[Security Solution] Create new events api #78326

jonathan-buttner · 2020-09-23T17:38:28Z

This PR creates a new /resolver/events api that is not tied to an entity_id. Instead it can take a filter as a kql string to filter the results from ES. This will allow a request to retrieve events for a specific entity_id, event.id, or any other kql filter.

Once the frontend is switched over to use this route the older resolver/{id}/events route will be removed.

jonathan-buttner · 2020-09-23T17:41:05Z

x-pack/test/security_solution_endpoint_api_int/apis/resolver/events.ts

-      await esArchiver.unload('endpoint/resolver/api_feature');
-    });
+  describe('event routes', () => {
+    describe('related events route', () => {


These changes look worse than they are. This block was wrapped in the above describe block and intended.

jonathan-buttner · 2020-09-23T17:41:24Z

x-pack/test/security_solution_endpoint_api_int/apis/resolver/events.ts

-        expect(body.events).be.empty();
-        expect(body.entityID).to.eql(entityID);
-        expect(body.nextEvent).to.eql(null);
+      describe('endpoint events', () => {


Same as above, wrapped in the outer describe block and indented.

jonathan-buttner · 2020-09-23T17:41:53Z

x-pack/test/security_solution_endpoint_api_int/apis/resolver/events.ts

-          .expect(200);
-        expect(body.entityID).to.eql(entityID);
-        expect(body.nextEvent).to.eql(null);
+    describe('kql events route', () => {


These are all new. Once the frontend is switched over to use this route the above tests will be removed.

jonathan-buttner · 2020-09-23T17:42:24Z

x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/related_events.ts

@@ -0,0 +1,89 @@
+/*


This file was really a move: event.ts -> related_events.ts

The files moved to their related_events.ts counterparts are essentially deprecated right?

That's correct. I wanted the events.ts file to have the new implementation since that name seemed most appropriate.

Sweet, good to know. Thanks. We can probably @deprecated these files

jonathan-buttner · 2020-09-23T17:43:14Z

x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/events.ts

@@ -4,86 +4,59 @@
 * you may not use this file except in compliance with the Elastic License.
 */
 import { SearchResponse } from 'elasticsearch';
+import { IScopedClusterClient } from 'kibana/server';


This is really a new file for the new /resolver/events route. It does not use the base class like the other queries that are tied to a particular entity_id.

jonathan-buttner · 2020-09-23T17:43:36Z

x-pack/plugins/security_solution/server/endpoint/routes/resolver/events.ts

 ): RequestHandler<
-  TypeOf<typeof validateEvents.params>,
+  unknown,


No params are used for the new events route.

jonathan-buttner · 2020-09-23T17:49:23Z

x-pack/plugins/security_solution/server/endpoint/routes/resolver/related_events.ts

@@ -0,0 +1,41 @@
+/*


This file was a move from resolver/events -> resolver/related_events

jonathan-buttner · 2020-09-23T17:53:48Z

x-pack/test/security_solution_endpoint_api_int/apis/resolver/events.ts

          .set('kbn-xsrf', 'xxx')
+          .send({
+            filter: `event.id:"${tree.origin.relatedEvents[0]?.event?.id}"`,


Get a specific event using the event.id field.

jonathan-buttner · 2020-09-23T17:56:01Z

x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/events.ts

-            {
-              term: { 'agent.id': endpointID },
-            },
+            ...kqlQuery,


Do we prefer that this new /events route filters out event.category:process like the previous route or includes them by default and leaves it up to the passed in kql filter to do it?

In the current state, to find non-process events for a specific entity_id we'd pass something like this: process.entity_id:"1234" and not event.category:"process" as the filter

I prefer this. Better to surface everything and let the filtering logic be decided on the front end

elasticmachine · 2020-09-23T17:57:04Z

Pinging @elastic/endpoint-data-visibility-team (Team:Endpoint Data Visibility)

michaelolo24 · 2020-09-23T18:27:36Z

x-pack/plugins/security_solution/server/endpoint/routes/resolver.ts


 export function registerResolverRoutes(router: IRouter, endpointAppContext: EndpointAppContext) {
  const log = endpointAppContext.logFactory.get('resolver');

+  // this route will be removed in favor of the one below


We can just tag all these as @deprecated. Easier to do a find all and remove later on

Yeah good call 👍

bkimmel · 2020-09-23T18:46:05Z

x-pack/plugins/security_solution/common/endpoint/types/index.ts

@@ -276,6 +276,14 @@ export interface SafeResolverRelatedEvents {
  nextEvent: string | null;
 }

+/**
+ * Response structure for the events route.


