-
Notifications
You must be signed in to change notification settings - Fork 8.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Security Solution][Endpoint] Adds matches
wildcard operator for file.path.text
field for Event Filters
#125202
[Security Solution][Endpoint] Adds matches
wildcard operator for file.path.text
field for Event Filters
#125202
Conversation
89e3a8a
to
75892f2
Compare
actually, is it possible to combine duplicated entries into one like this:
We support such filters, here is an example: Having it this way is a performance improvement as the wildcard is converted to one regex with OR match pattern. OK, looking again the the example, those two entries have different operator (included vs excluded) so couldn't be combined, but just keep this in mind in general. |
This is insightful @intxgo Thanks for pointing this out. I'll make sure I check this as I finish up the PR. |
825a266
to
4093521
Compare
@intxgo we talked offline and you pointed out that I was chasing down the wrong path. The grouping of values is only needed for ORed entries. Since event filters AND entries we don't need this improvement in this PR. In short, entries such as {
"entries": [
{
type: 'simple',
entries: [
{
"field": "file.path.text",
"operator": "excluded",
"type": "wildcard_caseless",
"value": "c:\\bin*\\group.exe"
}
]
},
{
type: 'simple',
entries: [
{
"field": "file.path.text",
"operator": "excluded",
"type": "wildcard_caseless",
"value": "d:\\doc*\\another.md"
}
]
}
]
} can be transformed to {
"entries": [
{
type: 'simple',
entries: [
{
"field": "file.path.text",
"operator": "excluded",
"type": "wildcard_caseless",
"value": [
"c:\\bin*\\group.exe",
"d:\\doc*\\another.md"
]
}
]
}
]
} but entries that look like {
type: 'simple',
entries: [
{
"field": "file.path.text",
"operator": "excluded",
"type": "wildcard_caseless",
"value": "c:\\bin*\\group.exe"
},
{
"field": "file.path.text",
"operator": "excluded",
"type": "wildcard_caseless",
"value": "d:\\doc*\\another.md"
}
]
} should not be transformed further to group values yet. |
0c27e38
to
fb482cb
Compare
review changes
review changes
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. Appreciate all the work to make these matches work out and all the feedback you changed here. Really awesome.
💚 Build SucceededMetrics [docs]Module Count
Public APIs missing comments
Async chunks
Unknown metric groupsAPI count
History
To update your PR or re-run it, just comment with: cc @ashokaditya |
Friendly reminder: Looks like this PR hasn’t been backported yet. |
…ile.path.text` field for Event Filters (elastic#125202) * labels for wildcard path entries fixes elastic/security-team/issues/2525 * consistent naming and add missing tests refs elastic/pull/120679 * add autocompletion for wildcard fixes elastic/security-team/issues/2525 * ensure event filter artifacts have correct wildcard type for process.name entry fixes elastic/security-team/issues/2525 fixes elastic/security-team/issues/2723 * set warning for input values fixes elastic/security-team/issues/2525 * lift path validations to packages fixes elastic/security-team/issues/2525 * Add more tests fixes elastic/security-team/issues/2525 * Add wildcards to event filter generator * fix merge i18n check * Remove not match/excluded operator for now review changes * add mixed entries for wildcard review changes * comparison typo refs 06c868b * fix vulnerable regex review changes * ignore empty space on input review changes * update component review changes * use const enum review changes * update type imports to use ConditionEntryField, OperatingSystem, TrustedAppEntryTypes
