github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 09:19:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

[Defend workflows] Establish /common/api folder in osquery plugin (#161944)

Browse source
This commit is contained in:
Tomasz Ciecierski 2023-08-01 13:00:10 +02:00 • committed by GitHub
parent f82ca84251
commit 132139ee74
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
63 changed files with 672 additions and 245 deletions
Download patch file Download diff file Expand all files Collapse all files

2
packages/kbn-io-ts-utils/src/to_number_rt/index.ts
View file

@ -8,7 +8,7 @@
import * as t from 'io-ts';
export const toNumberRt = new t.Type<number, unknown, unknown>(
export const toNumberRt = new t.Type<number, number, unknown>(
'ToNumber',
t.number.is,
(input, context) => {

8
x-pack/plugins/osquery/common/schemas/routes/saved_query/index.ts → x-pack/plugins/osquery/common/api/asset/get_assets_status_route.ts
View file

@ -5,4 +5,10 @@
* 2.0.
*/
export * from './create_saved_query_request_schema';
import * as t from 'io-ts';
export const getAssetsStatusRequestParamsSchema = t.unknown;
export type GetAssetsStatusRequestParamsSchema = t.OutputOf<
typeof getAssetsStatusRequestParamsSchema
>;

14
x-pack/plugins/osquery/common/api/asset/update_assets_status_route.ts Normal file
View file

@ -0,0 +1,14 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
export const updateAssetsStatusRequestParamsSchema = t.unknown;
export type UpdateAssetsStatusRequestParamsSchema = t.OutputOf<
typeof updateAssetsStatusRequestParamsSchema
>;

14
x-pack/plugins/osquery/common/api/fleet_wrapper/get_agent_details_route.ts Normal file
View file

@ -0,0 +1,14 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
export const getAgentDetailsRequestParamsSchema = t.unknown;
export type GetAgentDetailsRequestParamsSchema = t.OutputOf<
typeof getAgentDetailsRequestParamsSchema
>;

20
x-pack/plugins/osquery/common/api/fleet_wrapper/get_agent_policies_route.ts Normal file
View file

@ -0,0 +1,20 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
export const getAgentPoliciesRequestParamsSchema = t.unknown;
export type GetAgentPoliciesRequestParamsSchema = t.OutputOf<
typeof getAgentPoliciesRequestParamsSchema
>;
export const getAgentPoliciesRequestQuerySchema = t.unknown;
export type GetAgentPoliciesRequestQuerySchema = t.OutputOf<
typeof getAgentPoliciesRequestQuerySchema
>;

16
x-pack/plugins/osquery/common/api/fleet_wrapper/get_agent_policy_route.ts Normal file
View file

@ -0,0 +1,16 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
export const getAgentPolicyRequestParamsSchema = t.type({
id: t.string,
});
export type GetAgentPolicyRequestParamsSchema = t.OutputOf<
typeof getAgentPolicyRequestParamsSchema
>;

23
x-pack/plugins/osquery/common/api/fleet_wrapper/get_agent_status_for_agent_policy_route.ts Normal file
View file

@ -0,0 +1,23 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
export const getAgentStatusForAgentPolicyRequestParamsSchema = t.unknown;
export type GetAgentStatusForAgentPolicyRequestParamsSchema = t.OutputOf<
typeof getAgentStatusForAgentPolicyRequestParamsSchema
>;
export const getAgentStatusForAgentPolicyRequestQuerySchema = t.type({
policyId: t.string,
kuery: t.union([t.string, t.undefined]),
});
export type GetAgentStatusForAgentPolicyRequestQuerySchema = t.OutputOf<
typeof getAgentStatusForAgentPolicyRequestQuerySchema
>;

6
x-pack/plugins/osquery/common/schemas/common/index.ts → x-pack/plugins/osquery/common/api/fleet_wrapper/get_agents_route.ts
View file

@ -5,4 +5,8 @@
* 2.0.
*/
export * from './utils';
import * as t from 'io-ts';
export const getAgentsRequestQuerySchema = t.unknown;
export type GetAgentsRequestQuerySchema = t.OutputOf<typeof getAgentsRequestQuerySchema>;

14
x-pack/plugins/osquery/common/api/fleet_wrapper/get_package_policies_route.ts Normal file
View file

@ -0,0 +1,14 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
export const getPackagePoliciesRequestQuerySchema = t.unknown;
export type GetPackagePoliciesRequestQuerySchema = t.OutputOf<
typeof getPackagePoliciesRequestQuerySchema
>;

31
x-pack/plugins/osquery/common/api/index.ts Normal file
View file

@ -0,0 +1,31 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
export * from './asset/get_assets_status_route';
export * from './asset/update_assets_status_route';
export * from './fleet_wrapper/get_agent_policies_route';
export * from './fleet_wrapper/get_agent_details_route';
export * from './fleet_wrapper/get_agent_policy_route';
export * from './fleet_wrapper/get_agent_status_for_agent_policy_route';
export * from './fleet_wrapper/get_agents_route';
export * from './fleet_wrapper/get_package_policies_route';
export * from './live_query/create_live_query_route';
export * from './live_query/find_live_query_route';
export * from './live_query/get_live_query_results_route';
export * from './live_query/get_live_query_details_route';
export * from './saved_query/create_saved_query_route';
export * from './saved_query/delete_saved_query_route';
export * from './saved_query/find_saved_query_route';
export * from './saved_query/update_saved_query_route';
export * from './saved_query/read_saved_query_route';
export * from './packs/create_pack_route';
export * from './packs/delete_packs_route';
export * from './packs/find_packs_route';
export * from './packs/read_packs_route';
export * from './packs/update_packs_route';
export * from './model/default_uuid';
export * from './model/non_empty_string';

0
x-pack/plugins/osquery/common/schemas/routes/live_query/create_live_query_request_body_schema.ts → x-pack/plugins/osquery/common/api/live_query/create_live_query_route.ts
View file

19
x-pack/plugins/osquery/common/api/live_query/find_live_query_route.ts Normal file
View file

@ -0,0 +1,19 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
import { toNumberRt } from '@kbn/io-ts-utils';
export const findLiveQueryRequestQuerySchema = t.type({
filterQuery: t.union([t.string, t.undefined]),
page: t.union([toNumberRt, t.undefined]),
pageSize: t.union([toNumberRt, t.undefined]),
sort: t.union([t.string, t.undefined]),
sortOrder: t.union([t.union([t.literal('asc'), t.literal('desc')]), t.undefined]),
});
export type FindLiveQueryRequestQuerySchema = t.OutputOf<typeof findLiveQueryRequestQuerySchema>;

22
x-pack/plugins/osquery/common/api/live_query/get_live_query_details_route.ts Normal file
View file

@ -0,0 +1,22 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
export const getLiveQueryDetailsRequestQuerySchema = t.unknown;
export type GetLiveQueryDetailsRequestQuerySchema = t.OutputOf<
typeof getLiveQueryDetailsRequestQuerySchema
>;
export const getLiveQueryDetailsRequestParamsSchema = t.type({
id: t.string,
});
export type GetLiveQueryDetailsRequestParamsSchema = t.OutputOf<
typeof getLiveQueryDetailsRequestParamsSchema
>;

30
x-pack/plugins/osquery/common/api/live_query/get_live_query_results_route.ts Normal file
View file

