[Osquery] Add Osquery results to Case #139909

tomsonpl · 2022-09-01T11:52:10Z

This PR adds a functionality to add Osquery Results to Cases with help of CasesUi.hooks.

All types of Cases are supported - Security, Observability, Stack Management.

To Do:
[+] - Live queries + live query details
[+] - O11y Host metrics flyout
[+] - Alert flyout
[+] - Comment should include agentId details and query results
[+] - Change icon on the left side of comments
[+] - Adding packs
[] - Action item on the right side of the comment ( arrow-right ) should add whole result to Timeline
[+] - Add to timeline in case comment's result

# Conflicts: # x-pack/plugins/osquery/public/plugin.ts # x-pack/plugins/osquery/public/routes/live_queries/details/index.tsx # x-pack/plugins/osquery/public/routes/saved_queries/edit/tabs.tsx # x-pack/plugins/osquery/public/types.ts

…-fix'

…poc-cases # Conflicts: # x-pack/plugins/osquery/public/routes/live_queries/details/index.tsx

tomsonpl · 2022-09-05T18:01:01Z

x-pack/plugins/security_solution/public/detections/components/osquery/osquery_flyout.tsx


      return getAddToTimelineButton({
-        dataProvider: providerA,
-        field: value,
+        dataProvider: providers,


This change is required for us to add multiple actions to time at once. Is this a proper approach?
The functionality itself is not used yet, but I am hoping to use it still for 8.5

tomsonpl · 2022-09-06T05:51:38Z

@elasticmachine merge upstream

kobelb · 2022-09-15T14:25:38Z

x-pack/plugins/osquery/server/routes/privileges_check/privileges_check_route.ts

    },
    async (context, request, response) => {
+      // this is to skip validation eg. for analysts in cases attachments so they can see the results despite not having permissions
+      const { isSystemRequest } = request;
+      if (!isSystemRequest) {


@elastic/kibana-security please keep me honest here. The system request header should NOT be used to skip authorization checks. The existence of the system request header is only intended to allow us to determine whether or not the user's session should be extended as a result of a HTTP request being made.

Ok, the inner circle agreed to revert this changes and just show permission denied info.
Thanks @kobelb for your input 👍

Thanks for pinging us @kobelb! Yes, you're absolutely correct, isSystemRequest == request that wasn't initiated by the user and shouldn't be treated as the user activity.

jonathan-buttner

Great progress! Few other nit comments

jonathan-buttner · 2022-09-15T13:45:26Z

x-pack/plugins/osquery/public/cases/add_to_cases_button.tsx

+  const { cases } = useKibana().services;
+
+  const casePermissions = cases.helpers.canUseCases();
+  const hasReadPermissions = casePermissions.read && casePermissions.update && casePermissions.push;


nit: maybe rename this to hasCasesPermissions, the permissions being checked here indicate there are more than just read.

jonathan-buttner · 2022-09-15T13:46:50Z

x-pack/plugins/osquery/public/cases/add_to_cases_button.tsx

+      <EuiToolTip
+        content={
+          <EuiFlexItem>
+            {i18n.translate('xpack.osquery.cases.addToCaseText', {


Can we use the ADD_TO_CASE variable here?

👍 yes, thx!

jonathan-buttner · 2022-09-15T13:58:46Z

x-pack/plugins/osquery/public/shared_components/attachments/external_reference.tsx

+import OsqueryLogo from '../../components/osquery_icon/osquery.svg';
+
+// TODO waiting for Metadata to add "add to timeline" in here
+// const AttachmentActions: React.FC = () => (


Reminder to remove commented out code

jonathan-buttner · 2022-09-15T13:58:59Z

x-pack/plugins/osquery/public/shared_components/attachments/external_reference.tsx

+    type: 'regular',
+    event: 'attached Osquery results',
+    timelineAvatar: <EuiAvatar name="osquery" color="subdued" iconType={OsqueryLogo} />,
+    // actions: <AttachmentActions />,


jonathan-buttner · 2022-09-15T14:00:24Z

x-pack/plugins/osquery/public/shared_components/attachments/pack_queries_attachment_wrapper.tsx

+  const addToTimeline = useCallback(
+    (payload) => {
+      if (!actionId || !addToTimelineButton) {
+        return <></>;


Just checking, can this be null? or does that mess with how the parent component is rendered?

Null would mess up. I will refactor these 2 - addToTimeline and addToCases buttons within OSquery during FF, or for 8.6. There is a few new things we learnt during preparation for 8.5.

