[SIEM] Additional Overview Network & Hosts metrics (#38005) (#38275)

[SIEM] Additional Overview Network & Hosts metrics (#38005)
elastic · Jun 6, 2019 · 60deade · 60deade
1 parent 05757eb
commit 60deade
Show file tree

Hide file tree

Showing 21 changed files with 508 additions and 101 deletions.
diff --git a/x-pack/plugins/siem/public/components/page/overview/overview_host/index.tsx b/x-pack/plugins/siem/public/components/page/overview/overview_host/index.tsx
@@ -37,10 +37,7 @@ export const OverviewHost = pure<OverviewHostProps>(({ endDate, startDate, setQu
           />
         }
         title={
-          <FormattedMessage
-            id="xpack.siem.overview.hostsTitle"
-            defaultMessage="Host Beats Events"
-          />
+          <FormattedMessage id="xpack.siem.overview.hostsTitle" defaultMessage="Host Events" />
         }
       >
         <EuiButton href="#/link-to/hosts">

diff --git a/...iem/public/components/page/overview/overview_host_stats/__snapshots__/index.test.tsx.snap b/...iem/public/components/page/overview/overview_host_stats/__snapshots__/index.test.tsx.snap
diff --git a/x-pack/plugins/siem/public/components/page/overview/overview_host_stats/index.tsx b/x-pack/plugins/siem/public/components/page/overview/overview_host_stats/index.tsx
@@ -98,6 +98,27 @@ const overviewHostStats = (data: OverviewHostData) => [
       />
     ),
   },
+  {
+    description:
+      has('filebeatSystemModule', data) && data.filebeatSystemModule !== null
+        ? numeral(data.filebeatSystemModule).format('0,0')
+        : getEmptyTagValue(),
+    title: (
+      <FormattedMessage
+        id="xpack.siem.overview.filebeatSystemModuleTitle"
+        defaultMessage="Filebeat System Module"
+      />
+    ),
+  },
+  {
+    description:
+      has('winlogbeat', data) && data.winlogbeat !== null
+        ? numeral(data.winlogbeat).format('0,0')
+        : getEmptyTagValue(),
+    title: (
+      <FormattedMessage id="xpack.siem.overview.winlogbeatTitle" defaultMessage="Winlogbeat" />
+    ),
+  },
 ];
 
 export const DescriptionListDescription = styled(EuiDescriptionListDescription)`

diff --git a/x-pack/plugins/siem/public/components/page/overview/overview_host_stats/mock.ts b/x-pack/plugins/siem/public/components/page/overview/overview_host_stats/mock.ts
@@ -14,5 +14,7 @@ export const mockData: { OverviewHost: OverviewHostData } = {
     auditbeatPackage: 2003,
     auditbeatProcess: 1200,
     auditbeatUser: 1979,
+    filebeatSystemModule: 568,
+    winlogbeat: 296999,
   },
 };
diff --git a/x-pack/plugins/siem/public/components/page/overview/overview_network/index.tsx b/x-pack/plugins/siem/public/components/page/overview/overview_network/index.tsx
@@ -37,10 +37,7 @@ export const OverviewNetwork = pure<OwnProps>(({ endDate, startDate, setQuery })
           />
         }
         title={
-          <FormattedMessage
-            id="xpack.siem.overview.networkTitle"
-            defaultMessage="Network Beats Events"
-          />
+          <FormattedMessage id="xpack.siem.overview.networkTitle" defaultMessage="Network Events" />
         }
       >
         <EuiButton href="#/link-to/network/">

