[Cases] Case action: Registration and Oracle by cnasikas · Pull Request #168370 · elastic/kibana

cnasikas · 2023-10-09T14:48:44Z

Summary

This PR is the first of many that will follow for the case connector (automatically create cases when firing a rule). The PR will be merged on a feature branch. Please refer to the Case Action RFC for further details. In this PR:

Init of case connector registration
Create the Cases Oracle SO
Create the CasesOracleService to interact with the Cases Oracle SO
Create the CryptoService to do cryptographic operations

Checklist

Delete any items that are not applicable to this PR.

Unit or functional tests were updated or added to match the most common scenarios

For maintainers

This was checked for breaking API changes and was labeled appropriately

…te --fix'

…o register_case_action

cnasikas · 2023-10-13T14:30:25Z

packages/kbn-check-mappings-update-cli/current_mappings.json

    "dynamic": false,
    "properties": {}
  },
+  "cases-oracle": {


This is a new saved object type that we will use for the case action. This PR will be merged on a feature branch and the definition may change as we develop.

Aren't we already sure the grouping_definition should be included?

We will not index the grouping_definition so it will not be included in the mapping.

elasticmachine · 2023-10-16T10:31:07Z

Pinging @elastic/response-ops (Team:ResponseOps)

elasticmachine · 2023-10-16T10:31:09Z

Pinging @elastic/response-ops-cases (Feature:Cases)

…te --fix'

…o register_case_action

adcoelho

LGTM I am just not familiar with the SubActionConnectors

adcoelho · 2023-10-19T10:16:51Z

x-pack/plugins/cases/server/connectors/cases/cases_oracle_service.ts

+      owner,
+      this.cryptoService.stringifyDeterministically(grouping),
+    ]
+      .filter(Boolean)


adcoelho · 2023-10-19T10:18:56Z

x-pack/plugins/cases/server/connectors/cases/cases_oracle_service.test.ts

+      const spaceId = 'default';
+      const owner = 'cases';
+      const grouping = { 'host.ip': '0.0.0.1', 'agent.id': '8a4f500d' };
+      const sortedGrouping = { 'agent.id': '8a4f500d', 'host.ip': '0.0.0.1' };


Where is this done in the implementation?

Here https://github.com/elastic/kibana/pull/168370/files/c210a0c9cefc167ac1c1339757ec8494729abb4e#diff-6d91ad0215d2086dc33208df409ca2e693725d41e076a04b4bee371b36cfabf6R24. json-stable-stringify always return a sorted version of the object. We need the order to be the same to produce the same hash for the same grouping no matter how the object is defined (order is not guaranteed by JS neither we should care in the application level).

adcoelho · 2023-10-19T10:21:33Z

x-pack/plugins/cases/server/connectors/cases/cases_oracle_service.test.ts

+      const spaceId = 'default';
+      const owner = 'cases';
+
+      // @ts-expect-error: ruleId and grouping are omitted for testing


Does ExclusiveUnion<OracleKeyWithOptionalKey, OracleKeyWithOptionalGrouping>; guarantee that either can be null but not both?

This is correct. As we throw an error either way I added a test to check it.

adcoelho · 2023-10-19T10:32:41Z

x-pack/plugins/cases/server/connectors/cases/cases_connector.ts

+  constructor(params: ServiceParams<CasesConnectorConfig, CasesConnectorSecrets>) {
+    super(params);
+
+    this.registerSubActions();


Where do i find more about what this and SubActionConnector are for?

The documentation is in https://github.com/elastic/kibana/blob/c8f83ed2eb18bb8e6d98ae9d01290a6fd1d193fc/x-pack/plugins/actions/server/sub_action_framework/README.md

adcoelho · 2023-10-19T10:35:51Z

x-pack/plugins/cases/server/connectors/cases/cases_oracle_service.ts

+
+  public async increaseCounter(recordId: string): Promise<OracleRecord> {
+    const { id: _, version, ...record } = await this.getRecord(recordId);
+    const newCounter = record.counter + 1;


will there be no hard limit for the counter? We will put a limit on the number of total cases that can be created on an execution but what about total cases?

This service is responsible for interacting with the cases-oracle saved object. It is the consumer's responsibility to impose any limits before updating the counter.

adcoelho · 2023-10-19T10:38:16Z

x-pack/plugins/cases/server/saved_object_types/cases_oracle.ts

+        type: 'date',
+      },
+      /*
+      grouping: {


Should this still be commented out?

