Skip to content

Commit

Permalink
[SIEM][Detection Engine] Fixes critical regression on the backend wit…
Browse files Browse the repository at this point in the history
…h immutable and tags

## Summary

Fixes regression with immutable caused from:
#55004

* Updated types of Prepackaged 
* Updated unit tests
* Fixed unit test for it

Testing:

```
./post_rule.sh 
{
  "created_at": "2020-01-17T19:11:31.813Z",
  "updated_at": "2020-01-17T19:11:31.813Z",
  "created_by": "elastic_kibana",
  "description": "Query with a rule_id that acts like an external id",
  "enabled": true,
  "false_positives": [],
  "from": "now-6m",
  "id": "41ef6309-ef98-4c9f-8d2d-90a070361fb7",
  "immutable": false,
  "interval": "5m",
  "rule_id": "query-rule-id",
  "language": "kuery",
  "output_index": ".siem-signals-frank-hassanabad-default",
  "max_signals": 100,
  "risk_score": 1,
  "name": "Query with a rule id",
  "query": "user.name: root or user.name: admin",
  "references": [],
  "severity": "high",
  "updated_by": "elastic_kibana",
  "tags": [],
  "to": "now",
  "type": "query",
  "threats": [],
  "version": 1
}
```

Then get the saved object using whatever the id is comes back from above. In this example it is 41ef6309-ef98-4c9f-8d2d-90a070361fb7, yours will be different

```
./get_saved_objects.sh alert 41ef6309-ef98-4c9f-8d2d-90a070361fb7
{
  "id": "41ef6309-ef98-4c9f-8d2d-90a070361fb7",
  "type": "alert",
  "updated_at": "2020-01-17T19:11:32.844Z",
  "version": "WzY5NTQsMV0=",
  "attributes": {
    "name": "Query with a rule id",
    "tags": [
      "__internal_rule_id:query-rule-id",
      "__internal_immutable:false"
    ],
    "alertTypeId": "siem.signals",
    "consumer": "siem",
    "params": {
      "createdAt": "2020-01-17T19:11:31.813Z",
      "description": "Query with a rule_id that acts like an external id",
      "ruleId": "query-rule-id",
      "index": null,
      "falsePositives": [],
      "from": "now-6m",
      "immutable": false,
      "query": "user.name: root or user.name: admin",
      "language": "kuery",
      "outputIndex": ".siem-signals-frank-hassanabad-default",
      "savedId": null,
      "timelineId": null,
      "timelineTitle": null,
      "meta": null,
      "filters": null,
      "maxSignals": 100,
      "riskScore": 1,
      "severity": "high",
      "threats": [],
      "to": "now",
      "type": "query",
      "updatedAt": "2020-01-17T19:11:31.813Z",
      "references": [],
      "version": 1
    },
    "schedule": {
      "interval": "5m"
    },
    "enabled": true,
    "actions": [],
    "throttle": null,
    "apiKeyOwner": "elastic_kibana",
    "createdBy": "elastic_kibana",
    "updatedBy": "elastic_kibana",
    "createdAt": "2020-01-17T19:11:32.245Z",
    "muteAll": false,
    "mutedInstanceIds": [],
    "scheduledTaskId": "2c5cc340-395d-11ea-9276-d3c1c264ca9a"
  },
  "references": []
}
```

Ensure you have the internal immutable of "__internal_immutable:false" In your tags


Next test is to do a find filter of non-packaged rules:

```
./find_rule_by_filter.sh "alert.attributes.tags:%20%22__internal_immutable:false%22"
```

You should get back the above rule any others you created.

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

~~- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~~

~~- [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~~

~~- [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~~

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios

~~- [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~~

### For maintainers

~~- [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~

- [x] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)
  • Loading branch information
FrankHassanabad committed Jan 17, 2020
1 parent 81bcaed commit 6cfd1d4
Show file tree
Hide file tree
Showing 17 changed files with 170 additions and 171 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,9 @@ import {
DETECTION_ENGINE_PREPACKAGED_URL,
} from '../../../../../common/constants';
import { RuleAlertType, IRuleSavedAttributesSavedObjectAttributes } from '../../rules/types';
import { RuleAlertParamsRest } from '../../types';
import { RuleAlertParamsRest, PrepackagedRules } from '../../types';

export const fullRuleAlertParamsRest = (): RuleAlertParamsRest => ({
export const mockPrepackagedRule = (): PrepackagedRules => ({
rule_id: 'rule-1',
description: 'Detecting root and admin users',
index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
Expand Down Expand Up @@ -51,8 +51,6 @@ export const fullRuleAlertParamsRest = (): RuleAlertParamsRest => ({
false_positives: [],
saved_id: 'some-id',
max_signals: 100,
created_at: '2019-12-13T16:40:33.400Z',
updated_at: '2019-12-13T16:40:33.400Z',
timeline_id: 'timeline-id',
timeline_title: 'timeline-title',
});
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,6 @@ export const createCreateRulesBulkRoute = (server: ServerFacade): Hapi.ServerRou
enabled,
false_positives: falsePositives,
from,
immutable,
query,
language,
output_index: outputIndex,
Expand Down Expand Up @@ -109,7 +108,7 @@ export const createCreateRulesBulkRoute = (server: ServerFacade): Hapi.ServerRou
enabled,
falsePositives,
from,
immutable,
immutable: false,
query,
language,
outputIndex: finalIndex,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,6 @@ export const createCreateRulesRoute = (server: ServerFacade): Hapi.ServerRoute =
enabled,
false_positives: falsePositives,
from,
immutable,
query,
language,
output_index: outputIndex,
Expand Down Expand Up @@ -96,7 +95,7 @@ export const createCreateRulesRoute = (server: ServerFacade): Hapi.ServerRoute =
enabled,
falsePositives,
from,
immutable,
immutable: false,
query,
language,
outputIndex: finalIndex,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,6 @@ export const createUpdateRulesBulkRoute = (server: ServerFacade): Hapi.ServerRou
enabled,
false_positives: falsePositives,
from,
immutable,
query,
language,
output_index: outputIndex,
Expand Down Expand Up @@ -77,7 +76,6 @@ export const createUpdateRulesBulkRoute = (server: ServerFacade): Hapi.ServerRou
enabled,
falsePositives,
from,
immutable,
query,
language,
outputIndex,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@ export const createUpdateRulesRoute: Hapi.ServerRoute = {
enabled,
false_positives: falsePositives,
from,
immutable,
query,
language,
output_index: outputIndex,
Expand Down Expand Up @@ -75,7 +74,6 @@ export const createUpdateRulesRoute: Hapi.ServerRoute = {
enabled,
falsePositives,
from,
immutable,
query,
language,
outputIndex,
Expand Down
Loading

0 comments on commit 6cfd1d4

Please sign in to comment.