@ -0,0 +1,30 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
import { toNumberRt } from '@kbn/io-ts-utils';
export const getLiveQueryResultsRequestQuerySchema = t.type({
filterQuery: t.union([t.string, t.undefined]),
page: t.union([toNumberRt, t.undefined]),
pageSize: t.union([toNumberRt, t.undefined]),
sort: t.union([t.string, t.undefined]),
sortOrder: t.union([t.union([t.literal('asc'), t.literal('desc')]), t.undefined]),
});
export type GetLiveQueryResultsRequestQuerySchema = t.OutputOf<
typeof getLiveQueryResultsRequestQuerySchema
>;
export const getLiveQueryResultsRequestParamsSchema = t.type({
id: t.string,
actionId: t.string,
});
export type GetLiveQueryResultsRequestParamsSchema = t.OutputOf<
typeof getLiveQueryResultsRequestParamsSchema
>;

0
x-pack/plugins/osquery/common/schemas/types/default_uuid.test.ts → x-pack/plugins/osquery/common/api/model/default_uuid.test.ts
View file

0
x-pack/plugins/osquery/common/schemas/types/default_uuid.ts → x-pack/plugins/osquery/common/api/model/default_uuid.ts
View file

0
x-pack/plugins/osquery/common/schemas/types/non_empty_string.test.ts → x-pack/plugins/osquery/common/api/model/non_empty_string.test.ts
View file

0
x-pack/plugins/osquery/common/schemas/types/non_empty_string.ts → x-pack/plugins/osquery/common/api/model/non_empty_string.ts
View file

40
x-pack/plugins/osquery/common/api/packs/create_pack_route.ts Normal file
View file

@ -0,0 +1,40 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
import { toNumberRt } from '@kbn/io-ts-utils';
export const createPackRequestBodySchema = t.type({
name: t.string,
description: t.union([t.string, t.undefined]),
enabled: t.union([t.boolean, t.undefined]),
policy_ids: t.union([t.array(t.string), t.undefined]),
shards: t.record(t.string, toNumberRt),
queries: t.record(
t.string,
t.type({
query: t.string,
interval: t.union([toNumberRt, t.undefined]),
snapshot: t.union([t.boolean, t.undefined]),
removed: t.union([t.boolean, t.undefined]),
platform: t.union([t.string, t.undefined]),
version: t.union([t.string, t.undefined]),
ecs_mapping: t.union([
t.record(
t.string,
t.type({
field: t.union([t.string, t.undefined]),
value: t.union([t.string, t.array(t.string), t.undefined]),
})
),
t.undefined,
]),
})
),
});
export type CreatePackRequestBodySchema = t.OutputOf<typeof createPackRequestBodySchema>;

14
x-pack/plugins/osquery/common/api/packs/delete_packs_route.ts Normal file
View file

@ -0,0 +1,14 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
export const deletePacksRequestParamsSchema = t.type({
id: t.string,
});
export type DeletePacksRequestParamsSchema = t.OutputOf<typeof deletePacksRequestParamsSchema>;

18
x-pack/plugins/osquery/common/api/packs/find_packs_route.ts Normal file
View file

@ -0,0 +1,18 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
import { toNumberRt } from '@kbn/io-ts-utils';
export const findPacksRequestQuerySchema = t.type({
page: t.union([toNumberRt, t.undefined]),
pageSize: t.union([toNumberRt, t.undefined]),
sort: t.union([t.string, t.undefined]),
sortOrder: t.union([t.union([t.literal('asc'), t.literal('desc')]), t.undefined]),
});
export type FindPacksRequestQuerySchema = t.OutputOf<typeof findPacksRequestQuerySchema>;

8
x-pack/plugins/osquery/common/schemas/routes/live_query/index.ts → x-pack/plugins/osquery/common/api/packs/read_packs_route.ts
View file

@ -5,4 +5,10 @@
* 2.0.
*/
export * from './create_live_query_request_body_schema';
import * as t from 'io-ts';
export const readPacksRequestParamsSchema = t.type({
id: t.string,
});
export type ReadPacksRequestParamsSchema = t.OutputOf<typeof readPacksRequestParamsSchema>;

49
x-pack/plugins/osquery/common/api/packs/update_packs_route.ts Normal file
View file

@ -0,0 +1,49 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
import { toNumberRt } from '@kbn/io-ts-utils';
export const updatePacksRequestBodySchema = t.type({
name: t.union([t.string, t.undefined]),
description: t.union([t.string, t.undefined]),
enabled: t.union([t.boolean, t.undefined]),
policy_ids: t.union([t.array(t.string), t.undefined]),
shards: t.union([t.record(t.string, toNumberRt), t.undefined]),
queries: t.union([
t.record(
t.string,
t.type({
query: t.string,
interval: t.union([toNumberRt, t.undefined]),
snapshot: t.union([t.boolean, t.undefined]),
removed: t.union([t.boolean, t.undefined]),
platform: t.union([t.string, t.undefined]),
version: t.union([t.string, t.undefined]),
ecs_mapping: t.union([
t.record(
t.string,
t.type({
field: t.union([t.string, t.undefined]),
value: t.union([t.string, t.array(t.string), t.undefined]),
})
),
t.undefined,
]),
})
),
t.undefined,
]),
});
export type UpdatePacksRequestBodySchema = t.OutputOf<typeof updatePacksRequestBodySchema>;
export const updatePacksRequestParamsSchema = t.type({
id: t.string,
});
export type UpdatePacksRequestParamsSchema = t.OutputOf<typeof updatePacksRequestParamsSchema>;

0
x-pack/plugins/osquery/common/schemas/routes/saved_query/create_saved_query_request_schema.ts → x-pack/plugins/osquery/common/api/saved_query/create_saved_query_route.ts
View file

16
x-pack/plugins/osquery/common/api/saved_query/delete_saved_query_route.ts Normal file
View file

@ -0,0 +1,16 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
export const deleteSavedQueryRequestParamsSchema = t.type({
id: t.string,
});
export type DeleteSavedQueryRequestParamsSchema = t.OutputOf<
typeof deleteSavedQueryRequestParamsSchema
>;

18
x-pack/plugins/osquery/common/api/saved_query/find_saved_query_route.ts Normal file
View file

@ -0,0 +1,18 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
import { toNumberRt } from '@kbn/io-ts-utils';
export const findSavedQueryRequestQuerySchema = t.type({
page: t.union([toNumberRt, t.undefined]),
pageSize: t.union([toNumberRt, t.undefined]),
sort: t.union([t.string, t.undefined]),
sortOrder: t.union([t.union([t.literal('asc'), t.literal('desc')]), t.undefined]),
});
export type FindSavedQueryRequestQuerySchema = t.OutputOf<typeof findSavedQueryRequestQuerySchema>;

16
x-pack/plugins/osquery/common/api/saved_query/read_saved_query_route.ts Normal file
View file

@ -0,0 +1,16 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
export const readSavedQueryRequestParamsSchema = t.type({
id: t.string,
});
export type ReadSavedQueryRequestParamsSchema = t.OutputOf<
typeof readSavedQueryRequestParamsSchema
>;

42
x-pack/plugins/osquery/common/api/saved_query/update_saved_query_route.ts Normal file
View file

@ -0,0 +1,42 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import * as t from 'io-ts';
import { toNumberRt } from '@kbn/io-ts-utils';
export const updateSavedQueryRequestBodySchema = t.type({
id: t.string,
query: t.string,
description: t.union([t.string, t.undefined]),
interval: t.union([toNumberRt, t.undefined]),
snapshot: t.union([t.boolean, t.undefined]),
removed: t.union([t.boolean, t.undefined]),
platform: t.union([t.string, t.undefined]),
version: t.union([t.string, t.undefined]),
ecs_mapping: t.union([
t.record(
t.string,
t.type({
field: t.union([t.string, t.undefined]),
value: t.union([t.string, t.array(t.string), t.undefined]),
})
),
t.undefined,
]),
});
export type UpdateSavedQueryRequestBodySchema = t.OutputOf<
typeof updateSavedQueryRequestBodySchema
>;
export const updateSavedQueryRequestParamsSchema = t.type({
id: t.string,
});
export type UpdateSavedQueryRequestParamsSchema = t.OutputOf<
typeof updateSavedQueryRequestParamsSchema
>;

