[Security Solution] Refactor FirstLastSeenHost to use Search Strategy (…

…#76252) (#76314)

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/all/index.ts

@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+
+import { HostItem } from '../common';
+import {
+  CursorType,
+  Inspect,
+  Maybe,
+  PageInfoPaginated,
+  RequestOptionsPaginated,
+  SortField,
+} from '../..';
+
+export interface HostsEdges {
+  node: HostItem;
+
+  cursor: CursorType;
+}
+
+export interface HostsStrategyResponse extends IEsSearchResponse {
+  edges: HostsEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface HostsRequestOptions extends RequestOptionsPaginated {
+  sort: SortField;
+  defaultIndex: string[];
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/common/index.ts

@@ -0,0 +1,95 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CloudEcs } from '../../../../ecs/cloud';
+import { HostEcs, OsEcs } from '../../../../ecs/host';
+import { Maybe, SearchHit, TotalValue } from '../..';
+
+export enum HostPolicyResponseActionStatus {
+  success = 'success',
+  failure = 'failure',
+  warning = 'warning',
+}
+
+export interface EndpointFields {
+  endpointPolicy?: Maybe<string>;
+  sensorVersion?: Maybe<string>;
+  policyStatus?: Maybe<HostPolicyResponseActionStatus>;
+}
+
+export interface HostItem {
+  _id?: Maybe<string>;
+  cloud?: Maybe<CloudEcs>;
+  endpoint?: Maybe<EndpointFields>;
+  host?: Maybe<HostEcs>;
+  lastSeen?: Maybe<string>;
+}
+
+export interface HostValue {
+  value: number;
+  value_as_string: string;
+}
+
+export interface HostBucketItem {
+  key: string;
+  doc_count: number;
+  timestamp: HostValue;
+}
+
+export interface HostBuckets {
+  buckets: HostBucketItem[];
+}
+
+export interface HostOsHitsItem {
+  hits: {
+    total: TotalValue | number;
+    max_score: number | null;
+    hits: Array<{
+      _source: { host: { os: Maybe<OsEcs> } };
+      sort?: [number];
+      _index?: string;
+      _type?: string;
+      _id?: string;
+      _score?: number | null;
+    }>;
+  };
+}
+
+export interface HostAggEsItem {
+  cloud_instance_id?: HostBuckets;
+  cloud_machine_type?: HostBuckets;
+  cloud_provider?: HostBuckets;
+  cloud_region?: HostBuckets;
+  firstSeen?: HostValue;
+  host_architecture?: HostBuckets;
+  host_id?: HostBuckets;
+  host_ip?: HostBuckets;
+  host_mac?: HostBuckets;
+  host_name?: HostBuckets;
+  host_os_name?: HostBuckets;
+  host_os_version?: HostBuckets;
+  host_type?: HostBuckets;
+  key?: string;
+  lastSeen?: HostValue;
+  os?: HostOsHitsItem;
+}
+
+export interface HostEsData extends SearchHit {
+  sort: string[];
+  aggregations: {
+    host_count: {
+      value: number;
+    };
+    host_data: {
+      buckets: HostAggEsItem[];
+    };
+  };
+}
+
+export interface HostAggEsData extends SearchHit {
+  sort: string[];
+  aggregations: HostAggEsItem;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/first_last_seen/index.ts

@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe, RequestOptionsPaginated } from '../..';
+
+export interface HostFirstLastSeenRequestOptions extends Partial<RequestOptionsPaginated> {
+  hostName: string;
+}
+export interface HostFirstLastSeenStrategyResponse extends IEsSearchResponse {
+  inspect?: Maybe<Inspect>;
+  firstSeen?: Maybe<string>;
+  lastSeen?: Maybe<string>;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/index.ts

