Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

search returns detector type in CAPS fix and integration tests #174

Merged
merged 5 commits into from
Dec 30, 2022
Merged

search returns detector type in CAPS fix and integration tests #174

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
eac45d7
search returns detector type in CAPS fix and integration tests
raj-chak Dec 1, 2022
ba63cc6
nestedquery change at transport layer for detector type
raj-chak Dec 1, 2022
825abbd
removed unwanted commented code
raj-chak Dec 2, 2022
57b8640
make detector type in request case insensitive
raj-chak Dec 28, 2022
dea69bc
removed toUpperCase in randomDetectorType
raj-chak Dec 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/main/java/org/opensearch/securityanalytics/action/IndexRuleRequest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ public IndexRuleRequest(
super();
this.ruleId = ruleId;
this.refreshPolicy = refreshPolicy;
this.logType = logType;
this.logType = logType.toLowerCase(Locale.ROOT);
this.method = method;
this.rule = rule;
this.forced = forced;
Expand Down
32 changes: 16 additions & 16 deletions src/main/java/org/opensearch/securityanalytics/config/monitors/DetectorMonitorConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,32 +58,32 @@ public class DetectorMonitorConfig {
}

public static String getRuleIndex(String detectorType) {
return detectorTypeToIndicesMapping.containsKey(detectorType) ?
detectorTypeToIndicesMapping.get(detectorType).getRuleIndex() :
return detectorTypeToIndicesMapping.containsKey(detectorType.toLowerCase(Locale.ROOT)) ?
detectorTypeToIndicesMapping.get(detectorType.toLowerCase(Locale.ROOT)).getRuleIndex() :
OPENSEARCH_DEFAULT_RULE_INDEX;
}

public static String getAlertsIndex(String detectorType) {
return detectorTypeToIndicesMapping.containsKey(detectorType) ?
detectorTypeToIndicesMapping.get(detectorType).getAlertsIndex() :
return detectorTypeToIndicesMapping.containsKey(detectorType.toLowerCase(Locale.ROOT)) ?
detectorTypeToIndicesMapping.get(detectorType.toLowerCase(Locale.ROOT)).getAlertsIndex() :
OPENSEARCH_DEFAULT_ALERT_INDEX;
}

public static String getAlertsHistoryIndex(String detectorType) {
return detectorTypeToIndicesMapping.containsKey(detectorType) ?
detectorTypeToIndicesMapping.get(detectorType).getAlertsHistoryIndex() :
return detectorTypeToIndicesMapping.containsKey(detectorType.toLowerCase(Locale.ROOT)) ?
detectorTypeToIndicesMapping.get(detectorType.toLowerCase(Locale.ROOT)).getAlertsHistoryIndex() :
OPENSEARCH_DEFAULT_ALERT_HISTORY_INDEX;
}

public static String getAlertsHistoryIndexPattern(String detectorType) {
return detectorTypeToIndicesMapping.containsKey(detectorType) ?
detectorTypeToIndicesMapping.get(detectorType).getAlertsHistoryIndexPattern() :
return detectorTypeToIndicesMapping.containsKey(detectorType.toLowerCase(Locale.ROOT)) ?
detectorTypeToIndicesMapping.get(detectorType.toLowerCase(Locale.ROOT)).getAlertsHistoryIndexPattern() :
OPENSEARCH_DEFAULT_ALERT_HISTORY_INDEX_PATTERN;
}

public static String getAllAlertsIndicesPattern(String detectorType) {
return detectorTypeToIndicesMapping.containsKey(detectorType) ?
detectorTypeToIndicesMapping.get(detectorType).getAllAlertsIndicesPattern() :
return detectorTypeToIndicesMapping.containsKey(detectorType.toLowerCase(Locale.ROOT)) ?
detectorTypeToIndicesMapping.get(detectorType.toLowerCase(Locale.ROOT)).getAllAlertsIndicesPattern() :
OPENSEARCH_DEFAULT_ALL_ALERT_INDICES_PATTERN;
}