…poc-cases

cnasikas · 2022-09-15T14:52:04Z

x-pack/plugins/osquery/server/routes/fleet_wrapper/get_agent_details.ts

    },
    async (context, request, response) => {
      let agent;
+      // this is to skip validation eg. for analysts in cases attachments so they can see the results despite not having permissions
+      const { isSystemRequest } = request;
+      if (!isSystemRequest) {


Hey! Don't forget to remove this logic from all routes.

jonathan-buttner · 2022-09-15T17:31:56Z

Great progress on this feature! Here are a few things I noted while testing before the instance went down 😢 :

There is empty space on the overflow actions button

Extra padding in actions menu

Rerendering the osquery attachment causes the case to flicker and jump. I'm not sure if this is related to how Cases performs the rerendering, or maybe the animation of populating results in the osquery component. This appears to only happen in the Stack Cases, so maybe it's our fault 😆

Flickering

Screen.Recording.2022-09-15.at.1.03.30.PM.mov

tomsonpl · 2022-09-15T18:54:07Z

@elasticmachine merge upstream

tomsonpl · 2022-09-15T19:40:13Z

@elasticmachine merge upstream

jonathan-buttner

Nice work! I left a few minor questions and text changes.

I tested:

user with no osquery permissions cannot view the attachment within cases ✅
user with no cases permissions results in the add to case button being disabled ✅
user without superuser permissions can view the attachment within cases (this works after adding read to the all feature` ✅
user without indices permissions cannot view the attachment within cases ✅
attaching to timeline, viewing in lens, and viewing in discover from within cases works ✅

jonathan-buttner · 2022-09-15T18:39:41Z

x-pack/plugins/osquery/public/shared_components/attachments/lazy_external_reference_content.tsx

+          body={
+            <FormattedMessage
+              id="xpack.osquery.cases.permissionDenied"
+              defaultMessage=" To access this results, ask your administrator for {osquery} Kibana


Minor change: To access these...

jonathan-buttner · 2022-09-15T20:03:21Z

x-pack/plugins/osquery/public/routes/saved_queries/edit/tabs.tsx

+    <CasesContext owner={CASES_OWNER} permissions={casePermissions}>
+      <EuiTabbedContent
+        // TODO: extend the EuiTabbedContent component to support EuiTabs props
+        // bottomBorder={false}


nit: remove commented out code

I'd leave the TODO, maybe there's gonna be time to take care of it soon

jonathan-buttner · 2022-09-15T20:32:39Z

x-pack/plugins/osquery/public/live_queries/form/index.tsx

+      <AddToCaseButton
+        queryId={payload.queryId}
+        agentIds={agentIds}
+        actionId={liveQueryActionId || ''}


How likely is it for the liveQueryActionId to be undefined? aka setting actionId to an empty string? Should we disable the button if it undefined?

I think I tracked the code and it'll just result in the live query not running so maybe we'll just show an empty component within cases.

You're right, empty string doesn't make sense. I'll add a check if we have livequeryActionId before rendering Button. We should have it after running a query, before getting results - I would risk a statement that it's obligatory.

jonathan-buttner · 2022-09-15T20:39:46Z

Also I tested closing the osquery indices and that results in the attachments within cases looking like:

Seems fine to me 👍

Or maybe we could say something like Unable to find results or Index does not exist. Basically this is what a user would see if they exported a case and imported it into a different cluster. We can improve upon that later though.

tomsonpl · 2022-09-15T20:57:35Z

The indices error is definitely something we should take a closer look into, thanks for the suggestion. 👍 and the whole review thing, you were very helpful @jonathan-buttner and @cnasikas thanks 👍

…poc-cases

kibana-ci · 2022-09-16T07:25:40Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`osquery`	288	295	+7

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`cases`	68	71	+3

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`osquery`	1005.7KB	1009.7KB	+4.0KB

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`cases`	29	28	-1

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`cases`	124.4KB	124.6KB	+205.0B
`osquery`	85.5KB	89.9KB	+4.4KB
total			+4.6KB

Unknown metric groups

API count

id	before	after	diff
`cases`	84	87	+3

async chunk count

id	before	after	diff
`osquery`	7	9	+2

ESLint disabled line counts

id	before	after	diff
`osquery`	102	106	+4

Total ESLint disabled count

id	before	after	diff
`osquery`	104	108	+4

History

💛 Build #72973 was flaky 8714f33
💚 Build #72962 succeeded 8e1b158
💔 Build #72874 failed 08bc8f5
💔 Build #72793 failed f5d8d32
💔 Build #72755 failed 7cca8fd

