From 1b7cb0f29b15aa7ed2bbfa8aa13cee9bfa8dbc91 Mon Sep 17 00:00:00 2001 From: Jared Burgett <147995946+jaredburgettelastic@users.noreply.github.com> Date: Sun, 22 Jun 2025 00:36:09 -0500 Subject: [PATCH] Security Entity Analytics - Privileged user monitoring - Privileged access detection support (#224008) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit # Overview This pull request adds capabilities associated with the [Privileged Access Detection (PAD) anomaly integration package](https://www.elastic.co/docs/reference/integrations/pad) as a first-class-citizen into the Entity Analytics Privileged User Monitoring feature. # How to test - Pull this branch into your local machine - Ensure that the security experimental flag `privilegeMonitoringEnabled` has been enabled, for example by setting `xpack.securitySolution.enableExperimental: [privilegeMonitoringEnabled]` in your `config/kibana.dev.yml` file - Start Elasticsearch and Kibana - From the [security-documents-generator](https://github.com/elastic/security-documents-generator) repository, run the following command: `yarn start privileged-user-monitoring` (ensuring your config is pointing to your locally running Elastic cluster). This will load "source" events that are anomalous in nature. You can run this command more than once if desired to upload more than 10 users. - Grab the CSV file that the generator created in its console output. - Open the Entity analytics page and navigate to dashboards (by clicking "Go to dashboards") - Add the privileged users from the previous step to the privileged users index using the CSV File Upload option. > [!NOTE] > Any errors regarding risk scoring are unrelated to this PR, and are being resolved separately - You should see a panel that says "Enable Privileged access detection". Click "Install", and you'll meet a loading state. - Once complete, you shouldn't see any results. That's because, even though we **install** the ML jobs by default, we don't **run** them by default. - Click "ML Job Settings", and note that only `pad` jobs should be displaying in this callout. Feel free to test this callout's links and filtering options. - Click "Run job" next to the job called `pad_linux_high_count_privileged_process_events_by_user`. This is the job for which we have anomaly data. - Click away from the callout. **You still shouldn't see data.** That's because there just aren't any anomalies "today". - Change the global date filter at the top of the screen to "Last 30 days". - You should see something similar to this: Screenshot 2025-06-16 at 12 50 25 AM - Congrats for making it this far! Some things to play around with: - Click around on the anomaly filters (i.e., click 25-50), and notice that the results will change. - Ensure that the ordering of the users is based on the **highest single anomaly score in any visible bucket**. Meaning, if user `samwise` has only one anomaly, but its score is 99, and user `frodo` has dozens of anomalies, but no higher than, say, 80, `samwise` will be on the top of the list. - Click the user names to open the appropriate user flyout - Change the global time filter to change ranges, and ensure the data shows up appropriately. The buckets will try to roughly show 30 buckets total, but will have a maximum of 3 hours, meaning if your range is too small, it may show fewer than 30 buckets. This is intentional behavior, as the PAD jobs have an anomaly job window of 3 hours. - Click the button that says "View all in Anomaly Explorer", which uses the currently selected global time range, and compare results > [!WARNING] > Remember that the users in the privileged user monitoring table are only those that you designated as privileged users in a previous step. In contrast, the Anomaly Explorer page shows **all** users. Additionally, note that there may be very slight differences between the swimlanes, because ES|QL calculates the bucket dates slightly differently than the Anomaly Explorer. **This should not affect the results themselves, only the buckets that an individual anomaly score might fall in.** You might see a single anomaly fall into one visual bucket instead of another, but the date should be correct. # Helpful hints If you'd like an easy way to "reset" the Privileged Access Detection package and delete its associated jobs (and anomaly data), so that you can redo the onboarding flow, you can run the below commands (changing any credentials as necessary): ```shell curl "http://localhost:5601/api/fleet/epm/packages/pad/0.5.0" \ -X 'DELETE' \ -H 'elastic-api-version: 2023-10-31' \ -H 'kbn-xsrf:true' \ --user elastic:changeme curl "http://localhost:5601/internal/ml/jobs/delete_jobs" \ -H 'kbn-xsrf:true' \ --user elastic:changeme \ -X 'POST' \ -H 'elastic-api-version: 1' \ -H 'x-elastic-internal-origin:kibana' \ -H 'Content-Type: application/json' \ --data-raw '{ "jobIds": [ "pad_linux_high_count_privileged_process_events_by_user", "pad_linux_high_median_process_command_line_entropy_by_user", "pad_linux_rare_process_executed_by_user", "pad_okta_high_sum_concurrent_sessions_by_user", "pad_okta_rare_host_name_by_user", "pad_okta_rare_region_name_by_user", "pad_okta_rare_source_ip_by_user", "pad_okta_spike_in_group_application_assignment_changes", "pad_okta_spike_in_group_lifecycle_changes", "pad_okta_spike_in_group_membership_changes", "pad_okta_spike_in_group_privilege_changes", "pad_okta_spike_in_user_lifecycle_management_changes", "pad_windows_high_count_group_management_events", "pad_windows_high_count_special_logon_events", "pad_windows_high_count_special_privilege_use_events", "pad_windows_high_count_user_account_management_events", "pad_windows_rare_device_by_user", "pad_windows_rare_group_name_by_user", "pad_windows_rare_privilege_assigned_to_user", "pad_windows_rare_region_name_by_user", "pad_windows_rare_source_ip_by_user" ], "deleteUserAnnotations": true, "deleteAlertingRules": false } ' ``` # What's left? - This PR does not implement "proactive" permissions checks. Instead, relevant permission issues will cause requests/queries to fail, which are appropriately shown in the UI for troubleshooting. This proactive check will be tackled in [this (private) followup issue](https://github.com/elastic/security-team/issues/12822). - There is not yet a way to "upgrade" the package directly from the Privileged User Monitoring screen. This would be a nice addition later on, instead of requiring users to navigate to the integration page. This behavior will be tackled in [this (private) followup issue](https://github.com/elastic/security-team/issues/12823). --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine --- oas_docs/output/kibana.serverless.yaml | 66 ++++++ oas_docs/output/kibana.yaml | 66 ++++++ .../install.gen.ts | 24 ++ .../install.schema.yaml | 24 ++ .../privileged_access_detection/status.gen.ts | 32 +++ .../status.schema.yaml | 45 ++++ .../common/api/quickstart_client.gen.ts | 30 +++ ...alytics_api_2023_10_31.bundled.schema.yaml | 70 ++++++ ...alytics_api_2023_10_31.bundled.schema.yaml | 70 ++++++ .../index.test.tsx | 127 +++++++++++ .../privileged_access_detection/index.tsx | 155 +++++++++++++ .../hooks/pad_esql_source_query_hooks.test.ts | 171 ++++++++++++++ .../hooks/pad_esql_source_query_hooks.ts | 83 +++++++ .../hooks/pad_heatmap_interval_hooks.test.ts | 58 +++++ .../hooks/pad_heatmap_interval_hooks.tsx | 32 +++ .../pad_chart/hooks/pad_query_hooks.tsx | 144 ++++++++++++ .../pad_chart/index.tsx | 50 +++++ .../pad_chart/pad_anomaly_bands.ts | 54 +++++ .../pad_chart/pad_chart_severity_filter.tsx | 68 ++++++ .../pad_chart/pad_chart_styling.ts | 21 ++ .../pad_chart/pad_heatmap.tsx | 208 ++++++++++++++++++ .../pad_chart/pad_user_name_list.tsx | 65 ++++++ .../pad_install_prompt.tsx | 114 ++++++++++ .../hooks/pad_get_jobs_hooks.ts | 32 +++ .../pad_ml_popover/index.tsx | 120 ++++++++++ .../pad_ml_popover/pad_ml_popover_header.tsx | 50 +++++ .../pad_routes.tsx | 55 +++++ .../pad_view_all_anomalies_button.tsx | 49 +++++ .../privileged_user_monitoring/index.tsx | 7 +- .../hooks/use_integrations.ts | 27 ++- .../onboarding_panel.tsx | 2 +- .../routes/__mocks__/request_context.ts | 3 + .../privilege_monitoring/indices.ts | 23 +- .../pad_package_installation_client.mock.ts | 15 ++ .../pad_package_installation_client.ts | 191 ++++++++++++++++ .../pad_get_installation_status.ts | 63 ++++++ .../pad_install.ts | 65 ++++++ .../register_privilege_monitoring_routes.ts | 5 + .../server/request_context_factory.ts | 10 + .../plugins/security_solution/server/types.ts | 2 + .../services/security_solution_api.gen.ts | 24 ++ .../pad_installation.ts | 160 ++++++++++++++ 42 files changed, 2645 insertions(+), 35 deletions(-) create mode 100644 x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/install.gen.ts create mode 100644 x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/install.schema.yaml create mode 100644 x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/status.gen.ts create mode 100644 x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/status.schema.yaml create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/index.test.tsx create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/index.tsx create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_esql_source_query_hooks.test.ts create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_esql_source_query_hooks.ts create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_heatmap_interval_hooks.test.ts create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_heatmap_interval_hooks.tsx create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_query_hooks.tsx create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/index.tsx create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_anomaly_bands.ts create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_chart_severity_filter.tsx create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_chart_styling.ts create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_heatmap.tsx create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_user_name_list.tsx create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_install_prompt.tsx create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_ml_popover/hooks/pad_get_jobs_hooks.ts create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_ml_popover/index.tsx create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_ml_popover/pad_ml_popover_header.tsx create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_routes.tsx create mode 100644 x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_view_all_anomalies_button.tsx create mode 100644 x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/privileged_access_detection/pad_package_installation_client.mock.ts create mode 100644 x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/privileged_access_detection/pad_package_installation_client.ts create mode 100644 x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/routes/privileged_access_detection/pad_get_installation_status.ts create mode 100644 x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/routes/privileged_access_detection/pad_install.ts create mode 100644 x-pack/test/security_solution_api_integration/test_suites/entity_analytics/monitoring/trial_license_complete_tier/privileged_access_detection/pad_installation.ts diff --git a/oas_docs/output/kibana.serverless.yaml b/oas_docs/output/kibana.serverless.yaml index 4a827f8a8fe5..d5bde93f46c9 100644 --- a/oas_docs/output/kibana.serverless.yaml +++ b/oas_docs/output/kibana.serverless.yaml @@ -11317,6 +11317,72 @@ paths: summary: List all monitored users tags: - Security Entity Analytics API + /api/entity_analytics/privileged_user_monitoring/pad/install: + post: + operationId: InstallPrivilegedAccessDetectionPackage + responses: + '200': + content: + application/json: + schema: + type: object + properties: + message: + type: string + required: + - message + description: Successful response + summary: Installs the privileged access detection package for the Entity Analytics privileged user monitoring experience + tags: + - Security Entity Analytics API + /api/entity_analytics/privileged_user_monitoring/pad/status: + get: + operationId: GetPrivilegedAccessDetectionPackageStatus + responses: + '200': + content: + application/json: + schema: + type: object + properties: + jobs: + items: + type: object + properties: + description: + type: string + job_id: + type: string + state: + enum: + - closing + - closed + - opened + - failed + - opening + type: string + required: + - job_id + - state + type: array + ml_module_setup_status: + enum: + - complete + - incomplete + type: string + package_installation_status: + enum: + - complete + - incomplete + type: string + required: + - package_installation_status + - ml_module_setup_status + - jobs + description: Privileged access detection status retrieved + summary: Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience + tags: + - Security Entity Analytics API /api/entity_store/enable: post: operationId: InitEntityStore diff --git a/oas_docs/output/kibana.yaml b/oas_docs/output/kibana.yaml index 7ae00a6738fd..f1809a523b66 100644 --- a/oas_docs/output/kibana.yaml +++ b/oas_docs/output/kibana.yaml @@ -13476,6 +13476,72 @@ paths: summary: List all monitored users tags: - Security Entity Analytics API + /api/entity_analytics/privileged_user_monitoring/pad/install: + post: + operationId: InstallPrivilegedAccessDetectionPackage + responses: + '200': + content: + application/json: + schema: + type: object + properties: + message: + type: string + required: + - message + description: Successful response + summary: Installs the privileged access detection package for the Entity Analytics privileged user monitoring experience + tags: + - Security Entity Analytics API + /api/entity_analytics/privileged_user_monitoring/pad/status: + get: + operationId: GetPrivilegedAccessDetectionPackageStatus + responses: + '200': + content: + application/json: + schema: + type: object + properties: + jobs: + items: + type: object + properties: + description: + type: string + job_id: + type: string + state: + enum: + - closing + - closed + - opened + - failed + - opening + type: string + required: + - job_id + - state + type: array + ml_module_setup_status: + enum: + - complete + - incomplete + type: string + package_installation_status: + enum: + - complete + - incomplete + type: string + required: + - package_installation_status + - ml_module_setup_status + - jobs + description: Privileged access detection status retrieved + summary: Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience + tags: + - Security Entity Analytics API /api/entity_store/enable: post: operationId: InitEntityStore diff --git a/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/install.gen.ts b/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/install.gen.ts new file mode 100644 index 000000000000..cd972114f351 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/install.gen.ts @@ -0,0 +1,24 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +/* + * NOTICE: Do not edit this file manually. + * This file is automatically generated by the OpenAPI Generator, @kbn/openapi-generator. + * + * info: + * title: Install privileged access detection package + * version: 2023-10-31 + */ + +import { z } from '@kbn/zod'; + +export type InstallPrivilegedAccessDetectionPackageResponse = z.infer< + typeof InstallPrivilegedAccessDetectionPackageResponse +>; +export const InstallPrivilegedAccessDetectionPackageResponse = z.object({ + message: z.string(), +}); diff --git a/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/install.schema.yaml b/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/install.schema.yaml new file mode 100644 index 000000000000..b89c6a99f93d --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/install.schema.yaml @@ -0,0 +1,24 @@ +openapi: 3.0.0 +info: + title: Install privileged access detection package + version: "2023-10-31" +paths: + /api/entity_analytics/privileged_user_monitoring/pad/install: + post: + x-labels: [ess, serverless] + x-codegen-enabled: true + operationId: InstallPrivilegedAccessDetectionPackage + summary: Installs the privileged access detection package for the Entity Analytics privileged user monitoring experience + + responses: + "200": + description: Successful response + content: + application/json: + schema: + type: object + required: + - message + properties: + message: + type: string diff --git a/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/status.gen.ts b/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/status.gen.ts new file mode 100644 index 000000000000..599ce2e73a3b --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/status.gen.ts @@ -0,0 +1,32 