[SIEM][CASE] ServiceNow executor by cnasikas · Pull Request #58894 · elastic/kibana

cnasikas · 2020-02-28T16:16:55Z

Summary

This PR implements a ServiceNow connector where one can create or update incidents to ServiceNow. The action is needed for the Case Management System.

Usage

Create action:

Create a ServiceNow action. See README for more information about the parameters.

Endpoint: api/action
Method: POST

Payload:

{
    "name": "ServiceNow",
    "actionTypeId": ".servicenow",
    "secrets": {
        "username": "username",
        "password": "password"
    },
    "config": {
        "apiUrl": "https://<instance>.service-now.com",
        "casesConfiguration": {
            "mapping": [
                {
                    "source": "title",
                    "target": "short_description",
                    "actionType": "nothing"
                },
                {
                    "source": "description",
                    "target": "description",
                    "actionType": "nothing"
                },
                {
                    "source": "comments",
                    "target": "comments",
                    "actionType": "nothing"
                }
            ]
        }
    }
}

Response:

{
    "id": "6dfba6ca-8efa-442c-9ab8-d91a50e5b430",
    "actionTypeId": ".servicenow",
    "name": "ServiceNow",
    "config": {
        "apiUrl": "https://<instance>.service-now.com",
        "casesConfiguration": {
            "mapping": [
                {
                    "source": "title",
                    "target": "short_description",
                    "actionType": "nothing"
                },
                {
                    "source": "description",
                    "target": "description",
                    "actionType": "nothing"
                },
                {
                    "source": "comments",
                    "target": "comments",
                    "actionType": "nothing"
                }
            ]
        }
    }
}

Create an incident:

Create an incident to ServiceNow. When the incidentId attribute is not in params the executor will create the incident.

Endpoint: api/action/<action_id>/_execute
Method: POST

Payload:

{
    "params": {
    	"caseId": "d4387ac5-0899-4dc2-bbfa-0dd605c934aa",
        "title": "A new incident",
        "description": "A description",
        "comments": [
            {
                "commentId": "b5b4c4d0-574e-11ea-9e2e-21b90f8a9631",
                "version": "WzU3LDFd",
                "comment": "A comment"
            }
        ]
    }
}

Response

{
    "status": "ok",
    "actionId": "f631be57-0a59-4e28-8833-16fc3b309374",
    "data": {
        "incidentId": "7d7aad9c072fc0100e48fbbf7c1ed0c2",
        "number": "INC0010044",
        "pushedDate": "2020-03-10T13:02:59.000Z",
        "comments": [
            {
                "commentId": "b5b4c4d0-574e-11ea-9e2e-21b90f8a9631",
                "pushedDate": "2020-03-10T13:03:00.000Z"
            }
        ]
    }
}

Update an incident:

Update an incident to ServiceNow. When the incidentId attribute is in params the executor will update the incident.

Endpoint: api/action/<action_id>/_execute
Method: POST

Payload:

{
    "params": {
    	"caseId": "d4387ac5-0899-4dc2-bbfa-0dd605c934aa",
        "incidentId": "7d7aad9c072fc0100e48fbbf7c1ed0c2"
        "title": "A new incident",
        "description": "A description",
        "comments": [
            {
                "commentId": "b5b4c4d0-574e-11ea-9e2e-21b90f8a9631",
                "version": "WzU3LDFd",
                "comment": "A comment"
            }
        ]
    }
}

Response

{
    "status": "ok",
    "actionId": "f631be57-0a59-4e28-8833-16fc3b309374",
    "data": {
        "incidentId": "7d7aad9c072fc0100e48fbbf7c1ed0c2",
        "number": "INC0010044",
        "pushedDate": "2020-03-10T13:02:59.000Z",
        "comments": [
            {
                "commentId": "b5b4c4d0-574e-11ea-9e2e-21b90f8a9631",
                "pushedDate": "2020-03-10T13:03:00.000Z"
            }
        ]
    }
}

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios

For maintainers

This was checked for breaking API changes and was labeled appropriately

elasticmachine · 2020-02-28T16:16:57Z

Pinging @elastic/siem (Team:SIEM)

elasticmachine · 2020-02-28T16:16:58Z

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

cnasikas · 2020-03-09T18:21:33Z

@elasticmachine merge upstream

peterschretlen · 2020-03-09T19:17:33Z

I noticed we don't have any docs regarding ServiceNow within plugins/actions/README.md. @peterschretlen I know you're converting those to asciidoc. Is the README still a place we should add documentation for ServiceNow or you've started something already?

Adding to the README would be great. If there's a README description I will take care of the asciidoc conversion when the time comes.