diff --git a/.../public/components/page/overview/overview_network_stats/__snapshots__/index.test.tsx.snap b/.../public/components/page/overview/overview_network_stats/__snapshots__/index.test.tsx.snap
diff --git a/x-pack/plugins/siem/public/components/page/overview/overview_network_stats/index.tsx b/x-pack/plugins/siem/public/components/page/overview/overview_network_stats/index.tsx
@@ -38,6 +38,42 @@ const overviewNetworkStats = (data: OverviewNetworkData) => [
       />
     ),
   },
+  {
+    description:
+      has('filebeatCisco', data) && data.filebeatCisco !== null
+        ? numeral(data.filebeatCisco).format('0,0')
+        : getEmptyTagValue(),
+    title: (
+      <FormattedMessage
+        id="xpack.siem.overview.filebeatCiscoTitle"
+        defaultMessage="Filebeat Cisco"
+      />
+    ),
+  },
+  {
+    description:
+      has('filebeatNetflow', data) && data.filebeatNetflow !== null
+        ? numeral(data.filebeatNetflow).format('0,0')
+        : getEmptyTagValue(),
+    title: (
+      <FormattedMessage
+        id="xpack.siem.overview.filebeatNetflowTitle"
+        defaultMessage="Filebeat Netflow"
+      />
+    ),
+  },
+  {
+    description:
+      has('filebeatPanw', data) && data.filebeatPanw !== null
+        ? numeral(data.filebeatPanw).format('0,0')
+        : getEmptyTagValue(),
+    title: (
+      <FormattedMessage
+        id="xpack.siem.overview.filebeatPanwTitle"
+        defaultMessage="Filebeat Palo Alto Network"
+      />
+    ),
+  },
   {
     description:
       has('filebeatSuricata', data) && data.filebeatSuricata !== null
@@ -83,6 +119,18 @@ const overviewNetworkStats = (data: OverviewNetworkData) => [
       />
     ),
   },
+  {
+    description:
+      has('packetbeatTLS', data) && data.packetbeatTLS !== null
+        ? numeral(data.packetbeatTLS).format('0,0')
+        : getEmptyTagValue(),
+    title: (
+      <FormattedMessage
+        id="xpack.siem.overview.packetbeatTLSTitle"
+        defaultMessage="Packetbeat TLS"
+      />
+    ),
+  },
 ];
 
 export const DescriptionListDescription = styled(EuiDescriptionListDescription)`

diff --git a/x-pack/plugins/siem/public/components/page/overview/overview_network_stats/mock.ts b/x-pack/plugins/siem/public/components/page/overview/overview_network_stats/mock.ts
@@ -8,10 +8,14 @@ import { OverviewNetworkData } from '../../../../graphql/types';
 
 export const mockData: { OverviewNetwork: OverviewNetworkData } = {
   OverviewNetwork: {
-    packetbeatFlow: 16,
-    packetbeatDNS: 10277307,
+    auditbeatSocket: 12,
+    filebeatCisco: 999,
+    filebeatNetflow: 7777,
+    filebeatPanw: 66,
     filebeatSuricata: 60015,
     filebeatZeek: 2003,
-    auditbeatSocket: 12,
+    packetbeatDNS: 10277307,
+    packetbeatFlow: 16,
+    packetbeatTLS: 3400000,
   },
 };
diff --git a/x-pack/plugins/siem/public/containers/overview/overview_host/index.gql_query.ts b/x-pack/plugins/siem/public/containers/overview/overview_host/index.gql_query.ts
@@ -22,6 +22,8 @@ export const overviewHostQuery = gql`
         auditbeatPackage
         auditbeatProcess
         auditbeatUser
+        filebeatSystemModule
+        winlogbeat
       }
     }
   }

diff --git a/x-pack/plugins/siem/public/containers/overview/overview_network/index.gql_query.ts b/x-pack/plugins/siem/public/containers/overview/overview_network/index.gql_query.ts
@@ -20,11 +20,15 @@ export const overviewNetworkQuery = gql`
         filterQuery: $filterQuery
         defaultIndex: $defaultIndex
       ) {
-        packetbeatFlow
-        packetbeatDNS
+        auditbeatSocket
+        filebeatCisco
+        filebeatNetflow
+        filebeatPanw
         filebeatSuricata
         filebeatZeek
-        auditbeatSocket
+        packetbeatDNS
+        packetbeatFlow
+        packetbeatTLS
       }
     }
   }

