Skip to content

Commit feebee2

Browse files
shahzad31shahzad31
authored
Merge branch 'main' into remove-extra-overview
2 parents df4e583 + 27f5da4 commit feebee2

62 files changed

Lines changed: 2304 additions & 97 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.buildkite/ftr_security_serverless_configs.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ enabled:
8181
- x-pack/test/security_solution_api_integration/test_suites/genai/knowledge_base/entries/trial_license_complete_tier/configs/serverless.config.ts
8282
- x-pack/test/security_solution_api_integration/test_suites/entity_analytics/risk_engine/trial_license_complete_tier/configs/serverless.config.ts
8383
- x-pack/test/security_solution_api_integration/test_suites/entity_analytics/risk_engine/basic_license_essentials_tier/configs/serverless.config.ts
84+
- x-pack/test/security_solution_api_integration/test_suites/entity_analytics/entity_store/trial_license_complete_tier/configs/serverless.config.ts
8485
- x-pack/test/security_solution_api_integration/test_suites/lists_and_exception_lists/exception_lists_items/trial_license_complete_tier/configs/serverless.config.ts
8586
- x-pack/test/security_solution_api_integration/test_suites/lists_and_exception_lists/lists_items/trial_license_complete_tier/configs/serverless.config.ts
8687
- x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/configs/serverless.config.ts

‎.buildkite/ftr_security_stateful_configs.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ enabled:
6262
- x-pack/test/security_solution_api_integration/test_suites/detections_response/user_roles/trial_license_complete_tier/configs/ess.config.ts
6363
- x-pack/test/security_solution_api_integration/test_suites/entity_analytics/risk_engine/trial_license_complete_tier/configs/ess.config.ts
6464
- x-pack/test/security_solution_api_integration/test_suites/entity_analytics/risk_engine/basic_license_essentials_tier/configs/ess.config.ts
65+
- x-pack/test/security_solution_api_integration/test_suites/entity_analytics/entity_store/trial_license_complete_tier/configs/ess.config.ts
6566
- x-pack/test/security_solution_api_integration/test_suites/lists_and_exception_lists/exception_lists_items/trial_license_complete_tier/configs/ess.config.ts
6667
- x-pack/test/security_solution_api_integration/test_suites/lists_and_exception_lists/lists_items/trial_license_complete_tier/configs/ess.config.ts
6768
- x-pack/test/security_solution_api_integration/test_suites/explore/hosts/trial_license_complete_tier/configs/ess.config.ts

‎packages/kbn-securitysolution-endpoint-exceptions-common/docs/openapi/ess/security_solution_endpoint_exceptions_api_2023_10_31.bundled.schema.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,8 @@ paths:
5252
$ref: '#/components/schemas/SiemErrorResponse'
5353
description: Internal server error
5454
summary: Create an endpoint exception list
55+
tags:
56+
- Security Solution Endpoint Exceptions API
5557
/api/endpoint_list/items:
5658
delete:
5759
description: >-
@@ -111,6 +113,8 @@ paths:
111113
$ref: '#/components/schemas/SiemErrorResponse'
112114
description: Internal server error
113115
summary: Delete an endpoint exception list item
116+
tags:
117+
- Security Solution Endpoint Exceptions API
114118
get:
115119
description: >-
116120
Get the details of an endpoint exception list item using the `id` or
@@ -171,6 +175,8 @@ paths:
171175
$ref: '#/components/schemas/SiemErrorResponse'
172176
description: Internal server error
173177
summary: Get an endpoint exception list item
178+
tags:
179+
- Security Solution Endpoint Exceptions API
174180
post:
175181
description: >-
176182
Create an endpoint exception list item, and associate it with the
@@ -250,6 +256,8 @@ paths:
250256
$ref: '#/components/schemas/SiemErrorResponse'
251257
description: Internal server error
252258
summary: Create an endpoint exception list item
259+
tags:
260+
- Security Solution Endpoint Exceptions API
253261
put:
254262
description: >-
255263
Update an endpoint exception list item using the `id` or `item_id`
@@ -334,6 +342,8 @@ paths:
334342
$ref: '#/components/schemas/SiemErrorResponse'
335343
description: Internal server error
336344
summary: Update an endpoint exception list item
345+
tags:
346+
- Security Solution Endpoint Exceptions API
337347
/api/endpoint_list/items/_find:
338348
get:
339349
description: Get a list of all endpoint exception list items.
@@ -439,6 +449,8 @@ paths:
439449
$ref: '#/components/schemas/SiemErrorResponse'
440450
description: Internal server error
441451
summary: Get endpoint exception list items
452+
tags:
453+
- Security Solution Endpoint Exceptions API
442454
components:
443455
schemas:
444456
EndpointList:
@@ -867,3 +879,9 @@ components:
867879
type: http
868880
security:
869881
- BasicAuth: []
882+
tags:
883+
- description: >-
884+
Endpoint Exceptions API allows you to manage detection rule endpoint
885+
exceptions to prevent a rule from generating an alert from incoming events
886+
even when the rule's other criteria are met.
887+
name: Security Solution Endpoint Exceptions API