0
x-pack/plugins/osquery/common/schemas/common/utils.ts → x-pack/plugins/osquery/common/utils/converters.ts
View file

2
x-pack/plugins/osquery/public/live_queries/use_create_live_query_action.tsx
View file

@ -7,8 +7,8 @@
import { useMutation } from '@tanstack/react-query';
import type { AgentSelection } from '@kbn/osquery-io-ts-types';
import type { CreateLiveQueryRequestBodySchema } from '../../common/api';
import { API_VERSIONS } from '../../common/constants';
import type { CreateLiveQueryRequestBodySchema } from '../../common/schemas/routes/live_query';
import { useKibana } from '../common/lib/kibana';
import { useErrorToast } from '../common/hooks/use_error_toast';
import type { LiveQueryDetailsItem } from '../actions/use_live_query_details';

4
x-pack/plugins/osquery/public/packs/form/shards/pack_shards_field.tsx
View file

@ -13,9 +13,9 @@ import { EuiFlexItem } from '@elastic/eui';
import { EuiSpacer } from '@elastic/eui';
import deepEqual from 'fast-deep-equal';
import { isEmpty, last, reject } from 'lodash';
import { convertShardsToArray, convertShardsToObject } from '../../../../common/utils/converters';
import type { ShardsArray } from '../../../../common/utils/converters';
import { useAgentPolicies } from '../../../agent_policies';
import type { ShardsArray } from '../../../../common/schemas/common';
import { convertShardsToArray, convertShardsToObject } from '../../../../common/schemas/common';
import { ShardsForm } from './shards_form';
export const defaultShardData = {

2
x-pack/plugins/osquery/public/packs/form/shards/shards_form.tsx
View file

@ -11,7 +11,7 @@ import type { EuiComboBoxOptionOption } from '@elastic/eui';
import { EuiButtonIcon, EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
import styled from 'styled-components';
import type { UseFieldArrayRemove, UseFormReturn } from 'react-hook-form';
import type { ShardsArray } from '../../../../common/schemas/common/utils';
import type { ShardsArray } from '../../../../common/utils/converters';
import { ShardsPolicyField } from './shards_policy_field';
import { ShardsPercentageField } from './shards_percentage_field';
import { overflowCss } from '../../utils';

36
x-pack/plugins/osquery/public/packs/queries/ecs_mapping_editor_field.tsx
View file

@ -43,11 +43,11 @@ import type { FieldErrors, UseFieldArrayRemove, UseFormReturn } from 'react-hook
import { useForm, useController, useFieldArray, useFormContext } from 'react-hook-form';
import type { ECSMapping } from '@kbn/osquery-io-ts-types';
import type { ECSMappingArray } from '../../../common/schemas/common/utils';
import type { ECSMappingArray } from '../../../common/utils/converters';
import {
convertECSMappingToArray,
convertECSMappingToObject,
} from '../../../common/schemas/common/utils';
} from '../../../common/utils/converters';
import ECSSchema from '../../common/schemas/ecs/v8.7.0.json';
import osquerySchema from '../../common/schemas/osquery/v5.7.0.json';
@ -927,8 +927,8 @@ export const ECSMappingEditorField = React.memo(({ euiFieldProps }: ECSMappingEd
?.map((selectItem: { type: string; name: string; alias?: string }) => {
if (selectItem.type === 'identifier') {
/*
select * from routes, uptime;
*/
select * from routes, uptime;
*/
if (ast?.result.length === 1 && selectItem.name === '*') {
return reduce(
astOsqueryTables,
@ -953,8 +953,8 @@ export const ECSMappingEditorField = React.memo(({ euiFieldProps }: ECSMappingEd
}
/*
select i.*, p.resident_size, p.user_time, p.system_time, time.minutes as counter from osquery_info i, processes p, time where p.pid = i.pid;
*/
select i.*, p.resident_size, p.user_time, p.system_time, time.minutes as counter from osquery_info i, processes p, time where p.pid = i.pid;
*/
const [table, column] = selectItem.name.includes('.')
? selectItem.name?.split('.')
@ -998,18 +998,18 @@ export const ECSMappingEditorField = React.memo(({ euiFieldProps }: ECSMappingEd
}
/*
SELECT pid, uid, name, ROUND((
(user_time + system_time) / (cpu_time.tsb - cpu_time.itsb)
) * 100, 2) AS percentage
FROM processes, (
SELECT (
SUM(user) + SUM(nice) + SUM(system) + SUM(idle) * 1.0) AS tsb,
SUM(COALESCE(idle, 0)) + SUM(COALESCE(iowait, 0)) AS itsb
FROM cpu_time
) AS cpu_time
ORDER BY user_time+system_time DESC
LIMIT 5;
*/
SELECT pid, uid, name, ROUND((
(user_time + system_time) / (cpu_time.tsb - cpu_time.itsb)
) * 100, 2) AS percentage
FROM processes, (
SELECT (
SUM(user) + SUM(nice) + SUM(system) + SUM(idle) * 1.0) AS tsb,
SUM(COALESCE(idle, 0)) + SUM(COALESCE(iowait, 0)) AS itsb
FROM cpu_time
) AS cpu_time
ORDER BY user_time+system_time DESC
LIMIT 5;
*/
if (selectItem.type === 'function' && selectItem.alias) {
return [

2
x-pack/plugins/osquery/public/packs/queries/use_pack_query_form.tsx
View file

@ -11,7 +11,7 @@ import type { Draft } from 'immer';
import { produce } from 'immer';
import { useMemo } from 'react';
import type { ECSMapping } from '@kbn/osquery-io-ts-types';
import type { Shard } from '../../../common/schemas/common/utils';
import type { Shard } from '../../../common/utils/converters';
export interface UsePackQueryFormProps {
uniqueQueryIds: string[];

2
x-pack/plugins/osquery/public/packs/types.ts
View file

@ -4,7 +4,7 @@
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import type { Shard } from '../../common/schemas/common/utils';
import type { Shard } from '../../common/utils/converters';
import type { PackQueryFormData } from './queries/use_pack_query_form';
export interface PackSavedObject {

2
x-pack/plugins/osquery/server/handlers/action/create_action_handler.ts
View file

@ -11,12 +11,12 @@ import { filter, flatten, isEmpty, map, omit, pick, pickBy, some } from 'lodash'
import { AGENT_ACTIONS_INDEX } from '@kbn/fleet-plugin/common';
import type { SavedObjectsClientContract } from '@kbn/core/server';
import type { ParsedTechnicalFields } from '@kbn/rule-registry-plugin/common';
import type { CreateLiveQueryRequestBodySchema } from '../../../common/api';
import { createDynamicQueries, replacedQueries } from './create_queries';
import { getInternalSavedObjectsClient } from '../../routes/utils';
import { parseAgentSelection } from '../../lib/parse_agent_groups';
import { packSavedObjectType } from '../../../common/types';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import type { CreateLiveQueryRequestBodySchema } from '../../../common/schemas/routes/live_query';
import { convertSOQueriesToPack } from '../../routes/pack/utils';
import { ACTIONS_INDEX } from '../../../common/constants';
import { TELEMETRY_EBT_LIVE_QUERY_EVENT } from '../../lib/telemetry/constants';

