From dc638d152974c7210330de6020bf9eea40e530e3 Mon Sep 17 00:00:00 2001
From: Manuel Abascal <mjabascal10@gmail.com>
Date: Fri, 2 Feb 2024 23:51:02 +0200
Subject: [PATCH] Fixed
 Incident-response-automation-must-allow-to-run-in-default-agent (#396)

---
 .../ir-create-rule.component.html             | 104 +++++++++++++++---
 .../ir-create-rule.component.scss             |  13 +++
 .../ir-create-rule.component.ts               |  19 +++-
 .../ir-summary/ir-summary.component.html      |  57 ++++++++++
 .../ir-summary/ir-summary.component.scss      |   0
 .../ir-summary/ir-summary.component.ts        |  70 ++++++++++++
 .../shared/incident-response-shared.module.ts |   8 +-
 .../shared/type/incident-rule.type.ts         |   1 +
 .../util/utm-toggle/utm-toggle.component.html |   7 +-
 .../util/utm-toggle/utm-toggle.component.scss |   4 +
 .../util/utm-toggle/utm-toggle.component.ts   |   1 +
 11 files changed, 263 insertions(+), 21 deletions(-)
 create mode 100644 frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.html
 create mode 100644 frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.scss
 create mode 100644 frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.ts

