github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 01:13:23 -04:00
Code Issues Projects Releases Packages Wiki Activity

[Security Solution][Data Views] - Add custom DataView error (#136525)

Browse source 
Update rule error shown when data view not found during execution.
This commit is contained in:
Khristinin Nikita 2022-07-25 20:57:38 +02:00 • committed by GitHub
parent 3246ec733e
commit 8d88c7851c
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 36 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

10
x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts
View file

@ -37,7 +37,7 @@ import { scheduleThrottledNotificationActions } from '../notifications/schedule_
import aadFieldConversion from '../routes/index/signal_aad_mapping.json';
import { extractReferences, injectReferences } from '../signals/saved_object_references';
import { withSecuritySpan } from '../../../utils/with_security_span';
import { getInputIndex } from '../signals/get_input_output_index';
import { getInputIndex, DataViewError } from '../signals/get_input_output_index';
/* eslint-disable complexity */
export const createSecurityRuleTypeWrapper: CreateSecurityRuleTypeWrapper =
@ -179,7 +179,13 @@ export const createSecurityRuleTypeWrapper: CreateSecurityRuleTypeWrapper =
inputIndex = index ?? [];
runtimeMappings = dataViewRuntimeMappings;
} catch (exc) {
const errorMessage = buildRuleMessage(`Check for indices to search failed ${exc}`);
let errorMessage;
if (exc instanceof DataViewError) {
errorMessage = buildRuleMessage(`Data View not found ${exc}`);
} else {
errorMessage = buildRuleMessage(`Check for indices to search failed ${exc}`);
}
logger.error(errorMessage);
await ruleExecutionLogger.logStatusChange({
newStatus: RuleExecutionStatus.failed,

18
x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_input_output_index.test.ts
View file

@ -12,7 +12,7 @@ import { loggerMock } from '@kbn/logging-mocks';
import { DEFAULT_INDEX_KEY, DEFAULT_INDEX_PATTERN } from '../../../../common/constants';
import type { GetInputIndex } from './get_input_output_index';
import { getInputIndex } from './get_input_output_index';
import { getInputIndex, DataViewError } from './get_input_output_index';
describe('get_input_output_index', () => {
let servicesMock: RuleExecutorServicesMock;
@ -196,5 +196,21 @@ describe('get_input_output_index', () => {
`"Saved object [index-pattern/12345] not found"`
);
});
test('Returns error of DataViewErrorType', async () => {
servicesMock.savedObjectsClient.get.mockRejectedValue(
new Error('Saved object [index-pattern/12345] not found')
);
await expect(
getInputIndex({
services: servicesMock,
version: '8.0.0',
index: [],
dataViewId: '12345',
ruleId: 'rule_1',
logger,
})
).rejects.toBeInstanceOf(DataViewError);
});
});
});

15
x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_input_output_index.ts
View file

@ -34,6 +34,8 @@ export interface GetInputIndexReturn {
warningToWrite?: string;
}
export class DataViewError extends Error {}
export const getInputIndex = async ({
index,
services,
@ -45,10 +47,15 @@ export const getInputIndex = async ({
// If data views defined, use it
if (dataViewId != null && dataViewId !== '') {
// Check to see that the selected dataView exists
const dataView = await services.savedObjectsClient.get<DataViewAttributes>(
'index-pattern',
dataViewId
);
let dataView;
try {
dataView = await services.savedObjectsClient.get<DataViewAttributes>(
'index-pattern',
dataViewId
);
} catch (exc) {
throw new DataViewError(exc.message);
}
const indices = dataView.attributes.title.split(',');
const runtimeMappings =
dataView.attributes.runtimeFieldMap != null