github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

[EDR Workflows] Remove usage of _source in automated response actions (#162316)

Browse source
This commit is contained in:
Tomasz Ciecierski 2023-07-20 15:53:52 +02:00 • committed by GitHub
parent a190b3f2ab
commit 1a300e31bb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
x-pack/plugins/security_solution/public/management/hooks/response_actions/use_get_automated_action_list.ts
View file

@ -124,11 +124,9 @@ export const useGetAutomatedActionResponseList = (
)
);
const action = responseData.edges[0]?._source;
return {
action_id: actionId,
completedAt: action?.EndpointActions.completed_at,
completedAt: responseData.edges[0]?.fields?.['EndpointActions.completed_at']?.[0],
isExpired: responseData.isExpired,
wasSuccessful: responseData.wasSuccessful,
isCompleted: responseData.isCompleted,

1
x-pack/plugins/security_solution/server/search_strategy/endpoint/factory/response_actions/actions/query.all_actions.dsl.ts
View file

@ -34,6 +34,7 @@ export const buildResponseActionsQuery = (
ignore_unavailable: true,
body: {
fields,
_source: false,
query: {
bool: {
minimum_should_match: 2,

3
x-pack/plugins/security_solution/server/search_strategy/endpoint/factory/response_actions/results/query.action_results.dsl.ts
View file

@ -13,10 +13,13 @@ export const buildActionResultsQuery = ({
actionId,
sort,
}: ActionResponsesRequestOptions): ISearchRequestParams => {
const fields = [{ field: '*' }, { field: 'EndpointActions.*', include_unmapped: true }];
const dslQuery = {
allow_no_indices: true,
index: [ENDPOINT_ACTION_RESPONSES_INDEX],
body: {
fields,
_source: false,
size: 1,
query: {
term: { action_id: actionId },