,
7850-
Parent = TlsNode,
7851-
TContext = SiemContext
7852-
> = Resolver<R, Parent, TContext>;
78537844
export type NotAfterResolver<
78547845
R = Maybe<string[]>,
78557846
Parent = TlsNode,
78567847
TContext = SiemContext
78577848
> = Resolver<R, Parent, TContext>;
7858-
export type CommonNamesResolver<
7849+
export type SubjectsResolver<
78597850
R = Maybe<string[]>,
78607851
Parent = TlsNode,
78617852
TContext = SiemContext
@@ -7865,7 +7856,7 @@ export namespace TlsNodeResolvers {
78657856
Parent,
78667857
TContext
78677858
>;
7868-
export type IssuerNamesResolver<
7859+
export type IssuersResolver<
78697860
R = Maybe<string[]>,
78707861
Parent = TlsNode,
78717862
TContext = SiemContext

‎x-pack/legacy/plugins/siem/server/lib/tls/elasticsearch_adapter.ts‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,10 +66,9 @@ export const formatTlsEdges = (buckets: TlsBuckets[]): TlsEdges[] => {
6666
const edge: TlsEdges = {
6767
node: {
6868
_id: bucket.key,
69-
alternativeNames: bucket.alternative_names.buckets.map(({ key }) => key),
70-
commonNames: bucket.common_names.buckets.map(({ key }) => key),
69+
subjects: bucket.subjects.buckets.map(({ key }) => key),
7170
ja3: bucket.ja3.buckets.map(({ key }) => key),
72-
issuerNames: bucket.issuer_names.buckets.map(({ key }) => key),
71+
issuers: bucket.issuers.buckets.map(({ key }) => key),
7372
// eslint-disable-next-line @typescript-eslint/camelcase
7473
notAfter: bucket.not_after.buckets.map(({ key_as_string }) => key_as_string),
7574
},

0 commit comments

Comments
 (0)