[Alerting][Connectors] Refactor IBM Resilient: Generic Implementation (phase one) #74357

cnasikas · 2020-08-05T12:28:18Z

Summary

This PR refactors the Jira connector to be generic. Specifically:

Support for IBM Resilient alerts.
Creation of two subactions: incidentTypes and severity

When #73778 is merged x-pack/plugins/actions/server/builtin_action_types/case folder will be removed in this PR.

UI:

API

Push incident:

Pushes an incident to Jira

Endpoint: api/actions/action/<action_id>/_execute
Method: POST

Payload:

{
    "params": {
        "subAction": "pushToService",
        "subActionParams": {
            "title": "A title",
			"description": "A description",
            "savedObjectId": "1234",
            "incidentTypes": [
                1001,
                16,
                12
            ],
            "severityCode": 6,
            "comments": [
                {
                    "commentId": "b5b4c4d0-574e-11ea-9e2e-21b90f8a9631",
                    "comment": "A comment"
                },
                {
                    "commentId": "b5b4c4d0-574e-11ea-9e2e-21b90f8a9631",
                    "comment": "Another comment"
                }
            ]
        }
    }
}

Response

{
    "status": "ok",
    "data": {
        "title": "2158",
        "id": "2158",
        "pushedDate": "2020-09-02T09:40:04.640Z",
        "url": "https://ibm-resilient.siem.estc.dev/#incidents/2158",
        "comments": [
            {
                "commentId": "1",
                "pushedDate": "2020-09-02T09:40:06.261Z"
            }
        ]
    },
    "actionId": "a6dbda3d-0c24-472e-bada-a61fa39b146f"
}

Get issue types:

Get all incident types in IBM Resilient.

Endpoint: api/actions/action/<action_id>/_execute
Method: POST

Payload:

{
    "params": {
        "subAction": "incidentTypes",
        "subActionParams": {}
    }
}

Response

{
    "status": "ok",
    "data": [
        {
            "id": 17,
            "name": "Communication error (fax; email)"
        },
        {
            "id": 1001,
            "name": "Custom type"
        },
        {
            "id": 21,
            "name": "Denial of Service"
        },
        {
            "id": 6,
            "name": "Improper disposal: digital asset(s)"
        },
        {
            "id": 7,
            "name": "Improper disposal: documents / files"
        },
        {
            "id": 4,
            "name": "Lost documents / files / records"
        },
        {
            "id": 3,
            "name": "Lost PC / laptop / tablet"
        },
        {
            "id": 1,
            "name": "Lost PDA / smartphone"
        },
        {
            "id": 8,
            "name": "Lost storage device / media"
        },
        {
            "id": 19,
            "name": "Malware"
        },
        {
            "id": 23,
            "name": "Not an Issue"
        },
        {
            "id": 18,
            "name": "Other"
        },
        {
            "id": 22,
            "name": "Phishing"
        },
        {
            "id": 11,
            "name": "Stolen documents / files / records"
        },
        {
            "id": 12,
            "name": "Stolen PC / laptop / tablet"
        },
        {
            "id": 13,
            "name": "Stolen PDA / smartphone"
        },
        {
            "id": 14,
            "name": "Stolen storage device / media"
        },
        {
            "id": 20,
            "name": "System Intrusion"
        },
        {
            "id": 16,
            "name": "TBD / Unknown"
        },
        {
            "id": 15,
            "name": "Vendor / 3rd party error"
        }
    ],
    "actionId": "a6dbda3d-0c24-472e-bada-a61fa39b146f"
}

Get severity:

Get all severity codes in IBM Resilient.