No, we do not want to index the grouping at the moment. No plans to query the oracle about grouping. The other data are needed for telemetry purposes. They are not actually needed by the connector. It may change as we develop though.

adcoelho · 2023-10-19T10:39:31Z

packages/kbn-check-mappings-update-cli/current_mappings.json

    "dynamic": false,
    "properties": {}
  },
+  "cases-oracle": {


Aren't we already sure the grouping_definition should be included?

kibana-ci · 2023-10-23T17:11:21Z

💔 Build Failed

Failed CI Steps

Test Failures

[job] [logs] Serverless Osquery Cypress Tests #3 / ALL - Live Query should run multiline query should run multiline query
[job] [logs] Jest Tests #5 / EditConnector Edit external service on submit
[job] [logs] Jest Tests #5 / EditConnector resets to the initial connector onCancel
[job] [logs] Jest Tests #5 / EditConnector reverts to the initial selection if the caseData do not change
[job] [logs] Jest Integration Tests #5 / migration actions waitForPickupUpdatedMappingsTask resolves left wait_for_task_completion_timeout when the task does not complete within the timeout

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [f6c1ce9]

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @cnasikas

## Summary This PR is a continuation of the work for the Case action. This PR implements the basic logic of the case connector. Specifically: 1. Group the alerts based on the grouping provided by the user 2. Create the Oracle's SO IDs to fetch the records. If they do not exist they will get created and the counter will be set to 1. 3. Create the cases' SO IDs to fetch the Cases. If they do not exist they will get created. 4. Attach the alerts to the corresponding cases. Not in this PR: - Handle errors - Retries on errors - Reopen cases - Time window - Race conditions - Circuit breakers Depends on: #168370, #169484 ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

## Summary Depends on: #166267, #170326, #169484, #173740, #173763, #178068, #178307, #178600, #180437 PRs: - #168370 - #169229 - #171754 - #172709 - #173012 - #175107 - #175452 - #175505 - #177033 - #178277 - #177139 - #179796 Fixes: #153837 ## Testing Run Kibana with `--run-examples` if you want to use the "Always firing" rule. Create a rule with a case action in observability and the stack. The security solution is not supported. You should not be able to assign a case action in a security solution rule. 1. Test the "Reopen closed cases" configuration. 2. Test the "Grouping by" configuration. Only one field is allowed. Not all fields are persisted in alerts. If you select a field not part of the alert the case action will create a case where the grouping value is set to `unknow`. 3. Test the "Time window" feature. You can comment out the validation to test for shorter times. 4. Verify that the case action is experimental. 5. Verify that based on the rule type the case is created in the correct solution. 6. Verify that you cannot create a rule with the case action on the basic license. 7. Verify that the execution of the case action fails if you do not have permission for cases. Pending work on the system actions framework level to not allow users to create rules with system actions where they do not have permission. 8. Stress test the case action by creating multiple rules. ### Checklist Delete any items that are not applicable to this PR. - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) ## Release notes Automatically create cases when an alert is triggered. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: adcoelho <antonio.coelho@elastic.co> Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com>

cnasikas added 2 commits October 9, 2023 17:16

Register the case action

0e1bfb0

Register the cases oracle

4777f9c

cnasikas added release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// Feature:Cases Cases feature labels Oct 9, 2023

cnasikas self-assigned this Oct 9, 2023

cnasikas changed the title ~~[Cases]~~ [Cases] Case action: Registration and Oracle Oct 9, 2023

kibanamachine and others added 12 commits October 9, 2023 15:13

[CI] Auto-commit changed files from 'node scripts/check_mappings_upda…

65a88fa

…te --fix'

Calculate the hash of the record ID

eeb35a6

Merge branch 'register_case_action' of github.com:cnasikas/kibana int…

649dea9

…o register_case_action

Get oracle record

4491476

Rename folder

f4a81a1

Sort grouping definition

5822d73

Increase counter

df77537

Change grouping to record

9955239

Make the rule ID optional in the key

58bc3d6

Better types

581819a

Add version when updating

449a1b7

Improve types

c210a0c

cnasikas commented Oct 13, 2023

View reviewed changes

cnasikas added 4 commits October 13, 2023 17:35

Fix tests

c802637

Merge branch 'case_action' into register_case_action

b249032

Add model version and improve mapping

c120c97

Fix tests

043a9fe

cnasikas marked this pull request as ready for review October 16, 2023 10:31

cnasikas requested review from a team as code owners October 16, 2023 10:31

pgayvallet approved these changes Oct 16, 2023

View reviewed changes

cnasikas and others added 4 commits October 16, 2023 14:48

Fix mapping test

a9db13f

[CI] Auto-commit changed files from 'node scripts/check_mappings_upda…

32af9e3

…te --fix'

Merge branch 'case_action' into register_case_action

90acabf

Merge branch 'register_case_action' of github.com:cnasikas/kibana int…

b7605b7

…o register_case_action

cnasikas mentioned this pull request Oct 18, 2023

[Cases] Case action: Phase 2 #169229

Merged

2 tasks

adcoelho approved these changes Oct 19, 2023

View reviewed changes

jcger approved these changes Oct 23, 2023

View reviewed changes

Merge branch 'case_action' into register_case_action

a7f1ba1

cnasikas merged commit d5bbd8e into elastic:case_action Oct 23, 2023

cnasikas deleted the register_case_action branch October 23, 2023 17:13

cnasikas mentioned this pull request Nov 29, 2023

[Cases] Case action #168369

Merged

3 tasks

Conversation

cnasikas commented Oct 9, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

For maintainers

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Oct 16, 2023

Uh oh!

elasticmachine commented Oct 16, 2023

Uh oh!

adcoelho left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cnasikas Oct 19, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kibana-ci commented Oct 23, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

cnasikas commented Oct 9, 2023 •

edited

Loading

cnasikas Oct 19, 2023 •

edited

Loading

kibana-ci commented Oct 23, 2023 •

edited

Loading