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +/* + * NOTICE: Do not edit this file manually. + * This file is automatically generated by the OpenAPI Generator, @kbn/openapi-generator. + * + * info: + * title: Get the status of the privileged access detection package + * version: 2023-10-31 + */ + +import { z } from '@kbn/zod'; + +export type GetPrivilegedAccessDetectionPackageStatusResponse = z.infer< + typeof GetPrivilegedAccessDetectionPackageStatusResponse +>; +export const GetPrivilegedAccessDetectionPackageStatusResponse = z.object({ + package_installation_status: z.enum(['complete', 'incomplete']), + ml_module_setup_status: z.enum(['complete', 'incomplete']), + jobs: z.array( + z.object({ + job_id: z.string(), + description: z.string().optional(), + state: z.enum(['closing', 'closed', 'opened', 'failed', 'opening']), + }) + ), +}); diff --git a/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/status.schema.yaml b/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/status.schema.yaml new file mode 100644 index 000000000000..ef0b283b753d --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/common/api/entity_analytics/privilege_monitoring/privileged_access_detection/status.schema.yaml @@ -0,0 +1,45 @@ +openapi: 3.0.0 +info: + title: Get the status of the privileged access detection package + version: "2023-10-31" +paths: + /api/entity_analytics/privileged_user_monitoring/pad/status: + get: + x-labels: [ess, serverless] + x-codegen-enabled: true + operationId: GetPrivilegedAccessDetectionPackageStatus + summary: Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience + + responses: + "200": + description: Privileged access detection status retrieved + content: + application/json: + schema: + type: object + required: + - package_installation_status + - ml_module_setup_status + - jobs + properties: + package_installation_status: + type: string + enum: [complete, incomplete] + ml_module_setup_status: + type: string + enum: [complete, incomplete] + jobs: + type: array + items: + type: object + required: + - job_id + - state + properties: + job_id: + type: string + description: + type: string + state: + type: string + enum: [closing, closed, opened, failed, opening] diff --git a/x-pack/solutions/security/plugins/security_solution/common/api/quickstart_client.gen.ts b/x-pack/solutions/security/plugins/security_solution/common/api/quickstart_client.gen.ts index 333ba9201779..4dfa65598166 100644 --- a/x-pack/solutions/security/plugins/security_solution/common/api/quickstart_client.gen.ts +++ b/x-pack/solutions/security/plugins/security_solution/common/api/quickstart_client.gen.ts @@ -265,6 +265,8 @@ import type { } from './entity_analytics/monitoring/search_indices.gen'; import type { InitMonitoringEngineResponse } from './entity_analytics/privilege_monitoring/engine/init.gen'; import type { PrivMonHealthResponse } from './entity_analytics/privilege_monitoring/health.gen'; +import type { InstallPrivilegedAccessDetectionPackageResponse } from './entity_analytics/privilege_monitoring/privileged_access_detection/install.gen'; +import type { GetPrivilegedAccessDetectionPackageStatusResponse } from './entity_analytics/privilege_monitoring/privileged_access_detection/status.gen'; import type { CreatePrivMonUserRequestBodyInput, CreatePrivMonUserResponse, @@ -1429,6 +1431,20 @@ finalize it. }) .catch(catchAxiosErrorFormatAndThrow); } + async getPrivilegedAccessDetectionPackageStatus() { + this.log.info( + `${new Date().toISOString()} Calling API GetPrivilegedAccessDetectionPackageStatus` + ); + return this.kbnClient + .request({ + path: '/api/entity_analytics/privileged_user_monitoring/pad/status', + headers: { + [ELASTIC_HTTP_VERSION_HEADER]: '2023-10-31', + }, + method: 'GET', + }) + .catch(catchAxiosErrorFormatAndThrow); + } async getProtectionUpdatesNote(props: GetProtectionUpdatesNoteProps) { this.log.info(`${new Date().toISOString()} Calling API GetProtectionUpdatesNote`); return this.kbnClient @@ -1867,6 +1883,20 @@ providing you with the most current and effective threat detection capabilities. }) .catch(catchAxiosErrorFormatAndThrow); } + async installPrivilegedAccessDetectionPackage() { + this.log.info( + `${new Date().toISOString()} Calling API InstallPrivilegedAccessDetectionPackage` + ); + return this.kbnClient + .request({ + path: '/api/entity_analytics/privileged_user_monitoring/pad/install', + headers: { + [ELASTIC_HTTP_VERSION_HEADER]: '2023-10-31', + }, + method: 'POST', + }) + .catch(catchAxiosErrorFormatAndThrow); + } async internalUploadAssetCriticalityRecords(props: InternalUploadAssetCriticalityRecordsProps) { this.log.info(`${new Date().toISOString()} Calling API InternalUploadAssetCriticalityRecords`); return this.kbnClient diff --git a/x-pack/solutions/security/plugins/security_solution/docs/openapi/ess/security_solution_entity_analytics_api_2023_10_31.bundled.schema.yaml b/x-pack/solutions/security/plugins/security_solution/docs/openapi/ess/security_solution_entity_analytics_api_2023_10_31.bundled.schema.yaml index 0e8b289e845f..a6636c78f307 100644 --- a/x-pack/solutions/security/plugins/security_solution/docs/openapi/ess/security_solution_entity_analytics_api_2023_10_31.bundled.schema.yaml +++ b/x-pack/solutions/security/plugins/security_solution/docs/openapi/ess/security_solution_entity_analytics_api_2023_10_31.bundled.schema.yaml @@ -476,6 +476,76 @@ paths: summary: List all monitored users tags: - Security Entity Analytics API + /api/entity_analytics/privileged_user_monitoring/pad/install: + post: + operationId: InstallPrivilegedAccessDetectionPackage + responses: + '200': + content: + application/json: + schema: + type: object + properties: + message: + type: string + required: + - message + description: Successful response + summary: >- + Installs the privileged access detection package for the Entity + Analytics privileged user monitoring experience + tags: + - Security Entity Analytics API + /api/entity_analytics/privileged_user_monitoring/pad/status: + get: + operationId: GetPrivilegedAccessDetectionPackageStatus + responses: + '200': + content: + application/json: + schema: + type: object + properties: + jobs: + items: + type: object + properties: + description: + type: string + job_id: + type: string + state: + enum: + - closing + - closed + - opened + - failed + - opening + type: string + required: + - job_id + - state + type: array + ml_module_setup_status: + enum: + - complete + - incomplete + type: string + package_installation_status: + enum: + - complete + - incomplete + type: string + required: + - package_installation_status + - ml_module_setup_status + - jobs + description: Privileged access detection status retrieved + summary: >- + Gets the status of the privileged access detection package for the + Entity Analytics privileged user monitoring experience + tags: + - Security Entity Analytics API /api/entity_store/enable: post: operationId: InitEntityStore diff --git a/x-pack/solutions/security/plugins/security_solution/docs/openapi/serverless/security_solution_entity_analytics_api_2023_10_31.bundled.schema.yaml b/x-pack/solutions/security/plugins/security_solution/docs/openapi/serverless/security_solution_entity_analytics_api_2023_10_31.bundled.schema.yaml index d6aa9e9e7941..a041ea5fdc65 100644 --- a/x-pack/solutions/security/plugins/security_solution/docs/openapi/serverless/security_solution_entity_analytics_api_2023_10_31.bundled.schema.yaml +++ b/x-pack/solutions/security/plugins/security_solution/docs/openapi/serverless/security_solution_entity_analytics_api_2023_10_31.bundled.schema.yaml @@ -476,6 +476,76 @@ paths: summary: List all monitored users tags: - Security Entity Analytics API + /api/entity_analytics/privileged_user_monitoring/pad/install: + post: + operationId: InstallPrivilegedAccessDetectionPackage + responses: + '200': + content: + application/json: + schema: + type: object + properties: + message: + type: string + required: + - message + description: Successful response + summary: >- + Installs the privileged access detection package for the Entity + Analytics privileged user monitoring experience + tags: + - Security Entity Analytics API + /api/entity_analytics/privileged_user_monitoring/pad/status: + get: + operationId: GetPrivilegedAccessDetectionPackageStatus + responses: + '200': + content: + application/json: + schema: + type: object + properties: + jobs: + items: + type: object + properties: + description: + type: string + job_id: + type: string + state: + enum: + - closing + - closed + - opened + - failed + - opening + type: string + required: + - job_id + - state + type: array + ml_module_setup_status: + enum: + - complete + - incomplete + type: string + package_installation_status: + enum: + - complete + - incomplete + type: string + required: + - package_installation_status + - ml_module_setup_status + - jobs + description: Privileged access detection status retrieved + summary: >- + Gets the status of the privileged access detection package for the + Entity Analytics privileged user monitoring experience + tags: + - Security Entity Analytics API /api/entity_store/enable: post: operationId: InitEntityStore diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/index.test.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/index.test.tsx new file mode 100644 index 000000000000..9cedd3f1ddd5 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/index.test.tsx @@ -0,0 +1,127 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React from 'react'; +import { render, screen, waitFor } from '@testing-library/react'; +import { PrivilegedAccessDetectionsPanel } from '.'; +import { TestProviders } from '../../../../../common/mock'; +import { useQueryToggle } from '../../../../../common/containers/query_toggle'; +import { usePrivilegedAccessDetectionRoutes } from './pad_routes'; +import userEvent from '@testing-library/user-event'; + +jest.mock('../../../../../common/containers/query_toggle', () => ({ + useQueryToggle: jest.fn(), +})); + +jest.mock('./pad_routes', () => ({ + usePrivilegedAccessDetectionRoutes: jest.fn(), +})); + +const mockAllRoutes = { + getPrivilegedAccessDetectionStatus: jest.fn(), + setupPrivilegedAccessDetectionMlModule: jest.fn(), + installPrivilegedAccessDetectionPackage: jest.fn(), +}; + +const promiseThatNeverSettles = () => new Promise(() => {}); + +describe('PrivilegedAccessDetectionsPanel', () => { + const mockUseQueryToggle = useQueryToggle as jest.Mock; + const mockUsePrivilegedAccessDetectionRoutes = usePrivilegedAccessDetectionRoutes as jest.Mock; + + beforeEach(() => { + jest.clearAllMocks(); + mockUseQueryToggle.mockReturnValue({ + toggleStatus: true, + setToggleStatus: jest.fn(), + }); + mockUsePrivilegedAccessDetectionRoutes.mockReturnValue({ + ...mockAllRoutes, + }); + }); + + it(`renders a loading element when we don't yet have a status`, async () => { + mockUsePrivilegedAccessDetectionRoutes.mockReturnValue({ + ...mockAllRoutes, + getPrivilegedAccessDetectionStatus: () => promiseThatNeverSettles(), + }); + render(, { wrapper: TestProviders }); + + await waitFor(() => expect(screen.getByTestId('pad-loading-status')).toBeInTheDocument()); + }); + + it(`renders the enablement prompt if the package hasn't been installed`, async () => { + mockUsePrivilegedAccessDetectionRoutes.mockReturnValue({ + ...mockAllRoutes, + getPrivilegedAccessDetectionStatus: () => ({ + package_installation_status: 'incomplete', + ml_module_setup_status: 'incomplete', + jobs: [], + }), + }); + render(, { wrapper: TestProviders }); + + await waitFor(() => + expect(screen.getByText('Enable Privileged access detection.')).toBeInTheDocument() + ); + }); + + it(`renders enablement even if only the ML module hasn't been set up`, async () => { + mockUsePrivilegedAccessDetectionRoutes.mockReturnValue({ + ...mockAllRoutes, + getPrivilegedAccessDetectionStatus: () => ({ + package_installation_status: 'complete', + ml_module_setup_status: 'incomplete', + jobs: [], + }), + }); + render(, { wrapper: TestProviders }); + + await waitFor(() => + expect(screen.getByText('Enable Privileged access detection.')).toBeInTheDocument() + ); + }); + + it(`once installation is complete, ensure the header is visible`, async () => { + mockUsePrivilegedAccessDetectionRoutes.mockReturnValue({ + ...mockAllRoutes, + getPrivilegedAccessDetectionStatus: () => ({ + package_installation_status: 'complete', + ml_module_setup_status: 'complete', + jobs: [], + }), + }); + render(, { wrapper: TestProviders }); + + await waitFor(() => + expect(screen.getByText('Top privileged access detection anomalies')).toBeInTheDocument() + ); + }); + + it('shows a loading state while installation is in progress', async () => { + mockUsePrivilegedAccessDetectionRoutes.mockReturnValue({ + ...mockAllRoutes, + getPrivilegedAccessDetectionStatus: () => ({ + package_installation_status: 'incomplete', + ml_module_setup_status: 'incomplete', + jobs: [], + }), + installPrivilegedAccessDetectionPackage: () => promiseThatNeverSettles(), + }); + render(, { wrapper: TestProviders }); + + await waitFor(() => + expect(screen.getByText('Enable Privileged access detection.')).toBeInTheDocument() + ); + + await userEvent.click(screen.getByTestId('privilegedUserMonitoringEnablementButton')); + + await waitFor(() => + expect(screen.getByText('Installing Privileged access detection package')).toBeInTheDocument() + ); + }); +}); diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/index.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/index.tsx new file mode 100644 index 000000000000..67406f855df7 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/index.tsx @@ -0,0 +1,155 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { i18n } from '@kbn/i18n'; +import { EuiCallOut, EuiEmptyPrompt, EuiFlexGroup, EuiPanel, EuiProgress } from '@elastic/eui'; +import React from 'react'; +import { useMutation, useQuery } from '@tanstack/react-query'; +import { PrivilegedAccessDetectionMLPopover } from './pad_ml_popover'; +import { HeaderSection } from '../../../../../common/components/header_section'; +import { PRIVILEGED_USER_ACTIVITY_QUERY_ID } from '../privileged_user_activity/constants'; +import { useQueryToggle } from '../../../../../common/containers/query_toggle'; +import { PrivilegedAccessDetectionChart } from './pad_chart'; +import { usePrivilegedAccessDetectionRoutes } from './pad_routes'; +import { PrivilegedAccessDetectionInstallPrompt } from './pad_install_prompt'; +import { PrivilegedAccessDetectionViewAllAnomaliesButton } from './pad_view_all_anomalies_button'; + +const TITLE = i18n.translate( + 'xpack.securitySolution.entityAnalytics.privilegedUserMonitoring.topPrivilegedAccessDetectionAnomalies.title', + { defaultMessage: 'Top privileged access detection anomalies' } +); + +const PRIVILEGED_ACCESS_DETECTIONS_QUERY_ID = 'privileged-access-detection-query'; + +const PRIVILEGED_ACCESS_DETECTIONS_STATUS_REFRESH_INTERVAL_IN_MS = 10_000; + +export const PrivilegedAccessDetectionsPanel: React.FC<{ spaceId: string }> = ({ spaceId }) => { + const { toggleStatus, setToggleStatus } = useQueryToggle(PRIVILEGED_USER_ACTIVITY_QUERY_ID); + + const { + getPrivilegedAccessDetectionStatus, + setupPrivilegedAccessDetectionMlModule, + installPrivilegedAccessDetectionPackage, + } = usePrivilegedAccessDetectionRoutes(); + + const { + data: padInstallationStatus, + error: padInstallationStatusError, + refetch: refetchInstallationStatus, + } = useQuery(['padInstallationStatus'], getPrivilegedAccessDetectionStatus, { + refetchInterval: PRIVILEGED_ACCESS_DETECTIONS_STATUS_REFRESH_INTERVAL_IN_MS, + }); + + const setupMlModuleMutation = useMutation({ mutationFn: setupPrivilegedAccessDetectionMlModule }); + const installPrivilegedAccessDetectionPackageMutation = useMutation({ + mutationFn: installPrivilegedAccessDetectionPackage, + }); + + const currentlyInstalling = + installPrivilegedAccessDetectionPackageMutation.isLoading || setupMlModuleMutation.isLoading; + + const install = async () => { + await installPrivilegedAccessDetectionPackageMutation.mutateAsync(); + await setupMlModuleMutation.mutateAsync(); + await refetchInstallationStatus(); + }; + + const packageInstallationComplete = + padInstallationStatus?.package_installation_status === 'complete' && + padInstallationStatus?.ml_module_setup_status === 'complete'; + + return ( + <> + {padInstallationStatusError && ( + + )} + {!padInstallationStatus && !padInstallationStatusError && ( + + + + )} + {padInstallationStatus && !packageInstallationComplete && !currentlyInstalling && ( + + )} + + {currentlyInstalling && ( + <> + + + {i18n.translate( + 'xpack.securitySolution.entityAnalytics.privilegedUserMonitoring.topPrivilegedAccessDetectionAnomalies.privilegedAccessDetection', + { defaultMessage: 'Privileged access detection' } + )} + + } + body={ + <> +