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @tomsonpl

patrykkopycinski

LGTM

tomsonpl added 3 commits July 11, 2022 08:25

WIP add cases

989007c

Merge branch 'main' into osquery-poc-cases

9856853

# Conflicts: # x-pack/plugins/osquery/public/plugin.ts # x-pack/plugins/osquery/public/routes/live_queries/details/index.tsx # x-pack/plugins/osquery/public/routes/saved_queries/edit/tabs.tsx # x-pack/plugins/osquery/public/types.ts

add add to case button

4e08389

tomsonpl self-assigned this Sep 1, 2022

tomsonpl added v8.5.0 release_note:feature Makes this part of the condensed release notes Team:Asset Mgmt Osquery labels Sep 1, 2022

kibanamachine and others added 5 commits September 1, 2022 12:19

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

7f7c217

…-fix'

fix eslint

b19c351

Merge remote-tracking branch 'origin/osquery-poc-cases' into osquery-…

d879841

…poc-cases # Conflicts: # x-pack/plugins/osquery/public/routes/live_queries/details/index.tsx

add AddToTimeline in case attachment

c0ade68

rename files

f312f9d

tomsonpl requested review from cnasikas, jonathan-buttner and patrykkopycinski September 1, 2022 14:07

tomsonpl added 3 commits September 5, 2022 15:09

handle adding livequery to cases

5d49071

add timeline and case support in resultActions and others

a0447ec

fix linter

3d52211

tomsonpl commented Sep 5, 2022

View reviewed changes

tomsonpl added 6 commits September 5, 2022 20:03

fix eslint

0617e6f

fix eslint

cbe9695

fix file name

8bed045

fix types

9720c03

fix types

1e69e1b

fix import

d7ac807

Merge branch 'main' into osquery-poc-cases

d5a28d2

tomsonpl marked this pull request as ready for review September 6, 2022 07:05

tomsonpl requested a review from a team as a code owner September 6, 2022 07:05

tomsonpl added 4 commits September 15, 2022 14:57

move asSystemRequest to context, move lazy wrapper to separate component

7f3e124

fix eslint

9dde8b4

move context to a separate file

7b41f3f

Merge branch 'main' into osquery-poc-cases

272a2dd

kobelb reviewed Sep 15, 2022

View reviewed changes

jonathan-buttner reviewed Sep 15, 2022

View reviewed changes

tomsonpl added 3 commits September 15, 2022 16:46

remove http validation skip, add permision denied screen

f7d3855

Merge remote-tracking branch 'origin/osquery-poc-cases' into osquery-…

30ab478

…poc-cases

apply comments

3cf402b

cnasikas reviewed Sep 15, 2022

View reviewed changes

tomsonpl added 2 commits September 15, 2022 16:56

remove issystemrequest

7cca8fd

fix eslint

f5d8d32

Merge branch 'main' into osquery-poc-cases

08bc8f5

kibanamachine and others added 2 commits September 15, 2022 13:40

Merge branch 'main' into osquery-poc-cases

7901430

Adding read to all

8e1b158

jonathan-buttner approved these changes Sep 15, 2022

View reviewed changes

tomsonpl added 3 commits September 15, 2022 23:00

fix typo, check for liveQueryActionId in addToCasebutton

6226111

Merge remote-tracking branch 'origin/osquery-poc-cases' into osquery-…

8714f33

…poc-cases

fix typo, check for liveQueryActionId in addToCasebutton

56ab677

tomsonpl removed request for a team September 16, 2022 06:47

patrykkopycinski approved these changes Sep 16, 2022

View reviewed changes

tomsonpl merged commit b744e7c into elastic:main Sep 16, 2022

kibanamachine added the backport:skip This commit does not require backporting label Sep 16, 2022

[Osquery] Add Osquery results to Case #139909

[Osquery] Add Osquery results to Case #139909

Conversation

tomsonpl commented Sep 1, 2022 • edited

Choose a reason for hiding this comment

tomsonpl commented Sep 6, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jonathan-buttner left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jonathan-buttner commented Sep 15, 2022

tomsonpl commented Sep 15, 2022

tomsonpl commented Sep 15, 2022

jonathan-buttner left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jonathan-buttner commented Sep 15, 2022 • edited

tomsonpl commented Sep 15, 2022

kibana-ci commented Sep 16, 2022 • edited

💚 Build Succeeded

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Public APIs missing exports

Page load bundle

API count

async chunk count

ESLint disabled line counts

Total ESLint disabled count

History

patrykkopycinski left a comment

Choose a reason for hiding this comment

tomsonpl commented Sep 1, 2022 •

edited

jonathan-buttner commented Sep 15, 2022 •

edited

kibana-ci commented Sep 16, 2022 •

edited