2
x-pack/plugins/osquery/server/handlers/action/create_action_service.ts
View file

@ -7,8 +7,8 @@
import type { ParsedTechnicalFields } from '@kbn/rule-registry-plugin/common';
import type { Subscription } from 'rxjs';
import type { CreateLiveQueryRequestBodySchema } from '../../../common/api';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import type { CreateLiveQueryRequestBodySchema } from '../../../common/schemas/routes/live_query';
import type { OsqueryActiveLicenses } from './validate_license';
import { validateLicense } from './validate_license';
import { createActionHandler } from './create_action_handler';

2
x-pack/plugins/osquery/server/handlers/action/create_queries.ts
View file

@ -9,9 +9,9 @@ import { isEmpty, map, pickBy } from 'lodash';
import { v4 as uuidv4 } from 'uuid';
import type { ParsedTechnicalFields } from '@kbn/rule-registry-plugin/common';
import type { CreateLiveQueryRequestBodySchema } from '../../../common/api';
import { PARAMETER_NOT_FOUND } from '../../../common/translations/errors';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import type { CreateLiveQueryRequestBodySchema } from '../../../common/schemas/routes/live_query';
import { replaceParamsQuery } from '../../../common/utils/replace_params_query';
import { isSavedQueryPrebuilt } from '../../routes/saved_query/utils';

9
x-pack/plugins/osquery/server/routes/asset/get_assets_status_route.ts
View file

@ -6,15 +6,17 @@
*/
import { filter } from 'lodash/fp';
import { schema } from '@kbn/config-schema';
import { asyncForEach } from '@kbn/std';
import type { IRouter } from '@kbn/core/server';
import type { KibanaAssetReference } from '@kbn/fleet-plugin/common';
import type { GetAssetsStatusRequestParamsSchema } from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { packAssetSavedObjectType, packSavedObjectType } from '../../../common/types';
import { PLUGIN_ID, OSQUERY_INTEGRATION_NAME } from '../../../common';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import { getAssetsStatusRequestParamsSchema } from '../../../common/api';
export const getAssetsStatusRoute = (router: IRouter, osqueryContext: OsqueryAppContext) => {
router.versioned
@ -28,7 +30,10 @@ export const getAssetsStatusRoute = (router: IRouter, osqueryContext: OsqueryApp
version: API_VERSIONS.internal.v1,
validate: {
request: {
params: schema.object({}, { unknowns: 'allow' }),
params: buildRouteValidation<
typeof getAssetsStatusRequestParamsSchema,
GetAssetsStatusRequestParamsSchema
>(getAssetsStatusRequestParamsSchema),
},
},
},

9
x-pack/plugins/osquery/server/routes/asset/update_assets_route.ts
View file

@ -7,12 +7,13 @@
import moment from 'moment-timezone';
import { filter, omit, some } from 'lodash';
import { schema } from '@kbn/config-schema';
import { asyncForEach } from '@kbn/std';
import deepmerge from 'deepmerge';
import type { IRouter } from '@kbn/core/server';
import type { KibanaAssetReference } from '@kbn/fleet-plugin/common';
import type { UpdateAssetsStatusRequestParamsSchema } from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { packAssetSavedObjectType, packSavedObjectType } from '../../../common/types';
import { combineMerge } from './utils';
@ -20,6 +21,7 @@ import { PLUGIN_ID, OSQUERY_INTEGRATION_NAME } from '../../../common';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import { convertSOQueriesToPack, convertPackQueriesToSO } from '../pack/utils';
import type { PackSavedObject } from '../../common/types';
import { updateAssetsStatusRequestParamsSchema } from '../../../common/api';
export const updateAssetsRoute = (router: IRouter, osqueryContext: OsqueryAppContext) => {
router.versioned
@ -33,7 +35,10 @@ export const updateAssetsRoute = (router: IRouter, osqueryContext: OsqueryAppCon
version: API_VERSIONS.internal.v1,
validate: {
request: {
params: schema.object({}, { unknowns: 'allow' }),
params: buildRouteValidation<
typeof updateAssetsStatusRequestParamsSchema,
UpdateAssetsStatusRequestParamsSchema
>(updateAssetsStatusRequestParamsSchema),
},
},
},

9
x-pack/plugins/osquery/server/routes/fleet_wrapper/get_agent_details.ts
View file

@ -5,11 +5,13 @@
* 2.0.
*/
import { schema } from '@kbn/config-schema';
import type { IRouter } from '@kbn/core/server';
import type { GetAgentDetailsRequestParamsSchema } from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { PLUGIN_ID } from '../../../common';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import { getAgentDetailsRequestParamsSchema } from '../../../common/api';
export const getAgentDetailsRoute = (router: IRouter, osqueryContext: OsqueryAppContext) => {
router.versioned
@ -23,7 +25,10 @@ export const getAgentDetailsRoute = (router: IRouter, osqueryContext: OsqueryApp
version: API_VERSIONS.internal.v1,
validate: {
request: {
params: schema.object({}, { unknowns: 'allow' }),
params: buildRouteValidation<
typeof getAgentDetailsRequestParamsSchema,
GetAgentDetailsRequestParamsSchema
>(getAgentDetailsRequestParamsSchema),
},
},
},

20
x-pack/plugins/osquery/server/routes/fleet_wrapper/get_agent_policies.ts
View file

@ -6,16 +6,24 @@
*/
import pMap from 'p-map';
import { schema } from '@kbn/config-schema';
import { filter, uniq, map } from 'lodash';
import { satisfies } from 'semver';
import type { GetAgentPoliciesResponseItem, PackagePolicy } from '@kbn/fleet-plugin/common';
import { PACKAGE_POLICY_SAVED_OBJECT_TYPE } from '@kbn/fleet-plugin/common';
import type { IRouter } from '@kbn/core/server';
import type {
GetAgentPoliciesRequestParamsSchema,
GetAgentPoliciesRequestQuerySchema,
} from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { OSQUERY_INTEGRATION_NAME, PLUGIN_ID } from '../../../common';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import { getInternalSavedObjectsClient } from '../utils';
import {
getAgentPoliciesRequestParamsSchema,
getAgentPoliciesRequestQuerySchema,
} from '../../../common/api';
export const getAgentPoliciesRoute = (router: IRouter, osqueryContext: OsqueryAppContext) => {
router.versioned
@ -29,8 +37,14 @@ export const getAgentPoliciesRoute = (router: IRouter, osqueryContext: OsqueryAp
version: API_VERSIONS.internal.v1,
validate: {
request: {
params: schema.object({}, { unknowns: 'allow' }),
query: schema.object({}, { unknowns: 'allow' }),
params: buildRouteValidation<
typeof getAgentPoliciesRequestParamsSchema,
GetAgentPoliciesRequestParamsSchema
>(getAgentPoliciesRequestParamsSchema),
query: buildRouteValidation<
typeof getAgentPoliciesRequestQuerySchema,
GetAgentPoliciesRequestQuerySchema
>(getAgentPoliciesRequestQuerySchema),
},
},
},

11
x-pack/plugins/osquery/server/routes/fleet_wrapper/get_agent_policy.ts
View file