When nextEvent is null it means there are no more events, right? Maybe should add that to comment.

Yeah I'll add it 👍

bkimmel · 2020-09-23T19:39:14Z

x-pack/plugins/security_solution/server/endpoint/routes/resolver/events.ts

-import { EndpointAppContext } from '../../types';
+import { EventsQuery } from './queries/events';
+import { createEvents } from './utils/node';
+import { PaginationBuilder } from './utils/pagination';

 export function handleEvents(


❔ Just noticed this needs a doc comment

jonathan-buttner · 2020-09-24T15:32:29Z

@elasticmachine merge upstream

kibanamachine · 2020-09-24T17:06:30Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 5fae08d

Metrics [docs]

distributable file count

id	value	diff	baseline
default	45916	+2	45914

History

💔 Build #76902 failed aa9b7b8
💚 Build #76664 succeeded 7bfccf7
💛 Build #76637 was flaky 2cf7dcd

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* Creating new events route * Trying to get github to recognize the indent change * Using paginated name for events api return type * Updating comment * Updating comment * Adding deprecated comments * Adding more comments Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

* Creating new events route * Trying to get github to recognize the indent change * Using paginated name for events api return type * Updating comment * Updating comment * Adding deprecated comments * Adding more comments Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

Creating new events route

b1c275b

jonathan-buttner added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:Endpoint Data Visibility Team managing the endpoint resolver v7.10.0 labels Sep 23, 2020

jonathan-buttner added 3 commits September 23, 2020 13:39

Trying to get github to recognize the indent change

8fa3d1b

Using paginated name for events api return type

2e3ae2e

Updating comment

7938cf2

jonathan-buttner commented Sep 23, 2020

View reviewed changes

Updating comment

2cf7dcd

jonathan-buttner requested review from kqualters-elastic, oatkiller, michaelolo24 and bkimmel September 23, 2020 17:52

jonathan-buttner commented Sep 23, 2020

View reviewed changes

jonathan-buttner marked this pull request as ready for review September 23, 2020 17:57

jonathan-buttner requested review from a team as code owners September 23, 2020 17:57

michaelolo24 reviewed Sep 23, 2020

View reviewed changes

michaelolo24 approved these changes Sep 23, 2020

View reviewed changes

bkimmel reviewed Sep 23, 2020

View reviewed changes

Adding deprecated comments

7bfccf7

bkimmel reviewed Sep 23, 2020

View reviewed changes

Adding more comments

aa9b7b8

Merge branch 'master' into refactor-event-api

5fae08d

bkimmel approved these changes Sep 24, 2020

View reviewed changes

bkimmel merged commit 8081a85 into elastic:master Sep 24, 2020

jonathan-buttner deleted the refactor-event-api branch September 24, 2020 17:25

jonathan-buttner mentioned this pull request Sep 24, 2020

[7.x] [Security Solution] Create new events api (#78326) #78463

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Create new events api #78326

[Security Solution] Create new events api #78326

jonathan-buttner commented Sep 23, 2020

jonathan-buttner Sep 23, 2020

bkimmel Sep 23, 2020

jonathan-buttner Sep 23, 2020

jonathan-buttner Sep 23, 2020

jonathan-buttner Sep 23, 2020 •

edited

Loading

michaelolo24 Sep 23, 2020

jonathan-buttner Sep 23, 2020

michaelolo24 Sep 23, 2020

jonathan-buttner Sep 23, 2020

jonathan-buttner Sep 23, 2020

jonathan-buttner Sep 23, 2020

jonathan-buttner Sep 23, 2020

jonathan-buttner Sep 23, 2020

michaelolo24 Sep 23, 2020

elasticmachine commented Sep 23, 2020

michaelolo24 Sep 23, 2020

jonathan-buttner Sep 23, 2020

bkimmel Sep 23, 2020

jonathan-buttner Sep 23, 2020

bkimmel Sep 23, 2020

jonathan-buttner commented Sep 24, 2020

kibanamachine commented Sep 24, 2020

[Security Solution] Create new events api #78326

[Security Solution] Create new events api #78326

Conversation

jonathan-buttner commented Sep 23, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jonathan-buttner Sep 23, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Sep 23, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jonathan-buttner commented Sep 24, 2020

kibanamachine commented Sep 24, 2020

💚 Build Succeeded

Metrics [docs]

distributable file count

History

jonathan-buttner Sep 23, 2020 •

edited

Loading