github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 17:28:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

[8.10] [Cloud Security] [Alerts] Fix alerts telemetry collector (#164757) (#164913)

Browse source 
# Backport

This will backport the following commits from `main` to `8.10`:
- [[Cloud Security] [Alerts] Fix alerts telemetry collector
(#164757)](https://github.com/elastic/kibana/pull/164757)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Paulo
Henrique","email":"paulo.henrique@elastic.co"},"sourceCommit":{"committedDate":"2023-08-26T04:25:52Z","message":"[Cloud
Security] [Alerts] Fix alerts telemetry collector
(#164757)","sha":"d18ef2f9797787b481345694b512dd56f40c0b48","branchLabelMapping":{"^v8.11.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","Team:Cloud
Security","backport:prev-minor","v8.10.0","v8.11.0"],"number":164757,"url":"https://github.com/elastic/kibana/pull/164757","mergeCommit":{"message":"[Cloud
Security] [Alerts] Fix alerts telemetry collector
(#164757)","sha":"d18ef2f9797787b481345694b512dd56f40c0b48"}},"sourceBranch":"main","suggestedTargetBranches":["8.10"],"targetPullRequestStates":[{"branch":"8.10","label":"v8.10.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.11.0","labelRegex":"^v8.11.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/164757","number":164757,"mergeCommit":{"message":"[Cloud
Security] [Alerts] Fix alerts telemetry collector
(#164757)","sha":"d18ef2f9797787b481345694b512dd56f40c0b48"}}]}]
BACKPORT-->

Co-authored-by: Paulo Henrique <paulo.henrique@elastic.co>
This commit is contained in:
Kibana Machine 2023-08-26 01:37:01 -04:00 • committed by GitHub
parent 73c44a148a
commit 681661de29
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 36 additions and 56 deletions
Download patch file Download diff file Expand all files Collapse all files

92
x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/alert_stats_collector.ts
View file

@ -9,51 +9,26 @@ import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
import type { CloudSecurityAlertsStats } from './types';
import { DETECTION_ENGINE_ALERTS_INDEX_DEFAULT } from '../../../../common/constants';
interface AlertsStats {
aggregations: {
cspm: {
rules_count: {
value: number;
};
alerts_open: {
doc_count: number;
};
alerts_acknowledged: {
doc_count: number;
};
alerts_closed: {
doc_count: number;
};
};
kspm: {
rules_count: {
value: number;
};
alerts_open: {
doc_count: number;
};
alerts_acknowledged: {
doc_count: number;
};
alerts_closed: {
doc_count: number;
};
};
vuln_mgmt: {
rules_count: {
value: number;
};
alerts_open: {
doc_count: number;
};
alerts_acknowledged: {
doc_count: number;
};
alerts_closed: {
doc_count: number;
};
};
interface AlertStat {
doc_count: number;
rules_count: {
value: number;
};
alerts_open: {
doc_count: number;
};
alerts_acknowledged: {
doc_count: number;
};
alerts_closed: {
doc_count: number;
};
}
interface AlertsStats {
cspm: AlertStat;
kspm: AlertStat;
vuln_mgmt: AlertStat;
}
const getAlertsStatsQuery = (index: string) => ({
@ -187,20 +162,25 @@ export const getAlertsStats = async (
if (isIndexExists) {
const alertsStats = await esClient.search<unknown, AlertsStats>(getAlertsStatsQuery(index));
const postureTypes = ['cspm', 'kspm', 'vuln_mgmt'] as const;
return postureTypes.map((postureType) => ({
posture_type: postureType,
rules_count: alertsStats.aggregations?.aggregations[postureType].rules_count.value,
alerts_count: alertsStats.aggregations?.aggregations[postureType].alerts_open.doc_count,
alerts_open_count:
alertsStats.aggregations?.aggregations[postureType].alerts_open.doc_count,
alerts_acknowledged_count:
alertsStats.aggregations?.aggregations[postureType].alerts_acknowledged.doc_count,
alerts_closed_count:
alertsStats.aggregations?.aggregations[postureType].alerts_closed.doc_count,
})) as CloudSecurityAlertsStats[];
return postureTypes
.filter(
(postureType) =>
alertsStats?.aggregations?.[postureType]?.doc_count &&
alertsStats.aggregations[postureType].doc_count > 0
)
.map((postureType): CloudSecurityAlertsStats => {
const postureTypeData = alertsStats!.aggregations![postureType];
return {
posture_type: postureType,
rules_count: postureTypeData.rules_count?.value,
alerts_count: postureTypeData.doc_count,
alerts_open_count: postureTypeData.alerts_open?.doc_count,
alerts_acknowledged_count: postureTypeData.alerts_acknowledged?.doc_count,
alerts_closed_count: postureTypeData.alerts_closed?.doc_count,
};
});
}
return [];
} catch (e) {