@ -5,12 +5,14 @@
* 2.0.
*/
import { schema } from '@kbn/config-schema';
import type { IRouter } from '@kbn/core/server';
import type { GetAgentPolicyRequestParamsSchema } from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { PLUGIN_ID } from '../../../common';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import { getInternalSavedObjectsClient } from '../utils';
import { getAgentPolicyRequestParamsSchema } from '../../../common/api';
export const getAgentPolicyRoute = (router: IRouter, osqueryContext: OsqueryAppContext) => {
router.versioned
@ -24,9 +26,10 @@ export const getAgentPolicyRoute = (router: IRouter, osqueryContext: OsqueryAppC
version: API_VERSIONS.internal.v1,
validate: {
request: {
params: schema.object({
id: schema.string(),
}),
params: buildRouteValidation<
typeof getAgentPolicyRequestParamsSchema,
GetAgentPolicyRequestParamsSchema
>(getAgentPolicyRequestParamsSchema),
},
},
},

23
x-pack/plugins/osquery/server/routes/fleet_wrapper/get_agent_status_for_agent_policy.ts
View file

@ -5,12 +5,20 @@
* 2.0.
*/
import { schema } from '@kbn/config-schema';
import type { GetAgentStatusResponse } from '@kbn/fleet-plugin/common';
import type { IRouter } from '@kbn/core/server';
import type {
GetAgentStatusForAgentPolicyRequestParamsSchema,
GetAgentStatusForAgentPolicyRequestQuerySchema,
} from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { PLUGIN_ID } from '../../../common';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import {
getAgentStatusForAgentPolicyRequestParamsSchema,
getAgentStatusForAgentPolicyRequestQuerySchema,
} from '../../../common/api';
export const getAgentStatusForAgentPolicyRoute = (
router: IRouter,
@ -27,11 +35,14 @@ export const getAgentStatusForAgentPolicyRoute = (
version: API_VERSIONS.internal.v1,
validate: {
request: {
query: schema.object({
policyId: schema.string(),
kuery: schema.maybe(schema.string()),
}),
params: schema.object({}, { unknowns: 'allow' }),
params: buildRouteValidation<
typeof getAgentStatusForAgentPolicyRequestParamsSchema,
GetAgentStatusForAgentPolicyRequestParamsSchema
>(getAgentStatusForAgentPolicyRequestParamsSchema),
query: buildRouteValidation<
typeof getAgentStatusForAgentPolicyRequestQuerySchema,
GetAgentStatusForAgentPolicyRequestQuerySchema
>(getAgentStatusForAgentPolicyRequestQuerySchema),
},
},
},

9
x-pack/plugins/osquery/server/routes/fleet_wrapper/get_agents.ts
View file

@ -5,8 +5,10 @@
* 2.0.
*/
import { schema } from '@kbn/config-schema';
import type { IRouter } from '@kbn/core/server';
import { getAgentsRequestQuerySchema } from '../../../common/api';
import type { GetAgentsRequestQuerySchema } from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { PLUGIN_ID } from '../../../common';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
@ -23,7 +25,10 @@ export const getAgentsRoute = (router: IRouter, osqueryContext: OsqueryAppContex
version: API_VERSIONS.internal.v1,
validate: {
request: {
query: schema.object({}, { unknowns: 'allow' }),
query: buildRouteValidation<
typeof getAgentsRequestQuerySchema,
GetAgentsRequestQuerySchema
>(getAgentsRequestQuerySchema),
},
},
},

9
x-pack/plugins/osquery/server/routes/fleet_wrapper/get_package_policies.ts
View file

@ -5,13 +5,15 @@
* 2.0.
*/
import { schema } from '@kbn/config-schema';
import type { IRouter } from '@kbn/core/server';
import { PACKAGE_POLICY_SAVED_OBJECT_TYPE } from '@kbn/fleet-plugin/common';
import type { GetPackagePoliciesRequestQuerySchema } from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { PLUGIN_ID, OSQUERY_INTEGRATION_NAME } from '../../../common';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import { getInternalSavedObjectsClient } from '../utils';
import { getPackagePoliciesRequestQuerySchema } from '../../../common/api';
export const getPackagePoliciesRoute = (router: IRouter, osqueryContext: OsqueryAppContext) => {
router.versioned
@ -25,7 +27,10 @@ export const getPackagePoliciesRoute = (router: IRouter, osqueryContext: Osquery
version: API_VERSIONS.internal.v1,
validate: {
request: {
query: schema.object({}, { unknowns: 'allow' }),
query: buildRouteValidation<
typeof getPackagePoliciesRequestQuerySchema,
GetPackagePoliciesRequestQuerySchema
>(getPackagePoliciesRequestQuerySchema),
},
},
},

4
x-pack/plugins/osquery/server/routes/live_query/create_live_query_route.ts
View file

@ -11,11 +11,11 @@ import markdown from 'remark-parse-no-trim';
import { some, filter } from 'lodash';
import deepEqual from 'fast-deep-equal';
import type { ECSMappingOrUndefined } from '@kbn/osquery-io-ts-types';
import type { CreateLiveQueryRequestBodySchema } from '../../../common/api';
import { createLiveQueryRequestBodySchema } from '../../../common/api';
import { API_VERSIONS } from '../../../common/constants';
import { PARAMETER_NOT_FOUND } from '../../../common/translations/errors';
import { replaceParamsQuery } from '../../../common/utils/replace_params_query';
import { createLiveQueryRequestBodySchema } from '../../../common/schemas/routes/live_query';
import type { CreateLiveQueryRequestBodySchema } from '../../../common/schemas/routes/live_query';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import { createActionHandler } from '../../handlers';

20
x-pack/plugins/osquery/server/routes/live_query/find_live_query_route.ts
View file

@ -5,12 +5,13 @@
* 2.0.
*/
import { schema } from '@kbn/config-schema';
import type { IRouter } from '@kbn/core/server';
import { omit } from 'lodash';
import type { Observable } from 'rxjs';
import { lastValueFrom } from 'rxjs';
import type { DataRequestHandlerContext } from '@kbn/data-plugin/server';
import type { FindLiveQueryRequestQuerySchema } from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { PLUGIN_ID } from '../../../common';
@ -21,6 +22,7 @@ import type {
} from '../../../common/search_strategy';
import { OsqueryQueries } from '../../../common/search_strategy';
import { createFilter, generateTablePaginationOptions } from '../../../common/utils/build_query';
import { findLiveQueryRequestQuerySchema } from '../../../common/api';
export const findLiveQueryRoute = (router: IRouter<DataRequestHandlerContext>) => {
router.versioned
@ -34,18 +36,10 @@ export const findLiveQueryRoute = (router: IRouter<DataRequestHandlerContext>) =
version: API_VERSIONS.public.v1,
validate: {
request: {
query: schema.object(
{
filterQuery: schema.maybe(schema.string()),
page: schema.maybe(schema.number()),
pageSize: schema.maybe(schema.number()),
sort: schema.maybe(schema.string()),
sortOrder: schema.maybe(
schema.oneOf([schema.literal('asc'), schema.literal('desc')])
),
},
{ unknowns: 'allow' }
),
query: buildRouteValidation<
typeof findLiveQueryRequestQuerySchema,
FindLiveQueryRequestQuerySchema
>(findLiveQueryRequestQuerySchema),
},
},
},

27
x-pack/plugins/osquery/server/routes/live_query/get_live_query_details_route.ts
View file

