[Security Solution] Siem signals -> alerts as data field and index aliases #106049
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -96,10 +96,20 @@ export class RuleDataClient implements IRuleDataClient { | |
| if (response.body.errors) { | ||
| if ( | ||
| response.body.items.length > 0 && | ||
| (response.body.items.every( | ||
| (item) => item.index?.error?.type === 'index_not_found_exception' | ||
| ) || | ||
| response.body.items.every( | ||
| (item) => item.index?.error?.type === 'illegal_argument_exception' | ||
| )) | ||
|
Comment on lines
+99
to
+104
There was a problem hiding this comment. When can we get There was a problem hiding this comment.
|
||
| ) { | ||
| return this.createWriteTargetIfNeeded({ namespace }).then(() => { | ||
| return clusterClient.bulk(requestWithDefaultParameters).then((retryResponse) => { | ||
| if (retryResponse.body.errors) { | ||
| throw new ResponseError(retryResponse); | ||
| } | ||
| return retryResponse; | ||
| }); | ||
| }); | ||
| } | ||
| const error = new ResponseError(response); | ||
|
|
@@ -116,13 +126,14 @@ export class RuleDataClient implements IRuleDataClient { | |
|
|
||
| const clusterClient = await this.getClusterClient(); | ||
|
|
||
| const { body: indicesExist } = await clusterClient.indices.exists({ | ||
| index: `${alias}-*`, | ||
| allow_no_indices: false, | ||
|
Comment on lines
+129
to
+131
There was a problem hiding this comment. Confused a bit, why do we need to check this? If There was a problem hiding this comment. In some scenarios we could get an |
||
| }); | ||
|
|
||
| const concreteIndexName = `${alias}-000001`; | ||
|
|
||
|
There was a problem hiding this comment. I removed this check so that we can add the There was a problem hiding this comment. This check has now been replaced with a more specific check - querying to find concrete indices rather than the alias. |
||
| if (!indicesExist) { | ||
| try { | ||
| await clusterClient.indices.create({ | ||
| index: concreteIndexName, | ||
|
|
@@ -135,11 +146,37 @@ export class RuleDataClient implements IRuleDataClient { | |
| }, | ||
| }); | ||
| } catch (err) { | ||
| // If the index already exists and it's the write index for the alias, | ||
|
There was a problem hiding this comment. If the index already exists, will we ever get here? There was a problem hiding this comment. It's still possible to get here if multiple code paths attempt to create the index at the same time. It can be triggered in testing if the index doesn't exist yet with a construct like in this case both calls race to attempt to make the index and often one hits a There was a problem hiding this comment. True. But if the lack of a write index was the cause for this function being called we'd just fail silently because There was a problem hiding this comment. Ah I see. I was counting on the bulk retry to fail again in that case and throw the error, but I didn't notice that it wasn't checking for errors on the retry. I added handling for both in 28722b1 - the retry bulk call now throws errors if it encounters any, and if |
||
| // something else created it so suppress the error. If it's not the write | ||
| // index, that's bad, throw an error. | ||
| if (err?.meta?.body?.error?.type === 'resource_already_exists_exception') { | ||
| const { body: existingIndices } = await clusterClient.indices.get({ | ||
| index: concreteIndexName, | ||
| }); | ||
| if (!existingIndices[concreteIndexName]?.aliases?.[alias]?.is_write_index) { | ||
| throw Error( | ||
|
There was a problem hiding this comment. Nit: There was a problem hiding this comment. as of ES5 they're supposed to be equivalent, right? https://es5.github.io/#x15.11.1 There was a problem hiding this comment. Yes, but for a custom exception this might not work. Example: class CustomError extends Error {
constructor(value) {
super('Hello this is my message');
this.value = value;
}
}
let e = CustomError(42);
console.log(e.value); // ?Actually, I just checked it in Chrome, and calling However, this won't work the same way for any constructor defined as a function. In general, something like that would be needed: function User(name) {
if (!new.target) { // if you run me without new
return new User(name); // ...I will add new for you
}
this.name = name;
}
let john = User("John"); // redirects call to new User
alert(john.name); // JohnSee https://javascript.info/constructor-new#constructor-mode-test-new-target Maybe I was overthinking when trying to explain it, but for me it's quite simple - let's use Sorry, I'm 🚲 🏠 🎨 'ing |
||
| `Attempted to create index: ${concreteIndexName} as the write index for alias: ${alias}, but the index already exists and is not the write index for the alias` | ||
| ); | ||
| } | ||
| } else { | ||
| throw err; | ||
| } | ||
| } | ||
| } else { | ||
| // If we find indices matching the pattern, then we expect one of them to be the write index for the alias. | ||
| // Throw an error if none of them are the write index. | ||
| const { body: aliasesResponse } = await clusterClient.indices.getAlias({ | ||
| index: `${alias}-*`, | ||
| }); | ||
| if ( | ||
| !Object.entries(aliasesResponse).some( | ||
| ([_, aliasesObject]) => aliasesObject.aliases[alias]?.is_write_index | ||
| ) | ||
| ) { | ||
| throw Error( | ||
|
|
||
| `Indices matching pattern ${alias}-* exist but none are set as the write index for alias ${alias}` | ||
| ); | ||
| } | ||
| } | ||
| } | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is my understanding correct that
kibana.alert.owneris going to get removed in favour ofkibana.consumers?