diff --git a/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.html b/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.html
index c040e7e95..8a0e774c3 100644
--- a/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.html
+++ b/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.html
@@ -1,38 +1,50 @@
 <app-utm-modal-header [name]="(rule?'Edit':'Create') + ' incident response automation'"></app-utm-modal-header>
-<div class="container-fluid p-3">
-  <div class="d-flex flex-column justify-content-start align-items-start">
+<div class="container-fluid p-3 pt-5">
+  <div class="d-flex flex-column justify-content-start align-items-start pb-3">
     <div class="step-container wizard-step">
       <div class="step">
-         <span class="text-blue-800 font-weight-bold">
+        <span class="text-blue-800 font-weight-bold step-title">
           Automation
         </span>
         <div [ngClass]="isCompleted(1)?'step-success':step===1?'step-active':'step-inactive'"
              class="round-indicator">
-          <i [ngClass]="isCompleted(1)?'icon-checkmark3':'icon-file-css'"></i>
+          <i class="step-icon"  [ngClass]="isCompleted(1)?'icon-checkmark3':'icon-file-css'"></i>
         </div>
       </div>
       <div class="step-link">
         <div class="line w-100"></div>
       </div>
       <div class="step">
-         <span class="text-blue-800 font-weight-bold">
+         <span class="text-blue-800 font-weight-bold step-title">
           Trigger
         </span>
         <div [ngClass]="isCompleted(2)?'step-success':step===2?'step-active':'step-inactive'"
              class="round-indicator">
-          <i [ngClass]="isCompleted(2)?'icon-checkmark3':'icon-power2'"></i>
+          <i class="step-icon"  [ngClass]="isCompleted(2)?'icon-checkmark3':'icon-power2'"></i>
         </div>
       </div>
       <div class="step-link">
         <div class="line w-100"></div>
       </div>
       <div class="step">
-          <span class="text-blue-800 font-weight-bold">
+          <span class="text-blue-800 font-weight-bold step-title">
           Action
         </span>
         <div [ngClass]="isCompleted(3)?'step-success':step===3?'step-active':'step-inactive'"
              class="round-indicator">
-          <i [ngClass]="isCompleted(3)?'icon-checkmark3':'icon-terminal'"></i>
+          <i class="step-icon"  [ngClass]="isCompleted(3)?'icon-checkmark3':'icon-terminal'"></i>
+        </div>
+      </div>
+      <div class="step-link">
+        <div class="line w-100"></div>
+      </div>
+      <div class="step">
+          <span class="text-blue-800 font-weight-bold step-title">
+          Summary
+        </span>
+        <div [ngClass]="isCompleted(4)?'step-success':step===3?'step-active':'step-inactive'"
+             class="round-indicator">
+          <i class="step-icon"  [ngClass]="isCompleted(4)?'icon-checkmark3':'icon-eye'"></i>
         </div>
       </div>
     </div>
@@ -122,21 +134,22 @@
                placement="left"
                (click)="removeRuleCondition(i)"></i>
           </div>
-          <div class="d-flex justify-content-between">
+          <div class="d-flex justify-content-between pr-4">
             <div>
               <span *ngIf="ruleConditions.length === 0 || !ruleConditions.valid"
                     class="text-danger-300 font-size-base">
                 You must set at least one trigger condition
               </span>
             </div>
-            <button class="btn utm-button utm-button-primary align-self-end" (click)="addRuleCondition()">Add
-              condition
+            <button class="btn utm-button btn-success align-self-end" (click)="addRuleCondition()">
+              <i class="icon-plus22"></i>&nbsp;
+              Add
             </button>
           </div>
         </div>
       </div>
-      <div class="d-flex mt-3">
-        <div class="d-flex flex-column w-30 mb-3 pr-2">
+      <div class="d-flex mt-3 flex-column">
+        <div class="col-12 p-0">
           <label class="pb-1" for="exclude">Agent platform is</label>
           <ng-select [clearable]="false"
                      [items]="platforms"
@@ -149,7 +162,7 @@
           </ng-select>
           <app-formcontrol-error [formcontrol]="formRule.get('agentPlatform')"></app-formcontrol-error>
         </div>
-        <div class="d-flex flex-column flex-grow-1 mb-3 pl-2">
+        <!--<div class="d-flex flex-column flex-grow-1 mb-3 pl-2">
           <label class="pb-1" for="exclude">Exclude agents</label>
           <ng-select [clearable]="false"
                      [items]="agents"
@@ -163,6 +176,59 @@
                      bindLabel="assetName"
                      id="exclude">
           </ng-select>
+        </div>-->
+      </div>
+      <div class="d-flex mt-3 flex-column">
+        <div class="col-12">
+          <app-utm-toggle (toggleChange)="formRule.get('agentType').setValue($event)"
+                          [active]="formRule.get('agentType').value"
+                          [emitAtStart]="false"
+                          [customClass]="'pl-3'"
+                          [label]="'Select the agent handling strategy for the automation. By default, commands won\'t run on specified agents, even if the trigger conditions match. Alternatively, choose a default agent to run the automation if no other agent matches the criteria.'" class="mb-3"></app-utm-toggle>
+        </div>
+      </div>
+      <div *ngIf="formRule.get('agentType').value" class="d-flex mt-3 flex-column">
+        <div class="col-12 p-0">
+          <label class="pb-1" for="exclude">Exclude agents</label>
+          <ng-select [clearable]="false"
+                     [items]="agents"
+                     [placeholder]="'Select agents to exclude'"
+                     [loadingText]="'Loading agents...'"
+                     [virtualScroll]="true"
+                     [multiple]="true"
+                     formControlName="excludedAgents"
+                     (change)="onChangeExclude($event)"
+                     bindValue="assetName"
+                     bindLabel="assetName"
+                     id="exclude">
+          </ng-select>
+        </div>
+        <div class="col-12 p-0">
+          <div class="alert alert-info alert-styled-right mt-2 info-dismissible">
+            <span class="font-weight-semibold">Info! </span>
+            <span>Represents agents where the commands won't run, even if the trigger conditions match</span>
+          </div>
+        </div>
+      </div>
+      <div *ngIf="!formRule.get('agentType').value" class="d-flex mt-3 flex-column">
+        <div  class="col-12 p-0">
+          <label class="pb-1" for="exclude">Default agents</label>
+          <ng-select [clearable]="false"
+                     [items]="agents"
+                     [placeholder]="'Select agent'"
+                     [loadingText]="'Loading agents...'"
+                     [virtualScroll]="true"
+                     formControlName="defaultAgent"
+                     bindValue="assetName"
+                     bindLabel="assetName"
+                     id="deafult">
+          </ng-select>
+        </div>
+        <div class="col-12 p-0">
+          <div class="alert alert-info alert-styled-right mt-2 info-dismissible">
+            <span class="font-weight-semibold">Info! </span>
+            <span>Designates the agent to execute the automation when no other agent meets the criteria to serve as the runner for this automation.</span>
+          </div>
         </div>
       </div>
       <div *ngIf="platforms.length === 0"
@@ -206,6 +272,12 @@
         <span>Warning! You may cause damage to the infrastructure and services of your organization, please review the automation command before saving it</span>
       </div>
     </div>
+
+    <div *ngIf="step===4" class="configure-step mt-3 mb-3">
+      <app-ir-summary
+              [formRule]="formRule">
+      </app-ir-summary>
+    </div>
   </form>
   <div class="button-container d-flex justify-content-end mt-3">
     <button (click)="backStep()" *ngIf="step > 1"
@@ -213,7 +285,7 @@
       <i class="icon-arrow-left22"></i>&nbsp;
       Back
     </button>
-    <button (click)="nextStep()" *ngIf="step < 3"
+    <button (click)="nextStep()" *ngIf="step < 4"
             [disabled]="isDisable(step) "
             class="btn utm-button utm-button-primary ml-2">
       Next&nbsp;
@@ -221,7 +293,7 @@
     </button>
 