@ -5,12 +5,16 @@
* 2.0.
*/
import { schema } from '@kbn/config-schema';
import type { IRouter } from '@kbn/core/server';
import { every, map, mapKeys, pick, reduce } from 'lodash';
import type { Observable } from 'rxjs';
import { lastValueFrom, zip } from 'rxjs';
import type { DataRequestHandlerContext } from '@kbn/data-plugin/server';
import type {
GetLiveQueryDetailsRequestParamsSchema,
GetLiveQueryDetailsRequestQuerySchema,
} from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { PLUGIN_ID } from '../../../common';
import { getActionResponses } from './utils';
@ -20,6 +24,10 @@ import type {
ActionDetailsStrategyResponse,
} from '../../../common/search_strategy';
import { OsqueryQueries } from '../../../common/search_strategy';
import {
getLiveQueryDetailsRequestParamsSchema,
getLiveQueryDetailsRequestQuerySchema,
} from '../../../common/api';
export const getLiveQueryDetailsRoute = (router: IRouter<DataRequestHandlerContext>) => {
router.versioned
@ -33,13 +41,14 @@ export const getLiveQueryDetailsRoute = (router: IRouter<DataRequestHandlerConte
version: API_VERSIONS.public.v1,
validate: {
request: {
params: schema.object(
{
id: schema.string(),
},
{ unknowns: 'allow' }
),
query: schema.object({}, { unknowns: 'allow' }),
params: buildRouteValidation<
typeof getLiveQueryDetailsRequestParamsSchema,
GetLiveQueryDetailsRequestParamsSchema
>(getLiveQueryDetailsRequestParamsSchema),
query: buildRouteValidation<
typeof getLiveQueryDetailsRequestQuerySchema,
GetLiveQueryDetailsRequestQuerySchema
>(getLiveQueryDetailsRequestQuerySchema),
},
},
},
@ -52,7 +61,7 @@ export const getLiveQueryDetailsRoute = (router: IRouter<DataRequestHandlerConte
search.search<ActionDetailsRequestOptions, ActionDetailsStrategyResponse>(
{
actionId: request.params.id,
filterQuery: request.query,
filterQuery: {},
factoryQueryType: OsqueryQueries.actionDetails,
},
{ abortSignal, strategy: 'osquerySearchStrategy' }

37
x-pack/plugins/osquery/server/routes/live_query/get_live_query_results_route.ts
View file

@ -5,12 +5,16 @@
* 2.0.
*/
import { schema } from '@kbn/config-schema';
import type { IRouter } from '@kbn/core/server';
import { map } from 'lodash';
import type { Observable } from 'rxjs';
import { lastValueFrom, zip } from 'rxjs';
import type { DataRequestHandlerContext } from '@kbn/data-plugin/server';
import type {
GetLiveQueryResultsRequestQuerySchema,
GetLiveQueryResultsRequestParamsSchema,
} from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { PLUGIN_ID } from '../../../common';
import type {
@ -20,6 +24,10 @@ import type {
import { OsqueryQueries } from '../../../common/search_strategy';
import { createFilter, generateTablePaginationOptions } from '../../../common/utils/build_query';
import { getActionResponses } from './utils';
import {
getLiveQueryResultsRequestParamsSchema,
getLiveQueryResultsRequestQuerySchema,
} from '../../../common/api';
export const getLiveQueryResultsRoute = (router: IRouter<DataRequestHandlerContext>) => {
router.versioned
@ -33,25 +41,14 @@ export const getLiveQueryResultsRoute = (router: IRouter<DataRequestHandlerConte
version: API_VERSIONS.public.v1,
validate: {
request: {
query: schema.object(
{
filterQuery: schema.maybe(schema.string()),
page: schema.maybe(schema.number()),
pageSize: schema.maybe(schema.number()),
sort: schema.maybe(schema.string()),
sortOrder: schema.maybe(
schema.oneOf([schema.literal('asc'), schema.literal('desc')])
),
},
{ unknowns: 'allow' }
),
params: schema.object(
{
id: schema.string(),
actionId: schema.string(),
},
{ unknowns: 'allow' }
),
query: buildRouteValidation<
typeof getLiveQueryResultsRequestQuerySchema,
GetLiveQueryResultsRequestQuerySchema
>(getLiveQueryResultsRequestQuerySchema),
params: buildRouteValidation<
typeof getLiveQueryResultsRequestParamsSchema,
GetLiveQueryResultsRequestParamsSchema
>(getLiveQueryResultsRequestParamsSchema),
},
},
},

40
x-pack/plugins/osquery/server/routes/pack/create_pack_route.ts
View file

@ -8,7 +8,6 @@
import moment from 'moment-timezone';
import { set } from '@kbn/safer-lodash-set';
import { has, unset, find, some, mapKeys } from 'lodash';
import { schema } from '@kbn/config-schema';
import { produce } from 'immer';
import type { PackagePolicy } from '@kbn/fleet-plugin/common';
import {
@ -16,6 +15,8 @@ import {
PACKAGE_POLICY_SAVED_OBJECT_TYPE,
} from '@kbn/fleet-plugin/common';
import type { IRouter } from '@kbn/core/server';
import type { CreatePackRequestBodySchema } from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import { OSQUERY_INTEGRATION_NAME } from '../../../common';
@ -30,6 +31,7 @@ import {
import { convertShardsToArray, getInternalSavedObjectsClient } from '../utils';
import type { PackSavedObject } from '../../common/types';
import type { PackResponseData } from './types';
import { createPackRequestBodySchema } from '../../../common/api';
type PackSavedObjectLimited = Omit<PackSavedObject, 'saved_object_id' | 'references'>;
@ -45,38 +47,10 @@ export const createPackRoute = (router: IRouter, osqueryContext: OsqueryAppConte
version: API_VERSIONS.public.v1,
validate: {
request: {
body: schema.object(
{
name: schema.string(),
description: schema.maybe(schema.string()),
enabled: schema.maybe(schema.boolean()),
policy_ids: schema.maybe(schema.arrayOf(schema.string())),
shards: schema.recordOf(schema.string(), schema.number()),
queries: schema.recordOf(
schema.string(),
schema.object({
query: schema.string(),
interval: schema.maybe(schema.number()),
snapshot: schema.maybe(schema.boolean()),
removed: schema.maybe(schema.boolean()),
platform: schema.maybe(schema.string()),
version: schema.maybe(schema.string()),
ecs_mapping: schema.maybe(
schema.recordOf(
schema.string(),
schema.object({
field: schema.maybe(schema.string()),
value: schema.maybe(
schema.oneOf([schema.string(), schema.arrayOf(schema.string())])
),
})
)
),
})
),
},
{ unknowns: 'allow' }
),
body: buildRouteValidation<
typeof createPackRequestBodySchema,
CreatePackRequestBodySchema
>(createPackRequestBodySchema),
},
},
},

11
x-pack/plugins/osquery/server/routes/pack/delete_pack_route.ts
View file

@ -7,15 +7,17 @@
import { has, filter, unset } from 'lodash';
import { produce } from 'immer';
import { schema } from '@kbn/config-schema';
import { PACKAGE_POLICY_SAVED_OBJECT_TYPE } from '@kbn/fleet-plugin/common';
import type { IRouter } from '@kbn/core/server';
import type { DeletePacksRequestParamsSchema } from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { OSQUERY_INTEGRATION_NAME } from '../../../common';
import { PLUGIN_ID } from '../../../common';
import { packSavedObjectType } from '../../../common/types';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import { deletePacksRequestParamsSchema } from '../../../common/api';
export const deletePackRoute = (router: IRouter, osqueryContext: OsqueryAppContext) => {
router.versioned
@ -29,9 +31,10 @@ export const deletePackRoute = (router: IRouter, osqueryContext: OsqueryAppConte
version: API_VERSIONS.public.v1,
validate: {
request: {
params: schema.object({
id: schema.string(),
}),
params: buildRouteValidation<
typeof deletePacksRequestParamsSchema,
DeletePacksRequestParamsSchema
>(deletePacksRequestParamsSchema),
},
},
},

