[SIEM] [Case] Case workflow api schema #51535

stephmilovic · 2019-11-22T23:14:54Z

Summary

To test locally, add the following line to your kibana.dev.yml:

xpack.case.enabled: true

This PR establishes the initial Case Workflow API, including case and comment schema. Please reference this Postman generated documentation of the API.

Case & Comment mappings are in this temp file, see note below: x-pack/legacy/plugins/siem/server/lib/case/saved_object_mappings_temp.ts

Big Time Note

I needed to use the legacy API in order to to write mappings for case as the Saved Object Mappings API is not yet available on the NP. See: #50309
Therefore, I had to create some temporary files in the siem dir. I plan to commit this to master as I may need to change mappings. Eventually, this will get moved to the new platform.

Checklist

~~This was checked for cross-browser compatibility, including a check against IE11~~
~~Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support~~
~~Documentation was added for features that require explanation or tutorials~~
Unit or functional tests were updated or added to match the most common scenarios
~~This was checked for keyboard-only and screenreader accessibility~~

For maintainers

~~This was checked for breaking API changes and was labeled appropriately~~
~~This includes a feature addition or change that requires a release note and was labeled appropriately~~

elasticmachine · 2019-11-22T23:14:56Z

Pinging @elastic/siem (Team:SIEM)

elasticmachine · 2019-11-23T00:13:01Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: b67409b

x-pack/plugins/case/server/services/index.ts

x-pack/plugins/case/server/routes/api/get_case.ts

…tephmilovic/kibana into case-workflow-api-schema

stephmilovic · 2020-01-06T19:32:37Z

retest

stephmilovic · 2020-01-06T23:43:03Z

retest

tylersmalley · 2020-01-07T21:23:43Z

@elasticmachine merge upstream

stephmilovic · 2020-01-08T14:33:19Z

@elasticmachine merge upstream

packages/eslint-config-kibana/.eslintrc.js

.eslintrc.js

…tephmilovic/kibana into case-workflow-api-schema

tylersmalley · 2020-01-08T18:40:58Z

x-pack/legacy/plugins/siem/index.ts

+      // TODO: Remove once while Saved Object Mappings API is programmed for the NP See: https://github.com/elastic/kibana/issues/50309
+      savedObjectSchemas: {
+        'case-workflow': {
+          indexPattern: '.case-testing-ground', // TODO: Change this name and use kibana.yml settings to override it.


What's the reason for having this stored in a separate index? If we can avoid it, we should as a failed migration requires each of these indices to to removed currently and won't be resolved until 8.0.

i will need it in a separate index, but apparently there is a way to get access to the kibana.yml from this part of the code which I had not believed to be possible. I need to track down an example, brb!

I removed these lines for now since they will need to be done from the NP side ultimately. could have to do with these failures, we'll see

tylersmalley · 2020-01-08T18:50:17Z

Something is blocking the Kibana server from starting for me, which is probably the cause of the CI failures. If I disable the plugin --xpack.siem.enabled=false all is well again.

Are you able to reproduce this if you remove the configuration from your kibana.dev.yml?

stephmilovic · 2020-01-08T19:29:19Z

Something is blocking the Kibana server from starting for me, which is probably the cause of the CI failures. If I disable the plugin --xpack.siem.enabled=false all is well again.

Are you able to reproduce this if you remove the configuration from your kibana.dev.yml?

I think this all has to do with creating NP case saved objects from legacy siem. That was a temporary work around anyways. I removed that code, have the kibana server running locally without issues, let's see if we can get a green build

kibanamachine · 2020-01-08T20:46:50Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 60a727b

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* master: (23 commits) [Vis: Default editor] Reactify the timelion editor (elastic#52990) [Discover] fix histogram min interval (elastic#53979) [Telemetry] [Monitoring] Only retry fetching usage once monito… (elastic#54309) [docs][APM] Add runtime index config documentation (elastic#53907) [SIEM] Detection engine timeline (elastic#53783) Filter scripted fields preview field list to source fields (elastic#53826) Management - New platform api (elastic#52579) Reset region and Account when switching inventory (elastic#54287) [SIEM] [Case] Case workflow api schema (elastic#51535) Code coverage setup on CI (elastic#49003) [ML] DF Analytics Results: adds link to docs (elastic#54189) Update schemas boolean, byteSize, and duration to coerce strings (elastic#54177) [Metrics UI] Pass relevant shouldAllowEdit capabilities into SettingsPage (elastic#49781) [Canvas] Fixes bugs with autoplay and refresh (elastic#53149) [ML] DF Analytics Classification: ensure confusion matrix can be fetched (elastic#53629) Fix Vega react eslint errors (elastic#54259) Remove non existing codeowners (elastic#54274) use correct type (elastic#54244) [Dashboard] Removing 100% as dshDashboardViewport height (elastic#54263) add `examples/` to no-restricted-path config (elastic#54252) ...

