Add separate config for Rule and Timeline saved objects

rylnd · rylnd · commit 6b09a1fc523d · 2020-04-16T16:57:27.000-05:00
We had previously used the savedObjects' config, but those are not
currently exposed to us on New Platform. For now, we're going to split
this into two sets of values for the SOs we deal with
importing/exporting within the SIEM app, with the same defaults as
savedObjects.
diff --git a/x-pack/plugins/siem/server/config.ts b/x-pack/plugins/siem/server/config.ts
@@ -11,8 +11,10 @@ import { SIGNALS_INDEX_KEY, DEFAULT_SIGNALS_INDEX } from '../common/constants';
 
 export const configSchema = schema.object({
   enabled: schema.boolean({ defaultValue: true }),
-  maxImportPayloadBytes: schema.number({ defaultValue: 10485760 }),
-  maxImportExportSize: schema.number({ defaultValue: 10000 }),
+  maxRuleImportExportSize: schema.number({ defaultValue: 10000 }),
+  maxRuleImportPayloadBytes: schema.number({ defaultValue: 10485760 }),
+  maxTimelineImportExportSize: schema.number({ defaultValue: 10000 }),
+  maxTimelineImportPayloadBytes: schema.number({ defaultValue: 10485760 }),
   [SIGNALS_INDEX_KEY]: schema.string({ defaultValue: DEFAULT_SIGNALS_INDEX }),
 });
 
diff --git a/x-pack/plugins/siem/server/lib/detection_engine/routes/__mocks__/index.ts b/x-pack/plugins/siem/server/lib/detection_engine/routes/__mocks__/index.ts
@@ -15,6 +15,8 @@ export { requestMock, requestContextMock, responseMock, serverMock };
 export const createMockConfig = () => ({
   enabled: true,
   [SIGNALS_INDEX_KEY]: DEFAULT_SIGNALS_INDEX,
-  maxImportPayloadBytes: 10485760,
-  maxImportExportSize: 10000,
+  maxRuleImportExportSize: 10000,
+  maxRuleImportPayloadBytes: 10485760,
+  maxTimelineImportExportSize: 10000,
+  maxTimelineImportPayloadBytes: 10485760,
 });
diff --git a/x-pack/plugins/siem/server/lib/detection_engine/routes/rules/export_rules_route.ts b/x-pack/plugins/siem/server/lib/detection_engine/routes/rules/export_rules_route.ts
@@ -35,7 +35,7 @@ export const exportRulesRoute = (router: IRouter, config: ConfigType) => {
       }
 
       try {
-        const exportSizeLimit = config.maxImportExportSize;
+        const exportSizeLimit = config.maxRuleImportExportSize;
         if (request.body?.objects != null && request.body.objects.length > exportSizeLimit) {
           return siemResponse.error({
             statusCode: 400,
diff --git a/x-pack/plugins/siem/server/lib/detection_engine/routes/rules/import_rules_route.ts b/x-pack/plugins/siem/server/lib/detection_engine/routes/rules/import_rules_route.ts
@@ -49,7 +49,7 @@ export const importRulesRoute = (router: IRouter, config: ConfigType) => {
       options: {
         tags: ['access:siem'],
         body: {
-          maxBytes: config.maxImportPayloadBytes,
+          maxBytes: config.maxRuleImportPayloadBytes,
           output: 'stream',
         },
       },
@@ -77,7 +77,7 @@ export const importRulesRoute = (router: IRouter, config: ConfigType) => {
           });
         }
 
-        const objectLimit = config.maxImportExportSize;
+        const objectLimit = config.maxRuleImportExportSize;
         const readStream = createRulesStreamFromNdJson(objectLimit);
         const parsedObjects = await createPromiseFromStreams<PromiseFromStreams[]>([
           request.body.file,
diff --git a/x-pack/plugins/siem/server/lib/timeline/routes/export_timelines_route.ts b/x-pack/plugins/siem/server/lib/timeline/routes/export_timelines_route.ts
@@ -34,7 +34,7 @@ export const exportTimelinesRoute = (router: IRouter, config: ConfigType) => {
       try {
         const siemResponse = buildSiemResponse(response);
         const savedObjectsClient = context.core.savedObjects.client;
-        const exportSizeLimit = config.maxImportExportSize;
+        const exportSizeLimit = config.maxTimelineImportExportSize;
 
         if (request.body?.ids != null && request.body.ids.length > exportSizeLimit) {
           return siemResponse.error({
diff --git a/x-pack/plugins/siem/server/lib/timeline/routes/import_timelines_route.ts b/x-pack/plugins/siem/server/lib/timeline/routes/import_timelines_route.ts
@@ -56,7 +56,7 @@ export const importTimelinesRoute = (
       options: {
         tags: ['access:siem'],
         body: {
-          maxBytes: config.maxImportPayloadBytes,
+          maxBytes: config.maxTimelineImportPayloadBytes,
           output: 'stream',
         },
       },
@@ -81,7 +81,7 @@ export const importTimelinesRoute = (
           });
         }
 
-        const objectLimit = config.maxImportExportSize;
+        const objectLimit = config.maxTimelineImportExportSize;
 
         const readStream = createTimelinesStreamFromNdJson(objectLimit);
         const parsedObjects = await createPromiseFromStreams<PromiseFromStreams[]>([

Original file line number	Diff line number	Diff line change
`@@ -35,7 +35,7 @@ export const exportRulesRoute = (router: IRouter, config: ConfigType) => {`
`35`	`35`	`}`
`36`	`36`
`37`	`37`	`try {`
`38`		`- const exportSizeLimit = config.maxImportExportSize;`
	`38`	`+ const exportSizeLimit = config.maxRuleImportExportSize;`
`39`	`39`	`if (request.body?.objects != null && request.body.objects.length > exportSizeLimit) {`
`40`	`40`	`return siemResponse.error({`
`41`	`41`	`statusCode: 400,`