[Security Solution] Refactor NetworkTopNFlow to use Search Strategy

x-pack/plugins/security_solution/common/search_strategy/common/index.ts

@@ -80,10 +80,6 @@ export interface Explanation {
   details: Explanation[];
 }
 
-export interface TotalValue {
-  value: number;
-  relation: string;
-}
 export interface ShardsResponse {
   total: number;
   successful: number;

x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts

@@ -27,6 +27,8 @@ import {
   NetworkHttpRequestOptions,
   NetworkTopCountriesStrategyResponse,
   NetworkTopCountriesRequestOptions,
+  NetworkTopNFlowStrategyResponse,
+  NetworkTopNFlowRequestOptions,
 } from './network';
 import {
   DocValueFields,
@@ -77,6 +79,8 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
   ? NetworkHttpStrategyResponse
   : T extends NetworkQueries.topCountries
   ? NetworkTopCountriesStrategyResponse
+  : T extends NetworkQueries.topNFlow
+  ? NetworkTopNFlowStrategyResponse
   : never;
 
 export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQueries.hosts
@@ -95,4 +99,6 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
   ? NetworkHttpRequestOptions
   : T extends NetworkQueries.topCountries
   ? NetworkTopCountriesRequestOptions
+  : T extends NetworkQueries.topNFlow
+  ? NetworkTopNFlowRequestOptions
   : never;

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/common/index.ts

@@ -4,7 +4,28 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { GeoEcs } from '../../../../ecs/geo';
+import { Maybe } from '../../..';
+
+export enum NetworkTopTablesFields {
+  bytes_in = 'bytes_in',
+  bytes_out = 'bytes_out',
+  flows = 'flows',
+  destination_ips = 'destination_ips',
+  source_ips = 'source_ips',
+}
+
 export enum FlowTargetSourceDest {
   destination = 'destination',
   source = 'source',
 }
+
+export interface TopNetworkTablesEcsField {
+  bytes_in?: Maybe<number>;
+  bytes_out?: Maybe<number>;
+}
+
+export interface GeoItem {
+  geo?: Maybe<GeoEcs>;
+  flowTarget?: Maybe<FlowTargetSourceDest>;
+}

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts

@@ -8,9 +8,11 @@ export * from './common';
 export * from './http';
 export * from './tls';
 export * from './top_countries';
+export * from './top_n_flow';
 
 export enum NetworkQueries {
   http = 'http',
   tls = 'tls',
   topCountries = 'topCountries',
+  topNFlow = 'topNFlow',
 }

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/top_countries/index.ts

@@ -5,18 +5,14 @@
  */
 
 import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
-import { GeoEcs } from '../../../../ecs/geo';
 import { CursorType, Inspect, Maybe, PageInfoPaginated } from '../../../common';
 import { RequestOptionsPaginated } from '../..';
-import { FlowTargetSourceDest } from '../common';
-
-export enum NetworkTopTablesFields {
-  bytes_in = 'bytes_in',
-  bytes_out = 'bytes_out',
-  flows = 'flows',
-  destination_ips = 'destination_ips',
-  source_ips = 'source_ips',
-}
+import {
+  GeoItem,
+  FlowTargetSourceDest,
+  NetworkTopTablesFields,
+  TopNetworkTablesEcsField,
+} from '../common';
 
 export enum NetworkDnsFields {
   dnsName = 'dnsName',
@@ -33,11 +29,6 @@ export enum FlowTarget {
   source = 'source',
 }
 
-export interface GeoItem {
-  geo?: Maybe<GeoEcs>;
-  flowTarget?: Maybe<FlowTargetSourceDest>;
-}
-
 export interface TopCountriesItemSource {
   country?: Maybe<string>;
   destination_ips?: Maybe<number>;
@@ -79,11 +70,6 @@ export interface TopCountriesItemDestination {
   source_ips?: Maybe<number>;
 }
 
