Skip to content

Commit

Permalink
[SIEM] [Detection Engine] Timestamps for rules (#56197) (#56224)
Browse files Browse the repository at this point in the history 
* utilize createdAt and updatedAt from the alerting saved object

* revert accidental change to test rule

* updatedAt is not a part of savedObject attributes passed back from alerting, it's at the top level

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
  • Loading branch information
@dhurley14 @elasticmachine
dhurley14 and elasticmachine authored Jan 29, 2020
1 parent a3f3562 commit b652c96
Show file tree
Hide file tree
Showing 19 changed files with 85 additions and 32 deletions.
2 changes: 0 additions & 2 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -269,8 +269,6 @@ export const getResult = (): RuleAlertType => ({
alertTypeId: 'siem.signals',
consumer: 'siem',
params: {
createdAt: '2019-12-13T16:40:33.400Z',
updatedAt: '2019-12-13T16:40:33.400Z',
description: 'Detecting root and admin users',
ruleId: 'rule-1',
index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
Expand Down
4 changes: 0 additions & 4 deletions ...k/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,6 @@ export const createCreateRulesBulkRoute = (server: ServerFacade): Hapi.ServerRou
const rules = await Promise.all(
request.payload.map(async payloadRule => {
const {
created_at: createdAt,
description,
enabled,
false_positives: falsePositives,
Expand All @@ -73,7 +72,6 @@ export const createCreateRulesBulkRoute = (server: ServerFacade): Hapi.ServerRou
threat,
to,
type,
updated_at: updatedAt,
references,
timeline_id: timelineId,
timeline_title: timelineTitle,
Expand Down Expand Up @@ -104,7 +102,6 @@ export const createCreateRulesBulkRoute = (server: ServerFacade): Hapi.ServerRou
const createdRule = await createRules({
alertsClient,
actionsClient,
createdAt,
description,
enabled,
falsePositives,
Expand All @@ -129,7 +126,6 @@ export const createCreateRulesBulkRoute = (server: ServerFacade): Hapi.ServerRou
to,
type,
threat,
updatedAt,
references,
version,
});
Expand Down
4 changes: 0 additions & 4 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@ export const createCreateRulesRoute = (server: ServerFacade): Hapi.ServerRoute =
},
async handler(request: RulesRequest, headers) {
const {
created_at: createdAt,
description,
enabled,
false_positives: falsePositives,
Expand All @@ -59,7 +58,6 @@ export const createCreateRulesRoute = (server: ServerFacade): Hapi.ServerRoute =
threat,
to,
type,
updated_at: updatedAt,
references,
} = request.payload;
const alertsClient = isFunction(request.getAlertsClient) ? request.getAlertsClient() : null;
Expand Down Expand Up @@ -91,7 +89,6 @@ export const createCreateRulesRoute = (server: ServerFacade): Hapi.ServerRoute =
const createdRule = await createRules({
alertsClient,
actionsClient,
createdAt,
description,
enabled,
falsePositives,
Expand All @@ -116,7 +113,6 @@ export const createCreateRulesRoute = (server: ServerFacade): Hapi.ServerRoute =
to,
type,
threat,
updatedAt,
references,
version: 1,
});
Expand Down
2 changes: 0 additions & 2 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/import_rules_route.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,6 @@ export const createImportRulesRoute = (server: ServerFacade): Hapi.ServerRoute =
const createdRule = await createRules({
alertsClient,
actionsClient,
createdAt: new Date().toISOString(),
description,
enabled,
falsePositives,
Expand All @@ -155,7 +154,6 @@ export const createImportRulesRoute = (server: ServerFacade): Hapi.ServerRoute =
to,
type,
threat,
updatedAt: new Date().toISOString(),
references,
version,
});
Expand Down
4 changes: 2 additions & 2 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,8 @@ export const transformAlertToRule = (
ruleStatus?: SavedObject<IRuleSavedAttributesSavedObjectAttributes>
): Partial<OutputRuleAlertRest> => {
return pickBy<OutputRuleAlertRest>((value: unknown) => value != null, {
created_at: alert.params.createdAt,
updated_at: alert.params.updatedAt,
created_at: alert.createdAt.toISOString(),
updated_at: alert.updatedAt.toISOString(),
created_by: alert.createdBy,
description: alert.params.description,
enabled: alert.enabled,
Expand Down
2 changes: 0 additions & 2 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/create_rules.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,6 @@ export const createRules = ({
alertTypeId: SIGNALS_ID,
consumer: APP_ID,
params: {
createdAt: new Date().toISOString(),
description,
ruleId,
index,
Expand All @@ -66,7 +65,6 @@ export const createRules = ({
threat,
to,
type,
updatedAt: new Date().toISOString(),
references,
version,
},
Expand Down
2 changes: 0 additions & 2 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/install_prepacked_rules.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -75,8 +75,6 @@ export const installPrepackagedRules = (
threat,
references,
version,
createdAt: new Date().toISOString(),
updatedAt: new Date().toISOString(),
}),
];
}, []);
1 change: 0 additions & 1 deletion x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,6 @@ export const updateRules = async ({
threat,
to,
type,
updatedAt: new Date().toISOString(),
references,
version: calculatedVersion,
}
Expand Down
2 changes: 0 additions & 2 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/__mocks__/es_results.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,6 @@ export const sampleRuleAlertParams = (
meta: undefined,
threat: undefined,
version: 1,
updatedAt: '2019-12-17T15:04:25.343Z',
createdAt: '2019-12-17T15:04:37.105Z',
});

