[9.0] Added more request validation to entity store enablement (#212657) (#215257)

# Backport This will backport the following commits from `main` to `9.0`: - [Added more request validation to entity store enablement (#212657)](https://github.com/elastic/kibana/pull/212657)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Jared Burgett <147995946+jaredburgettelastic@users.noreply.github.com>
2025-04-24 09:48:58 -04:00 · 2025-03-20 06:54:32 +01:00 · 2025-03-20 06:54:32 +01:00 · 12a8f3062c
commit 12a8f3062c
parent f6876a4349
12 changed files with 183 additions and 34 deletions
--- a/oas_docs/output/kibana.serverless.yaml
+++ b/oas_docs/output/kibana.serverless.yaml
@ -10265,6 +10265,8 @@ paths:
                  succeeded:
                    type: boolean
          description: Successful response
+        '400':
+          description: Invalid request
      summary: Initialize the Entity Store
      tags:
        - Security Entity Analytics API
@ -10402,6 +10404,8 @@ paths:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_EngineDescriptor'
          description: Successful response
+        '400':
+          description: Invalid request
      summary: Initialize an Entity Engine
      tags:
        - Security Entity Analytics API
@ -53017,7 +53021,7 @@ components:
        - dsl
        - response
    Security_Entity_Analytics_API_Interval:
-      description: Interval in which enrich policy runs. For example, `"1h"` means the rule runs every hour.
+      description: Interval in which enrich policy runs. For example, `"1h"` means the rule runs every hour. Must be less than or equal to half the duration of the lookback period,
      example: 1h
      pattern: ^[1-9]\d*[smh]$
      type: string
--- a/oas_docs/output/kibana.yaml
+++ b/oas_docs/output/kibana.yaml
@ -12284,6 +12284,8 @@ paths:
                  succeeded:
                    type: boolean
          description: Successful response
+        '400':
+          description: Invalid request
      summary: Initialize the Entity Store
      tags:
        - Security Entity Analytics API
@ -12417,6 +12419,8 @@ paths:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_EngineDescriptor'
          description: Successful response
+        '400':
+          description: Invalid request
      summary: Initialize an Entity Engine
      tags:
        - Security Entity Analytics API
@ -60619,7 +60623,7 @@ components:
        - dsl
        - response
    Security_Entity_Analytics_API_Interval:
-      description: Interval in which enrich policy runs. For example, `"1h"` means the rule runs every hour.
+      description: Interval in which enrich policy runs. For example, `"1h"` means the rule runs every hour. Must be less than or equal to half the duration of the lookback period,
      example: 1h
      pattern: ^[1-9]\d*[smh]$
      type: string
--- a/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/entity_store/common.gen.ts
+++ b/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/entity_store/common.gen.ts
@ -104,7 +104,7 @@ export const InspectQuery = z.object({
 });

 /**
- * Interval in which enrich policy runs. For example, `"1h"` means the rule runs every hour.
+ * Interval in which enrich policy runs. For example, `"1h"` means the rule runs every hour. Must be less than or equal to half the duration of the lookback period,
 */
 export type Interval = z.infer<typeof Interval>;
 export const Interval = z.string().regex(/^[1-9]\d*[smh]$/);
--- a/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/entity_store/common.schema.yaml
+++ b/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/entity_store/common.schema.yaml
@ -31,7 +31,7 @@ components:
          type: string
        fieldHistoryLength:
          type: integer
-        lookbackPeriod: 
+        lookbackPeriod:
          type: string
          default: 24h
          pattern: '[smdh]$'
@ -42,15 +42,15 @@ components:
          default: 180s
          pattern: '[smdh]$'
        frequency:
-          type: string 
+          type: string
          default: 1m
          pattern: '[smdh]$'
        delay:
          type: string
-          default: 1m 
-          pattern: '[smdh]$'               
+          default: 1m
+          pattern: '[smdh]$'
        docsPerSecond:
-          type: integer       
+          type: integer
        error:
          type: object

@ -62,7 +62,7 @@ components:
        - stopped
        - updating
        - error
-    
+
    EngineComponentStatus:
      type: object
      required:
@ -70,13 +70,13 @@ components:
          - installed
          - resource
      properties:
-        id: 
+        id:
          type: string
-        installed: 
+        installed:
          type: boolean
        resource:
          $ref: '#/components/schemas/EngineComponentResource'
-        health: 
+        health:
          type: string
          enum:
            - green
@ -134,6 +134,6 @@ components:
        - response
    Interval:
      type: string
-      description: Interval in which enrich policy runs. For example, `"1h"` means the rule runs every hour.