‎packages/kbn-securitysolution-endpoint-exceptions-common/docs/openapi/serverless/security_solution_endpoint_exceptions_api_2023_10_31.bundled.schema.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,8 @@ paths:
5252
$ref: '#/components/schemas/SiemErrorResponse'
5353
description: Internal server error
5454
summary: Create an endpoint exception list
55+
tags:
56+
- Security Solution Endpoint Exceptions API
5557
/api/endpoint_list/items:
5658
delete:
5759
description: >-
@@ -111,6 +113,8 @@ paths:
111113
$ref: '#/components/schemas/SiemErrorResponse'
112114
description: Internal server error
113115
summary: Delete an endpoint exception list item
116+
tags:
117+
- Security Solution Endpoint Exceptions API
114118
get:
115119
description: >-
116120
Get the details of an endpoint exception list item using the `id` or
@@ -171,6 +175,8 @@ paths:
171175
$ref: '#/components/schemas/SiemErrorResponse'
172176
description: Internal server error
173177
summary: Get an endpoint exception list item
178+
tags:
179+
- Security Solution Endpoint Exceptions API
174180
post:
175181
description: >-
176182
Create an endpoint exception list item, and associate it with the
@@ -250,6 +256,8 @@ paths:
250256
$ref: '#/components/schemas/SiemErrorResponse'
251257
description: Internal server error
252258
summary: Create an endpoint exception list item
259+
tags:
260+
- Security Solution Endpoint Exceptions API
253261
put:
254262
description: >-
255263
Update an endpoint exception list item using the `id` or `item_id`
@@ -334,6 +342,8 @@ paths:
334342
$ref: '#/components/schemas/SiemErrorResponse'
335343
description: Internal server error
336344
summary: Update an endpoint exception list item
345+
tags:
346+
- Security Solution Endpoint Exceptions API
337347
/api/endpoint_list/items/_find:
338348
get:
339349
description: Get a list of all endpoint exception list items.
@@ -439,6 +449,8 @@ paths:
439449
$ref: '#/components/schemas/SiemErrorResponse'
440450
description: Internal server error
441451
summary: Get endpoint exception list items
452+
tags:
453+
- Security Solution Endpoint Exceptions API
442454
components:
443455
schemas:
444456
EndpointList:
@@ -867,3 +879,9 @@ components:
867879
type: http
868880
security:
869881
- BasicAuth: []
882+
tags:
883+
- description: >-
884+
Endpoint Exceptions API allows you to manage detection rule endpoint
885+
exceptions to prevent a rule from generating an alert from incoming events
886+
even when the rule's other criteria are met.
887+
name: Security Solution Endpoint Exceptions API

‎packages/kbn-securitysolution-endpoint-exceptions-common/scripts/openapi_bundle.js‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,13 @@ const ROOT = resolve(__dirname, '..');
2727
title: 'Security Solution Endpoint Exceptions API (Elastic Cloud Serverless)',
2828
description: 'Endpoint Exceptions API allow you to manage Endpoint lists.',
2929
},
30+
tags: [
31+
{
32+
name: 'Security Solution Endpoint Exceptions API',
33+
description:
34+
"Endpoint Exceptions API allows you to manage detection rule endpoint exceptions to prevent a rule from generating an alert from incoming events even when the rule's other criteria are met.",
35+
},
36+
],
3037
},
3138
},
3239
});
@@ -44,6 +51,13 @@ const ROOT = resolve(__dirname, '..');
4451
title: 'Security Solution Endpoint Exceptions API (Elastic Cloud and self-hosted)',
4552
description: 'Endpoint Exceptions API allow you to manage Endpoint lists.',
4653
},
54+
tags: [
55+
{
56+
name: 'Security Solution Endpoint Exceptions API',
57+
description:
58+
"Endpoint Exceptions API allows you to manage detection rule endpoint exceptions to prevent a rule from generating an alert from incoming events even when the rule's other criteria are met.",
59+
},
60+
],
4761
},
4862
},
4963
});

