WIP

elastic · Mar 9, 2020 · f8892c7 · f8892c7
1 parent f0e063c
commit f8892c7
Show file tree

Hide file tree

Showing 33 changed files with 165 additions and 21 deletions.
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
@@ -50,6 +50,7 @@ export const mockPrepackagedRule = (): PrepackagedRules => ({
       technique: [{ id: 'techniqueId', name: 'techniqueName', reference: 'techniqueRef' }],
     },
   ],
+  throttle: null,
   enabled: true,
   filters: [],
   immutable: false,
@@ -348,6 +349,7 @@ export const getResult = (): RuleAlertType => ({
   alertTypeId: 'siem.signals',
   consumer: 'siem',
   params: {
+    actions: [],
     description: 'Detecting root and admin users',
     ruleId: 'rule-1',
     index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
@@ -391,6 +393,7 @@ export const getResult = (): RuleAlertType => ({
         ],
       },
     ],
+    throttle: null,
     references: ['http://www.example.com', 'https://ww.example.com'],
     version: 1,
   },

diff --git a/...k/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts b/...k/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts
@@ -56,6 +56,7 @@ export const createRulesBulkRoute = (router: IRouter) => {
           .filter(rule => rule.rule_id == null || !dupes.includes(rule.rule_id))
           .map(async payloadRule => {
             const {
+              actions,
               description,
               enabled,
               false_positives: falsePositives,
@@ -75,6 +76,7 @@ export const createRulesBulkRoute = (router: IRouter) => {
               severity,
               tags,
               threat,
+              throttle,
               to,
               type,
               references,
@@ -106,6 +108,7 @@ export const createRulesBulkRoute = (router: IRouter) => {
               const createdRule = await createRules({
                 alertsClient,
                 actionsClient,
+                actions,
                 description,
                 enabled,
                 falsePositives,
@@ -127,6 +130,7 @@ export const createRulesBulkRoute = (router: IRouter) => {
                 name,
                 severity,
                 tags,
+                throttle,
                 to,
                 type,
                 threat,

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.ts
@@ -31,6 +31,7 @@ export const createRulesRoute = (router: IRouter): void => {
     },
     async (context, request, response) => {
       const {
+        actions,
         description,
         enabled,
         false_positives: falsePositives,
@@ -52,6 +53,7 @@ export const createRulesRoute = (router: IRouter): void => {
         severity,
         tags,
         threat,
+        throttle,
         to,
         type,
         references,
@@ -92,6 +94,7 @@ export const createRulesRoute = (router: IRouter): void => {
         const createdRule = await createRules({
           alertsClient,
           actionsClient,
+          actions,
           description,
           enabled,
           falsePositives,
@@ -113,6 +116,7 @@ export const createRulesRoute = (router: IRouter): void => {
           name,
           severity,
           tags,
+          throttle,
           to,
           type,
           threat,

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/import_rules_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/import_rules_route.ts
@@ -111,6 +111,7 @@ export const importRulesRoute = (router: IRouter, config: LegacyServices['config
                     return null;
                   }
                   const {
+                    actions,
                     description,
                     enabled,
                     false_positives: falsePositives,
@@ -131,6 +132,7 @@ export const importRulesRoute = (router: IRouter, config: LegacyServices['config
                     severity,
                     tags,
                     threat,
+                    throttle,
                     to,
                     type,
                     references,
@@ -158,6 +160,7 @@ export const importRulesRoute = (router: IRouter, config: LegacyServices['config
                       await createRules({
                         alertsClient,
                         actionsClient,
+                        actions,
                         description,
                         enabled,
                         falsePositives,
@@ -182,6 +185,7 @@ export const importRulesRoute = (router: IRouter, config: LegacyServices['config
                         to,
                         type,
                         threat,
+                        throttle,
                         references,
                         version,
                       });
@@ -190,6 +194,7 @@ export const importRulesRoute = (router: IRouter, config: LegacyServices['config
                       await patchRules({
                         alertsClient,
                         actionsClient,
+                        actions,
                         savedObjectsClient,
                         description,
                         enabled,
@@ -216,6 +221,7 @@ export const importRulesRoute = (router: IRouter, config: LegacyServices['config
                         to,
                         type,
                         threat,
+                        throttle,
                         references,
                         version,
                       });

diff --git a/...ck/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts b/...ck/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts
@@ -46,6 +46,7 @@ export const patchRulesBulkRoute = (router: IRouter) => {
       const rules = await Promise.all(
         request.body.map(async payloadRule => {
           const {
+            actions,
             description,
             enabled,
             false_positives: falsePositives,
@@ -70,6 +71,7 @@ export const patchRulesBulkRoute = (router: IRouter) => {
             to,
             type,
             threat,
+            throttle,
             references,
             version,
           } = payloadRule;
@@ -78,6 +80,7 @@ export const patchRulesBulkRoute = (router: IRouter) => {
             const rule = await patchRules({
               alertsClient,
               actionsClient,
+              actions,
               description,
               enabled,
               falsePositives,
@@ -103,6 +106,7 @@ export const patchRulesBulkRoute = (router: IRouter) => {
               to,
               type,
               threat,
+              throttle,
               references,
               version,
             });