Endpoint: api/actions/action/<action_id>/_execute
Method: POST

Payload:

{
    "params": {
        "subAction": "severity",
        "subActionParams": {}
    }
}

Response

{
    "status": "ok",
    "data": [
        {
            "id": 4,
            "name": "Low"
        },
        {
            "id": 5,
            "name": "Medium"
        },
        {
            "id": 6,
            "name": "High"
        }
    ],
    "actionId": "a6dbda3d-0c24-472e-bada-a61fa39b146f"
}

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
This was checked for keyboard-only and screenreader accessibility
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser
This was checked for cross-browser compatibility

For maintainers

This was checked for breaking API changes and was labeled appropriately

elasticmachine · 2020-09-02T10:08:11Z

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

elasticmachine · 2020-09-02T10:08:12Z

Pinging @elastic/siem (Team:SIEM)

cnasikas · 2020-09-02T10:38:21Z

@elasticmachine merge upstream

YulNaumenko

Great work! LGTM in overall, but requested the same changes as for a Jira PR, because we want to keep the code cleaner and planning to work on the actions functionality improvements and connectors and actions responsibility splitting. cc @mikecote

x-pack/plugins/actions/server/builtin_action_types/resilient/case_schema.ts

x-pack/plugins/actions/server/builtin_action_types/resilient/translations.ts

x-pack/plugins/actions/server/builtin_action_types/resilient/validators.ts

...rs_actions_ui/public/application/components/builtin_action_types/email/email_params.test.tsx

...tions_ui/public/application/components/builtin_action_types/resilient/case_mappings/utils.ts

x-pack/plugins/triggers_actions_ui/public/types.ts

YulNaumenko

LGTM! Just a few nits about white spaces

...rs_actions_ui/public/application/components/builtin_action_types/email/email_params.test.tsx

...ions_ui/public/application/components/builtin_action_types/es_index/es_index_params.test.tsx

...ns_ui/public/application/components/builtin_action_types/pagerduty/pagerduty_params.test.tsx

..._ui/public/application/components/builtin_action_types/servicenow/servicenow_params.test.tsx

...rs_actions_ui/public/application/components/builtin_action_types/slack/slack_params.test.tsx

...ctions_ui/public/application/components/builtin_action_types/webhook/webhook_params.test.tsx

cnasikas · 2020-09-10T20:34:34Z

@elasticmachine merge upstream

kibanamachine · 2020-09-10T22:10:16Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 31714d5

Build metrics

@kbn/optimizer bundle module count

id	value	diff	baseline
securitySolution	1957	-13	1970
triggers_actions_ui	251	+10	241
total		-3

async chunks size

id	value	diff	baseline
securitySolution	10.0MB	-31.8KB	10.0MB
triggers_actions_ui	961.3KB	+66.8KB	894.5KB
total		+35.0KB

page load bundle size

id	value	diff	baseline
securitySolution	793.0KB	-16.8KB	809.8KB
triggers_actions_ui	287.4KB	+12.8KB	274.6KB
total		-4.0KB

distributable file count

id	value	diff	baseline
default	45520	-2	45522

History

💔 Build #73749 failed c659161
💔 Build #73680 failed 2fb4fe0
💔 Build #73666 failed f52c02796568f838b8c2281302d9ab3bf847dcf6
💔 Build #73639 failed 178be1af9d941033bd38f11cc7baa3518b18c275
💚 Build #71906 succeeded 06f7fc94e1ec05990b37951d23466fe323594f86

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

… (phase one) (elastic#74357) Co-authored-by: Elastic Machine <[email protected]>

…tation (phase one) (#74357) (#77264) Co-authored-by: Elastic Machine <[email protected]> Co-authored-by: Elastic Machine <[email protected]>