+ {i18n.translate( + 'xpack.securitySolution.entityAnalytics.privilegedUserMonitoring.topPrivilegedAccessDetectionAnomalies.installingPrivilegedAccessDetection', + { defaultMessage: 'Installing Privileged access detection package' } + )} +

+ + + } + /> + + + )} + + {packageInstallationComplete && ( + + + {toggleStatus && ( + + + + + )} + + {toggleStatus && ( + <> + eachJob.job_id)} + spaceId={spaceId} + /> + + )} + + )} + + ); +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_esql_source_query_hooks.test.ts b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_esql_source_query_hooks.test.ts new file mode 100644 index 000000000000..8c75635d5281 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_esql_source_query_hooks.test.ts @@ -0,0 +1,171 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { + usePadTopAnomalousUsersEsqlSource, + usePadAnomalyDataEsqlSource, +} from './pad_esql_source_query_hooks'; + +const trimEsql = (str: string) => str.replace(/[\n]/g, '').replace(/\s\s+/g, ' ').trim(); + +jest.mock('./pad_heatmap_interval_hooks', () => ({ + useIntervalForHeatmap: () => 24, +})); + +describe('the source queries for privileged access detection', () => { + describe('the top anomalous users ESQL query', () => { + it('includes all of the jobs passed in, and respects the provided usersLimit', () => { + const query = usePadTopAnomalousUsersEsqlSource({ + jobIds: ['jobOne', 'jobTwo'], + anomalyBands: [], + spaceId: 'default', + usersLimit: 100, + }); + + expect(trimEsql(query)).toEqual( + trimEsql(` + FROM .ml-anomalies-shared + | WHERE job_id IN ("jobOne", "jobTwo") + | WHERE record_score IS NOT NULL AND user.name IS NOT NULL + | RENAME @timestamp AS event_timestamp + | LOOKUP JOIN .entity_analytics.monitoring.users-default ON user.name + | RENAME event_timestamp AS @timestamp + | WHERE user.is_privileged == true + | STATS max_record_score = MAX(record_score), user.is_privileged = TOP(user.is_privileged, 100, "desc") by user.name + | WHERE user.is_privileged == true + | SORT max_record_score DESC + | KEEP user.name + | LIMIT 100 + `) + ); + }); + + it('has only the hidden anomaly bands', () => { + const query = usePadTopAnomalousUsersEsqlSource({ + jobIds: ['job'], + anomalyBands: [ + { + start: 0, + end: 25, + color: '#ffffff', + hidden: true, + }, + { + start: 25, + end: 50, + color: '#ffffff', + hidden: true, + }, + { + start: 50, + end: 75, + color: '#ffffff', + hidden: false, + }, + ], + spaceId: 'default', + usersLimit: 100, + }); + + expect(trimEsql(query)).toEqual( + trimEsql(` + FROM .ml-anomalies-shared + | WHERE job_id IN ("job") + | WHERE record_score IS NOT NULL AND user.name IS NOT NULL + | WHERE record_score < 0 OR record_score >= 25 + | WHERE record_score < 25 OR record_score >= 50 + | RENAME @timestamp AS event_timestamp + | LOOKUP JOIN .entity_analytics.monitoring.users-default ON user.name + | RENAME event_timestamp AS @timestamp + | WHERE user.is_privileged == true + | STATS max_record_score = MAX(record_score), user.is_privileged = TOP(user.is_privileged, 100, "desc") by user.name + | WHERE user.is_privileged == true + | SORT max_record_score DESC + | KEEP user.name + | LIMIT 100 + `) + ); + }); + }); + describe('the anomalies query', () => { + it('has the provided jobs and usernames, and uses the 24h interval coming from the heatmap interval', () => { + const query = usePadAnomalyDataEsqlSource({ + jobIds: ['jobOne', 'jobTwo'], + anomalyBands: [], + spaceId: 'default', + userNames: ['cloud', 'squall', 'zidane'], + }); + expect(trimEsql(query ?? fail('Query must not be undefined'))).toEqual( + trimEsql(` + FROM .ml-anomalies-shared + | WHERE job_id IN ("jobOne", "jobTwo") + | WHERE record_score IS NOT NULL AND user.name IS NOT NULL AND user.name IN ("cloud", "squall", "zidane") + | RENAME @timestamp AS event_timestamp + | LOOKUP JOIN .entity_analytics.monitoring.users-default ON user.name + | RENAME event_timestamp AS @timestamp + | WHERE user.is_privileged == true + | EVAL user_name_to_record_score = CONCAT(user.name, " : ", TO_STRING(record_score)) + | STATS user_name_to_record_score = VALUES(user_name_to_record_score) BY @timestamp = BUCKET(@timestamp, 24h) + | MV_EXPAND user_name_to_record_score + | DISSECT user_name_to_record_score """%{user.name} : %{record_score}""" + | EVAL record_score = TO_DOUBLE(record_score) + | KEEP @timestamp, user.name, record_score + | STATS record_score = MAX(record_score) BY @timestamp, user.name + | SORT record_score DESC + `) + ); + }); + it('has only the hidden anomaly bands', () => { + const query = usePadAnomalyDataEsqlSource({ + jobIds: ['job'], + anomalyBands: [ + { + start: 0, + end: 25, + color: '#ffffff', + hidden: true, + }, + { + start: 25, + end: 50, + color: '#ffffff', + hidden: true, + }, + { + start: 50, + end: 75, + color: '#ffffff', + hidden: false, + }, + ], + spaceId: 'default', + userNames: ['ramza'], + }); + expect(trimEsql(query ?? fail('Query must not be undefined'))).toEqual( + trimEsql(` + FROM .ml-anomalies-shared + | WHERE job_id IN ("job") + | WHERE record_score IS NOT NULL AND user.name IS NOT NULL AND user.name IN ("ramza") + | WHERE record_score < 0 OR record_score >= 25 + | WHERE record_score < 25 OR record_score >= 50 + | RENAME @timestamp AS event_timestamp + | LOOKUP JOIN .entity_analytics.monitoring.users-default ON user.name + | RENAME event_timestamp AS @timestamp + | WHERE user.is_privileged == true + | EVAL user_name_to_record_score = CONCAT(user.name, " : ", TO_STRING(record_score)) + | STATS user_name_to_record_score = VALUES(user_name_to_record_score) BY @timestamp = BUCKET(@timestamp, 24h) + | MV_EXPAND user_name_to_record_score + | DISSECT user_name_to_record_score """%{user.name} : %{record_score}""" + | EVAL record_score = TO_DOUBLE(record_score) + | KEEP @timestamp, user.name, record_score + | STATS record_score = MAX(record_score) BY @timestamp, user.name + | SORT record_score DESC + `) + ); + }); + }); +}); diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_esql_source_query_hooks.ts b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_esql_source_query_hooks.ts new file mode 100644 index 000000000000..12262fdcac3d --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_esql_source_query_hooks.ts @@ -0,0 +1,83 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { useIntervalForHeatmap } from './pad_heatmap_interval_hooks'; +import { getPrivilegedMonitorUsersJoin } from '../../../../helpers'; +import type { AnomalyBand } from '../pad_anomaly_bands'; + +const getHiddenBandsFilters = (anomalyBands: AnomalyBand[]) => { + const hiddenBands = anomalyBands.filter((each) => each.hidden); + const recordScoreFilterClause = (eachHiddenBand: AnomalyBand) => + `| WHERE record_score < ${eachHiddenBand.start} OR record_score >= ${eachHiddenBand.end} `; + return hiddenBands.map(recordScoreFilterClause).join(''); +}; + +/** + * Currently, this query utilizes the `TOP` ES|QL command to filter for privileged users, and this effectively puts a cap on the number of data + * sources, per `user.name`, this query supports. Right now, we have a total of 3 possible values ('integration', 'api', and 'csv'), so 100 + * is more than enough, and should likely suffice with the current architecture. If the `VALUES` ES|QL command is ever officially supported, this limitation would go away. + */ +const numberOfSupportedDataSources = 100; + +export const usePadTopAnomalousUsersEsqlSource = ({ + jobIds, + anomalyBands, + spaceId, + usersLimit, +}: { + jobIds: string[]; + anomalyBands: AnomalyBand[]; + spaceId: string; + usersLimit: number; +}) => { + const formattedJobIds = jobIds.map((each) => `"${each}"`).join(', '); + + return `FROM .ml-anomalies-shared + | WHERE job_id IN (${formattedJobIds}) + | WHERE record_score IS NOT NULL AND user.name IS NOT NULL + ${getHiddenBandsFilters(anomalyBands)} + ${getPrivilegedMonitorUsersJoin(spaceId)} + | STATS max_record_score = MAX(record_score), user.is_privileged = TOP(user.is_privileged, ${numberOfSupportedDataSources}, "desc") by user.name + | WHERE user.is_privileged == true + | SORT max_record_score DESC + | KEEP user.name + | LIMIT ${usersLimit}`; + // NOTE: the final `WHERE user.is_privileged == true` should not be necessary, as we've already performed the join and filtered by privileged users by that point. I believe this is a bug in ES|QL. This workaround doesn't cause any issues, however. +}; + +export const usePadAnomalyDataEsqlSource = ({ + jobIds, + anomalyBands, + spaceId, + userNames, +}: { + jobIds: string[]; + anomalyBands: AnomalyBand[]; + spaceId: string; + userNames?: string[]; +}) => { + const interval = useIntervalForHeatmap(); + + if (!userNames) return undefined; + const formattedJobIds = jobIds.map((each) => `"${each}"`).join(', '); + const formattedUserNames = userNames.map((each) => `"${each}"`).join(', '); + + return `FROM .ml-anomalies-shared + | WHERE job_id IN (${formattedJobIds}) + | WHERE record_score IS NOT NULL AND user.name IS NOT NULL AND user.name IN (${formattedUserNames}) + ${getHiddenBandsFilters(anomalyBands)} + ${getPrivilegedMonitorUsersJoin(spaceId)} + | EVAL user_name_to_record_score = CONCAT(user.name, " : ", TO_STRING(record_score)) + | STATS user_name_to_record_score = VALUES(user_name_to_record_score) BY @timestamp = BUCKET(@timestamp, ${interval}h) + | MV_EXPAND user_name_to_record_score + | DISSECT user_name_to_record_score """%{user.name} : %{record_score}""" + | EVAL record_score = TO_DOUBLE(record_score) + | KEEP @timestamp, user.name, record_score + | STATS record_score = MAX(record_score) BY @timestamp, user.name + | SORT record_score DESC +`; +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_heatmap_interval_hooks.test.ts b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_heatmap_interval_hooks.test.ts new file mode 100644 index 000000000000..3f5b0d462b68 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_heatmap_interval_hooks.test.ts @@ -0,0 +1,58 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { useGlobalTime } from '../../../../../../../common/containers/use_global_time'; +import moment from 'moment'; +import { useIntervalForHeatmap } from './pad_heatmap_interval_hooks'; + +jest.mock('../../../../../../../common/containers/use_global_time', () => ({ + useGlobalTime: jest.fn(), +})); + +describe('useIntervalForHeatmap', () => { + const mockUseGlobalTime = useGlobalTime as jest.Mock; + + beforeEach(() => { + jest.clearAllMocks(); + mockUseGlobalTime.mockReturnValue({ + from: 0, + to: 0, + }); + }); + + it('returns a minimum of three hours for our bucket ranges, no matter how short the query range', () => { + const now = moment.now().valueOf(); + mockUseGlobalTime.mockReturnValue({ + from: now, + to: now, + }); + const interval = useIntervalForHeatmap(); + expect(interval).toEqual(3); + }); + + it('in the case of a 30 day interval, returns buckets that are 24 hours in length, as we want to compute 30 buckets', () => { + const now = moment.now().valueOf(); + const thirtyDaysAgo = moment().subtract(30, 'days').valueOf(); + mockUseGlobalTime.mockReturnValue({ + from: thirtyDaysAgo, + to: now, + }); + const interval = useIntervalForHeatmap(); + expect(interval).toEqual(24); + }); + + it('in the case of a 90 day interval, returns buckets that are 24 hours in length, as we still want to compute 30 buckets', () => { + const now = moment.now().valueOf(); + const thirtyDaysAgo = moment().subtract(90, 'days').valueOf(); + mockUseGlobalTime.mockReturnValue({ + from: thirtyDaysAgo, + to: now, + }); + const interval = useIntervalForHeatmap(); + expect(interval).toEqual(72); + }); +}); diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_heatmap_interval_hooks.