Expand All @@ -95,14 +95,14 @@ public static List<String> getAllAlertsIndicesPatternForAllTypes() {
}

public static String getFindingsIndex(String detectorType) {
return detectorTypeToIndicesMapping.containsKey(detectorType) ?
detectorTypeToIndicesMapping.get(detectorType).getFindingsIndex() :
return detectorTypeToIndicesMapping.containsKey(detectorType.toLowerCase(Locale.ROOT)) ?
detectorTypeToIndicesMapping.get(detectorType.toLowerCase(Locale.ROOT)).getFindingsIndex() :
OPENSEARCH_DEFAULT_FINDINGS_INDEX;
}

public static String getAllFindingsIndicesPattern(String detectorType) {
return detectorTypeToIndicesMapping.containsKey(detectorType) ?
detectorTypeToIndicesMapping.get(detectorType).getAllFindingsIndicesPattern() :
return detectorTypeToIndicesMapping.containsKey(detectorType.toLowerCase(Locale.ROOT)) ?
detectorTypeToIndicesMapping.get(detectorType.toLowerCase(Locale.ROOT)).getAllFindingsIndicesPattern() :
OPENSEARCH_DEFAULT_ALL_FINDINGS_INDICES_PATTERN;
}

Expand All @@ -114,8 +114,8 @@ public static List<String> getAllFindingsIndicesPatternForAllTypes() {
}

public static String getFindingsIndexPattern(String detectorType) {
return detectorTypeToIndicesMapping.containsKey(detectorType) ?
detectorTypeToIndicesMapping.get(detectorType).getFindingsIndexPattern() :
return detectorTypeToIndicesMapping.containsKey(detectorType.toLowerCase(Locale.ROOT)) ?
detectorTypeToIndicesMapping.get(detectorType.toLowerCase(Locale.ROOT)).getFindingsIndexPattern() :
OPENSEARCH_DEFAULT_FINDINGS_INDEX_PATTERN;
}

Expand Down
5 changes: 3 additions & 2 deletions src/main/java/org/opensearch/securityanalytics/mapper/MapperTopicStore.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
import java.io.InputStream;
import java.nio.charset.StandardCharsets;
import java.util.HashMap;
import java.util.Locale;
import java.util.Map;
import java.util.Objects;
import java.util.stream.Collectors;
Expand Down Expand Up @@ -54,11 +55,11 @@ private MapperTopicStore() {
}

public static String aliasMappings(String mapperTopic) throws IOException {
if (INSTANCE.mapperMap.containsKey(mapperTopic)) {
if (INSTANCE.mapperMap.containsKey(mapperTopic.toLowerCase(Locale.ROOT))) {
return new String(Objects.requireNonNull(

INSTANCE.getClass().getClassLoader().getResourceAsStream(INSTANCE.
mapperMap.get(mapperTopic))).readAllBytes(),
mapperMap.get(mapperTopic.toLowerCase(Locale.ROOT)))).readAllBytes(),
StandardCharsets.UTF_8);
}
throw new IllegalArgumentException("Mapper not found: [" + mapperTopic + "]");
Expand Down
2 changes: 1 addition & 1 deletion src/main/java/org/opensearch/securityanalytics/model/Detector.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,7 +248,7 @@ private XContentBuilder createXContentBuilder(XContentBuilder builder, ToXConten
}
builder.field(TYPE_FIELD, type)
.field(NAME_FIELD, name)
.field(DETECTOR_TYPE_FIELD, detectorType);
.field(DETECTOR_TYPE_FIELD, detectorType.getDetectorType());

if (!secure) {
if (user == null) {
Expand Down
5 changes: 4 additions & 1 deletion src/main/java/org/opensearch/securityanalytics/model/DetectorTrigger.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
import java.util.Locale;
import java.util.Map;
import java.util.Objects;
import java.util.stream.Collectors;