‎x-pack/plugins/cases/server/telemetry/collect_telemetry_data.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ import { getCasesSystemActionData } from './queries/case_system_action';
1111
import { getUserCommentsTelemetryData } from './queries/comments';
1212
import { getConfigurationTelemetryData } from './queries/configuration';
1313
import { getConnectorsTelemetryData } from './queries/connectors';
14-
import { getPushedTelemetryData } from './queries/pushes';
14+
import { getPushedTelemetryData } from './queries/push';
1515
import { getUserActionsTelemetryData } from './queries/user_actions';
1616
import type { CasesTelemetry, CollectTelemetryDataParams } from './types';
1717

‎x-pack/plugins/cases/server/telemetry/index.ts‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,7 @@
55
* 2.0.
66
*/
77

8-
import type {
9-
CoreSetup,
10-
ISavedObjectsRepository,
11-
Logger,
12-
PluginInitializerContext,
13-
} from '@kbn/core/server';
8+
import type { CoreSetup, Logger, PluginInitializerContext } from '@kbn/core/server';
149
import { SavedObjectsErrorHelpers } from '@kbn/core/server';
1510
import type { TaskManagerSetupContract } from '@kbn/task-manager-plugin/server';
1611
import type { UsageCollectionSetup } from '@kbn/usage-collection-plugin/server';
@@ -25,6 +20,7 @@ import {
2520
} from '../../common/constants';
2621
import type { CasesTelemetry } from './types';
2722
import { casesSchema } from './schema';
23+
import { TelemetrySavedObjectsClient } from './telemetry_saved_objects_client';
2824

2925
export { scheduleCasesTelemetryTask } from './schedule_telemetry_task';
3026

@@ -42,13 +38,18 @@ export const createCasesTelemetry = ({
4238
usageCollection,
4339
logger,
4440
}: CreateCasesTelemetryArgs) => {
45-
const getInternalSavedObjectClient = async (): Promise<ISavedObjectsRepository> => {
41+
const getInternalSavedObjectClient = async (): Promise<TelemetrySavedObjectsClient> => {
4642
const [coreStart] = await core.getStartServices();
47-
return coreStart.savedObjects.createInternalRepository([
43+
const soClient = coreStart.savedObjects.createInternalRepository([
4844
...SAVED_OBJECT_TYPES,
4945
FILE_SO_TYPE,
5046
CASE_RULES_SAVED_OBJECT,
5147
]);
48+
49+
// Wrapping the internalRepository with the `TelemetrySavedObjectsClient`
50+
// to ensure some best practices when collecting "all the telemetry"
51+
// (i.e.: `.find` requests should query all spaces)
52+
return new TelemetrySavedObjectsClient(soClient);
5253
};
5354

5455
taskManager.registerTaskDefinitions({

‎x-pack/plugins/cases/server/telemetry/queries/alerts.test.ts‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,15 @@
77

88
import { loggingSystemMock, savedObjectsRepositoryMock } from '@kbn/core/server/mocks';
99
import { getAlertsTelemetryData } from './alerts';
10+
import { TelemetrySavedObjectsClient } from '../telemetry_saved_objects_client';
1011

1112
describe('alerts', () => {
1213
const logger = loggingSystemMock.createLogger();
1314

1415
describe('getAlertsTelemetryData', () => {
1516
const savedObjectsClient = savedObjectsRepositoryMock.create();
17+
const telemetrySavedObjectsClient = new TelemetrySavedObjectsClient(savedObjectsClient);
18+
1619
savedObjectsClient.find.mockResolvedValue({
1720
total: 5,
1821
saved_objects: [],
@@ -35,7 +38,10 @@ describe('alerts', () => {
3538
});
3639