19
x-pack/plugins/osquery/server/routes/pack/find_pack_route.ts
View file

@ -6,15 +6,17 @@
*/
import { filter, map, omit } from 'lodash';
import { schema } from '@kbn/config-schema';
import { AGENT_POLICY_SAVED_OBJECT_TYPE } from '@kbn/fleet-plugin/common';
import type { IRouter } from '@kbn/core/server';
import type { FindPacksRequestQuerySchema } from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { packSavedObjectType } from '../../../common/types';
import { PLUGIN_ID } from '../../../common';
import type { PackSavedObject } from '../../common/types';
import type { PackResponseData } from './types';
import { findPacksRequestQuerySchema } from '../../../common/api';
export const findPackRoute = (router: IRouter) => {
router.versioned
@ -28,17 +30,10 @@ export const findPackRoute = (router: IRouter) => {
version: API_VERSIONS.public.v1,
validate: {
request: {
query: schema.object(
{
page: schema.maybe(schema.number()),
pageSize: schema.maybe(schema.number()),
sort: schema.maybe(schema.string()),
sortOrder: schema.maybe(
schema.oneOf([schema.literal('asc'), schema.literal('desc')])
),
},
{ unknowns: 'allow' }
),
query: buildRouteValidation<
typeof findPacksRequestQuerySchema,
FindPacksRequestQuerySchema
>(findPacksRequestQuerySchema),
},
},
},

11
x-pack/plugins/osquery/server/routes/pack/read_pack_route.ts
View file

@ -6,9 +6,10 @@
*/
import { filter, map } from 'lodash';
import { schema } from '@kbn/config-schema';
import { AGENT_POLICY_SAVED_OBJECT_TYPE } from '@kbn/fleet-plugin/common';
import type { IRouter } from '@kbn/core/server';
import type { ReadPacksRequestParamsSchema } from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import type { PackSavedObject } from '../../common/types';
import { PLUGIN_ID } from '../../../common';
@ -17,6 +18,7 @@ import { packSavedObjectType } from '../../../common/types';
import { convertSOQueriesToPack } from './utils';
import { convertShardsToObject } from '../utils';
import type { ReadPackResponseData } from './types';
import { readPacksRequestParamsSchema } from '../../../common/api';
export const readPackRoute = (router: IRouter) => {
router.versioned
@ -30,9 +32,10 @@ export const readPackRoute = (router: IRouter) => {
version: API_VERSIONS.public.v1,
validate: {
request: {
params: schema.object({
id: schema.string(),
}),
params: buildRouteValidation<
typeof readPacksRequestParamsSchema,
ReadPacksRequestParamsSchema
>(readPacksRequestParamsSchema),
},
},
},

55
x-pack/plugins/osquery/server/routes/pack/update_pack_route.ts
View file

@ -8,7 +8,6 @@
import moment from 'moment-timezone';
import { set } from '@kbn/safer-lodash-set';
import { unset, has, difference, filter, find, map, mapKeys, uniq, some, isEmpty } from 'lodash';
import { schema } from '@kbn/config-schema';
import { produce } from 'immer';
import type { PackagePolicy } from '@kbn/fleet-plugin/common';
import {
@ -17,6 +16,11 @@ import {
} from '@kbn/fleet-plugin/common';
import type { IRouter } from '@kbn/core/server';
import type {
UpdatePacksRequestParamsSchema,
UpdatePacksRequestBodySchema,
} from '../../../common/api';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { OSQUERY_INTEGRATION_NAME } from '../../../common';
import { packSavedObjectType } from '../../../common/types';
@ -33,6 +37,7 @@ import {
import { convertShardsToArray, getInternalSavedObjectsClient } from '../utils';
import type { PackSavedObject } from '../../common/types';
import type { PackResponseData } from './types';
import { updatePacksRequestBodySchema, updatePacksRequestParamsSchema } from '../../../common/api';
export const updatePackRoute = (router: IRouter, osqueryContext: OsqueryAppContext) => {
router.versioned
@ -46,46 +51,14 @@ export const updatePackRoute = (router: IRouter, osqueryContext: OsqueryAppConte
version: API_VERSIONS.public.v1,
validate: {
request: {
params: schema.object(
{
id: schema.string(),
},
{ unknowns: 'allow' }
),
body: schema.object(
{
name: schema.maybe(schema.string()),
description: schema.maybe(schema.string()),
enabled: schema.maybe(schema.boolean()),
policy_ids: schema.maybe(schema.arrayOf(schema.string())),
shards: schema.maybe(schema.recordOf(schema.string(), schema.number())),
queries: schema.maybe(
schema.recordOf(
schema.string(),
schema.object({
query: schema.string(),
interval: schema.maybe(schema.number()),
snapshot: schema.maybe(schema.boolean()),
removed: schema.maybe(schema.boolean()),
platform: schema.maybe(schema.string()),
version: schema.maybe(schema.string()),
ecs_mapping: schema.maybe(
schema.recordOf(
schema.string(),
schema.object({
field: schema.maybe(schema.string()),
value: schema.maybe(
schema.oneOf([schema.string(), schema.arrayOf(schema.string())])
),
})
)
),
})
)
),
},
{ unknowns: 'allow' }
),
params: buildRouteValidation<
typeof updatePacksRequestParamsSchema,
UpdatePacksRequestParamsSchema
>(updatePacksRequestParamsSchema),
body: buildRouteValidation<
typeof updatePacksRequestBodySchema,
UpdatePacksRequestBodySchema
>(updatePacksRequestBodySchema),
},
},
},

2
x-pack/plugins/osquery/server/routes/pack/utils.ts
View file

@ -8,7 +8,7 @@
import { isEmpty, pick, reduce, isArray, filter, uniq, map, mapKeys } from 'lodash';
import { satisfies } from 'semver';
import type { AgentPolicy, PackagePolicy } from '@kbn/fleet-plugin/common';
import type { Shard } from '../../../common/schemas/common/utils';
import type { Shard } from '../../../common/utils/converters';
import { DEFAULT_PLATFORM } from '../../../common/constants';
import { removeMultilines } from '../../../common/utils/build_query/remove_multilines';
import { convertECSMappingToArray, convertECSMappingToObject } from '../utils';

4
x-pack/plugins/osquery/server/routes/saved_query/create_saved_query_route.ts
View file

@ -7,16 +7,16 @@
import { isEmpty, pickBy, some, isBoolean } from 'lodash';
import type { IRouter } from '@kbn/core/server';
import type { CreateSavedQueryRequestSchemaDecoded } from '../../../common/api';
import { API_VERSIONS } from '../../../common/constants';
import type { SavedQueryResponse } from './types';
import type { SavedQuerySavedObject } from '../../common/types';
import { PLUGIN_ID } from '../../../common';
import type { CreateSavedQueryRequestSchemaDecoded } from '../../../common/schemas/routes/saved_query/create_saved_query_request_schema';
import { createSavedQueryRequestSchema } from '../../../common/schemas/routes/saved_query/create_saved_query_request_schema';
import { savedQuerySavedObjectType } from '../../../common/types';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import { convertECSMappingToArray } from '../utils';
import { createSavedQueryRequestSchema } from '../../../common/api';
export const createSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAppContext) => {
router.versioned

11
x-pack/plugins/osquery/server/routes/saved_query/delete_saved_query_route.ts
View file

