-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Security Solution][Endpoint] Add support for spaces to DEV CLI scrip…
…ts (#192525) ## Summary The following changes were made to dev's CLI tooling: - support for space ID (`--spaceId`) was added to the following CLI [dev scripts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/scripts/endpoint): - `run_endpoint_agent.js` - `run_sentinelone_host.js` - Support API key (`--apiKey`) was dded to the `run_sentinelone_host.js` CLI dev script (can now run script against cloud intances) - Fleet Agent Policies created via our scripting common methods will now set the `namespace` on the agent policy to match the active space - A few areas of scripting were also updated so that Integration Policies no longer define a `namespace`, thus allowing for it to default to the Agent Policy `namespace` value - SentinelOne SIEM rule, created when the `run_sentinelone_host` script is run, will now set the namespace on the index patterns (retrieved from the integration policy created) - Ensures that the rule only pulls data from the scope (`namespace`) the integration policy is setup with - The space id was added to the VM name when creating an Endpoint or Sentinelone VM (will help to identify what space a VM belongs to)
- Loading branch information
1 parent
c1b7d82
commit 25225c3
Showing
12 changed files
with
287 additions
and
45 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
85 changes: 85 additions & 0 deletions
85
x-pack/plugins/security_solution/scripts/endpoint/common/spaces.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| import type { KbnClient } from '@kbn/test'; | ||
| import { AxiosError } from 'axios'; | ||
| import type { ToolingLog } from '@kbn/tooling-log'; | ||
| import type { Space } from '@kbn/spaces-plugin/common'; | ||
| import { DEFAULT_SPACE_ID, getSpaceIdFromPath } from '@kbn/spaces-plugin/common'; | ||
| import { memoize } from 'lodash'; | ||
| import { createToolingLogger } from '../../../common/endpoint/data_loaders/utils'; | ||
| import { catchAxiosErrorFormatAndThrow } from '../../../common/endpoint/format_axios_error'; | ||
|
|
||
| /** | ||
| * Check that a given space id exists in Kibana and created it if not. | ||
| */ | ||
| export const ensureSpaceIdExists = async ( | ||
| kbnClient: KbnClient, | ||
| /** If space id is not defined, it will be derived from the `KbnClient` kibana url */ | ||
| spaceId: string = getSpaceIdFromKbnClientUrl(kbnClient).spaceId, | ||
| { log = createToolingLogger() }: { log?: ToolingLog } = {} | ||
| ): Promise<void> => { | ||
| if (!spaceId || spaceId === DEFAULT_SPACE_ID) { | ||
| return; | ||
| } | ||
|
|
||
| const alreadyExists = await kbnClient.spaces | ||
| .get(spaceId) | ||
| .then(() => { | ||
| log.debug(`Space id [${spaceId}] already exists. Nothing to do.`); | ||
| return true; | ||
| }) | ||
| .catch((err) => { | ||
| if (err instanceof AxiosError && (err.response?.status ?? err.status) === 404) { | ||
| return false; | ||
| } | ||
|
|
||
| throw err; | ||
| }) | ||
| .catch(catchAxiosErrorFormatAndThrow); | ||
|
|
||
| if (!alreadyExists) { | ||
| log.info(`Creating space id [${spaceId}]`); | ||
|
|
||
| await kbnClient.spaces | ||
| .create({ | ||
| name: spaceId, | ||
| id: spaceId, | ||
| }) | ||
| .catch(catchAxiosErrorFormatAndThrow); | ||
| } | ||
| }; | ||
|
|
||
| /** | ||
| * Get the current active space for the provided KbnClient | ||
| * | ||
| * NOTE: this utility may generate a `404` error if the `KbnClient` has been | ||
| * initialized for a specific space, but that space does not yet exist. | ||
| * | ||
| * @param kbnClient | ||
| */ | ||
| export const fetchActiveSpace = memoize(async (kbnClient: KbnClient): Promise<Space> => { | ||
| return kbnClient | ||
| .request<Space>({ | ||
| method: 'GET', | ||
| path: `/internal/spaces/_active_space`, | ||
| }) | ||
| .catch(catchAxiosErrorFormatAndThrow) | ||
| .then((response) => response.data); | ||
| }); | ||
|
|
||
| /** | ||
| * Returns the space id that the provided KbnClient was initialized for by parsting its url | ||
| * @param kbnClient | ||
| */ | ||
| export const getSpaceIdFromKbnClientUrl = ( | ||
| kbnClient: KbnClient | ||
| ): ReturnType<typeof getSpaceIdFromPath> => { | ||
| const newUrl = new URL(kbnClient.resolveUrl('/')); | ||
|
|
||
| return getSpaceIdFromPath(newUrl.pathname); // NOTE: we are not currently supporting a Kibana base path prefix | ||
| }; |
Oops, something went wrong.