-export interface TopNetworkTablesEcsField {
-  bytes_in?: Maybe<number>;
-  bytes_out?: Maybe<number>;
-}
-
 export interface NetworkTopCountriesBuckets {
   country: string;
   key: string;

x-pack/plugins/security_solution/common/search_strategy/security_solution/network/top_n_flow/index.ts

@@ -0,0 +1,124 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import {
+  GeoItem,
+  FlowTargetSourceDest,
+  TopNetworkTablesEcsField,
+  NetworkTopTablesFields,
+} from '../common';
+import {
+  CursorType,
+  Inspect,
+  Maybe,
+  PageInfoPaginated,
+  TotalValue,
+  GenericBuckets,
+} from '../../../common';
+import { RequestOptionsPaginated } from '../..';
+
+export interface NetworkTopNFlowRequestOptions
+  extends RequestOptionsPaginated<NetworkTopTablesFields> {
+  flowTarget: FlowTargetSourceDest;
+  ip?: Maybe<string>;
+}
+
+export interface NetworkTopNFlowStrategyResponse extends IEsSearchResponse {
+  edges: NetworkTopNFlowEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface NetworkTopNFlowEdges {
+  node: NetworkTopNFlowItem;
+  cursor: CursorType;
+}
+
+export interface NetworkTopNFlowItem {
+  _id?: Maybe<string>;
+  source?: Maybe<TopNFlowItemSource>;
+  destination?: Maybe<TopNFlowItemDestination>;
+  network?: Maybe<TopNetworkTablesEcsField>;
+}
+
+export interface TopNFlowItemSource {
+  autonomous_system?: Maybe<AutonomousSystemItem>;
+  domain?: Maybe<string[]>;
+  ip?: Maybe<string>;
+  location?: Maybe<GeoItem>;
+  flows?: Maybe<number>;
+  destination_ips?: Maybe<number>;
+}
+
+export interface AutonomousSystemItem {
+  name?: Maybe<string>;
+  number?: Maybe<number>;
+}
+
+export interface TopNFlowItemDestination {
+  autonomous_system?: Maybe<AutonomousSystemItem>;
+  domain?: Maybe<string[]>;
+  ip?: Maybe<string>;
+  location?: Maybe<GeoItem>;
+  flows?: Maybe<number>;
+  source_ips?: Maybe<number>;
+}
+
+export interface AutonomousSystemHit<T> {
+  doc_count: number;
+  top_as: {
+    hits: {
+      total: TotalValue | number;
+      max_score: number | null;
+      hits: Array<{
+        _source: T;
+        sort?: [number];
+        _index?: string;
+        _type?: string;
+        _id?: string;
+        _score?: number | null;
+      }>;
+    };
+  };
+}
+
+export interface NetworkTopNFlowBuckets {
+  key: string;
+  autonomous_system: AutonomousSystemHit<object>;
+  bytes_in: {
+    value: number;
+  };
+  bytes_out: {
+    value: number;
+  };
+  domain: {
+    buckets: GenericBuckets[];
+  };
+  location: LocationHit<object>;
+  flows: number;
+  destination_ips?: number;
+  source_ips?: number;
+}
+
+export interface LocationHit<T> {
+  doc_count: number;
+  top_geo: {
+    hits: {
+      total: TotalValue | number;
+      max_score: number | null;
+      hits: Array<{
+        _source: T;
+        sort?: [number];
+        _index?: string;
+        _type?: string;
+        _id?: string;
+        _score?: number | null;
+      }>;
+    };
+  };
+}

x-pack/plugins/security_solution/public/network/containers/network_top_countries/index.tsx

@@ -50,14 +50,12 @@ interface UseNetworkTopCountries {
   endDate: string;
   startDate: string;
   skip: boolean;
-  id?: string;
 }
 
 export const useNetworkTopCountries = ({
   endDate,
   filterQuery,
   flowTarget,
-  id = ID,
   skip,
   startDate,
   type,
@@ -101,7 +99,7 @@ export const useNetworkTopCountries = ({
     NetworkTopCountriesArgs
   >({
     networkTopCountries: [],
-    id: ID,
+    id: `${ID}-${flowTarget}`,
     inspect: {
       dsl: [],
       response: [],