     <button (click)="createRule()"
-            *ngIf="step===3"
+            *ngIf="step===4"
             [disabled]="!command || command === ''"
             class="btn utm-button utm-button-primary ml-2">
       <i [ngClass]="creating?'icon-spinner2 spinner':'icon-terminal'"></i>
diff --git a/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.scss b/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.scss
index 8b1378917..af695239f 100644
--- a/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.scss
+++ b/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.scss
@@ -1 +1,14 @@
+.step-title {
+  position: absolute;
+  bottom: 35px;
+}
 
+.wizard-step .step-link {
+  padding-top: 0 !important;
+}
+
+.step-icon {
+  position: absolute;
+  top:50%;
+  transform: translateY(-50%);
+}
diff --git a/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.ts b/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.ts
index adf744e30..8d5a9a163 100644
--- a/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.ts
+++ b/frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.ts
@@ -54,7 +54,9 @@ export class IrCreateRuleComponent implements OnInit {
       conditions: this.fb.array([]),
       command: ['', Validators.required],
       active: [true],
+      agentType: [true],
       excludedAgents: [[]],
+      defaultAgent: [''],
       agentPlatform: ['', Validators.required]
     });
     this.getPlatforms();
@@ -79,6 +81,8 @@ export class IrCreateRuleComponent implements OnInit {
         this.ruleConditions.push(ruleCondition);
         this.getAgents(this.formRule.get('agentPlatform').value);
         this.formRule.get('excludedAgents').setValue(this.rule.excludedAgents);
+        this.formRule.get('agentType').setValue(this.rule.excludedAgents.length > 0);
+        this.formRule.get('defaultAgent').setValue(this.rule.defaultAgent);
       }
     } else if (this.alert) {
       const alertName = this.getValueFromAlert(ALERT_NAME_FIELD);
@@ -182,6 +186,7 @@ export class IrCreateRuleComponent implements OnInit {
     const action = 'created';
     const actionError = 'creating';
     this.formRule.get('command').setValue(this.command);
+    this.clearAgentTypeSelection();
     this.setNameBeforeSave();
     this.incidentResponseRuleService.create(this.formRule.value).subscribe(() => {
       this.successSaved(action);
@@ -189,8 +194,10 @@ export class IrCreateRuleComponent implements OnInit {
   }
 
   editRule() {
+    console.log('edit');
     const action = 'edited';
     const actionError = 'editing';
+    this.clearAgentTypeSelection();
     this.formRule.get('command').setValue(this.command);
     this.setNameBeforeSave();
     this.incidentResponseRuleService.update(this.formRule.value).subscribe(() => {
@@ -208,7 +215,13 @@ export class IrCreateRuleComponent implements OnInit {
     this.formRule.get('name').setValue(this.rulePrefix + this.formRule.get('name').value);
   }
 
-
+ clearAgentTypeSelection(){
+   if (!this.formRule.get('agentType').value) {
+     this.formRule.get('excludedAgents').setValue([]);
+   } else {
+     this.formRule.get('defaultAgent').setValue('');
+   }
+ }
   errorSaving(action: string) {
     const ruleName: string = this.formRule.get('name').value;
     this.formRule.get('name').setValue(this.replacePrefixInName(ruleName));
@@ -268,4 +281,8 @@ export class IrCreateRuleComponent implements OnInit {
     });
   }
 