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_heatmap_interval_hooks.tsx new file mode 100644 index 000000000000..b01a7f6cfc6b --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_heatmap_interval_hooks.tsx @@ -0,0 +1,32 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { useGlobalTime } from '../../../../../../../common/containers/use_global_time'; + +/** + * This function computes the appropriate interval (length of time, in hours) of each bucket of the heatmap in a given timerange. + * At most, we will compute 30 buckets, and the interval will be evenly distributed across those 30. + * However, the lowest possible interval that will return is 3 (which equates to 3 hours), which means it is possible + * for fewer buckets than 30. + * + * @return a number representing the number of hours per interval. + */ +export const useIntervalForHeatmap = () => { + const { from, to } = useGlobalTime(); + + const millisecondsToHours = (millis: number) => { + return Number((millis / (1000 * 60 * 60)).toFixed(0)); + }; + + const maximumNumberOfBuckets = 30; + const minimumNumberOfBucketInterval = 3; + const hoursInRange = millisecondsToHours(new Date(to).getTime() - new Date(from).getTime()); + const bucketInterval = Number((hoursInRange / maximumNumberOfBuckets).toFixed(0)); + return bucketInterval < minimumNumberOfBucketInterval + ? minimumNumberOfBucketInterval + : bucketInterval; +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_query_hooks.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_query_hooks.tsx new file mode 100644 index 000000000000..52955bb16b26 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/hooks/pad_query_hooks.tsx @@ -0,0 +1,144 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { useQuery } from '@tanstack/react-query'; +import { getESQLResults } from '@kbn/esql-utils'; +import { i18n } from '@kbn/i18n'; +import { useEsqlGlobalFilterQuery } from '../../../../../../../common/hooks/esql/use_esql_global_filter'; +import { esqlResponseToRecords } from '../../../../../../../common/utils/esql'; +import { useKibana } from '../../../../../../../common/lib/kibana'; +import { useErrorToast } from '../../../../../../../common/hooks/use_error_toast'; +import type { AnomalyBand } from '../pad_anomaly_bands'; +import { + usePadAnomalyDataEsqlSource, + usePadTopAnomalousUsersEsqlSource, +} from './pad_esql_source_query_hooks'; + +interface ESQLRawAnomalyRecord extends Record { + '@timestamp': number | string; + record_score: number; + 'user.name': string; +} + +/** + * An Anomaly record that ensures consistent timestamps as milliseconds since Epoch time. + */ +export interface ESQLAnomalyRecord { + '@timestamp': number; + record_score: number; + 'user.name': string; +} + +const usePrivilegedAccessDetectionTopUsersQuery = (params: { + jobIds: string[]; + spaceId: string; + anomalyBands: AnomalyBand[]; +}) => { + const search = useKibana().services.data.search.search; + + const filterQuery = useEsqlGlobalFilterQuery(); + + const padTopAnomalousUsersEsqlSource = usePadTopAnomalousUsersEsqlSource({ + ...params, + usersLimit: 10, + }); + + const { isLoading, data, isError } = useQuery( + [filterQuery, padTopAnomalousUsersEsqlSource], + async ({ signal }) => { + return esqlResponseToRecords<{ 'user.name': string }>( + ( + await getESQLResults({ + esqlQuery: padTopAnomalousUsersEsqlSource, + search, + signal, + filter: filterQuery, + }) + )?.response + ); + } + ); + return { + isLoading, + userNames: data?.map((each) => each['user.name']), + isError, + }; +}; + +export const usePrivilegedAccessDetectionAnomaliesQuery = (params: { + jobIds: string[]; + spaceId: string; + anomalyBands: AnomalyBand[]; +}) => { + const search = useKibana().services.data.search.search; + const filterQuery = useEsqlGlobalFilterQuery(); + + const { + userNames, + isError: isTopUsersError, + isLoading: isTopUsersLoading, + } = usePrivilegedAccessDetectionTopUsersQuery(params); + + const padAnomalyDataEsqlSource = usePadAnomalyDataEsqlSource({ ...params, userNames }); + + const { + isLoading: isAnomaliesLoading, + data, + error, + isError: isAnomaliesError, + refetch, + } = useQuery<{ + anomalyRecords: ESQLAnomalyRecord[]; + userNames: string[]; + }>( + [filterQuery, padAnomalyDataEsqlSource, userNames], + async ({ signal }) => { + if (!padAnomalyDataEsqlSource || !userNames || userNames.length === 0) { + return { anomalyRecords: [], userNames: [] }; + } + const anomalyRecords = esqlResponseToRecords( + ( + await getESQLResults({ + esqlQuery: padAnomalyDataEsqlSource, + search, + signal, + filter: filterQuery, + }) + ).response + ).map((eachRawRecord) => ({ + ...eachRawRecord, + '@timestamp': new Date(eachRawRecord['@timestamp']).getTime(), + })); + return { + anomalyRecords: anomalyRecords ?? [], + userNames: userNames ?? [], + }; + }, + { + enabled: !!padAnomalyDataEsqlSource && !!userNames, + keepPreviousData: true, + } + ); + + useErrorToast( + i18n.translate( + 'xpack.securitySolution.entityAnalytics.privilegedUserMonitoring.privilegedAccessDetection.queryError', + { + defaultMessage: 'There was an error loading privileged access detection data', + } + ), + error + ); + + return { + data, + isLoading: isTopUsersLoading || isAnomaliesLoading, + isError: isTopUsersError || isAnomaliesError, + refetch, + error, + }; +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/index.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/index.tsx new file mode 100644 index 000000000000..deb0cac055de --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/index.tsx @@ -0,0 +1,50 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ +import React from 'react'; +import { EuiFlexGroup } from '@elastic/eui'; +import { PrivilegedAccessDetectionSeverityFilter } from './pad_chart_severity_filter'; +import { usePrivilegedAccessDetectionAnomaliesQuery } from './hooks/pad_query_hooks'; +import { useAnomalyBands } from './pad_anomaly_bands'; +import { UserNameList } from './pad_user_name_list'; +import { PrivilegedAccessDetectionHeatmap } from './pad_heatmap'; + +export interface PrivilegedAccessDetectionChartProps { + jobIds: string[]; + spaceId: string; +} + +export const PrivilegedAccessDetectionChart: React.FC = ({ + jobIds, + spaceId, +}) => { + const { bands, toggleHiddenBand } = useAnomalyBands(); + + const { data, isLoading, isError } = usePrivilegedAccessDetectionAnomaliesQuery({ + jobIds, + anomalyBands: bands, + spaceId, + }); + + return ( + <> + + + + + + + ); +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_anomaly_bands.ts b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_anomaly_bands.ts new file mode 100644 index 000000000000..12d77e42e733 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_anomaly_bands.ts @@ -0,0 +1,54 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { useEuiTheme } from '@elastic/eui'; +import { useState } from 'react'; + +export interface AnomalyBand { + start: number; + end: number; + color: string; + hidden: boolean; +} + +/** + * Uses the `start` and `end` values of the band to determine equality, as the `color` value could theoretically change across renders (though not in practice) + */ +const bandsAreEqual = (a: AnomalyBand, b: AnomalyBand) => a.start === b.start && a.end === b.end; + +export const useAnomalyBands: () => { + bands: AnomalyBand[]; + toggleHiddenBand: (bandToToggle: AnomalyBand) => void; +} = () => { + const { euiTheme } = useEuiTheme(); + + const bandDefinitions = [ + { start: 0, end: 3, color: '#E5F6Fa' }, // TODO, this color needs to align with the usage in ML, ongoing discussion in this ticket: https://github.com/elastic/kibana/issues/217508. Issue to track this todo: https://github.com/elastic/security-team/issues/12810 + { start: 3, end: 25, color: euiTheme.colors.severity.neutral }, + { start: 25, end: 50, color: euiTheme.colors.severity.warning }, + { start: 50, end: 75, color: euiTheme.colors.severity.risk }, + { start: 75, end: 100, color: euiTheme.colors.severity.danger }, + ]; + + const [bands, setBands] = useState( + bandDefinitions.map((each) => ({ ...each, hidden: false })) + ); + + const toggleHiddenBand = (bandToToggle: AnomalyBand) => { + setBands((currentBands) => + currentBands.map((band) => ({ + ...band, + hidden: bandsAreEqual(bandToToggle, band) ? !band.hidden : band.hidden, + })) + ); + }; + + return { + bands, + toggleHiddenBand, + }; +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_chart_severity_filter.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_chart_severity_filter.tsx new file mode 100644 index 000000000000..97b817d053c8 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_chart_severity_filter.tsx @@ -0,0 +1,68 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React from 'react'; +import { + EuiFlexGroup, + EuiFlexItem, + EuiHealth, + EuiIcon, + EuiPanel, + EuiText, + useEuiTheme, +} from '@elastic/eui'; +import type { AnomalyBand } from './pad_anomaly_bands'; + +interface SeverityFilterProps { + anomalyBands: AnomalyBand[]; + toggleHiddenBand: (band: AnomalyBand) => void; +} + +export const PrivilegedAccessDetectionSeverityFilter: React.FC = ({ + anomalyBands, + toggleHiddenBand, +}) => { + const { euiTheme } = useEuiTheme(); + + return ( + + + +