export const sampleDocNoSortId = (someUuid: string = sampleIdGuid): SignalSourceHit => ({
Expand Down
8 changes: 8 additions & 0 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,8 @@ describe('buildBulkBody', () => {
ruleParams: sampleParams,
id: sampleRuleGuid,
name: 'rule-name',
createdAt: '2020-01-28T15:58:34.810Z',
updatedAt: '2020-01-28T15:59:14.004Z',
createdBy: 'elastic',
updatedBy: 'elastic',
interval: '5m',
Expand Down Expand Up @@ -103,6 +105,8 @@ describe('buildBulkBody', () => {
ruleParams: sampleParams,
id: sampleRuleGuid,
name: 'rule-name',
createdAt: '2020-01-28T15:58:34.810Z',
updatedAt: '2020-01-28T15:59:14.004Z',
createdBy: 'elastic',
updatedBy: 'elastic',
interval: '5m',
Expand Down Expand Up @@ -189,6 +193,8 @@ describe('buildBulkBody', () => {
ruleParams: sampleParams,
id: sampleRuleGuid,
name: 'rule-name',
createdAt: '2020-01-28T15:58:34.810Z',
updatedAt: '2020-01-28T15:59:14.004Z',
createdBy: 'elastic',
updatedBy: 'elastic',
interval: '5m',
Expand Down Expand Up @@ -272,6 +278,8 @@ describe('buildBulkBody', () => {
ruleParams: sampleParams,
id: sampleRuleGuid,
name: 'rule-name',
createdAt: '2020-01-28T15:58:34.810Z',
updatedAt: '2020-01-28T15:59:14.004Z',
createdBy: 'elastic',
updatedBy: 'elastic',
interval: '5m',
Expand Down
6 changes: 6 additions & 0 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,9 @@ interface BuildBulkBodyParams {
ruleParams: RuleTypeParams;
id: string;
name: string;
createdAt: string;
createdBy: string;
updatedAt: string;
updatedBy: string;
interval: string;
enabled: boolean;
Expand All @@ -28,7 +30,9 @@ export const buildBulkBody = ({
ruleParams,
id,
name,
createdAt,
createdBy,
updatedAt,
updatedBy,
interval,
enabled,
Expand All @@ -39,7 +43,9 @@ export const buildBulkBody = ({
id,
name,
enabled,
createdAt,
createdBy,
updatedAt,
updatedBy,
interval,
tags,
Expand Down
6 changes: 6 additions & 0 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@ describe('buildRule', () => {
name: 'some-name',
id: sampleRuleGuid,
enabled: false,
createdAt: '2020-01-28T15:58:34.810Z',
updatedAt: '2020-01-28T15:59:14.004Z',
createdBy: 'elastic',
updatedBy: 'elastic',
interval: 'some interval',
Expand Down Expand Up @@ -85,6 +87,8 @@ describe('buildRule', () => {
name: 'some-name',
id: sampleRuleGuid,
enabled: true,
createdAt: '2020-01-28T15:58:34.810Z',
updatedAt: '2020-01-28T15:59:14.004Z',
createdBy: 'elastic',
updatedBy: 'elastic',
interval: 'some interval',
Expand Down Expand Up @@ -128,6 +132,8 @@ describe('buildRule', () => {
name: 'some-name',
id: sampleRuleGuid,
enabled: true,
createdAt: '2020-01-28T15:58:34.810Z',
updatedAt: '2020-01-28T15:59:14.004Z',
createdBy: 'elastic',
updatedBy: 'elastic',
interval: 'some interval',
Expand Down
8 changes: 6 additions & 2 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,9 @@ interface BuildRuleParams {
name: string;
id: string;
enabled: boolean;
createdAt: string;
createdBy: string;
updatedAt: string;
updatedBy: string;
interval: string;
tags: string[];
Expand All @@ -23,7 +25,9 @@ export const buildRule = ({
name,
id,
enabled,
createdAt,
createdBy,
updatedAt,
updatedBy,
interval,
tags,
Expand Down Expand Up @@ -58,7 +62,7 @@ export const buildRule = ({
updated_by: updatedBy,
threat: ruleParams.threat,
version: ruleParams.version,
created_at: ruleParams.createdAt,
updated_at: ruleParams.updatedAt,
created_at: createdAt,
updated_at: updatedAt,