…s-for-710 * 'master' of github.com:elastic/kibana: (65 commits) Separate url forwarding logic and legacy services (elastic#76892) Bump yargs-parser to v13.1.2+ (elastic#77009) [Ingest Manager] Shared Fleet agent policy action (elastic#76013) [Search] Re-add support for aborting when a connection is closed (elastic#76470) [Search] Remove long-running query pop-up (elastic#75385) [Monitoring] Fix UI error when alerting is not available (elastic#77179) do not log plugin id format warning in dist mode (elastic#77134) [ML] Improving client side error handling (elastic#76743) [Alerting][Connectors] Refactor IBM Resilient: Generic Implementation (phase one) (elastic#74357) [Docs] some basic searchsource api docs (elastic#77038) add cGroupOverrides to the legacy config (elastic#77180) Change saved object bulkUpdate to work across multiple namespaces (elastic#75478) [Security Solution][Resolver] Replace Selectable popover with badges (elastic#76997) Removing ml-state index from archive (elastic#77143) [Security Solution] Add unit tests for histograms (elastic#77081) [Lens] Filters aggregation (elastic#75635) [Enterprise Search] Update WS Overview logic to use new config data (elastic#77122) Cleanup type output before building new types (elastic#77211) [Security Solution] Use safe type in resolver backend (elastic#76969) Use proper lodash syntax (elastic#77105) ... # Conflicts: # x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_allocation.tsx

cnasikas · 2020-10-19T08:30:47Z

@gchaps

API changes for creating an ~~Jira~~ IBM Resilient connector:

casesConfiguration renamed to incidentConfiguration
Added optional attributeisCaseOwned.

gchaps · 2020-10-19T21:14:08Z

@cnasikas Do you mean "API changes for creating a IBM Resilient connector"?

cnasikas · 2020-10-20T11:47:29Z

@gchaps Yes. Sorry, my mistake.

gchaps · 2020-10-20T19:20:38Z

@cnasikas as this PR is an API change, I think this should have the label release_note:plugin_api_change instead of release_note:breaking.

cnasikas · 2020-10-21T07:34:23Z

@gchaps Ok! What is the difference?

elasticmachine · 2021-09-23T14:27:38Z

Pinging @elastic/security-solution (Team: SecuritySolution)

cnasikas added Team:SIEM v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) v7.10.0 labels Aug 5, 2020

cnasikas self-assigned this Aug 5, 2020

cnasikas force-pushed the refactor_resilient_phase_one branch from 3b6bb94 to a99a0da Compare August 5, 2020 16:24

cnasikas force-pushed the refactor_resilient_phase_one branch from a99a0da to 0a1b5bb Compare August 24, 2020 10:39

cnasikas changed the title ~~[Alerting][Connectors][skip-ci] Refactor IBM Resilient: Generic Implementation (phase one)~~ [Alerting][Connectors] Refactor IBM Resilient: Generic Implementation (phase one) Aug 30, 2020

cnasikas mentioned this pull request Aug 30, 2020

[Actions][skip-ci] IBM Resilient generic implementation (supporting both Case specific and generic Alerts) #69929

Closed

7 tasks

cnasikas changed the title ~~[Alerting][Connectors] Refactor IBM Resilient: Generic Implementation (phase one)~~ [Alerting][Connectors][skip-ci] Refactor IBM Resilient: Generic Implementation (phase one) Aug 30, 2020

cnasikas force-pushed the refactor_resilient_phase_one branch from 0a1b5bb to dd5afb2 Compare August 30, 2020 18:57

cnasikas mentioned this pull request Aug 31, 2020

[Security Solution] [Threat Hunting] [Cases] Allow User to Specify IBM Resilient fields from Cases UI #76222

Open

cnasikas force-pushed the refactor_resilient_phase_one branch 2 times, most recently from da1d165 to 5d65f72 Compare September 2, 2020 09:49

cnasikas changed the title ~~[Alerting][Connectors][skip-ci] Refactor IBM Resilient: Generic Implementation (phase one)~~ [Alerting][Connectors] Refactor IBM Resilient: Generic Implementation (phase one) Sep 2, 2020

cnasikas marked this pull request as ready for review September 2, 2020 10:08

cnasikas requested review from a team as code owners September 2, 2020 10:08

YulNaumenko requested changes Sep 3, 2020

View reviewed changes

cnasikas added 6 commits September 9, 2020 17:56

Create schema

6cc8ea0

Create types

de92c6b

Fix service

62448a2

Fix validators

91dc222

Fix api

d6c040c

Fix init

4413f74

cnasikas added 2 commits September 10, 2020 15:50

Improve UX when editing an alert

d35aab5

Remove unused translations

2fb4fe0

cnasikas force-pushed the refactor_resilient_phase_one branch from f52c027 to 2fb4fe0 Compare September 10, 2020 12:50

