-
Notifications
You must be signed in to change notification settings - Fork 8.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Security Solution] Refactor rules for modularization by updating bul…
…kCreate and wrapHits methods (#101544) creates bulkCreate and wrapHits factories for the modularization of the detection engine Co-authored-by: Marshall Main <marshall.main@elastic.co>
- Loading branch information
1 parent
767b67d
commit 4fb0c94
Showing
33 changed files
with
543 additions
and
836 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
15 changes: 15 additions & 0 deletions
15
...ecurity_solution/server/lib/detection_engine/signals/__mocks__/build_rule_message.mock.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| import { buildRuleMessageFactory } from '../rule_messages'; | ||
|
|
||
| export const mockBuildRuleMessage = buildRuleMessageFactory({ | ||
| id: 'fake id', | ||
| ruleId: 'fake rule id', | ||
| index: 'fakeindex', | ||
| name: 'fake name', | ||
| }); |
100 changes: 100 additions & 0 deletions
100
x-pack/plugins/security_solution/server/lib/detection_engine/signals/bulk_create_factory.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| import { performance } from 'perf_hooks'; | ||
| import { countBy, isEmpty, get } from 'lodash'; | ||
| import { ElasticsearchClient, Logger } from 'kibana/server'; | ||
| import { BuildRuleMessage } from './rule_messages'; | ||
| import { RefreshTypes } from '../types'; | ||
| import { BaseHit } from '../../../../common/detection_engine/types'; | ||
| import { errorAggregator, makeFloatString } from './utils'; | ||
|
|
||
| export interface GenericBulkCreateResponse<T> { | ||
| success: boolean; | ||
| bulkCreateDuration: string; | ||
| createdItemsCount: number; | ||
| createdItems: Array<T & { _id: string; _index: string }>; | ||
| errors: string[]; | ||
| } | ||
|
|
||
| export const bulkCreateFactory = ( | ||
| logger: Logger, | ||
| esClient: ElasticsearchClient, | ||
| buildRuleMessage: BuildRuleMessage, | ||
| refreshForBulkCreate: RefreshTypes | ||
| ) => async <T>(wrappedDocs: Array<BaseHit<T>>): Promise<GenericBulkCreateResponse<T>> => { | ||
| if (wrappedDocs.length === 0) { | ||
| return { | ||
| errors: [], | ||
| success: true, | ||
| bulkCreateDuration: '0', | ||
| createdItemsCount: 0, | ||
| createdItems: [], | ||
| }; | ||
| } | ||
|
|
||
| const bulkBody = wrappedDocs.flatMap((wrappedDoc) => [ | ||
| { | ||
| create: { | ||
| _index: wrappedDoc._index, | ||
| _id: wrappedDoc._id, | ||
| }, | ||
| }, | ||
| wrappedDoc._source, | ||
| ]); | ||
| const start = performance.now(); | ||
|
|
||
| const { body: response } = await esClient.bulk({ | ||
| refresh: refreshForBulkCreate, | ||
| body: bulkBody, | ||
| }); | ||
|
|
||
| const end = performance.now(); | ||
| logger.debug( | ||
| buildRuleMessage( | ||
| `individual bulk process time took: ${makeFloatString(end - start)} milliseconds` | ||
| ) | ||
| ); | ||
| logger.debug(buildRuleMessage(`took property says bulk took: ${response.took} milliseconds`)); | ||
| const createdItems = wrappedDocs | ||
| .map((doc, index) => ({ | ||
| _id: response.items[index].create?._id ?? '', | ||
| _index: response.items[index].create?._index ?? '', | ||
| ...doc._source, | ||
| })) | ||
| .filter((_, index) => get(response.items[index], 'create.status') === 201); | ||
| const createdItemsCount = createdItems.length; | ||
| const duplicateSignalsCount = countBy(response.items, 'create.status')['409']; | ||
| const errorCountByMessage = errorAggregator(response, [409]); | ||
|
|
||
| logger.debug(buildRuleMessage(`bulk created ${createdItemsCount} signals`)); | ||
| if (duplicateSignalsCount > 0) { | ||
| logger.debug(buildRuleMessage(`ignored ${duplicateSignalsCount} duplicate signals`)); | ||
| } | ||
| if (!isEmpty(errorCountByMessage)) { | ||
| logger.error( | ||
| buildRuleMessage( | ||
| `[-] bulkResponse had errors with responses of: ${JSON.stringify(errorCountByMessage)}` | ||
| ) | ||
| ); | ||
| return { | ||
| errors: Object.keys(errorCountByMessage), | ||
| success: false, | ||
| bulkCreateDuration: makeFloatString(end - start), | ||
| createdItemsCount, | ||
| createdItems, | ||
| }; | ||
| } else { | ||
| return { | ||
| errors: [], | ||
| success: true, | ||
| bulkCreateDuration: makeFloatString(end - start), | ||
| createdItemsCount, | ||
| createdItems, | ||
| }; | ||
| } | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.