});
};
16 changes: 16 additions & 0 deletions .../legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,8 @@ describe('searchAfterAndBulkCreate', () => {
id: sampleRuleGuid,
signalsIndex: DEFAULT_SIGNALS_INDEX,
name: 'rule-name',
createdAt: '2020-01-28T15:58:34.810Z',
updatedAt: '2020-01-28T15:59:14.004Z',
createdBy: 'elastic',
updatedBy: 'elastic',
interval: '5m',
Expand Down Expand Up @@ -93,6 +95,8 @@ describe('searchAfterAndBulkCreate', () => {
id: sampleRuleGuid,
signalsIndex: DEFAULT_SIGNALS_INDEX,
name: 'rule-name',
createdAt: '2020-01-28T15:58:34.810Z',
updatedAt: '2020-01-28T15:59:14.004Z',
createdBy: 'elastic',
updatedBy: 'elastic',
interval: '5m',
Expand All @@ -117,6 +121,8 @@ describe('searchAfterAndBulkCreate', () => {
id: sampleRuleGuid,
signalsIndex: DEFAULT_SIGNALS_INDEX,
name: 'rule-name',
createdAt: '2020-01-28T15:58:34.810Z',
updatedAt: '2020-01-28T15:59:14.004Z',
createdBy: 'elastic',
updatedBy: 'elastic',
interval: '5m',
Expand Down Expand Up @@ -148,6 +154,8 @@ describe('searchAfterAndBulkCreate', () => {
id: sampleRuleGuid,
signalsIndex: DEFAULT_SIGNALS_INDEX,
name: 'rule-name',
createdAt: '2020-01-28T15:58:34.810Z',
updatedAt: '2020-01-28T15:59:14.004Z',
createdBy: 'elastic',
updatedBy: 'elastic',
interval: '5m',
Expand Down Expand Up @@ -179,6 +187,8 @@ describe('searchAfterAndBulkCreate', () => {
id: sampleRuleGuid,
signalsIndex: DEFAULT_SIGNALS_INDEX,
name: 'rule-name',
createdAt: '2020-01-28T15:58:34.810Z',
updatedAt: '2020-01-28T15:59:14.004Z',
createdBy: 'elastic',
updatedBy: 'elastic',
interval: '5m',
Expand Down Expand Up @@ -212,6 +222,8 @@ describe('searchAfterAndBulkCreate', () => {
id: sampleRuleGuid,
signalsIndex: DEFAULT_SIGNALS_INDEX,
name: 'rule-name',
createdAt: '2020-01-28T15:58:34.810Z',
updatedAt: '2020-01-28T15:59:14.004Z',
createdBy: 'elastic',
updatedBy: 'elastic',
interval: '5m',
Expand Down Expand Up @@ -245,6 +257,8 @@ describe('searchAfterAndBulkCreate', () => {
id: sampleRuleGuid,
signalsIndex: DEFAULT_SIGNALS_INDEX,
name: 'rule-name',
createdAt: '2020-01-28T15:58:34.810Z',
updatedAt: '2020-01-28T15:59:14.004Z',
createdBy: 'elastic',
updatedBy: 'elastic',
interval: '5m',
Expand Down Expand Up @@ -280,6 +294,8 @@ describe('searchAfterAndBulkCreate', () => {
id: sampleRuleGuid,
signalsIndex: DEFAULT_SIGNALS_INDEX,
name: 'rule-name',
createdAt: '2020-01-28T15:58:34.810Z',
updatedAt: '2020-01-28T15:59:14.004Z',
createdBy: 'elastic',
updatedBy: 'elastic',
interval: '5m',
Expand Down
8 changes: 8 additions & 0 deletions x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,10 @@ interface SearchAfterAndBulkCreateParams {
id: string;
signalsIndex: string;
name: string;
createdAt: string;
createdBy: string;
updatedBy: string;
updatedAt: string;
interval: string;
enabled: boolean;
pageSize: number;
Expand All @@ -38,8 +40,10 @@ export const searchAfterAndBulkCreate = async ({
signalsIndex,
filter,
name,
createdAt,
createdBy,
updatedBy,
updatedAt,
interval,
enabled,
pageSize,
Expand All @@ -58,7 +62,9 @@ export const searchAfterAndBulkCreate = async ({
id,
signalsIndex,
name,
createdAt,
createdBy,
updatedAt,
updatedBy,
interval,
enabled,
Expand Down Expand Up @@ -118,7 +124,9 @@ export const searchAfterAndBulkCreate = async ({
id,
signalsIndex,
name,
createdAt,
createdBy,
updatedAt,
updatedBy,
interval,
enabled,
Expand Down
Loading

0 comments on commit b652c96

Please sign in to comment.