Convert missed casesConfiguration to incidentConfiguration

c659161

YulNaumenko approved these changes Sep 10, 2020

View reviewed changes

XavierM approved these changes Sep 10, 2020

View reviewed changes

Merge branch 'master' into refactor_resilient_phase_one

31714d5

cnasikas merged commit 22b4e40 into elastic:master Sep 11, 2020

cnasikas deleted the refactor_resilient_phase_one branch September 11, 2020 07:24

cnasikas mentioned this pull request Sep 11, 2020

[7.x] [Alerting][Connectors] Refactor IBM Resilient: Generic Implementation (phase one) (#74357) #77264

Merged

cnasikas added a commit to cnasikas/kibana that referenced this pull request Sep 11, 2020

[Alerting][Connectors] Refactor IBM Resilient: Generic Implementation…

36ba742

… (phase one) (elastic#74357) Co-authored-by: Elastic Machine <[email protected]>

cnasikas mentioned this pull request Sep 21, 2020

[Actions] Migrate cases configuration object #77998

Merged

2 tasks

This was referenced Oct 1, 2020

[Actions] Jira and IBM Resilient tests #79060

Closed

[SIEM][CASE] Add generics to connector's types #64506

Closed

cnasikas mentioned this pull request Oct 15, 2020

[Security Solution][Cases] Fix bug with case connectors #80642

Merged

2 tasks

cnasikas added release_note:breaking and removed release_note:skip Skip the PR/issue when compiling release notes labels Oct 19, 2020

cnasikas added release_note:plugin_api_changes Contains a Plugin API changes section for the breaking plugin API changes section. and removed release_note:breaking labels Oct 21, 2020

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Alerting][Connectors] Refactor IBM Resilient: Generic Implementation (phase one) #74357

[Alerting][Connectors] Refactor IBM Resilient: Generic Implementation (phase one) #74357

cnasikas commented Aug 5, 2020 •

edited

Loading

elasticmachine commented Sep 2, 2020

elasticmachine commented Sep 2, 2020

cnasikas commented Sep 2, 2020

YulNaumenko left a comment

YulNaumenko left a comment

cnasikas commented Sep 10, 2020

kibanamachine commented Sep 10, 2020

cnasikas commented Oct 19, 2020 •

edited

Loading

gchaps commented Oct 19, 2020

cnasikas commented Oct 20, 2020

gchaps commented Oct 20, 2020

cnasikas commented Oct 21, 2020

elasticmachine commented Sep 23, 2021

[Alerting][Connectors] Refactor IBM Resilient: Generic Implementation (phase one) #74357

[Alerting][Connectors] Refactor IBM Resilient: Generic Implementation (phase one) #74357

Conversation

cnasikas commented Aug 5, 2020 • edited Loading

Summary

Summary

API

Push incident:

Get issue types:

Get severity:

Checklist

For maintainers

elasticmachine commented Sep 2, 2020

elasticmachine commented Sep 2, 2020

cnasikas commented Sep 2, 2020

YulNaumenko left a comment

Choose a reason for hiding this comment

YulNaumenko left a comment

Choose a reason for hiding this comment

cnasikas commented Sep 10, 2020

kibanamachine commented Sep 10, 2020

💚 Build Succeeded

Build metrics

@kbn/optimizer bundle module count

async chunks size

page load bundle size

distributable file count

History

cnasikas commented Oct 19, 2020 • edited Loading

gchaps commented Oct 19, 2020

cnasikas commented Oct 20, 2020

gchaps commented Oct 20, 2020

cnasikas commented Oct 21, 2020

elasticmachine commented Sep 23, 2021

cnasikas commented Aug 5, 2020 •

edited

Loading

cnasikas commented Oct 19, 2020 •

edited

Loading