stephmilovic added 13 commits November 14, 2019 17:14

init case commit, mostly boilerplate

99626ed

all right! cooking up the APIs finally

97cac86

trying to post

5f566ac

fixes post case

5808a24

update case api added

e47965e

response type cleanup

f6e8784

temp mapping

514d395

change to saved object

655ecce

code cleanup

bc55d64

posting comments

1f4bd1f

about to refactor a bit

2a1bd4e

initial APIs complete

ced5899

cleanup and added link to API documentation

b67409b

stephmilovic added release_note:roadmap Team:SIEM v8.0.0 v7.7.0 labels Nov 22, 2019

stephmilovic changed the title ~~[SIEM] [Case] Case workflow api schema~~ [skip-ci] [SIEM] [Case] Case workflow api schema Nov 22, 2019

stephmilovic removed the release_note:roadmap label Nov 25, 2019

stephmilovic commented Nov 25, 2019

View reviewed changes

x-pack/plugins/case/server/services/index.ts Show resolved Hide resolved

fix comment response format

5eab03b

stephmilovic commented Nov 25, 2019

View reviewed changes

x-pack/plugins/case/server/routes/api/get_case.ts Outdated Show resolved Hide resolved

stephmilovic added 6 commits November 25, 2019 13:43

update return types

c27f242

Merge branch 'master' into case-workflow-api-schema

482de76

references updated and comments on case are optional

71bc1bb

add a test

8ea5c14

Merge branch 'master' into case-workflow-api-schema

864d048

tests

2c8e731

Merge branch 'master' into case-workflow-api-schema

5536fa1

MikePaquette mentioned this pull request Jan 2, 2020

[SIEM] Case workflow integration with third-party system(s) #50103

Open

9 tasks

stephmilovic added 2 commits January 6, 2020 08:39

resolve merge conflicts

4a24bd2

Merge branch 'case-workflow-api-schema' of ssh://ssh.github.com:443/s…

b55bd97

…tephmilovic/kibana into case-workflow-api-schema

Merge branch 'master' into case-workflow-api-schema

468b0c1

stephmilovic added release_note:enhancement and removed release_note:roadmap labels Jan 7, 2020

Merge branch 'master' into case-workflow-api-schema

d0c0a10

Merge branch 'master' into case-workflow-api-schema

7af64f0

tylersmalley reviewed Jan 8, 2020

View reviewed changes

packages/eslint-config-kibana/.eslintrc.js Outdated Show resolved Hide resolved

tylersmalley reviewed Jan 8, 2020

View reviewed changes

.eslintrc.js Outdated Show resolved Hide resolved

stephmilovic added 2 commits January 8, 2020 09:13

rm lint changes

81928a3

Merge branch 'case-workflow-api-schema' of ssh://ssh.github.com:443/s…

b58b904

…tephmilovic/kibana into case-workflow-api-schema

tylersmalley suggested changes Jan 8, 2020

View reviewed changes

stephmilovic added 2 commits January 8, 2020 12:07

remove temporary mappings from legacy siem

c11df85

rm case saved object mappings from siem

60a727b

tylersmalley approved these changes Jan 8, 2020

View reviewed changes

stephmilovic merged commit 303e484 into elastic:master Jan 8, 2020

stephmilovic deleted the case-workflow-api-schema branch January 8, 2020 21:28

stephmilovic mentioned this pull request Jan 8, 2020

[7.x] [SIEM] [Case] Case workflow api schema (#51535) #54304

Merged

stephmilovic added a commit to stephmilovic/kibana that referenced this pull request Jan 8, 2020

[SIEM] [Case] Case workflow api schema (elastic#51535)

9953624

stephmilovic added a commit that referenced this pull request Jan 9, 2020

[SIEM] [Case] Case workflow api schema (#51535) (#54304)

4fbf9c7

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SIEM] [Case] Case workflow api schema #51535

[SIEM] [Case] Case workflow api schema #51535

stephmilovic commented Nov 22, 2019 •

edited

Loading

elasticmachine commented Nov 22, 2019

elasticmachine commented Nov 23, 2019

stephmilovic commented Jan 6, 2020

stephmilovic commented Jan 6, 2020

tylersmalley commented Jan 7, 2020

stephmilovic commented Jan 8, 2020

tylersmalley Jan 8, 2020

stephmilovic Jan 8, 2020

stephmilovic Jan 8, 2020

tylersmalley commented Jan 8, 2020

stephmilovic commented Jan 8, 2020

kibanamachine commented Jan 8, 2020

[SIEM] [Case] Case workflow api schema #51535

[SIEM] [Case] Case workflow api schema #51535

Conversation

stephmilovic commented Nov 22, 2019 • edited Loading

Summary

Big Time Note

Checklist

For maintainers

elasticmachine commented Nov 22, 2019

elasticmachine commented Nov 23, 2019

💔 Build Failed

stephmilovic commented Jan 6, 2020

stephmilovic commented Jan 6, 2020

tylersmalley commented Jan 7, 2020

stephmilovic commented Jan 8, 2020

tylersmalley Jan 8, 2020

Choose a reason for hiding this comment

stephmilovic Jan 8, 2020

Choose a reason for hiding this comment

stephmilovic Jan 8, 2020

Choose a reason for hiding this comment

tylersmalley commented Jan 8, 2020

stephmilovic commented Jan 8, 2020

kibanamachine commented Jan 8, 2020

💚 Build Succeeded

stephmilovic commented Nov 22, 2019 •

edited

Loading