@@ -4,81 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IEsSearchResponse } from '../../../../../../../src/plugins/data/common';
-import { CloudEcs } from '../../../ecs/cloud';
-import { HostEcs } from '../../../ecs/host';
-
-import {
-  CursorType,
-  Inspect,
-  Maybe,
-  PageInfoPaginated,
-  RequestOptionsPaginated,
-  SortField,
-  TimerangeInput,
-} from '..';
+export * from './all';
+export * from './common';
+export * from './overview';
+export * from './first_last_seen';
 
 export enum HostsQueries {
   hosts = 'hosts',
   hostOverview = 'hostOverview',
-}
-
-export enum HostPolicyResponseActionStatus {
-  success = 'success',
-  failure = 'failure',
-  warning = 'warning',
-}
-
-export interface EndpointFields {
-  endpointPolicy?: Maybe<string>;
-
-  sensorVersion?: Maybe<string>;
-
-  policyStatus?: Maybe<HostPolicyResponseActionStatus>;
-}
-
-export interface HostItem {
-  _id?: Maybe<string>;
-
-  cloud?: Maybe<CloudEcs>;
-
-  endpoint?: Maybe<EndpointFields>;
-
-  host?: Maybe<HostEcs>;
-
-  lastSeen?: Maybe<string>;
-}
-
-export interface HostsEdges {
-  node: HostItem;
-
-  cursor: CursorType;
-}
-
-export interface HostsStrategyResponse extends IEsSearchResponse {
-  edges: HostsEdges[];
-
-  totalCount: number;
-
-  pageInfo: PageInfoPaginated;
-
-  inspect?: Maybe<Inspect>;
-}
-
-export interface HostOverviewStrategyResponse extends IEsSearchResponse, HostItem {
-  inspect?: Maybe<Inspect>;
-}
-
-export interface HostsRequestOptions extends RequestOptionsPaginated {
-  sort: SortField;
-  defaultIndex: string[];
-}
-
-export interface HostLastFirstSeenRequestOptions extends Partial<RequestOptionsPaginated> {
-  hostName: string;
-}
-
-export interface HostOverviewRequestOptions extends HostLastFirstSeenRequestOptions {
-  fields: string[];
-  timerange: TimerangeInput;
+  firstLastSeen = 'firstLastSeen',
 }

x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/overview/index.ts

@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+
+import { HostItem } from '../common';
+import { Inspect, Maybe, RequestOptionsPaginated, TimerangeInput } from '../..';
+
+export interface HostOverviewStrategyResponse extends IEsSearchResponse {
+  hostOverview: HostItem;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface HostOverviewRequestOptions extends Partial<RequestOptionsPaginated> {
+  hostName: string;
+  skip?: boolean;
+  timerange: TimerangeInput;
+  inspect?: Maybe<Inspect>;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts

@@ -4,11 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IEsSearchRequest } from '../../../../../../src/plugins/data/common';
+import { IEsSearchRequest, IEsSearchResponse } from '../../../../../../src/plugins/data/common';
 import { ESQuery } from '../../typed_json';
 import {
   HostOverviewStrategyResponse,
   HostOverviewRequestOptions,
+  HostFirstLastSeenStrategyResponse,
+  HostFirstLastSeenRequestOptions,
   HostsQueries,
   HostsRequestOptions,
   HostsStrategyResponse,
@@ -18,6 +20,13 @@ export type Maybe<T> = T | null;
 
 export type FactoryQueryTypes = HostsQueries;
 
+export type SearchHit = IEsSearchResponse<object>['rawResponse']['hits']['hits'][0];
+
+export interface TotalValue {
+  value: number;
+  relation: string;
+}
+
 export interface Inspect {
   dsl: string[];
   response: string[];
@@ -100,10 +109,14 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
   ? HostsStrategyResponse
   : T extends HostsQueries.hostOverview
   ? HostOverviewStrategyResponse
+  : T extends HostsQueries.firstLastSeen
+  ? HostFirstLastSeenStrategyResponse
   : never;
 
 export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQueries.hosts
   ? HostsRequestOptions
   : T extends HostsQueries.hostOverview
   ? HostOverviewRequestOptions
+  : T extends HostsQueries.firstLastSeen
+  ? HostFirstLastSeenRequestOptions
   : never;