github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

update artifacts to support wildcard entries

Browse source 
refs elastic/security-team/issues/543
This commit is contained in:
Ashokaditya 2021-04-27 11:07:39 +02:00
parent f7448086b1
commit 6a874c07e2
2 changed files with 36 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts
View file

@ -22,6 +22,8 @@ import {
translatedEntryMatchAnyMatcher,
TranslatedEntryMatcher,
translatedEntryMatchMatcher,
TranslatedEntryMatchWildcardMatcher,
translatedEntryMatchWildcardMatcher,
TranslatedEntryNestedEntry,
translatedEntryNestedEntry,
TranslatedExceptionListItem,
@ -203,6 +205,10 @@ function getMatcherFunction(field: string, matchAny?: boolean): TranslatedEntryM
: 'exact_cased';
}
function getMatcherWildcardFunction(field: string): TranslatedEntryMatchWildcardMatcher {
return field.endsWith('.caseless') ? 'wildcard_caseless' : 'wildcard_cased';
}
function normalizeFieldName(field: string): string {
return field.endsWith('.caseless') ? field.substring(0, field.lastIndexOf('.')) : field;
}
@ -272,6 +278,17 @@ function translateEntry(
}
: undefined;
}
case 'wildcard': {
const matcher = getMatcherWildcardFunction(entry.field);
return translatedEntryMatchWildcardMatcher.is(matcher)
? {
field: normalizeFieldName(entry.field),
operator: entry.operator,
type: matcher,
value: entry.value,
}
: undefined;
}
}
}

19
x-pack/plugins/security_solution/server/endpoint/schemas/artifacts/lists.ts
View file

@ -30,6 +30,24 @@ export const translatedEntryMatchMatcher = t.keyof({
});
export type TranslatedEntryMatchMatcher = t.TypeOf<typeof translatedEntryMatchMatcher>;
export const translatedEntryMatchWildcardMatcher = t.keyof({
wildcard_cased: null,
wildcard_caseless: null,
});
export type TranslatedEntryMatchWildcardMatcher = t.TypeOf<
typeof translatedEntryMatchWildcardMatcher
>;
export const translatedEntryMatchWildcard = t.exact(
t.type({
field: t.string,
operator,
type: translatedEntryMatchWildcardMatcher,
value: t.string,
})
);
export type TranslatedEntryMatchWildcard = t.TypeOf<typeof translatedEntryMatchWildcard>;
export const translatedEntryMatch = t.exact(
t.type({
field: t.string,
@ -61,6 +79,7 @@ export type TranslatedEntryNested = t.TypeOf<typeof translatedEntryNested>;
export const translatedEntry = t.union([
translatedEntryNested,
translatedEntryMatch,
translatedEntryMatchWildcard,
translatedEntryMatchAny,
]);
export type TranslatedEntry = t.TypeOf<typeof translatedEntry>;