+      description: Interval in which enrich policy runs. For example, `"1h"` means the rule runs every hour. Must be less than or equal to half the duration of the lookback period,
      pattern: '^[1-9]\d*[smh]$' # any number except zero followed by one of the suffixes 's', 'm', 'h'
      example: '1h'
--- a/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/entity_store/enable.schema.yaml
+++ b/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/entity_store/enable.schema.yaml
@ -37,7 +37,7 @@ paths:
                  type: string
                  description: The field to use as the timestamp.
                  default: '@timestamp'
-                lookbackPeriod: 
+                lookbackPeriod:
                  type: string
                  default: 24h
                  pattern: '[smdh]$'
@ -48,18 +48,18 @@ paths:
                  pattern: '[smdh]$'
                  description: The timeout for initializing the aggregating transform.
                frequency:
-                  type: string 
+                  type: string
                  default: 1m
                  pattern: '[smdh]$'
                  description: The frequency at which the transform will run.
                delay:
                  type: string
-                  default: 1m 
-                  pattern: '[smdh]$'               
+                  default: 1m
+                  pattern: '[smdh]$'
                  description: The delay before the transform will run.
                docsPerSecond:
-                  type: integer  
-                  description: The number of documents per second to process.    
+                  type: integer
+                  description: The number of documents per second to process.
      responses:
        '200':
          description: Successful response
@ -74,3 +74,5 @@ paths:
                    type: array
                    items:
                      $ref: './common.schema.yaml#/components/schemas/EngineDescriptor'
+        '400':
+          description: Invalid request
--- a/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/entity_store/engine/init.schema.yaml
+++ b/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/entity_store/engine/init.schema.yaml
@ -39,7 +39,7 @@ paths:
                  type: string
                  description: The field to use as the timestamp for the entity type.
                  default: '@timestamp'
-                lookbackPeriod: 
+                lookbackPeriod:
                  type: string
                  default: 24h
                  pattern: '[smdh]$'
@ -50,20 +50,18 @@ paths:
                  pattern: '[smdh]$'
                  description: The timeout for initializing the aggregating transform.
                frequency:
-                  type: string 
+                  type: string
                  default: 1m
                  pattern: '[smdh]$'
                  description: The frequency at which the transform will run.
                delay:
                  type: string
-                  default: 1m 
-                  pattern: '[smdh]$'               
+                  default: 1m
+                  pattern: '[smdh]$'
                  description: The delay before the transform will run.
                docsPerSecond:
-                  type: integer  
-                  description: The number of documents per second to process.     
-
-   
+                  type: integer
+                  description: The number of documents per second to process.
      responses:
        '200':
          description: Successful response
@ -71,4 +69,5 @@ paths:
            application/json:
              schema:
                $ref: '../common.schema.yaml#/components/schemas/EngineDescriptor'
-                  
+        '400':
+          description: Invalid request
--- a/x-pack/solutions/security/plugins/security_solution/docs/openapi/ess/security_solution_entity_analytics_api_2023_10_31.bundled.schema.yaml
+++ b/x-pack/solutions/security/plugins/security_solution/docs/openapi/ess/security_solution_entity_analytics_api_2023_10_31.bundled.schema.yaml
@ -366,6 +366,8 @@ paths:
                  succeeded:
                    type: boolean
          description: Successful response
+        '400':
+          description: Invalid request
      summary: Initialize the Entity Store
      tags:
        - Security Entity Analytics API
@ -501,6 +503,8 @@ paths:
              schema:
                $ref: '#/components/schemas/EngineDescriptor'
          description: Successful response
+        '400':
+          description: Invalid request
      summary: Initialize an Entity Engine
      tags:
        - Security Entity Analytics API
@ -1299,7 +1303,8 @@ components:
    Interval:
      description: >-
        Interval in which enrich policy runs. For example, `"1h"` means the rule
-        runs every hour.