public class DetectorTrigger implements Writeable, ToXContentObject {

Expand Down Expand Up @@ -66,7 +67,9 @@ public DetectorTrigger(String id, String name, String severity, List<String> rul
this.id = id == null? UUIDs.base64UUID(): id;
this.name = name;
this.severity = severity;
this.ruleTypes = ruleTypes;
this.ruleTypes = ruleTypes.stream()
.map( e -> e.toLowerCase(Locale.ROOT))
.collect(Collectors.toList());
this.ruleIds = ruleIds;
this.ruleSeverityLevels = ruleSeverityLevels;
this.tags = tags;
Expand Down
2 changes: 1 addition & 1 deletion src/main/java/org/opensearch/securityanalytics/transport/TransportGetAlertsAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ protected void doExecute(Task task, GetAlertsRequest request, ActionListener<Get
QueryBuilders.boolQuery().must(
QueryBuilders.matchQuery(
DETECTOR_TYPE_PATH,
request.getDetectorType().getDetectorType().toUpperCase(Locale.ROOT)
request.getDetectorType().getDetectorType()
)
),
ScoreMode.None
Expand Down
2 changes: 1 addition & 1 deletion src/main/java/org/opensearch/securityanalytics/transport/TransportGetFindingsAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,7 @@ protected void doExecute(Task task, GetFindingsRequest request, ActionListener<G
QueryBuilders.boolQuery().must(
QueryBuilders.matchQuery(
DETECTOR_TYPE_PATH,
request.getDetectorType().getDetectorType().toUpperCase(Locale.ROOT)
request.getDetectorType().getDetectorType()
)
),
ScoreMode.None
Expand Down
2 changes: 1 addition & 1 deletion src/main/java/org/opensearch/securityanalytics/transport/TransportIndexRuleAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,7 @@ public void onFailure(Exception e) {

void prepareRuleIndexing() {
String rule = request.getRule();
String category = request.getLogType();
String category = request.getLogType().toLowerCase(Locale.ROOT);

try {
SigmaRule parsedRule = SigmaRule.fromYaml(rule, true);
Expand Down
2 changes: 1 addition & 1 deletion src/test/java/org/opensearch/securityanalytics/SecurityAnalyticsRestTestCase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,7 +239,7 @@ protected List<String> getRandomPrePackagedRules() throws IOException {
" \"query\": {\n" +
" \"bool\": {\n" +
" \"must\": [\n" +
" { \"match\": {\"rule.category\": \"" + TestHelpers.randomDetectorType() + "\"}}\n" +
" { \"match\": {\"rule.category\": \"" + TestHelpers.randomDetectorType().toLowerCase(Locale.ROOT) + "\"}}\n" +
" ]\n" +
" }\n" +
" }\n" +
Expand Down
2 changes: 1 addition & 1 deletion src/test/java/org/opensearch/securityanalytics/TestHelpers.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -307,7 +307,7 @@ public static User randomUserEmpty() {
}

public static String randomDetectorType() {
return "test_windows";
return "TEST_WINDOWS";
}

public static DetectorInput randomDetectorInput() {
Expand Down
17 changes: 17 additions & 0 deletions src/test/java/org/opensearch/securityanalytics/resthandler/DetectorRestApiIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,9 @@ public void testCreatingADetector() throws IOException {
Assert.assertFalse(((Map<String, Object>) responseBody.get("detector")).containsKey("findings_index"));
Assert.assertFalse(((Map<String, Object>) responseBody.get("detector")).containsKey("alert_index"));

String detectorTypeInResponse = (String) ((Map<String, Object>)responseBody.get("detector")).get("detector_type");
Assert.assertEquals("Detector type incorrect", randomDetectorType().toLowerCase(Locale.ROOT), detectorTypeInResponse);

String request = "{\n" +
" \"query\" : {\n" +
" \"match\":{\n" +
Expand Down Expand Up @@ -182,6 +185,9 @@ public void testGettingADetector() throws IOException {
Map<String, Object> responseBody = asMap(getResponse);
Assert.assertEquals(createdId, responseBody.get("_id"));
Assert.assertNotNull(responseBody.get("detector"));

String detectorTypeInResponse = (String) ((Map<String, Object>)responseBody.get("detector")).get("detector_type");
Assert.assertEquals("Detector type incorrect", randomDetectorType().toLowerCase(Locale.ROOT), detectorTypeInResponse);
}