3740
it('it returns the correct res', async () => {
38-
const res = await getAlertsTelemetryData({ savedObjectsClient, logger });
41+
const res = await getAlertsTelemetryData({
42+
savedObjectsClient: telemetrySavedObjectsClient,
43+
logger,
44+
});
3945
expect(res).toEqual({
4046
all: {
4147
total: 5,
@@ -48,7 +54,7 @@ describe('alerts', () => {
4854
});
4955

5056
it('should call find with correct arguments', async () => {
51-
await getAlertsTelemetryData({ savedObjectsClient, logger });
57+
await getAlertsTelemetryData({ savedObjectsClient: telemetrySavedObjectsClient, logger });
5258
expect(savedObjectsClient.find).toBeCalledWith({
5359
aggs: {
5460
counts: {
@@ -117,6 +123,7 @@ describe('alerts', () => {
117123
page: 0,
118124
perPage: 0,
119125
type: 'cases-comments',
126+
namespaces: ['*'],
120127
});
121128
});
122129
});

‎x-pack/plugins/cases/server/telemetry/queries/case_system_action.test.ts‎

Lines changed: 48 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,14 @@
77

88
import { loggingSystemMock, savedObjectsRepositoryMock } from '@kbn/core/server/mocks';
99
import { getCasesSystemActionData } from './case_system_action';
10+
import { TelemetrySavedObjectsClient } from '../telemetry_saved_objects_client';
1011

1112
describe('casesSystemAction', () => {
1213
const logger = loggingSystemMock.createLogger();
1314

1415
describe('getCasesSystemActionData', () => {
1516
const savedObjectsClient = savedObjectsRepositoryMock.create();
17+
const telemetrySavedObjectsClient = new TelemetrySavedObjectsClient(savedObjectsClient);
1618

1719
beforeEach(() => {
1820
jest.clearAllMocks();
@@ -26,7 +28,10 @@ describe('casesSystemAction', () => {
2628
});
2729

2830
it('calculates the metrics correctly', async () => {
29-
const res = await getCasesSystemActionData({ savedObjectsClient, logger });
31+
const res = await getCasesSystemActionData({
32+
savedObjectsClient: telemetrySavedObjectsClient,
33+
logger,
34+
});
3035
expect(res).toEqual({ totalCasesCreated: 4, totalRules: 2 });
3136
});
3237

@@ -38,8 +43,49 @@ describe('casesSystemAction', () => {
3843
page: 1,
3944
});
4045

41-
const res = await getCasesSystemActionData({ savedObjectsClient, logger });
46+
const res = await getCasesSystemActionData({
47+
savedObjectsClient: telemetrySavedObjectsClient,
48+
logger,
49+
});
50+
4251
expect(res).toEqual({ totalCasesCreated: 0, totalRules: 0 });
4352
});
53+
54+
it('should call find with correct arguments', async () => {
55+
savedObjectsClient.find.mockResolvedValue({
56+
total: 1,
57+
saved_objects: [],
58+
per_page: 1,
59+
page: 1,
60+
});
61+
62+
await getCasesSystemActionData({
63+
savedObjectsClient: telemetrySavedObjectsClient,
64+
logger,
65+
});
66+
67+
expect(savedObjectsClient.find.mock.calls[0][0]).toMatchInlineSnapshot(`
68+
Object {
69+
"aggs": Object {
70+
"counterSum": Object {
71+
"sum": Object {
72+
"field": "cases-rules.attributes.counter",
73+
},
74+
},
75+
"totalRules": Object {
76+
"cardinality": Object {
77+
"field": "cases-rules.attributes.rules.id",
78+
},
79+
},
80+
},
81+
"namespaces": Array [
82+
"*",
83+
],
84+
"page": 1,
85+
"perPage": 1,
86+
"type": "cases-rules",
87+
}
88+
`);
89+
});
4490
});
4591
});

‎x-pack/plugins/cases/server/telemetry/queries/case_system_action.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ export const getCasesSystemActionData = async ({
2626
cardinality: { field: `${CASE_RULES_SAVED_OBJECT}.attributes.rules.id` },
2727
},
2828
},
29+
namespaces: ['*'],
2930
});
3031

3132
return {

0 commit comments

Comments
 (0)