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_route.ts
@@ -30,6 +30,7 @@ export const patchRulesRoute = (router: IRouter) => {
     },
     async (context, request, response) => {
       const {
+        actions,
         description,
         enabled,
         false_positives: falsePositives,
@@ -54,6 +55,7 @@ export const patchRulesRoute = (router: IRouter) => {
         to,
         type,
         threat,
+        throttle,
         references,
         version,
       } = request.body;
@@ -75,6 +77,7 @@ export const patchRulesRoute = (router: IRouter) => {
         const rule = await patchRules({
           actionsClient,
           alertsClient,
+          actions,
           description,
           enabled,
           falsePositives,
@@ -100,6 +103,7 @@ export const patchRulesRoute = (router: IRouter) => {
           to,
           type,
           threat,
+          throttle,
           references,
           version,
         });

diff --git a/...k/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts b/...k/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts
@@ -47,6 +47,7 @@ export const updateRulesBulkRoute = (router: IRouter) => {
       const rules = await Promise.all(
         request.body.map(async payloadRule => {
           const {
+            actions,
             description,
             enabled,
             false_positives: falsePositives,
@@ -71,6 +72,7 @@ export const updateRulesBulkRoute = (router: IRouter) => {
             to,
             type,
             threat,
+            throttle,
             references,
             version,
           } = payloadRule;
@@ -80,6 +82,7 @@ export const updateRulesBulkRoute = (router: IRouter) => {
             const rule = await updateRules({
               alertsClient,
               actionsClient,
+              actions,
               description,
               enabled,
               immutable: false,
@@ -106,6 +109,7 @@ export const updateRulesBulkRoute = (router: IRouter) => {
               to,
               type,
               threat,
+              throttle,
               references,
               version,
             });

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_route.ts
@@ -30,6 +30,7 @@ export const updateRulesRoute = (router: IRouter) => {
     },
     async (context, request, response) => {
       const {
+        actions,
         description,
         enabled,
         false_positives: falsePositives,
@@ -54,6 +55,7 @@ export const updateRulesRoute = (router: IRouter) => {
         to,
         type,
         threat,
+        throttle,
         references,
         version,
       } = request.body;
@@ -76,6 +78,7 @@ export const updateRulesRoute = (router: IRouter) => {
         const rule = await updateRules({
           alertsClient,
           actionsClient,
+          actions,
           description,
           enabled,
           falsePositives,
@@ -102,6 +105,7 @@ export const updateRulesRoute = (router: IRouter) => {
           to,
           type,
           threat,
+          throttle,
           references,
           version,
         });