@SuppressWarnings("unchecked")
Expand Down Expand Up @@ -218,6 +224,11 @@ public void testSearchingDetectors() throws IOException {
Map<String, Object> searchResponseHits = (Map) searchResponseBody.get("hits");
Map<String, Object> searchResponseTotal = (Map) searchResponseHits.get("total");
Assert.assertEquals(1, searchResponseTotal.get("value"));

List<Map<String, Object>> hits = ((List<Map<String, Object>>) ((Map<String, Object>) searchResponseBody.get("hits")).get("hits"));
Map<String, Object> hit = hits.get(0);
String detectorTypeInResponse = (String) ((Map<String, Object>) hit.get("_source")).get("detector_type");
Assert.assertEquals("Detector type incorrect", detectorTypeInResponse, randomDetectorType().toLowerCase(Locale.ROOT));
}

@SuppressWarnings("unchecked")
Expand Down Expand Up @@ -274,6 +285,9 @@ public void testCreatingADetectorWithCustomRules() throws IOException {
List<SearchHit> hits = executeSearch(Detector.DETECTORS_INDEX, request);
SearchHit hit = hits.get(0);

String detectorType = (String) ((Map<String, Object>) hit.getSourceAsMap().get("detector")).get("detector_type");
Assert.assertEquals("Detector type incorrect", detectorType, randomDetectorType().toLowerCase(Locale.ROOT));

String monitorId = ((List<String>) ((Map<String, Object>) hit.getSourceAsMap().get("detector")).get("monitor_id")).get(0);

indexDoc(index, "1", randomDoc());
Expand Down Expand Up @@ -430,6 +444,9 @@ public void testUpdateADetector() throws IOException {
Response updateResponse = makeRequest(client(), "PUT", SecurityAnalyticsPlugin.DETECTOR_BASE_URI + "/" + detectorId, Collections.emptyMap(), toHttpEntity(updatedDetector));
Assert.assertEquals("Update detector failed", RestStatus.OK, restStatus(updateResponse));

String detectorTypeInResponse = (String) ((Map<String, Object>) (asMap(updateResponse).get("detector"))).get("detector_type");
Assert.assertEquals("Detector type incorrect", randomDetectorType().toLowerCase(Locale.ROOT), detectorTypeInResponse);

request = "{\n" +
" \"query\" : {\n" +
" \"match_all\":{\n" +
Expand Down
6 changes: 3 additions & 3 deletions src/test/java/org/opensearch/securityanalytics/resthandler/RuleRestApiIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ public void testCreatingARule() throws IOException {
" \"query\": {\n" +
" \"bool\": {\n" +
" \"must\": [\n" +
" { \"match\": {\"rule.category\": \"" + randomDetectorType() + "\"}}\n" +
" { \"match\": {\"rule.category\": \"" + randomDetectorType().toLowerCase(Locale.ROOT) + "\"}}\n" +
" ]\n" +
" }\n" +
" }\n" +
Expand Down Expand Up @@ -180,7 +180,7 @@ public void testSearchingPrepackagedRules() throws IOException {
" \"query\": {\n" +
" \"bool\": {\n" +
" \"must\": [\n" +
" { \"match\": {\"rule.category\": \"" + randomDetectorType() + "\"}}\n" +
" { \"match\": {\"rule.category\": \"" + randomDetectorType().toLowerCase(Locale.ROOT) + "\"}}\n" +
" ]\n" +
" }\n" +
" }\n" +
Expand Down Expand Up @@ -288,7 +288,7 @@ public void testSearchingCustomRules() throws IOException {
" \"query\": {\n" +
" \"bool\": {\n" +
" \"must\": [\n" +
" { \"match\": {\"rule.category\": \"" + randomDetectorType() + "\"}}\n" +
" { \"match\": {\"rule.category\": \"" + randomDetectorType().toLowerCase(Locale.ROOT) + "\"}}\n" +
" ]\n" +
" }\n" +
" }\n" +
Expand Down