+  onChangeToggle() {
+
+  }
+
 }
diff --git a/frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.html b/frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.html
new file mode 100644
index 000000000..d3eef8c42
--- /dev/null
+++ b/frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.html
@@ -0,0 +1,57 @@
+
+<div class="d-flex p-2 flex-column">
+  <div>
+    <p>
+      The automation <strong>{{ automationName }}</strong> is designed to execute based on specific conditions.
+      It will evaluate the following conditions:
+    </p>
+
+    <div class="alert-details mb-1 mt-1"
+         *ngFor="let condition of conditions">
+      <span class="text-blue-800 font-weight-light has-minimum-width">{{getFieldName(condition.field)}}</span>&nbsp;
+      <span class="font-weight-light  font-weight-semibold">{{getFilterName(condition.operator)}}</span>&nbsp;
+      <span class="">{{condition.value}}</span>&nbsp;
+    </div>
+
+    <span>
+      On agents operating on the <strong>{{ platform | capitalize }}</strong> platform.
+    </span>
+
+
+    <ng-container *ngIf="agentType">
+      <span>
+        Importantly, the automation excludes designated agents, such as
+      </span>
+      <span class="badge p-1 border-1 badge-flat font-weight-light border-info-800 text-info-800 mr-2 mb-2"
+            *ngFor="let exclusion of excludedAgents">{{exclusion}}
+      </span>
+    </ng-container>
+
+    <ng-container *ngIf="!agentType">
+      <span>
+        In case none of the agents satisfy the specified conditions, the automation will smoothly revert and execute on the default agent,
+        <span class="badge p-1 border-1 badge-flat font-weight-light border-info-800 text-info-800 mr-2 mb-2">
+              {{ defaultAgent | uppercase}}.
+        </span>
+        <span>
+          This guarantees a comprehensive and adaptable approach to the automation process.
+        </span>
+      </span>
+    </ng-container>
+  </div>
+  <div class="alert-details w-100 d-flex justify-content-start align-items-start mb-2 flex-column">
+    <span>
+     Crucially, when these conditions are met, the automation will proceed to execute the following action:
+    </span>
+    <app-utm-code-view [code]="command" [allowCopy]="true"></app-utm-code-view>
+  </div>
+</div>
+
+<div class="d-flex p-0 flex-column">
+  <div class="col-12 p-0">
+    <div class="alert alert-info alert-styled-right mt-2 info-dismissible">
+      <span class="font-weight-semibold">Info! </span>
+      <span>Please carefully review all presented changes, such as this one, before saving. Any oversight may lead to potential damage to your infrastructure.</span>
+    </div>
+  </div>
+</div>
diff --git a/frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.scss b/frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.scss
new file mode 100644
index 000000000..e69de29bb
diff --git a/frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.ts b/frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.ts
new file mode 100644
index 000000000..2cd20c98f
--- /dev/null
+++ b/frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.ts
@@ -0,0 +1,70 @@
+import {Component, EventEmitter, Input, OnInit, Output} from '@angular/core';
+import {FormArray, FormGroup} from '@angular/forms';
+import {UtmToastService} from '../../../../shared/alert/utm-toast.service';
+import {INCIDENT_AUTOMATION_ALERT_FIELDS} from '../../../../shared/constants/alert/alert-field.constant';
+import {FILTER_OPERATORS} from '../../../../shared/constants/filter-operators.const';
+import {ElasticOperatorsEnum} from '../../../../shared/enums/elastic-operators.enum';
+import {IncidentResponseAssetService} from '../../services/incident-response-asset.service';
+import {IncidentResponseJobService} from '../../services/incident-response-job.service';
+
+@Component({
+  selector: 'app-ir-summary',
+  templateUrl: './ir-summary.component.html',
+  styleUrls: ['./ir-summary.component.scss']
+})
+export class IrSummaryComponent implements OnInit {
+  @Input() formRule: FormGroup;
+  @Output() jobCreated = new EventEmitter<string>();
+  alertFields = INCIDENT_AUTOMATION_ALERT_FIELDS;
+
+
+  constructor(private incidentResponseAssetService: IncidentResponseAssetService,
+              public utmToastService: UtmToastService,
+              private incidentResponseJobService: IncidentResponseJobService) {
+  }
+
+  ngOnInit() {
+  }
+
+  get automationName() {
+    return this.formRule.get('name').value;
+  }
+
+  get platform() {
+    return this.formRule.get('agentPlatform').value;
+  }
+
+  get defaultAgent() {
+    return this.formRule.get('defaultAgent').value;
+  }
+
+  get command() {
+    return this.formRule.get('command').value;
+  }
+
+  get agentType() {
+    return this.formRule.get('agentType').value;
+  }
+
+   get conditions() {
+    return (this.formRule.get('conditions') as FormArray).value;
+  }
+
+  get excludedAgents() {
+    return this.formRule.get('excludedAgents').value;
+  }
+
+  getFieldName(field: string): string {
+    return INCIDENT_AUTOMATION_ALERT_FIELDS.filter(value => value.field === field)[0].label;
+  }
+
+  getFilterName(operator: ElasticOperatorsEnum): string {
+    const index = FILTER_OPERATORS.findIndex(value => value.operator === operator);
+    if (index !== -1) {
+      return FILTER_OPERATORS[index].name;
+    } else {
+      return operator;
+    }
+  }
+
+}
diff --git a/frontend/src/app/incident-response/shared/incident-response-shared.module.ts b/frontend/src/app/incident-response/shared/incident-response-shared.module.ts
index df0aa3c2c..221c37eb4 100644
--- a/frontend/src/app/incident-response/shared/incident-response-shared.module.ts
+++ b/frontend/src/app/incident-response/shared/incident-response-shared.module.ts
@@ -15,6 +15,7 @@ import {IrExecuteCommandComponent} from './component/ir-execute-command/ir-execu
 import {IrFullLogComponent} from './component/ir-full-log/ir-full-log.component';
 import {IrJobCreateComponent} from './component/ir-job-create/ir-job-create.component';
 import {IraHistoryComponent} from './component/ira-history/ira-history.component';
+import {IrSummaryComponent} from "./component/ir-summary/ir-summary.component";
 
