[Alerting][Connectors] Refactor IBM Resilient: Generic Implementation (phase one)

[cnasikas]

Summary

Summary

This PR refactors the Jira connector to be generic. Specifically:

• Support for IBM Resilient alerts.
• Creation of two subactions: incidentTypes and severity

When #73778 is merged x-pack/plugins/actions/server/builtin_action_types/case folder will be removed in this PR.

UI:

API

Push incident:

Pushes an incident to Jira

Endpoint: api/actions/action/<action_id>/_execute
Method: POST

Payload:

{
    "params": {
        "subAction": "pushToService",
        "subActionParams": {
            "title": "A title",
			"description": "A description",
            "savedObjectId": "1234",
            "incidentTypes": [
                1001,
                16,
                12
            ],
            "severityCode": 6,
            "comments": [
                {
                    "commentId": "b5b4c4d0-574e-11ea-9e2e-21b90f8a9631",
                    "comment": "A comment"
                },
                {
                    "commentId": "b5b4c4d0-574e-11ea-9e2e-21b90f8a9631",
                    "comment": "Another comment"
                }
            ]
        }
    }
}

Response

{
    "status": "ok",
    "data": {
        "title": "2158",
        "id": "2158",
        "pushedDate": "2020-09-02T09:40:04.640Z",
        "url": "https://ibm-resilient.siem.estc.dev/#incidents/2158",
        "comments": [
            {
                "commentId": "1",
                "pushedDate": "2020-09-02T09:40:06.261Z"
            }
        ]
    },
    "actionId": "a6dbda3d-0c24-472e-bada-a61fa39b146f"
}

Get issue types:

Get all incident types in IBM Resilient.

Endpoint: api/actions/action/<action_id>/_execute
Method: POST

Payload:

{
    "params": {
        "subAction": "incidentTypes",
        "subActionParams": {}
    }
}

Response

{
    "status": "ok",
    "data": [
        {
            "id": 17,
            "name": "Communication error (fax; email)"
        },
        {
            "id": 1001,
            "name": "Custom type"
        },
        {
            "id": 21,
            "name": "Denial of Service"
        },
        {
            "id": 6,
            "name": "Improper disposal: digital asset(s)"
        },
        {
            "id": 7,
            "name": "Improper disposal: documents / files"
        },
        {
            "id": 4,
            "name": "Lost documents / files / records"
        },
        {
            "id": 3,
            "name": "Lost PC / laptop / tablet"
        },
        {
            "id": 1,
            "name": "Lost PDA / smartphone"
        },
        {
            "id": 8,
            "name": "Lost storage device / media"
        },
        {
            "id": 19,
            "name": "Malware"
        },
        {
            "id": 23,
            "name": "Not an Issue"
        },
        {
            "id": 18,
            "name": "Other"
        },
        {
            "id": 22,
            "name": "Phishing"
        },
        {
            "id": 11,
            "name": "Stolen documents / files / records"
        },
        {
            "id": 12,
            "name": "Stolen PC / laptop / tablet"
        },
        {
            "id": 13,
            "name": "Stolen PDA / smartphone"
        },
        {
            "id": 14,
            "name": "Stolen storage device / media"
        },
        {
            "id": 20,
            "name": "System Intrusion"
        },
        {
            "id": 16,
            "name": "TBD / Unknown"
        },
        {
            "id": 15,
            "name": "Vendor / 3rd party error"
        }
    ],
    "actionId": "a6dbda3d-0c24-472e-bada-a61fa39b146f"
}

Get severity:

Get all severity codes in IBM Resilient.

Endpoint: api/actions/action/<action_id>/_execute
Method: POST

Payload:

{
    "params": {
        "subAction": "severity",
        "subActionParams": {}
    }
}	

Response

{
    "status": "ok",
    "data": [
        {
            "id": 4,
            "name": "Low"
        },
        {
            "id": 5,
            "name": "Medium"
        },
        {
            "id": 6,
            "name": "High"
        }
    ],
    "actionId": "a6dbda3d-0c24-472e-bada-a61fa39b146f"
}

Checklist

Delete any items that are not applicable to this PR.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• This was checked for keyboard-only and screenreader accessibility
• This renders correctly on smaller devices using a responsive layout. (You can test this in your browser
• This was checked for cross-browser compatibility

For maintainers

• This was checked for breaking API changes and was labeled appropriately

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[cnasikas]

@elasticmachine merge upstream

[YulNaumenko]

Great work! LGTM in overall, but requested the same changes as for a Jira PR, because we want to keep the code cleaner and planning to work on the actions functionality improvements and connectors and actions responsibility splitting. cc @mikecote

[YulNaumenko]

LGTM! Just a few nits about white spaces

[cnasikas]

@elasticmachine merge upstream

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 31714d5

Build metrics

@kbn/optimizer bundle module count

id	value	diff	baseline
securitySolution	1957	-13	1970
triggers_actions_ui	251	+10	241
total		-3

async chunks size

id	value	diff	baseline
securitySolution	10.0MB	-31.8KB	10.0MB
triggers_actions_ui	961.3KB	+66.8KB	894.5KB
total		+35.0KB

page load bundle size

id	value	diff	baseline
securitySolution	793.0KB	-16.8KB	809.8KB
triggers_actions_ui	287.4KB	+12.8KB	274.6KB
total		-4.0KB

distributable file count

id	value	diff	baseline
default	45520	-2	45522

History

• 💔 Build #73749 failed c659161
• 💔 Build #73680 failed 2fb4fe0
• 💔 Build #73666 failed f52c027
• 💔 Build #73639 failed 178be1a
• 💚 Build #71906 succeeded 06f7fc9

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[cnasikas]

@gchaps

API changes for creating an Jira IBM Resilient connector:

casesConfiguration renamed to incidentConfiguration
Added optional attributeisCaseOwned.

[gchaps]

@cnasikas Do you mean "API changes for creating a IBM Resilient connector"?

[cnasikas]

@gchaps Yes. Sorry, my mistake.

[gchaps]

@cnasikas as this PR is an API change, I think this should have the label release_note:plugin_api_change instead of release_note:breaking.

[cnasikas]

@gchaps Ok! What is the difference?

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)