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.test.ts
@@ -37,6 +37,7 @@ describe('utils', () => {
       const fullRule = getResult();
       const rule = transformAlertToRule(fullRule);
       const expected: OutputRuleAlertRest = {
+        actions: [],
         created_by: 'elastic',
         created_at: '2019-12-13T16:40:33.400Z',
         updated_at: '2019-12-13T16:40:33.400Z',
@@ -101,6 +102,7 @@ describe('utils', () => {
       const fullRule = getResult();
       const { from, language, ...omitData } = transformAlertToRule(fullRule);
       const expected: Partial<OutputRuleAlertRest> = {
+        actions: [],
         created_by: 'elastic',
         created_at: '2019-12-13T16:40:33.400Z',
         updated_at: '2019-12-13T16:40:33.400Z',
@@ -164,6 +166,7 @@ describe('utils', () => {
       fullRule.params.query = null;
       const rule = transformAlertToRule(fullRule);
       const expected: Partial<OutputRuleAlertRest> = {
+        actions: [],
         created_by: 'elastic',
         created_at: '2019-12-13T16:40:33.400Z',
         updated_at: '2019-12-13T16:40:33.400Z',
@@ -228,6 +231,7 @@ describe('utils', () => {
       fullRule.params.query = undefined;
       const rule = transformAlertToRule(fullRule);
       const expected: Partial<OutputRuleAlertRest> = {
+        actions: [],
         created_by: 'elastic',
         created_at: '2019-12-13T16:40:33.400Z',
         updated_at: '2019-12-13T16:40:33.400Z',
@@ -293,6 +297,7 @@ describe('utils', () => {
       fullRule.params.language = null;
       const { from, enabled, ...omitData } = transformAlertToRule(fullRule);
       const expected: Partial<OutputRuleAlertRest> = {
+        actions: [],
         created_by: 'elastic',
         created_at: '2019-12-13T16:40:33.400Z',
         updated_at: '2019-12-13T16:40:33.400Z',
@@ -354,6 +359,7 @@ describe('utils', () => {
       fullRule.enabled = false;
       const ruleWithEnabledFalse = transformAlertToRule(fullRule);
       const expected: OutputRuleAlertRest = {
+        actions: [],
         created_by: 'elastic',
         created_at: '2019-12-13T16:40:33.400Z',
         updated_at: '2019-12-13T16:40:33.400Z',
@@ -419,6 +425,7 @@ describe('utils', () => {
       fullRule.params.immutable = false;
       const ruleWithEnabledFalse = transformAlertToRule(fullRule);
       const expected: OutputRuleAlertRest = {
+        actions: [],
         created_by: 'elastic',
         created_at: '2019-12-13T16:40:33.400Z',
         updated_at: '2019-12-13T16:40:33.400Z',
@@ -484,6 +491,7 @@ describe('utils', () => {
       fullRule.tags = ['tag 1', 'tag 2', `${INTERNAL_IDENTIFIER}_some_other_value`];
       const rule = transformAlertToRule(fullRule);
       const expected: OutputRuleAlertRest = {
+        actions: [],
         created_at: '2019-12-13T16:40:33.400Z',
         updated_at: '2019-12-13T16:40:33.400Z',
         created_by: 'elastic',
@@ -633,6 +641,7 @@ describe('utils', () => {
         data: [getResult()],
       });
       const expected: OutputRuleAlertRest = {
+        actions: [],
         created_by: 'elastic',
         created_at: '2019-12-13T16:40:33.400Z',
         updated_at: '2019-12-13T16:40:33.400Z',
@@ -714,6 +723,7 @@ describe('utils', () => {
     test('outputs 200 if the data is of type siem alert', () => {
       const output = transform(getResult());
       const expected: OutputRuleAlertRest = {
+        actions: [],
         created_by: 'elastic',
         created_at: '2019-12-13T16:40:33.400Z',
         updated_at: '2019-12-13T16:40:33.400Z',
@@ -886,6 +896,7 @@ describe('utils', () => {
     test('outputs 200 if the data is of type siem alert', () => {
       const output = transformOrBulkError('rule-1', getResult());
       const expected: OutputRuleAlertRest = {
+        actions: [],
         created_by: 'elastic',
         created_at: '2019-12-13T16:40:33.400Z',
         updated_at: '2019-12-13T16:40:33.400Z',
@@ -1008,6 +1019,7 @@ describe('utils', () => {
       const transformed = transformAlertsToRules([result1]);
       expect(transformed).toEqual([
         {
+          actions: [],
           created_at: '2019-12-13T16:40:33.400Z',
           created_by: 'elastic',
           description: 'Detecting root and admin users',
@@ -1067,6 +1079,7 @@ describe('utils', () => {
       const transformed = transformAlertsToRules([result1, result2]);
       expect(transformed).toEqual([
         {
+          actions: [],
           created_at: '2019-12-13T16:40:33.400Z',
           created_by: 'elastic',
           description: 'Detecting root and admin users',
@@ -1115,6 +1128,7 @@ describe('utils', () => {
           version: 1,
         },
         {
+          actions: [],
           created_at: '2019-12-13T16:40:33.400Z',
           created_by: 'elastic',
           description: 'Detecting root and admin users',

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts
@@ -101,6 +101,7 @@ export const transformAlertToRule = (
   ruleStatus?: SavedObject<IRuleSavedAttributesSavedObjectAttributes>
 ): Partial<OutputRuleAlertRest> => {
   return pickBy<OutputRuleAlertRest>((value: unknown) => value != null, {
+    actions: alert.actions,
     created_at: alert.createdAt.toISOString(),
     updated_at: alert.updatedAt.toISOString(),
     created_by: alert.createdBy,
@@ -131,6 +132,7 @@ export const transformAlertToRule = (
     to: alert.params.to,
     type: alert.params.type,
     threat: alert.params.threat,
+    throttle: alert.params.throttle,
     version: alert.params.version,
     status: ruleStatus?.attributes.status,
     status_date: ruleStatus?.attributes.statusDate,

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/validate.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/validate.test.ts
@@ -18,6 +18,7 @@ import { RulesSchema } from '../schemas/response/rules_schema';
 import { BulkError } from '../utils';
 
 export const ruleOutput: RulesSchema = {
+  actions: [],
   created_at: '2019-12-13T16:40:33.400Z',
   updated_at: '2019-12-13T16:40:33.400Z',
   created_by: 'elastic',