 @NgModule({
   declarations: [IrJobCreateComponent,
@@ -25,14 +26,17 @@ import {IraHistoryComponent} from './component/ira-history/ira-history.component
     IrExecuteCommandComponent,
     IrCommandSelectComponent,
     IrCreateRuleComponent,
-    IraHistoryComponent],
+    IraHistoryComponent,
+    IrSummaryComponent],
   entryComponents: [IrJobCreateComponent, IrActionCreateComponent, IrCreateRuleComponent],
     exports: [IrJobCreateComponent,
         IncidentResponseFilterComponent,
         IncidentResponseStatusComponent,
         IrFullLogComponent,
         IrExecuteCommandComponent,
-        IrCreateRuleComponent, IraHistoryComponent],
+        IrCreateRuleComponent,
+        IraHistoryComponent,
+        IrSummaryComponent],
   imports: [
     CommonModule,
     NgbModule,
diff --git a/frontend/src/app/incident-response/shared/type/incident-rule.type.ts b/frontend/src/app/incident-response/shared/type/incident-rule.type.ts
index 554c2e975..a107dfd3b 100644
--- a/frontend/src/app/incident-response/shared/type/incident-rule.type.ts
+++ b/frontend/src/app/incident-response/shared/type/incident-rule.type.ts
@@ -13,6 +13,7 @@ export class IncidentRuleType {
   createdDate: Date;
   lastModifiedBy: string;
   lastModifiedDate: Date;
+  defaultAgent: string;
 }
 
 
diff --git a/frontend/src/app/shared/components/utm/util/utm-toggle/utm-toggle.component.html b/frontend/src/app/shared/components/utm/util/utm-toggle/utm-toggle.component.html
index 7a6b9a4ec..969177a5c 100644
--- a/frontend/src/app/shared/components/utm/util/utm-toggle/utm-toggle.component.html
+++ b/frontend/src/app/shared/components/utm/util/utm-toggle/utm-toggle.component.html
@@ -5,6 +5,9 @@
         [ngClass]="active?'toggle-active':'toggle-inactive'"
         class="switchery switchery-default switchery-sm">
       <small></small>
-    </span> &nbsp;
-  {{label}}
+    </span>
+    <div class="text-justify pl-2 w-95"
+         [ngClass]="customClass">
+        {{label}}
+    </div>
 </label>
diff --git a/frontend/src/app/shared/components/utm/util/utm-toggle/utm-toggle.component.scss b/frontend/src/app/shared/components/utm/util/utm-toggle/utm-toggle.component.scss
index 2c9dd3268..eb1f5ee61 100644
--- a/frontend/src/app/shared/components/utm/util/utm-toggle/utm-toggle.component.scss
+++ b/frontend/src/app/shared/components/utm/util/utm-toggle/utm-toggle.component.scss
@@ -54,3 +54,7 @@
 
 }
 
+.w-95 {
+  width: 95%;
+}
+
diff --git a/frontend/src/app/shared/components/utm/util/utm-toggle/utm-toggle.component.ts b/frontend/src/app/shared/components/utm/util/utm-toggle/utm-toggle.component.ts
index acac26d2b..0a7e93fb7 100644
--- a/frontend/src/app/shared/components/utm/util/utm-toggle/utm-toggle.component.ts
+++ b/frontend/src/app/shared/components/utm/util/utm-toggle/utm-toggle.component.ts
@@ -8,6 +8,7 @@ import {Component, EventEmitter, Input, OnInit, Output} from '@angular/core';
 export class UtmToggleComponent implements OnInit {
   @Input() active: boolean;
   @Input() label: string;
+  @Input() customClass: string;
   @Input() emitAtStart: boolean;
   @Output() toggleChange = new EventEmitter<boolean>();