@ -5,13 +5,15 @@
* 2.0.
*/
import { schema } from '@kbn/config-schema';
import type { IRouter } from '@kbn/core/server';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { PLUGIN_ID } from '../../../common';
import { savedQuerySavedObjectType } from '../../../common/types';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import { isSavedQueryPrebuilt } from './utils';
import type { DeleteSavedQueryRequestParamsSchema } from '../../../common/api/saved_query/delete_saved_query_route';
import { deleteSavedQueryRequestParamsSchema } from '../../../common/api/saved_query/delete_saved_query_route';
export const deleteSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAppContext) => {
router.versioned
@ -25,9 +27,10 @@ export const deleteSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAp
version: API_VERSIONS.public.v1,
validate: {
request: {
params: schema.object({
id: schema.string(),
}),
params: buildRouteValidation<
typeof deleteSavedQueryRequestParamsSchema,
DeleteSavedQueryRequestParamsSchema
>(deleteSavedQueryRequestParamsSchema),
},
},
},

22
x-pack/plugins/osquery/server/routes/saved_query/find_saved_query_route.ts
View file

@ -5,10 +5,10 @@
* 2.0.
*/
import { schema } from '@kbn/config-schema';
import type { IRouter } from '@kbn/core/server';
import { omit } from 'lodash';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import type { SavedQueryResponse } from './types';
import type { SavedQuerySavedObject } from '../../common/types';
@ -17,6 +17,8 @@ import { PLUGIN_ID } from '../../../common';
import { savedQuerySavedObjectType } from '../../../common/types';
import { convertECSMappingToObject } from '../utils';
import { getInstalledSavedQueriesMap } from './utils';
import type { FindSavedQueryRequestQuerySchema } from '../../../common/api/saved_query/find_saved_query_route';
import { findSavedQueryRequestQuerySchema } from '../../../common/api/saved_query/find_saved_query_route';
export const findSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAppContext) => {
router.versioned
@ -30,14 +32,10 @@ export const findSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAppC
version: API_VERSIONS.public.v1,
validate: {
request: {
query: schema.object({
page: schema.number({ defaultValue: 1 }),
pageSize: schema.maybe(schema.number()),
sort: schema.string({ defaultValue: 'id' }),
sortOrder: schema.oneOf([schema.literal('asc'), schema.literal('desc')], {
defaultValue: 'desc',
}),
}),
query: buildRouteValidation<
typeof findSavedQueryRequestQuerySchema,
FindSavedQueryRequestQuerySchema
>(findSavedQueryRequestQuerySchema),
},
},
},
@ -48,10 +46,10 @@ export const findSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAppC
try {
const savedQueries = await savedObjectsClient.find<SavedQuerySavedObject>({
type: savedQuerySavedObjectType,
page: request.query.page,
page: request.query.page || 1,
perPage: request.query.pageSize,
sortField: request.query.sort,
sortOrder: request.query.sortOrder,
sortField: request.query.sort || 'id',
sortOrder: request.query.sortOrder || 'desc',
});
const prebuiltSavedQueriesMap = await getInstalledSavedQueriesMap(

11
x-pack/plugins/osquery/server/routes/saved_query/read_saved_query_route.ts
View file

@ -5,8 +5,8 @@
* 2.0.
*/
import { schema } from '@kbn/config-schema';
import type { IRouter } from '@kbn/core/server';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import type { SavedQueryResponse } from './types';
import type { SavedQuerySavedObject } from '../../common/types';
@ -15,6 +15,8 @@ import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import { PLUGIN_ID } from '../../../common';
import { savedQuerySavedObjectType } from '../../../common/types';
import { convertECSMappingToObject } from '../utils';
import type { ReadSavedQueryRequestParamsSchema } from '../../../common/api/saved_query/read_saved_query_route';
import { readSavedQueryRequestParamsSchema } from '../../../common/api/saved_query/read_saved_query_route';
export const readSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAppContext) => {
router.versioned
@ -28,9 +30,10 @@ export const readSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAppC
version: API_VERSIONS.public.v1,
validate: {
request: {
params: schema.object({
id: schema.string(),
}),
params: buildRouteValidation<
typeof readSavedQueryRequestParamsSchema,
ReadSavedQueryRequestParamsSchema
>(readSavedQueryRequestParamsSchema),
},
},
},

45
x-pack/plugins/osquery/server/routes/saved_query/update_saved_query_route.ts
View file

@ -6,9 +6,9 @@
*/
import { filter, some } from 'lodash';
import { schema } from '@kbn/config-schema';
import type { IRouter } from '@kbn/core/server';
import { buildRouteValidation } from '../../utils/build_validation/route_validation';
import { API_VERSIONS } from '../../../common/constants';
import { isSavedQueryPrebuilt } from './utils';
import { PLUGIN_ID } from '../../../common';
@ -16,6 +16,14 @@ import { savedQuerySavedObjectType } from '../../../common/types';
import type { OsqueryAppContext } from '../../lib/osquery_app_context_services';
import { convertECSMappingToArray, convertECSMappingToObject } from '../utils';
import type { UpdateSavedQueryResponse } from './types';
import type {
UpdateSavedQueryRequestBodySchema,
UpdateSavedQueryRequestParamsSchema,
} from '../../../common/api/saved_query/update_saved_query_route';
import {
updateSavedQueryRequestBodySchema,
updateSavedQueryRequestParamsSchema,
} from '../../../common/api/saved_query/update_saved_query_route';
export const updateSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAppContext) => {
router.versioned
@ -29,33 +37,14 @@ export const updateSavedQueryRoute = (router: IRouter, osqueryContext: OsqueryAp
version: API_VERSIONS.public.v1,
validate: {
request: {
params: schema.object({
id: schema.string(),
}),
body: schema.object(
{
id: schema.string(),
query: schema.string(),
description: schema.maybe(schema.string()),
interval: schema.maybe(schema.number()),
snapshot: schema.maybe(schema.boolean()),
removed: schema.maybe(schema.boolean()),
platform: schema.maybe(schema.string()),
version: schema.maybe(schema.string()),
ecs_mapping: schema.maybe(
schema.recordOf(
schema.string(),
schema.object({
field: schema.maybe(schema.string()),
value: schema.maybe(
schema.oneOf([schema.string(), schema.arrayOf(schema.string())])
),
})
)
),
},
{ unknowns: 'allow' }
),
params: buildRouteValidation<
typeof updateSavedQueryRequestParamsSchema,
UpdateSavedQueryRequestParamsSchema
>(updateSavedQueryRequestParamsSchema),
body: buildRouteValidation<
typeof updateSavedQueryRequestBodySchema,
UpdateSavedQueryRequestBodySchema
>(updateSavedQueryRequestBodySchema),
},
},
},

2
x-pack/plugins/osquery/server/routes/utils.ts
View file

@ -8,7 +8,7 @@
import type { CoreSetup } from '@kbn/core/server';
import { SavedObjectsClient } from '@kbn/core/server';
import { reduce } from 'lodash';
import type { Shard } from '../../common/schemas/common/utils';
import type { Shard } from '../../common/utils/converters';
import type { SOShard } from '../common/types';
export const convertECSMappingToArray = (ecsMapping: Record<string, object> | undefined) =>

3
x-pack/plugins/osquery/tsconfig.json
View file

@ -72,6 +72,7 @@
"@kbn/licensing-plugin",
"@kbn/core-lifecycle-browser",
"@kbn/core-saved-objects-server",
"@kbn/monaco"
"@kbn/monaco",
"@kbn/io-ts-utils"
]
}