{'Anomaly score'}

+ {anomalyBands.map((band) => { + if (band.hidden) { + return ( + toggleHiddenBand(band)} + grow={false} + > + + + +

{`${band.start}-${band.end}`}

+ + + + ); + } + return ( + toggleHiddenBand(band)} + color={band.color} + >{`${band.start}-${band.end}`} + ); + })} + + + + + ); +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_chart_styling.ts b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_chart_styling.ts new file mode 100644 index 000000000000..469c7715b333 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_chart_styling.ts @@ -0,0 +1,21 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +export const padChartStyling = { + heightOfNoResults: 300, + heightOfXAxisLegend: 28, + heightOfTopLegend: 32, + heightOfEachCell: 40, + heightOfUserNamesList: (userNames: string[]) => + userNames.length > 0 + ? userNames.length * padChartStyling.heightOfEachCell + : padChartStyling.heightOfNoResults, + heightOfHeatmap: (userNames: string[]) => + userNames.length > 0 + ? userNames.length * padChartStyling.heightOfEachCell + padChartStyling.heightOfXAxisLegend + : padChartStyling.heightOfNoResults, +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_heatmap.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_heatmap.tsx new file mode 100644 index 000000000000..30948e3c44ef --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_heatmap.tsx @@ -0,0 +1,208 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { + Chart, + Heatmap, + type HeatmapStyle, + niceTimeFormatter, + type RecursivePartial, + ScaleType, + Settings, +} from '@elastic/charts'; +import { + EuiFlexGroup, + EuiFlexItem, + EuiImage, + EuiText, + EuiTitle, + EuiLoadingChart, + EuiCallOut, +} from '@elastic/eui'; +import { FormattedMessage } from '@kbn/i18n-react'; +import { i18n } from '@kbn/i18n'; +import React from 'react'; +import { useIntervalForHeatmap } from './hooks/pad_heatmap_interval_hooks'; +import { padChartStyling } from './pad_chart_styling'; +import type { ESQLAnomalyRecord } from './hooks/pad_query_hooks'; +import { useGlobalTime } from '../../../../../../common/containers/use_global_time'; +import type { AnomalyBand } from './pad_anomaly_bands'; +import illustration from '../../../../../../common/images/illustration_product_no_results_magnifying_glass.svg'; + +const heatmapComponentStyle: RecursivePartial = { + brushTool: { + visible: false, + }, + cell: { + maxWidth: 'fill', + label: { + visible: false, + }, + border: { + stroke: 'transparent', + strokeWidth: 0, + }, + }, + xAxisLabel: { + fontSize: 12, + padding: { top: 10, bottom: 10 }, + }, + yAxisLabel: { + visible: false, // We do not show the yAxisLabel, as we instead render the user names separately in order to link to the User flyout + fontSize: 14, + width: 'auto', + padding: { left: 10, right: 10 }, + }, +}; + +interface PrivilegedAccessDetectionHeatmapProps { + records: ESQLAnomalyRecord[]; + anomalyBands: AnomalyBand[]; + userNames: string[]; + isLoading: boolean; + isError: boolean; +} + +const PrivilegedAccessDetectionHeatmapNoResults: React.FC = () => { + return ( + + + + +

+ +

+ +

+ +

+ + + + + + + ); +}; + +const useGlobalTimeInMillis = () => { + const { from, to } = useGlobalTime(); + + return { + from: new Date(from).getTime(), + to: new Date(to).getTime(), + }; +}; + +const useXDomainFromGlobalTime = () => { + const { from, to } = useGlobalTimeInMillis(); + + return { + min: from, + max: to, + }; +}; + +const useTimeFormatter = () => { + const { from, to } = useGlobalTimeInMillis(); + + return (value: string | number) => + niceTimeFormatter([from, to])(value, { + timeZone: 'UTC', + }); +}; + +export const PrivilegedAccessDetectionHeatmap: React.FC = ({ + records, + anomalyBands, + userNames, + isLoading, + isError, +}) => { + const intervalForHeatmap = useIntervalForHeatmap(); + const timeFormatter = useTimeFormatter(); + const xDomain = useXDomainFromGlobalTime(); + + return ( + + {isLoading && ( + + + + )} + {isError && ( + + )} + {!isLoading && !isError && ( + + } + xDomain={xDomain} + /> + + + )} + + ); +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_user_name_list.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_user_name_list.tsx new file mode 100644 index 000000000000..6cd97a248d6a --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_chart/pad_user_name_list.tsx @@ -0,0 +1,65 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React from 'react'; +import { useExpandableFlyoutApi } from '@kbn/expandable-flyout'; +import { EuiFlexGroup, EuiFlexItem, EuiLink, EuiText } from '@elastic/eui'; +import { css } from '@emotion/css'; +import { padChartStyling } from './pad_chart_styling'; +import { UserPanelKey } from '../../../../../../flyout/entity_details/shared/constants'; + +const PRIVILEGED_ACCESS_DETECTION_TABLE_ID = 'PadAnomalies-table'; + +export const UserNameList: React.FC<{ userNames: string[] }> = ({ userNames }) => { + const { openFlyout } = useExpandableFlyoutApi(); + + const openUserFlyout = (userName: string) => { + openFlyout({ + right: { + id: UserPanelKey, + params: { + contextID: PRIVILEGED_ACCESS_DETECTION_TABLE_ID, + userName, + scopeId: PRIVILEGED_ACCESS_DETECTION_TABLE_ID, + }, + }, + }); + }; + + return ( + + + {userNames.map((userName) => ( + + + { + openUserFlyout(userName); + }} + > + {userName} + + + + ))} + + + ); +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_install_prompt.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_install_prompt.tsx new file mode 100644 index 000000000000..d29df53162b3 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_install_prompt.tsx @@ -0,0 +1,114 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { + EuiButton, + EuiCallOut, + EuiEmptyPrompt, + EuiImage, + EuiToolTip, + EuiPanel, +} from '@elastic/eui'; +import { FormattedMessage } from '@kbn/i18n-react'; +import React, { useState } from 'react'; +import { MlNodeAvailableWarningShared } from '@kbn/ml-plugin/public'; +import { i18n } from '@kbn/i18n'; +import dashboardEnableImg from '../../../../images/entity_store_dashboard.png'; + +export const PrivilegedAccessDetectionInstallPrompt: React.FC<{ + installationErrorOccurred: boolean; + install: () => Promise; +}> = ({ installationErrorOccurred, install }) => { + const [mlNodesAvailable, setMlNodesAvailable] = useState(false); + + const privilegedAccessDetectionInstallTooltipText = i18n.translate( + 'xpack.securitySolution.entityAnalytics.privilegedUserMonitoring.topPrivilegedAccessDetectionAnomalies.installTooltip', + { defaultMessage: 'Install and enable privileged access detection anomaly jobs' } + ); + + const privilegedAccessDetectionInstallTooltipUnavailableText = i18n.translate( + 'xpack.securitySolution.entityAnalytics.privilegedUserMonitoring.topPrivilegedAccessDetectionAnomalies.installUnavailableTooltip', + { defaultMessage: 'Unable to install jobs due to no ML node currently available.' } + ); + + return ( + + + install()} + data-test-subj={`privilegedUserMonitoringEnablementButton`} + > + + + + } + icon={ + + } + data-test-subj="privilegedUserMonitoringEnablementPanel" + title={ +

+ {i18n.translate( + 'xpack.securitySolution.entityAnalytics.privilegedUserMonitoring.topPrivilegedAccessDetectionAnomalies.enablePrivilegedAccessDetection', + { defaultMessage: 'Enable Privileged access detection.' } + )} +