+        runs every hour. Must be less than or equal to half the duration of the
+        lookback period,
      example: 1h
      pattern: ^[1-9]\d*[smh]$
      type: string
--- a/x-pack/solutions/security/plugins/security_solution/docs/openapi/serverless/security_solution_entity_analytics_api_2023_10_31.bundled.schema.yaml
+++ b/x-pack/solutions/security/plugins/security_solution/docs/openapi/serverless/security_solution_entity_analytics_api_2023_10_31.bundled.schema.yaml
@ -366,6 +366,8 @@ paths:
                  succeeded:
                    type: boolean
          description: Successful response
+        '400':
+          description: Invalid request
      summary: Initialize the Entity Store
      tags:
        - Security Entity Analytics API
@ -501,6 +503,8 @@ paths:
              schema:
                $ref: '#/components/schemas/EngineDescriptor'
          description: Successful response
+        '400':
+          description: Invalid request
      summary: Initialize an Entity Engine
      tags:
        - Security Entity Analytics API
@ -1299,7 +1303,8 @@ components:
    Interval:
      description: >-
        Interval in which enrich policy runs. For example, `"1h"` means the rule
-        runs every hour.
+        runs every hour. Must be less than or equal to half the duration of the
+        lookback period,
      example: 1h
      pattern: ^[1-9]\d*[smh]$
      type: string
--- a/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/enablement.ts
+++ b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/enablement.ts
@ -8,13 +8,13 @@
 import type { IKibanaResponse, Logger } from '@kbn/core/server';
 import { buildSiemResponse } from '@kbn/lists-plugin/server/routes/utils';
 import { transformError } from '@kbn/securitysolution-es-utils';
-import { buildRouteValidationWithZod } from '@kbn/zod-helpers';

+import { buildInitRequestBodyValidation } from './validation';
 import type { InitEntityStoreResponse } from '../../../../../common/api/entity_analytics/entity_store/enable.gen';
-import { InitEntityStoreRequestBody } from '../../../../../common/api/entity_analytics/entity_store/enable.gen';
 import { API_VERSIONS, APP_ID } from '../../../../../common/constants';
 import type { EntityAnalyticsRoutesDeps } from '../../types';
 import { checkAndInitAssetCriticalityResources } from '../../asset_criticality/check_and_init_asset_criticality_resources';
+import { InitEntityStoreRequestBody } from '../../../../../common/api/entity_analytics/entity_store/enable.gen';

 export const enableEntityStoreRoute = (
  router: EntityAnalyticsRoutesDeps['router'],
@ -36,7 +36,7 @@ export const enableEntityStoreRoute = (
        version: API_VERSIONS.public.v1,
        validate: {
          request: {
-            body: buildRouteValidationWithZod(InitEntityStoreRequestBody),
+            body: buildInitRequestBodyValidation(InitEntityStoreRequestBody),
          },
        },
      },
--- a/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/init.ts
+++ b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/init.ts
@ -19,6 +19,7 @@ import {
 import { API_VERSIONS, APP_ID } from '../../../../../common/constants';
 import type { EntityAnalyticsRoutesDeps } from '../../types';
 import { checkAndInitAssetCriticalityResources } from '../../asset_criticality/check_and_init_asset_criticality_resources';
+import { buildInitRequestBodyValidation } from './validation';

 export const initEntityEngineRoute = (
  router: EntityAnalyticsRoutesDeps['router'],
@ -41,7 +42,7 @@ export const initEntityEngineRoute = (
        validate: {
          request: {
            params: buildRouteValidationWithZod(InitEntityEngineRequestParams),
-            body: buildRouteValidationWithZod(InitEntityEngineRequestBody),
+            body: buildInitRequestBodyValidation(InitEntityEngineRequestBody),
          },
        },
      },
--- a/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/validation.test.ts
+++ b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/validation.test.ts
@ -0,0 +1,82 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { validateInitializationRequestBody } from './validation';
+import type { InitEntityEngineRequestBody } from '../../../../../common/api/entity_analytics';
+import { BadRequestError } from '@kbn/securitysolution-es-utils';
+
+describe('entity store initialization request validation', () => {
+  const defaultRequestBody: InitEntityEngineRequestBody = {
+    fieldHistoryLength: 10,
+    timestampField: '@timestamp',
+    lookbackPeriod: '24h',
+    timeout: '180s',
+    frequency: '1m',
+    delay: '1m',
+    enrichPolicyExecutionInterval: '1h',
+  };
+  it('should allow the default values (24 hour lookback period, 1 hour enrich policy interval)', () => {
+    expect(validateInitializationRequestBody(defaultRequestBody)).toBeUndefined();
+  });
+  it('should allow the enrich policy interval to be exactly half the lookback period', () => {
+    expect(
+      validateInitializationRequestBody({
+        ...defaultRequestBody,
+        lookbackPeriod: '24h',
+        enrichPolicyExecutionInterval: '12h',
+      })
+    ).toBeUndefined();
+  });
+  it('should allow the enrich policy interval to be barely less than half the lookback period', () => {
+    expect(
+      validateInitializationRequestBody({
+        ...defaultRequestBody,
+        lookbackPeriod: '24h',
+        enrichPolicyExecutionInterval: '11h',
+      })
+    ).toBeUndefined();
+  });
+  it('should not allow the lookback period and enrich policy interval to be the same', () => {
+    expect(
+      validateInitializationRequestBody({
+        ...defaultRequestBody,
+        lookbackPeriod: '1h',
+        enrichPolicyExecutionInterval: '1h',
+      })
+    ).toEqual(
+      new BadRequestError(
+        'The enrich policy execution interval must be less than or equal to half the duration of the lookback period.'
