[EDR Workflows] Add Runscript openApi schema (#206044)

This commit is contained in:
Tomasz Ciecierski 2025-01-10 11:26:41 +01:00 committed by GitHub
parent 20fa1a54c1
commit 39774bfc48
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
9 changed files with 542 additions and 74 deletions

View file

@ -146,6 +146,7 @@ import {
RulePreviewRequestQueryInput,
RulePreviewRequestBodyInput,
} from '@kbn/security-solution-plugin/common/api/detection_engine/rule_preview/rule_preview.gen';
import { RunScriptActionRequestBodyInput } from '@kbn/security-solution-plugin/common/api/endpoint/actions/response_actions/run_script/run_script.gen';
import { SearchAlertsRequestBodyInput } from '@kbn/security-solution-plugin/common/api/detection_engine/signals/query_signals/query_signals_route.gen';
import { SetAlertAssigneesRequestBodyInput } from '@kbn/security-solution-plugin/common/api/detection_engine/alert_assignees/set_alert_assignees_route.gen';
import { SetAlertsStatusRequestBodyInput } from '@kbn/security-solution-plugin/common/api/detection_engine/signals/set_signal_status/set_signals_status_route.gen';
@ -1448,6 +1449,17 @@ detection engine rules.
.send(props.body as object)
.query(props.query);
},
/**
* Run a shell command on an endpoint.
*/
runScriptAction(props: RunScriptActionProps, kibanaSpace: string = 'default') {
return supertest
.post(routeWithNamespace('/api/endpoint/action/runscript', kibanaSpace))
.set('kbn-xsrf', 'true')
.set(ELASTIC_HTTP_VERSION_HEADER, '2023-10-31')
.set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana')
.send(props.body as object);
},
/**
* Schedule the risk scoring engine to run as soon as possible. You can use this to recalculate entity risk scores after updating their asset criticality.
*/
@ -1913,6 +1925,9 @@ export interface RulePreviewProps {
query: RulePreviewRequestQueryInput;
body: RulePreviewRequestBodyInput;
}
export interface RunScriptActionProps {
body: RunScriptActionRequestBodyInput;
}
export interface SearchAlertsProps {
body: SearchAlertsRequestBodyInput;
}