+ } + body={ + <> +

+ +

+ + {installationErrorOccurred && ( + + )} + + } + /> + + ); +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_ml_popover/hooks/pad_get_jobs_hooks.ts b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_ml_popover/hooks/pad_get_jobs_hooks.ts new file mode 100644 index 000000000000..60b00ae71f84 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_ml_popover/hooks/pad_get_jobs_hooks.ts @@ -0,0 +1,32 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { useSecurityJobs } from '../../../../../../../common/components/ml_popover/hooks/use_security_jobs'; +import { searchFilter } from '../../../../../../../common/components/ml_popover/helpers'; + +export const usePadMlJobs = (searchValue: string) => { + const { + isMlAdmin, + loading: isLoadingSecurityJobs, + jobs, + refetch: refreshJobs, + } = useSecurityJobs(); + + const allPrivilegedAccessDetectionJobs = jobs.filter((job) => job.groups.includes('pad')); + + const filteredPrivilegedAccessDetectionJobs = searchFilter( + allPrivilegedAccessDetectionJobs, + searchValue + ); + + return { + jobs: filteredPrivilegedAccessDetectionJobs, + refreshJobs, + isMlAdmin, + isLoadingSecurityJobs, + }; +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_ml_popover/index.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_ml_popover/index.tsx new file mode 100644 index 000000000000..bb5b7b45a007 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_ml_popover/index.tsx @@ -0,0 +1,120 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React, { useCallback, useState } from 'react'; +import { EuiButtonEmpty, EuiFlexGroup, EuiPopover, EuiFieldSearch } from '@elastic/eui'; +import { i18n } from '@kbn/i18n'; +import { css } from '@emotion/react'; +import { MLJobsAwaitingNodeWarning, MlNodeAvailableWarningShared } from '@kbn/ml-plugin/public'; +import { PrivilegedAccessDetectionMLPopoverHeader } from './pad_ml_popover_header'; +import { useEnableDataFeed } from '../../../../../../common/components/ml_popover/hooks/use_enable_data_feed'; +import type { SecurityJob } from '../../../../../../common/components/ml_popover/types'; +import { JobsTable } from '../../../../../../common/components/ml_popover/jobs_table/jobs_table'; +import { usePadMlJobs } from './hooks/pad_get_jobs_hooks'; + +export const PrivilegedAccessDetectionMLPopover: React.FC = () => { + const { + enableDatafeed, + disableDatafeed, + isLoading: isLoadingEnableDataFeed, + } = useEnableDataFeed(); + + const [searchValue, setSearchValue] = useState(''); + + const { jobs, refreshJobs, isLoadingSecurityJobs, isMlAdmin } = usePadMlJobs(searchValue); + + const handleJobStateChange = useCallback( + async (job: SecurityJob, latestTimestampMs: number, enable: boolean) => { + if (enable) { + await enableDatafeed(job, latestTimestampMs); + } else { + await disableDatafeed(job); + } + + refreshJobs(); + }, + [refreshJobs, enableDatafeed, disableDatafeed] + ); + + const [mlNodesAvailable, setMlNodesAvailable] = useState(false); + + const [isPopoverOpen, setIsPopoverOpen] = useState(false); + + const installedJobsIds = jobs.filter((job) => job.isInstalled).map((job) => job.id); + + if (!isMlAdmin) return null; + + return ( + <> + { + setIsPopoverOpen(!isPopoverOpen); + refreshJobs(); + }} + > + {i18n.translate( + 'xpack.securitySolution.entityAnalytics.privilegedUserMonitoring.privilegedAccessDetection.padMlJobsPopoverText', + { defaultMessage: 'Privileged access detection ML Jobs' } + )} + + } + isOpen={isPopoverOpen} + closePopover={() => setIsPopoverOpen(!isPopoverOpen)} + repositionOnScroll + > + + + setSearchValue(e.target.value)} + isClearable={true} + aria-label={i18n.translate( + 'xpack.securitySolution.entityAnalytics.privilegedUserMonitoring.privilegedAccessDetection.searchAria', + { defaultMessage: 'Privileged access detection search box' } + )} + /> + + + + + + + ); +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_ml_popover/pad_ml_popover_header.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_ml_popover/pad_ml_popover_header.tsx new file mode 100644 index 000000000000..d1a31b6bf9ab --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_ml_popover/pad_ml_popover_header.tsx @@ -0,0 +1,50 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React, { useCallback } from 'react'; +import { useNavigation } from '@kbn/security-solution-navigation'; +import { FormattedMessage } from '@kbn/i18n-react'; +import { EuiLink, EuiText } from '@elastic/eui'; +import { useIntegrationLinkState } from '../../../../../../common/hooks/integrations/use_integration_link_state'; +import { ENTITY_ANALYTICS_PRIVILEGED_USER_MONITORING_PATH } from '../../../../../../../common/constants'; +import { usePrivilegedAccessDetectionIntegration } from '../../../../privileged_user_monitoring_onboarding/hooks/use_integrations'; +import { INTEGRATION_APP_ID } from '../../../../../../common/lib/integrations/constants'; +import { addPathParamToUrl } from '../../../../../../common/utils/integrations'; + +export const PrivilegedAccessDetectionMLPopoverHeader: React.FC = () => { + const state = useIntegrationLinkState(ENTITY_ANALYTICS_PRIVILEGED_USER_MONITORING_PATH); + const { navigateTo } = useNavigation(); + const padPackage = usePrivilegedAccessDetectionIntegration(); + const navigateToPadIntegration = useCallback(() => { + navigateTo({ + appId: INTEGRATION_APP_ID, + path: addPathParamToUrl( + `/detail/${padPackage?.name}-${padPackage?.version}/overview`, + ENTITY_ANALYTICS_PRIVILEGED_USER_MONITORING_PATH + ), + state, + }); + }, [navigateTo, padPackage, state]); + + return ( + +