+      )
+    );
+  });
+  it('should not allow the enrich policy interval to be greater than the lookback period', () => {
+    expect(
+      validateInitializationRequestBody({
+        ...defaultRequestBody,
+        lookbackPeriod: '1h',
+        enrichPolicyExecutionInterval: '2h',
+      })
+    ).toEqual(
+      new BadRequestError(
+        'The enrich policy execution interval must be less than or equal to half the duration of the lookback period.'
+      )
+    );
+  });
+  it('should not allow the enrich policy interval to be more than half the lookback period', () => {
+    expect(
+      validateInitializationRequestBody({
+        ...defaultRequestBody,
+        lookbackPeriod: '24h',
+        enrichPolicyExecutionInterval: '13h',
+      })
+    ).toEqual(
+      new BadRequestError(
+        'The enrich policy execution interval must be less than or equal to half the duration of the lookback period.'
+      )
+    );
+  });
+});
--- a/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/validation.ts
+++ b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/validation.ts
@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { parseDuration } from '@kbn/alerting-plugin/common';
+import { BadRequestError } from '@kbn/securitysolution-es-utils';
+import type { RouteValidationFunction, RouteValidationResultFactory } from '@kbn/core-http-server';
+import { buildRouteValidationWithZod } from '@kbn/zod-helpers';
+import type { TypeOf, ZodType } from '@kbn/zod';
+import type { InitEntityEngineRequestBody } from '../../../../../common/api/entity_analytics';
+
+export const buildInitRequestBodyValidation =
+  <ZodSchema extends ZodType, Type = TypeOf<ZodSchema>>(
+    schema: ZodSchema
+  ): RouteValidationFunction<Type> =>
+  (inputValue: unknown, validationResultFactory: RouteValidationResultFactory) => {
+    const zodValidationResult = buildRouteValidationWithZod(schema)(
+      inputValue,
+      validationResultFactory
+    );
+    if (zodValidationResult.error) return zodValidationResult;
+    const additionalValidationResult = validateInitializationRequestBody(zodValidationResult.value);
+    if (additionalValidationResult)
+      return validationResultFactory.badRequest(additionalValidationResult);
+    return zodValidationResult;
+  };
+
+/**
+ * Validations performed:
+ * - Ensures that the enrich policy execution interval is less than or equal to half the duration of the lookback period,
+ * as the execution policy must run successfully at least once within the lookback period in order to ensure no loss of
+ * data
+ */
+export const validateInitializationRequestBody = (requestBody: InitEntityEngineRequestBody) => {
+  const { lookbackPeriod, enrichPolicyExecutionInterval } = requestBody;
+  if (!lookbackPeriod || !enrichPolicyExecutionInterval) return;
+  const lookbackPeriodMillis = parseDuration(lookbackPeriod);
+  const enrichPolicyExecutionIntervalMillis = parseDuration(enrichPolicyExecutionInterval);
+  if (enrichPolicyExecutionIntervalMillis > lookbackPeriodMillis / 2) {
+    return new BadRequestError(
+      'The enrich policy execution interval must be less than or equal to half the duration of the lookback period.'
+    );
+  }
+};