…ile.path.text` field for Event Filters (elastic#125202) * labels for wildcard path entries fixes elastic/security-team/issues/2525 * consistent naming and add missing tests refs elastic/pull/120679 * add autocompletion for wildcard fixes elastic/security-team/issues/2525 * ensure event filter artifacts have correct wildcard type for process.name entry fixes elastic/security-team/issues/2525 fixes elastic/security-team/issues/2723 * set warning for input values fixes elastic/security-team/issues/2525 * lift path validations to packages fixes elastic/security-team/issues/2525 * Add more tests fixes elastic/security-team/issues/2525 * Add wildcards to event filter generator * fix merge i18n check * Remove not match/excluded operator for now review changes * add mixed entries for wildcard review changes * comparison typo refs 06c868b * fix vulnerable regex review changes * ignore empty space on input review changes * update component review changes * use const enum review changes * update type imports to use ConditionEntryField, OperatingSystem, TrustedAppEntryTypes
…wildcard) in wildcard-ed event filter `file.path.text` (#127432) * update filename regex to include multiple hyphens and periods Uses a much simpler pattern that covers a whole gamut file name patterns. fixes elastic/security-team/issues/3294 * remove duplicated code * add tests for `process.name` entry for filenames with wildcard path refs /pull/120349 /pull/125202 * Add file.name optimized entry when wildcard filepath in file.path.text has a filename fixes elastic/security-team/issues/3294 * update regex to include unicode chars review changes * add tests for `file.name` and `process.name` entries if it already exists This works out of the box and we don't add endpoint related `file.name` or `process.name` entry when it already is added by the user refs /pull/127958#discussion_r829086447 elastic/security-team/issues/3199 * fix `file.name` and `file.path.text` entries for linux and mac/linux refs /pull/127098 * do not add endpoint optimized entry Add `file.name` and `process.name` entry for wildcard path values only when file.name and process.name entries do not already exist. The earlier commit 8a516ae was mistakenly labeled as this worked out of the box. In the same commit we notice that the test data had a wildcard file path that did not add a `file.name` or `process.name` entry. For more see: /pull/127958#discussion_r829086447 elastic/security-team/issues/3199 * update regex to include gamut of unicode characters review suggestions * remove regex altogether simplifies the logic to check if path is without wildcard characters. This way it includes all other strings as valid filenames that do not have * or ? * update artifact creation for `file.path.text` entries Similar to when we normalize `file.path.caseless` entries, except that the `type` is `*_cased` for linux and `*_caseless` for non-linux
Summary
Notable changes
matches
andoperators fornot match
file.path.text
fields.process.name
entries forfile.path.text
when there's a simple filename at the end of the wildcard pathpackages/kbn-securitysolution-utils
in order to use in both Trusted Apps and Event Filters input validations.For creating/updating event filters, this change allows adding wildcard path values when the selected field is
file.path.text
viamatches
operator.Screens
![event filter card](https://user-images.githubusercontent.com/1849116/153383605-e64e9318-ce42-43e6-9c5a-e3cb1c990083.png)
![event filter update form](https://user-images.githubusercontent.com/1849116/153385490-2159fe24-bc28-4f41-82b3-655a039ec73b.png)
![event filter condition entry](https://user-images.githubusercontent.com/1849116/153385487-cd92c5cf-be51-4a46-849d-1e2adfb2aad8.png)
![Screenshot 2022-02-11 at 17 33 07](https://user-images.githubusercontent.com/1849116/153669056-1e2a1f1a-5842-42c6-b60b-0f3d7315d758.png)
![Screenshot 2022-02-11 at 17 20 20](https://user-images.githubusercontent.com/1849116/153669059-6a5ca517-f7d0-4d86-b019-bc0e6891bb9f.png)
Artifact cards vs artifact entries
![windows event filter](https://user-images.githubusercontent.com/1849116/153561684-b218c7dd-07f1-4d61-b338-a4903780ed6a.png)
Windows
windows artifact entry
Mac
![mac event filter](https://user-images.githubusercontent.com/1849116/153563217-86f6b3c8-9a4f-4eaf-b94a-b33e32e90dab.png)
mac artifact entry
Linux
![linux event filter](https://user-images.githubusercontent.com/1849116/153563519-b0ac1151-c578-4f53-a94b-e2907a0c5abc.png)
linux artifact entry
Checklist
Delete any items that are not applicable to this PR.