+ + {'Privileged access detection integration'} + + ), + }} + /> +

+ + ); +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_routes.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_routes.tsx new file mode 100644 index 000000000000..5204dd2037f0 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_routes.tsx @@ -0,0 +1,55 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { useMemo } from 'react'; +import { API_VERSIONS } from '../../../../../../common/entity_analytics/constants'; +import { useKibana } from '../../../../../common/lib/kibana'; +import type { GetPrivilegedAccessDetectionPackageStatusResponse } from '../../../../../../common/api/entity_analytics/privilege_monitoring/privileged_access_detection/status.gen'; + +const PRIVILEGED_ACCESS_DETECTION_INDEX_PATTERN = + 'logs-*,ml_okta_multiple_user_sessions_pad.all,ml_windows_privilege_type_pad.all'; + +export const usePrivilegedAccessDetectionRoutes = () => { + const http = useKibana().services.http; + + return useMemo(() => { + const getPrivilegedAccessDetectionStatus = async () => { + return http.fetch( + '/api/entity_analytics/privileged_user_monitoring/pad/status', + { + method: 'GET', + version: API_VERSIONS.public.v1, + } + ); + }; + + const installPrivilegedAccessDetectionPackage = async () => { + return http.fetch('/api/entity_analytics/privileged_user_monitoring/pad/install', { + method: 'POST', + version: API_VERSIONS.public.v1, + }); + }; + + const setupPrivilegedAccessDetectionMlModule = async () => { + return http.fetch('/internal/ml/modules/setup/pad-ml', { + version: '1', + method: 'POST', + body: JSON.stringify({ + indexPatternName: PRIVILEGED_ACCESS_DETECTION_INDEX_PATTERN, + useDedicatedIndex: false, + startDatafeed: false, + }), + }); + }; + + return { + getPrivilegedAccessDetectionStatus, + installPrivilegedAccessDetectionPackage, + setupPrivilegedAccessDetectionMlModule, + }; + }, [http]); +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_view_all_anomalies_button.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_view_all_anomalies_button.tsx new file mode 100644 index 000000000000..3066c7f29c86 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/privileged_access_detection/pad_view_all_anomalies_button.tsx @@ -0,0 +1,49 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { EuiButton, EuiLink } from '@elastic/eui'; +import { FormattedMessage } from '@kbn/i18n-react'; +import React from 'react'; +import { ML_PAGES, useMlHref } from '@kbn/ml-plugin/public'; +import { useKibana } from '../../../../../common/lib/kibana'; +import { useGlobalTime } from '../../../../../common/containers/use_global_time'; + +const usePadMlAnomalyExplorerUrl = () => { + const { from, to } = useGlobalTime(); + const { services } = useKibana(); + + return useMlHref( + services.ml, + services.http.basePath.get(), + { + page: ML_PAGES.ANOMALY_EXPLORER, + pageState: { + jobIds: ['pad'], + timeRange: { from, to }, + mlExplorerSwimlane: { + viewByFieldName: 'user.name', + }, + }, + }, + [from, to] + ); +}; + +export const PrivilegedAccessDetectionViewAllAnomaliesButton: React.FC = () => { + const anomalyExplorerUrl = usePadMlAnomalyExplorerUrl(); + + return ( + + + + + + ); +}; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/index.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/index.tsx index bf195a16f868..56c712de871a 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/index.tsx +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/index.tsx @@ -11,6 +11,7 @@ import { FormattedMessage } from '@kbn/i18n-react'; import { useSpaceId } from '../../../common/hooks/use_space_id'; import { RiskLevelsPrivilegedUsersPanel } from './components/risk_level_panel'; import { UserActivityPrivilegedUsersPanel } from './components/privileged_user_activity'; +import { PrivilegedAccessDetectionsPanel } from './components/privileged_access_detection'; export interface OnboardingCallout { userCount: number; @@ -82,11 +83,7 @@ export const PrivilegedUserMonitoring = ({ - - - {'TODO: Top privileged access detections'} - - + {spaceId && } diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring_onboarding/hooks/use_integrations.ts b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring_onboarding/hooks/use_integrations.ts index ce6999939a1f..fad5e73abf0d 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring_onboarding/hooks/use_integrations.ts +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring_onboarding/hooks/use_integrations.ts @@ -8,6 +8,10 @@ import { useGetPackageInfoByKeyQuery } from '@kbn/fleet-plugin/public'; import type { GetInfoResponse } from '@kbn/fleet-plugin/common'; +const isGetInfoResponse = ( + integration: GetInfoResponse | undefined +): integration is GetInfoResponse => integration !== undefined; + export const useEntityAnalyticsIntegrations = () => { const { data: okta } = useGetPackageInfoByKeyQuery( 'entityanalytics_okta', @@ -28,11 +32,20 @@ export const useEntityAnalyticsIntegrations = () => { } ); - const integrations = [okta, ad] - .filter( - (integration): integration is GetInfoResponse => integration !== undefined - ) - .map(({ item }) => item); - - return integrations; + return [okta, ad].filter(isGetInfoResponse).map(({ item }) => item); +}; + +export const usePrivilegedAccessDetectionIntegration = () => { + const { data: pad } = useGetPackageInfoByKeyQuery( + 'pad', + undefined, // When package version is undefined it gets the latest version + { + prerelease: true, // This is a technical preview package, delete this line when it is GA + }, + { + suspense: false, + } + ); + + return isGetInfoResponse(pad) ? pad.item : undefined; }; diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring_onboarding/onboarding_panel.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring_onboarding/onboarding_panel.tsx index 7e7a298e9c43..7a445375798a 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring_onboarding/onboarding_panel.tsx +++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring_onboarding/onboarding_panel.tsx @@ -38,7 +38,7 @@ export const PrivilegedUserMonitoringOnboardingPanel = ({ gutterSize="xl" alignItems="center" > - + diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/routes/__mocks__/request_context.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/routes/__mocks__/request_context.ts index 18d7d7ea35bb..53d4c8be2517 100644 --- a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/routes/__mocks__/request_context.ts +++ b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/routes/__mocks__/request_context.ts @@ -47,6 +47,7 @@ import { AssetInventoryDataClientMock } from '../../../asset_inventory/asset_inv import { privilegeMonitorDataClientMock } from '../../../entity_analytics/privilege_monitoring/privilege_monitoring_data_client.mock'; import { createProductFeaturesServiceMock } from '../../../product_features_service/mocks'; import type { EndpointAppContextService } from '../../../../endpoint/endpoint_app_context_services'; +import { padPackageInstallationClientMock } from '../../../entity_analytics/privilege_monitoring/privileged_access_detection/pad_package_installation_client.mock'; export const createMockClients = () => { const core = coreMock.createRequestHandlerContext(); @@ -80,6 +81,7 @@ export const createMockClients = () => { assetCriticalityDataClient: assetCriticalityDataClientMock.create(), entityStoreDataClient: entityStoreDataClientMock.create(), privilegeMonitorDataClient: privilegeMonitorDataClientMock.create(), + padPackageInstallationClient: padPackageInstallationClientMock.create(), internalFleetServices: { packages: packageServiceMock.createClient(), @@ -191,6 +193,7 @@ const createSecuritySolutionRequestContextMock = ( getEntityStoreApiKeyManager: jest.fn(), getEntityStoreDataClient: jest.fn(() => clients.entityStoreDataClient), getPrivilegeMonitoringDataClient: jest.fn(() => clients.privilegeMonitorDataClient), + getPadPackageInstallationClient: jest.fn(() => clients.padPackageInstallationClient), getMonitoringEntitySourceDataClient: jest.fn(), getSiemRuleMigrationsClient: jest.fn(() => clients.siemRuleMigrationsClient), getInferenceClient: jest.fn(() => clients.getInferenceClient()), diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/indices.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/indices.ts index ce68ddc53876..5b7fa647cb88 100644 --- a/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/indices.ts +++ b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/indices.ts @@ -19,28 +19,7 @@ export const PRIVILEGED_MONITOR_USERS_INDEX_MAPPING: MappingProperties = { 'user.name': { type: 'keyword', }, - 'labels.is_privileged': { - type: 'boolean', - }, -}; - -export const PRIVILEGED_MONITOR_GROUPS_INDEX_MAPPING: MappingProperties = { - 'event.ingested': { - type: 'date', - }, - '@timestamp': { - type: 'date', - }, - 'group.name': { - type: 'keyword', - }, - indexPattern: { - type: 'keyword', - }, - nameMatcher: { - type: 'keyword', - }, - 'labels.is_privileged': { + 'user.is_privileged': { type: 'boolean', }, }; diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/privileged_access_detection/pad_package_installation_client.mock.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/privileged_access_detection/pad_package_installation_client.mock.ts new file mode 100644 index 000000000000..fda64a9760a9 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/privileged_access_detection/pad_package_installation_client.mock.ts @@ -0,0 +1,15 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import type { PadPackageInstallationClient } from './pad_package_installation_client'; + +const createPadPackageInstallationClientMock = () => + ({ + init: jest.fn(), + } as unknown as jest.Mocked); + +export const padPackageInstallationClientMock = { create: createPadPackageInstallationClientMock }; diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/privileged_access_detection/pad_package_installation_client.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/privileged_access_detection/pad_package_installation_client.ts new file mode 100644 index 000000000000..ccee3c2f172e --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/privileged_access_detection/pad_package_installation_client.ts @@ -0,0 +1,191 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import type { + BulkInstallResponse, + IBulkInstallPackageError, +} from '@kbn/fleet-plugin/server/services/epm/packages'; +import { + bulkInstallPackages, + getInstalledPackages, + getPackages, +} from '@kbn/fleet-plugin/server/services/epm/packages'; + +import type { + ElasticsearchClient, + IScopedClusterClient, + Logger, + SavedObjectsClientContract, +} from '@kbn/core/server'; +import type { DataViewsService } from '@kbn/data-views-plugin/common'; +import type { MlJobStats } from '@elastic/elasticsearch/lib/api/types'; +import type { Installable, RegistrySearchResult } from '@kbn/fleet-plugin/common'; +import type { GetPrivilegedAccessDetectionPackageStatusResponse } from '../../../../../common/api/entity_analytics/privilege_monitoring/privileged_access_detection/status.gen'; + +interface PadPackageInstallationClientOpts { + logger: Logger; + clusterClient: IScopedClusterClient; + namespace: string; + soClient: SavedObjectsClientContract; + dataViewsService: DataViewsService; +} + +export interface PadMlJob { + jobId: string; + description: string | undefined; + state: string; +} + +interface JobStatsByJobId { + [key: string]: MlJobStats; +} + +export class PadPackageInstallationClient { + private readonly esClient: ElasticsearchClient; + private readonly soClient: SavedObjectsClientContract; + + constructor(private readonly opts: PadPackageInstallationClientOpts) { + this.esClient = opts.clusterClient.asCurrentUser; + this.soClient = opts.soClient; + } + + private log(level: Exclude, msg: string) { + this.opts.logger[level]( + `[Privileged access detection] [namespace: ${this.opts.namespace}] ${msg}` + ); + } + + private async getCurrentlyInstalledPADPackage() { + const installedPadPackages = await getInstalledPackages({ + savedObjectsClient: this.soClient, + esClient: this.esClient, + nameQuery: 'pad', + perPage: 100, + sortOrder: 'asc', + }); + return installedPadPackages.items.find((installedPackage) => installedPackage.name === 'pad'); + } + + private async getJobs() { + const jobs = (await this.esClient.ml.getJobs({ job_id: 'pad' })).jobs.filter( + (each) => each.custom_settings.created_by === 'ml-module-pad' + ); + + const jobStatsByJobId = (await this.esClient.ml.getJobStats({ job_id: 'pad' })).jobs.reduce( + (accumulator, nextJobStats) => ({ ...accumulator, [nextJobStats.job_id]: nextJobStats }), + {} as JobStatsByJobId + ); + + return jobs.map((eachJob) => ({ + job_id: eachJob.job_id, + description: eachJob.description, + state: jobStatsByJobId[eachJob.job_id].state, + })); + } + + public async getStatus(): Promise { + const packageInstalled = !!(await this.getCurrentlyInstalledPADPackage()); + const packageInstallationStatus = packageInstalled ? 'complete' : 'incomplete'; + if (!packageInstalled) { + // even if there happen to be jobs that match our search criteria, if the package is not installed, we consider the ML installation incomplete and the jobs to not be associated with our privileged access detection usage + return { + package_installation_status: packageInstallationStatus, + ml_module_setup_status: 'incomplete', + jobs: [], + }; + } + + try { + const jobs = await this.getJobs(); + + const mlModuleSetupStatus = jobs.length > 0 ? 'complete' : 'incomplete'; + + return { + package_installation_status: packageInstallationStatus, + ml_module_setup_status: mlModuleSetupStatus, + jobs, + }; + } catch (e) { + this.log( + 'info', + 'The privileged access detection package is installed, but the ML jobs are not yet set up.' + ); + return { + package_installation_status: packageInstallationStatus, + ml_module_setup_status: 'incomplete', + jobs: [], + }; + } + } + + private async getPrivilegedAccessDetectionPackageFromRegistry() { + return ( + await getPackages({ + savedObjectsClient: this.soClient, + category: 'security', + prerelease: true, + }) + ).find((availablePackage) => availablePackage.name === 'pad'); + } + + public async installPrivilegedAccessDetectionPackage() { + const alreadyInstalledPadPackage = await this.getCurrentlyInstalledPADPackage(); + if (alreadyInstalledPadPackage) { + return { + message: 'Privileged access detection package was already installed.', + }; + } + + const availablePadPackage = await this.getPrivilegedAccessDetectionPackageFromRegistry(); + + if (!availablePadPackage) { + this.log('info', 'Privileged access detection package was not found'); + throw new Error('Privileged access detection package was not found.'); + } + + const installationResponse = await this.installPackage(availablePadPackage); + + if (!installationResponse || this.isInstallError(installationResponse)) { + throw new Error( + `Failed to install privileged access detection package. ${installationResponse?.error}` + ); + } + return { + message: 'Successfully installed privileged access detection package.', + }; + } + + /** + * A type guard function to determine if the bulk package installation response is an error type + * + * @param potentialInstallResponseError the `BulkInstallResponse` to check type of + */ + private isInstallError = ( + potentialInstallResponseError: BulkInstallResponse + ): potentialInstallResponseError is IBulkInstallPackageError => { + return (potentialInstallResponseError as IBulkInstallPackageError).error !== undefined; + }; + + private async installPackage(installablePackage: Installable) { + this.log( + 'info', + `Installing Privileged Access Detection package: ${installablePackage.name} ${installablePackage.version}` + ); + + const bulkInstallResponse = await bulkInstallPackages({ + savedObjectsClient: this.soClient, + packagesToInstall: [ + { name: installablePackage.name, version: installablePackage.version, prerelease: true }, + ], + esClient: this.esClient, + spaceId: this.opts.namespace, + skipIfInstalled: true, + force: true, + }); + return bulkInstallResponse.length > 0 ? bulkInstallResponse[0] : undefined; + } +} diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/routes/privileged_access_detection/pad_get_installation_status.