diff --git a/x-pack/plugins/siem/public/graphql/introspection.json b/x-pack/plugins/siem/public/graphql/introspection.json
@@ -7628,7 +7628,7 @@
         "description": "",
         "fields": [
           {
-            "name": "packetbeatFlow",
+            "name": "auditbeatSocket",
             "description": "",
             "args": [],
             "type": {
@@ -7640,7 +7640,31 @@
             "deprecationReason": null
           },
           {
-            "name": "packetbeatDNS",
+            "name": "filebeatCisco",
+            "description": "",
+            "args": [],
+            "type": {
+              "kind": "NON_NULL",
+              "name": null,
+              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
+            },
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
+          {
+            "name": "filebeatNetflow",
+            "description": "",
+            "args": [],
+            "type": {
+              "kind": "NON_NULL",
+              "name": null,
+              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
+            },
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
+          {
+            "name": "filebeatPanw",
             "description": "",
             "args": [],
             "type": {
@@ -7667,15 +7691,47 @@
             "name": "filebeatZeek",
             "description": "",
             "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
+            "type": {
+              "kind": "NON_NULL",
+              "name": null,
+              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
+            },
             "isDeprecated": false,
             "deprecationReason": null
           },
           {
-            "name": "auditbeatSocket",
+            "name": "packetbeatDNS",
             "description": "",
             "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
+            "type": {
+              "kind": "NON_NULL",
+              "name": null,
+              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
+            },
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
+          {
+            "name": "packetbeatFlow",
+            "description": "",
+            "args": [],
+            "type": {
+              "kind": "NON_NULL",
+              "name": null,
+              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
+            },
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
+          {
+            "name": "packetbeatTLS",
+            "description": "",
+            "args": [],
+            "type": {
+              "kind": "NON_NULL",
+              "name": null,
+              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
+            },
             "isDeprecated": false,
             "deprecationReason": null
           }
@@ -7694,47 +7750,95 @@
             "name": "auditbeatAuditd",
             "description": "",
             "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
+            "type": {
+              "kind": "NON_NULL",
+              "name": null,
+              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
+            },
             "isDeprecated": false,
             "deprecationReason": null
           },
           {
             "name": "auditbeatFIM",
             "description": "",
             "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
+            "type": {
+              "kind": "NON_NULL",
+              "name": null,
+              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
+            },
             "isDeprecated": false,
             "deprecationReason": null
           },
           {
             "name": "auditbeatLogin",
             "description": "",
             "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
+            "type": {
+              "kind": "NON_NULL",
+              "name": null,
+              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
+            },
             "isDeprecated": false,
             "deprecationReason": null
           },
           {
             "name": "auditbeatPackage",
             "description": "",
             "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
+            "type": {
+              "kind": "NON_NULL",
+              "name": null,
+              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
+            },
             "isDeprecated": false,
             "deprecationReason": null
           },
           {
             "name": "auditbeatProcess",
             "description": "",
             "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
+            "type": {
+              "kind": "NON_NULL",
+              "name": null,
+              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
+            },
             "isDeprecated": false,
             "deprecationReason": null
           },
           {
             "name": "auditbeatUser",
             "description": "",
             "args": [],
-            "type": { "kind": "SCALAR", "name": "Float", "ofType": null },
+            "type": {
+              "kind": "NON_NULL",
+              "name": null,
+              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
+            },
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
+          {
+            "name": "filebeatSystemModule",
+            "description": "",
+            "args": [],
+            "type": {
+              "kind": "NON_NULL",
+              "name": null,
+              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
+            },
+            "isDeprecated": false,
+            "deprecationReason": null
+          },
+          {
+            "name": "winlogbeat",
+            "description": "",
+            "args": [],
+            "type": {
+              "kind": "NON_NULL",
+              "name": null,
+              "ofType": { "kind": "SCALAR", "name": "Float", "ofType": null }
+            },
             "isDeprecated": false,
             "deprecationReason": null
           }