YulNaumenko

LGTM

cnasikas · 2020-03-10T17:14:11Z

@mikecote @YulNaumenko Thanks a lot for your review. I did a few small changes to the logic of the executor, especially how we treat comments. @mikecote I made the changes you requested.

mikecote

LGTM 👍 just one comment about the README.

x-pack/plugins/actions/README.md

* Refactor structure * Init ServiceNow class * Add constants * Add configuration scheme * Refactor configuration schema * Refactor parameters schema * Create new types * Add supported source fields * Create helpers * Create ServiceNow lib * Push incident * Declare private methods * Create UpdateIncident type * Create updateIncident method * Create executor actions * Refactor response * Test helpers * Remove unnecessary validation * Fix validation errors * Throw error for unsupported actions * Create mock incident * Test executor * Test ServiceNow lib * Convert to camelCase * Remove caller_id * Refactor helpers * Refactor schema * Remove executorAction * Test action handlers * Refactor tests * Create and update comments * Remove closure option & change attribute name * Fix tests * Change lib structure * Validate empty mapping * Fix functional tests * Fix type * Change API to only add comments through incident's API * Add instruction to README * Change API version * Test * Test simulator * Fix version on tests * Remove SIEM reference in README

kibanamachine · 2020-03-13T21:10:15Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: c7f4844

History

💚 Build #32378 succeeded c7f4844
💚 Build #32272 succeeded 5dc8062
💔 Build #32239 failed 42110b3
💔 Build #32218 failed da2edb952fe2890397025c539b6e3635473ee27d
💔 Build #32180 failed 68f9b6c48b6fff213510fb9c456894de49eb316e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cnasikas added WIP Work in progress Team:SIEM v8.0.0 release_note:skip Skip the PR/issue when compiling release notes v7.7.0 in progress Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// labels Feb 28, 2020

cnasikas changed the title ~~[SIEM][CASE] ServiceNow executor~~ [SIEM][CASE][skip-ci] ServiceNow executor Feb 28, 2020

cnasikas force-pushed the servicenow_api branch 3 times, most recently from 08482fa to 42cff02 Compare March 4, 2020 19:22

cnasikas mentioned this pull request Mar 4, 2020

[SIEM][CASES] Configure cases: Final #59358

Merged

3 tasks

cnasikas force-pushed the servicenow_api branch from a29ebf7 to fd2f119 Compare March 5, 2020 15:31

cnasikas added 15 commits March 6, 2020 11:11

Refactor structure

7a47cf5

Init ServiceNow class

4e940c1

Add constants

3d098d3

Add configuration scheme

58f6fd2

Refactor configuration schema

82fae42

Refactor parameters schema

8ef660a

Create new types

4e710ad

Add supported source fields

91a85a6

Create helpers

5af92be

Create ServiceNow lib

9585d6b

Push incident

709e1e5

Declare private methods

818f2fe

Create UpdateIncident type

b537fc6

Create updateIncident method

2f805bb

Create executor actions

cacef33

cnasikas added 2 commits March 9, 2020 20:26

Merge branch 'master' into servicenow_api

0dcb94f

Fix type

6d1c648

YulNaumenko approved these changes Mar 9, 2020

View reviewed changes

cnasikas added 4 commits March 10, 2020 15:05

Change API to only add comments through incident's API

74b3d44

Add instruction to README

62ab8fe

Change API version

03af835

Test

d992c51

cnasikas removed WIP Work in progress in progress labels Mar 10, 2020

cnasikas requested review from XavierM, mikecote and stephmilovic March 10, 2020 18:12

cnasikas force-pushed the servicenow_api branch from 68f9b6c to da2edb9 Compare March 10, 2020 19:37

Test simulator

42110b3

cnasikas force-pushed the servicenow_api branch from da2edb9 to 42110b3 Compare March 10, 2020 20:28

Fix version on tests

5dc8062

mikecote approved these changes Mar 11, 2020

View reviewed changes

x-pack/plugins/actions/README.md Outdated Show resolved Hide resolved

Remove SIEM reference in README

c7f4844

cnasikas merged commit e6327d3 into elastic:master Mar 11, 2020

cnasikas mentioned this pull request Mar 11, 2020

[7.x] [SIEM][CASE] ServiceNow executor (#58894) #59905

Merged

mikecote added release_note:enhancement and removed release_note:skip Skip the PR/issue when compiling release notes labels Apr 15, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SIEM][CASE] ServiceNow executor#58894

[SIEM][CASE] ServiceNow executor#58894
cnasikas merged 45 commits intoelastic:masterfrom
cnasikas:servicenow_api

cnasikas commented Feb 28, 2020 •

edited

Loading

Uh oh!

elasticmachine commented Feb 28, 2020

Uh oh!

elasticmachine commented Feb 28, 2020

Uh oh!

cnasikas commented Mar 9, 2020

Uh oh!

peterschretlen commented Mar 9, 2020

Uh oh!

YulNaumenko left a comment

Uh oh!

cnasikas commented Mar 10, 2020 •

edited

Loading

Uh oh!

mikecote left a comment

Uh oh!

Uh oh!

kibanamachine commented Mar 13, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

cnasikas commented Feb 28, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Usage

Create action:

Create an incident:

Update an incident:

Checklist

For maintainers

Uh oh!

elasticmachine commented Feb 28, 2020

Uh oh!

elasticmachine commented Feb 28, 2020

Uh oh!

cnasikas commented Mar 9, 2020

Uh oh!

peterschretlen commented Mar 9, 2020

Uh oh!

YulNaumenko left a comment

Choose a reason for hiding this comment

Uh oh!

cnasikas commented Mar 10, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mikecote left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kibanamachine commented Mar 13, 2020

💚 Build Succeeded

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

cnasikas commented Feb 28, 2020 •

edited

Loading

cnasikas commented Mar 10, 2020 •

edited

Loading