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/routes/privileged_access_detection/pad_get_installation_status.ts new file mode 100644 index 000000000000..71623b644017 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/routes/privileged_access_detection/pad_get_installation_status.ts @@ -0,0 +1,63 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import type { IKibanaResponse, Logger } from '@kbn/core/server'; +import { buildSiemResponse } from '@kbn/lists-plugin/server/routes/utils'; +import { transformError } from '@kbn/securitysolution-es-utils'; + +import type { GetPrivilegedAccessDetectionPackageStatusResponse } from '../../../../../../common/api/entity_analytics/privilege_monitoring/privileged_access_detection/status.gen'; +import { API_VERSIONS, APP_ID } from '../../../../../../common/constants'; + +import type { EntityAnalyticsRoutesDeps } from '../../../types'; + +export const padGetStatusRoute = ( + router: EntityAnalyticsRoutesDeps['router'], + logger: Logger, + config: EntityAnalyticsRoutesDeps['config'] +) => { + router.versioned + .get({ + access: 'public', + path: '/api/entity_analytics/privileged_user_monitoring/pad/status', + security: { + authz: { + requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`], + }, + }, + }) + .addVersion( + { + version: API_VERSIONS.public.v1, + validate: {}, + }, + + async ( + context, + request, + response + ): Promise> => { + const siemResponse = buildSiemResponse(response); + const secSol = await context.securitySolution; + + try { + const clientResponse = await secSol.getPadPackageInstallationClient().getStatus(); + return response.ok({ + body: { + ...clientResponse, + }, + }); + } catch (e) { + const error = transformError(e); + logger.error(`Error with PAD installation: ${error.message}`); + return siemResponse.error({ + statusCode: error.statusCode, + body: error.message, + }); + } + } + ); +}; diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/routes/privileged_access_detection/pad_install.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/routes/privileged_access_detection/pad_install.ts new file mode 100644 index 000000000000..e177e237a125 --- /dev/null +++ b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/routes/privileged_access_detection/pad_install.ts @@ -0,0 +1,65 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import type { IKibanaResponse, Logger } from '@kbn/core/server'; +import { buildSiemResponse } from '@kbn/lists-plugin/server/routes/utils'; +import { transformError } from '@kbn/securitysolution-es-utils'; + +import type { InstallPrivilegedAccessDetectionPackageResponse } from '../../../../../../common/api/entity_analytics/privilege_monitoring/privileged_access_detection/install.gen'; +import { API_VERSIONS, APP_ID } from '../../../../../../common/constants'; + +import type { EntityAnalyticsRoutesDeps } from '../../../types'; + +export const padInstallRoute = ( + router: EntityAnalyticsRoutesDeps['router'], + logger: Logger, + config: EntityAnalyticsRoutesDeps['config'] +) => { + router.versioned + .post({ + access: 'public', + path: '/api/entity_analytics/privileged_user_monitoring/pad/install', + security: { + authz: { + requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`], + }, + }, + }) + .addVersion( + { + version: API_VERSIONS.public.v1, + validate: {}, + }, + + async ( + context, + request, + response + ): Promise> => { + const siemResponse = buildSiemResponse(response); + const secSol = await context.securitySolution; + + try { + const clientResponse = await secSol + .getPadPackageInstallationClient() + .installPrivilegedAccessDetectionPackage(); + return response.ok({ + body: { + ...clientResponse, + }, + }); + } catch (e) { + const error = transformError(e); + logger.error(`Error PAD installation: ${error.message}`); + return siemResponse.error({ + statusCode: error.statusCode, + body: error.message, + }); + } + } + ); +}; diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/routes/register_privilege_monitoring_routes.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/routes/register_privilege_monitoring_routes.ts index eabd184d8a4a..17e3f3e2f675 100644 --- a/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/routes/register_privilege_monitoring_routes.ts +++ b/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/privilege_monitoring/routes/register_privilege_monitoring_routes.ts @@ -19,6 +19,9 @@ import { uploadUsersCSVRoute, } from './users'; +import { padInstallRoute } from './privileged_access_detection/pad_install'; +import { padGetStatusRoute } from './privileged_access_detection/pad_get_installation_status'; + export const registerPrivilegeMonitoringRoutes = ({ router, logger, @@ -26,6 +29,8 @@ export const registerPrivilegeMonitoringRoutes = ({ }: EntityAnalyticsRoutesDeps) => { initPrivilegeMonitoringEngineRoute(router, logger, config); healthCheckPrivilegeMonitoringRoute(router, logger, config); + padInstallRoute(router, logger, config); + padGetStatusRoute(router, logger, config); searchPrivilegeMonitoringIndicesRoute(router, logger, config); monitoringEntitySourceRoute(router, logger, config); createUserRoute(router, logger); diff --git a/x-pack/solutions/security/plugins/security_solution/server/request_context_factory.ts b/x-pack/solutions/security/plugins/security_solution/server/request_context_factory.ts index 507aea2e6371..5b66745b2715 100644 --- a/x-pack/solutions/security/plugins/security_solution/server/request_context_factory.ts +++ b/x-pack/solutions/security/plugins/security_solution/server/request_context_factory.ts @@ -12,6 +12,7 @@ import type { KibanaRequest, Logger, RequestHandlerContext } from '@kbn/core/ser import type { BuildFlavor } from '@kbn/config'; import { EntityDiscoveryApiKeyType } from '@kbn/entityManager-plugin/server/saved_objects'; import { MonitoringEntitySourceDataClient } from './lib/entity_analytics/privilege_monitoring/monitoring_entity_source_data_client'; +import { PadPackageInstallationClient } from './lib/entity_analytics/privilege_monitoring/privileged_access_detection/pad_package_installation_client'; import { DEFAULT_SPACE_ID } from '../common/constants'; import type { Immutable } from '../common/endpoint/types'; import type { EndpointAuthz } from '../common/endpoint/types/authz'; @@ -275,6 +276,15 @@ export class RequestContextFactory implements IRequestContextFactory { soClient: coreContext.savedObjects.client, }); }), + getPadPackageInstallationClient: memoize(() => { + return new PadPackageInstallationClient({ + clusterClient: coreContext.elasticsearch.client, + soClient: coreContext.savedObjects.client, + logger: options.logger, + namespace: getSpaceId(), + dataViewsService, + }); + }), getEntityStoreDataClient: memoize(() => { // why are we defining this here, but other places we do it inline? const clusterClient = coreContext.elasticsearch.client; diff --git a/x-pack/solutions/security/plugins/security_solution/server/types.ts b/x-pack/solutions/security/plugins/security_solution/server/types.ts index 1e19597985c0..baa8f321c990 100644 --- a/x-pack/solutions/security/plugins/security_solution/server/types.ts +++ b/x-pack/solutions/security/plugins/security_solution/server/types.ts @@ -22,6 +22,7 @@ import type { Readable } from 'stream'; import type { AuditLogger } from '@kbn/security-plugin-types-server'; import type { InferenceClient } from '@kbn/inference-common'; import type { DataViewsService } from '@kbn/data-views-plugin/common'; +import type { PadPackageInstallationClient } from './lib/entity_analytics/privilege_monitoring/privileged_access_detection/pad_package_installation_client'; import type { EndpointAppContextService } from './endpoint/endpoint_app_context_services'; import type { Immutable } from '../common/endpoint/types'; import { AppClient } from './client'; @@ -71,6 +72,7 @@ export interface SecuritySolutionApiRequestHandlerContext { getEntityStoreDataClient: () => EntityStoreDataClient; getPrivilegeMonitoringDataClient: () => PrivilegeMonitoringDataClient; getMonitoringEntitySourceDataClient: () => MonitoringEntitySourceDataClient; + getPadPackageInstallationClient: () => PadPackageInstallationClient; getSiemRuleMigrationsClient: () => SiemRuleMigrationsClient; getInferenceClient: () => InferenceClient; getAssetInventoryClient: () => AssetInventoryDataClient; diff --git a/x-pack/test/api_integration/services/security_solution_api.gen.ts b/x-pack/test/api_integration/services/security_solution_api.gen.ts index 7318fc6fd906..94956f4848c3 100644 --- a/x-pack/test/api_integration/services/security_solution_api.gen.ts +++ b/x-pack/test/api_integration/services/security_solution_api.gen.ts @@ -966,6 +966,18 @@ finalize it. .set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana') .query(props.query); }, + getPrivilegedAccessDetectionPackageStatus(kibanaSpace: string = 'default') { + return supertest + .get( + routeWithNamespace( + '/api/entity_analytics/privileged_user_monitoring/pad/status', + kibanaSpace + ) + ) + .set('kbn-xsrf', 'true') + .set(ELASTIC_HTTP_VERSION_HEADER, '2023-10-31') + .set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana'); + }, getProtectionUpdatesNote( props: GetProtectionUpdatesNoteProps, kibanaSpace: string = 'default' @@ -1341,6 +1353,18 @@ providing you with the most current and effective threat detection capabilities. .set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana') .send(props.body as object); }, + installPrivilegedAccessDetectionPackage(kibanaSpace: string = 'default') { + return supertest + .post( + routeWithNamespace( + '/api/entity_analytics/privileged_user_monitoring/pad/install', + kibanaSpace + ) + ) + .set('kbn-xsrf', 'true') + .set(ELASTIC_HTTP_VERSION_HEADER, '2023-10-31') + .set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana'); + }, internalUploadAssetCriticalityRecords(kibanaSpace: string = 'default') { return supertest .post(routeWithNamespace('/internal/asset_criticality/upload_csv', kibanaSpace)) diff --git a/x-pack/test/security_solution_api_integration/test_suites/entity_analytics/monitoring/trial_license_complete_tier/privileged_access_detection/pad_installation.ts b/x-pack/test/security_solution_api_integration/test_suites/entity_analytics/monitoring/trial_license_complete_tier/privileged_access_detection/pad_installation.ts new file mode 100644 index 000000000000..5d40f3465354 --- /dev/null +++ b/x-pack/test/security_solution_api_integration/test_suites/entity_analytics/monitoring/trial_license_complete_tier/privileged_access_detection/pad_installation.ts @@ -0,0 +1,160 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import expect from '@kbn/expect'; +import { FtrProviderContext } from '../../../../../ftr_provider_context'; +import { dataViewRouteHelpersFactory } from '../../../utils/data_view'; + +export default ({ getService }: FtrProviderContext) => { + const api = getService('securitySolutionApi'); + const supertest = getService('supertest'); + const log = getService('log'); + const kibanaServer = getService('kibanaServer'); + + const uninstallPackage = async () => { + try { + await kibanaServer.request({ + method: 'DELETE', + path: '/api/fleet/epm/packages/pad/0.5.0', + retries: 1, + }); + } catch (e) { + log.info('No existing package found for deletion, continuing'); + } + }; + + const deleteMLJobs = async () => { + try { + return await kibanaServer.request({ + method: 'POST', + path: '/internal/ml/jobs/delete_jobs', + body: { + jobIds: [ + 'pad_linux_high_count_privileged_process_events_by_user', + 'pad_linux_high_median_process_command_line_entropy_by_user', + 'pad_linux_rare_process_executed_by_user', + 'pad_okta_high_sum_concurrent_sessions_by_user', + 'pad_okta_rare_host_name_by_user', + 'pad_okta_rare_region_name_by_user', + 'pad_okta_rare_source_ip_by_user', + 'pad_okta_spike_in_group_application_assignment_changes', + 'pad_okta_spike_in_group_lifecycle_changes', + 'pad_okta_spike_in_group_membership_changes', + 'pad_okta_spike_in_group_privilege_changes', + 'pad_okta_spike_in_user_lifecycle_management_changes', + 'pad_windows_high_count_group_management_events', + 'pad_windows_high_count_special_logon_events', + 'pad_windows_high_count_special_privilege_use_events', + 'pad_windows_high_count_user_account_management_events', + 'pad_windows_rare_device_by_user', + 'pad_windows_rare_group_name_by_user', + 'pad_windows_rare_privilege_assigned_to_user', + 'pad_windows_rare_region_name_by_user', + 'pad_windows_rare_source_ip_by_user', + ], + deleteUserAnnotations: true, + deleteAlertingRules: false, + }, + headers: { + 'elastic-api-version': '1', + }, + }); + } catch (e) { + log.info('Job deletion unsuccessful, but continuing'); + } + }; + + const simulateMlModuleSetupFromUI = async () => { + try { + return await kibanaServer.request({ + method: 'POST', + path: '/internal/ml/modules/setup/pad-ml', + body: { + indexPatternName: + 'logs-*,ml_okta_multiple_user_sessions_pad.all,ml_windows_privilege_type_pad.all', + useDedicatedIndex: false, + startDatafeed: false, + }, + headers: { + 'elastic-api-version': '1', + }, + }); + } catch (e) { + log.error(e); + throw Error('Failed to setup ML module'); + } + }; + + describe('@ess @serverless @skipInServerlessMKI Entity Privilege Monitoring APIs', () => { + const dataView = dataViewRouteHelpersFactory(supertest); + before(async () => { + await dataView.create('security-solution'); + await uninstallPackage(); + await deleteMLJobs(); + }); + + after(async () => { + await dataView.delete('security-solution'); + await uninstallPackage(); + await deleteMLJobs(); + }); + + describe('privileged access detection status and installation APIs', () => { + it('should be able to successfully install the package', async () => { + const statusResponseBeforeInstallation = + await api.getPrivilegedAccessDetectionPackageStatus(); + + if (statusResponseBeforeInstallation.status !== 200) { + log.error(`Retrieving status failed`); + log.error(JSON.stringify(statusResponseBeforeInstallation.body)); + } + + expect(statusResponseBeforeInstallation.status).eql(200); + + const { + package_installation_status: packageInstallationStatusBeforeInstallation, + ml_module_setup_status: mlModuleSetupStatusBeforeInstallation, + } = statusResponseBeforeInstallation.body; + + expect(packageInstallationStatusBeforeInstallation).eql('incomplete'); + expect(mlModuleSetupStatusBeforeInstallation).eql('incomplete'); + + const installationResponse = await api.installPrivilegedAccessDetectionPackage('default'); + + expect(installationResponse.status).eql(200); + expect(installationResponse.body.message).eql( + 'Successfully installed privileged access detection package.' + ); + + const mlModuleSetupResponse = await simulateMlModuleSetupFromUI(); + expect(mlModuleSetupResponse.status).eql(200); + + log.info('Privileged access detection installation was successful'); + + const statusResponseAfterInstallation = + await api.getPrivilegedAccessDetectionPackageStatus(); + + if (statusResponseAfterInstallation.status !== 200) { + log.error(`Retrieving status failed`); + log.error(JSON.stringify(statusResponseAfterInstallation.body)); + } + + expect(statusResponseAfterInstallation.status).eql(200); + + const { + package_installation_status: packageInstallationStatusAfterInstallation, + ml_module_setup_status: mlModuleSetupStatusAfterInstallation, + jobs: jobsAfterInstallation, + } = statusResponseAfterInstallation.body; + + expect(packageInstallationStatusAfterInstallation).eql('complete'); + expect(mlModuleSetupStatusAfterInstallation).eql('complete'); + expect(jobsAfterInstallation.length).greaterThan(20); + }); + }); + }); +};