Commits on Nov 16, 2019

1. [SIEM][Detection Engine] REST API improvements and changes from UI/UX… …

   … feedback (elastic#50797)
   
   ## Summary
   
   Updated REST API from feedback from the UI/UX
     * Changes the `id` to be `rule_id` on PUT/POST and makes it optional for a POST (create).
     * On data return sets both `id` and `rule_id` is returned. If `rule_id` is not set, a uuid.v4() will b assigned to the rule_id and the value will be returned.
     * Transforms output of all endpoints to be 1-1 to the input.
     * Fixes delete to return the deleted rule
     * Changes the URL to be `/api/detection_engine/rules`
     * Changes the POST behavior to fail with a `409 (conflict)` if the rule already exists (For creates)
     * Changes the POST behavior where sending in a `rule_id` is now optional. If none are sent in it does not create a `rule_id` and instead returns `null` for the `rule_id` and the autogenerated one.
     * Changes the PUT behavior to fail with a `404 (not found)` if the rule does not already exist (For updates)
     * Deletes the actions code and just uses an empty array since we don't have actions yet
     * Makes all error conditions consistent and does not expose the underlying error codes. Only exception to the rule is if an error condition returns non `404` or something unexpected. In which case it will show that error upstream.
   
   
   Example post output:
   
   ```ts
   $ ./post_signal.sh
   {
     "created_by": "elastic",
     "description": "Detecting root and admin users",
     "enabled": true,
     "false_positives": [],
     "from": "now-6m",
     "id": "8277a0e8-474c-4507-9c11-5f197b5fe2d5",
     "index": [
       "auditbeat-*",
       "filebeat-*",
       "packetbeat-*",
       "winlogbeat-*"
     ],
     "interval": "5m",
     "rule_id": "rule-1",
     "language": "kuery",
     "max_signals": 100,
     "name": "Detect Root/Admin Users",
     "query": "user.name: root or user.name: admin",
     "references": [
       "http://www.example.com",
       "https://ww.example.com"
     ],
     "severity": "high",
     "updated_by": "elastic",
     "tags": [],
     "to": "now",
     "type": "query"
   }
   ```
   
   Example delete and get URL's now (see scripts for more details):
   
   ```ts
   ${KIBANA_URL}/api/detection_engine/rules?rule_id="rule-1"
   ${KIBANA_URL}/api/detection_engine/rules?id="04128c15-0d1b-4716-a4c5-46997ac7f3bd"
   ```
   
   ### Checklist
   
   Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.
   
   ~~- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~~
   
   ~~- [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~~
   
   ~~- [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~~
   
   - [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios
   
   ~~- [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~~
   
   ### For maintainers
   
   ~~- [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~
   
   - [x] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)

   

   FrankHassanabad committed Nov 16, 2019
   Configuration menu

   • View commit details
   • Copy full SHA for 66f837b
   • Browse repository at this point

   Copy the full SHA

   66f837b View commit details

   Browse the repository at this point in the history