[8.18] [Security Solution] [Attack discovery] Display error messages for invalid Anonymization configurations (#214506) (#214616)

# Backport This will backport the following commits from `main` to `8.18`: - [[Security Solution] [Attack discovery] Display error messages for invalid Anonymization configurations (#214506)](https://github.com/elastic/kibana/pull/214506)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Andrew Macri <andrew.macri@elastic.co>
2025-04-24 09:48:58 -04:00 · 2025-03-15 05:31:00 +11:00 · 2025-03-15 05:31:00 +11:00 · a2fea44c48
commit a2fea44c48
parent 0cfc64b271
4 changed files with 152 additions and 0 deletions
--- a/x-pack/solutions/security/plugins/elastic_assistant/server/routes/attack_discovery/post/helpers/invoke_attack_discovery_graph/index.tsx
+++ b/x-pack/solutions/security/plugins/elastic_assistant/server/routes/attack_discovery/post/helpers/invoke_attack_discovery_graph/index.tsx
@ -22,6 +22,7 @@ import {
 } from '../../../../../lib/attack_discovery/graphs/default_attack_discovery_graph/constants';
 import { GraphState } from '../../../../../lib/attack_discovery/graphs/default_attack_discovery_graph/types';
 import { throwIfErrorCountsExceeded } from '../throw_if_error_counts_exceeded';
+import { throwIfInvalidAnonymization } from '../throw_if_invalid_anonymization';
 import { getLlmType } from '../../../../utils';
 import { getAttackDiscoveryPrompts } from '../../../../../lib/attack_discovery/graphs/default_attack_discovery_graph/nodes/helpers/prompts';

@ -63,6 +64,8 @@ export const invokeAttackDiscoveryGraph = async ({
  anonymizedAlerts: Document[];
  attackDiscoveries: AttackDiscovery[] | null;
 }> => {
+  throwIfInvalidAnonymization(anonymizationFields);
+
  const llmType = getLlmType(apiConfig.actionTypeId);
  const model = apiConfig.model;
  const tags = [ATTACK_DISCOVERY_TAG, llmType, model].flatMap((tag) => tag ?? []);
--- a/x-pack/solutions/security/plugins/elastic_assistant/server/routes/attack_discovery/post/helpers/throw_if_invalid_anonymization/index.test.ts
+++ b/x-pack/solutions/security/plugins/elastic_assistant/server/routes/attack_discovery/post/helpers/throw_if_invalid_anonymization/index.test.ts
@ -0,0 +1,96 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { AnonymizationFieldResponse } from '@kbn/elastic-assistant-common/impl/schemas/anonymization_fields/bulk_crud_anonymization_fields_route.gen';
+
+import { throwIfInvalidAnonymization } from '.';
+import * as i18n from './translations';
+
+const userNameFieldNotAllowed: AnonymizationFieldResponse = {
+  allowed: false, // <-- This field is NOT allowed
+  anonymized: true,
+  createdAt: '2025-03-13T06:07:34.493Z',
+  field: 'user.name',
+  id: 'kB8djpUBwtgi0OSKhvlf',
+  namespace: 'default',
+  timestamp: '2025-03-13T06:07:34.493Z',
+  updatedAt: '2025-03-13T20:33:58.283Z',
+};
+
+const userNameFieldAllowed: AnonymizationFieldResponse = {
+  ...userNameFieldNotAllowed,
+  allowed: true, // <-- the user.name field IS allowed
+};
+
+const idFieldNotAllowed: AnonymizationFieldResponse = {
+  allowed: false, // <-- This field is NOT allowed
+  anonymized: false,
+  createdAt: '2025-03-13T20:45:41.877Z',
+  field: '_id',
+  id: 'TShBkZUBT8Bn3CFdeOR3',
+  namespace: 'default',
+  timestamp: '2025-03-13T20:45:41.877Z',
+  updatedAt: '2025-03-13T20:33:58.283Z',
+};
+
+describe('throwIfInvalidAnonymization', () => {
+  it('throws when the anonymizationFields are empty', () => {
+    const emptyAnonymizationFields: AnonymizationFieldResponse[] = [];
+
+    expect(() => {
+      throwIfInvalidAnonymization(emptyAnonymizationFields);
+    }).toThrowError(i18n.NO_FIELDS_ALLOWED);
+  });
+
+  it('throws when all fields are NOT allowed', () => {
+    const anonymizationFields: AnonymizationFieldResponse[] = [
+      userNameFieldNotAllowed,
+      idFieldNotAllowed,
+    ];
+
+    expect(() => {
+      throwIfInvalidAnonymization(anonymizationFields);
+    }).toThrowError(i18n.NO_FIELDS_ALLOWED);
+  });
+
+  it('throws when the _id field is NOT included', () => {
+    const idFieldNotIncluded: AnonymizationFieldResponse[] = [
+      userNameFieldAllowed, // <-- at least one field is allowed
+    ];
+
+    expect(() => {
+      throwIfInvalidAnonymization(idFieldNotIncluded);
+    }).toThrowError(i18n.ID_FIELD_REQUIRED);
+  });
+
+  it('throws when the _id field is NOT allowed', () => {
+    const anonymizationFields: AnonymizationFieldResponse[] = [
+      userNameFieldAllowed, // <-- at least one field is allowed
+      idFieldNotAllowed,
+    ];
+
+    expect(() => {
+      throwIfInvalidAnonymization(anonymizationFields);
+    }).toThrowError(i18n.ID_FIELD_REQUIRED);
+  });
+
+  it('does NOT throw when the _id field is allowed', () => {
+    const idFieldAllowed: AnonymizationFieldResponse = {
+      ...idFieldNotAllowed,
+      allowed: true, // <-- the _id field is allowed
+    };
+
+    const anonymizationFields: AnonymizationFieldResponse[] = [
+      idFieldAllowed,
+      userNameFieldNotAllowed,
+    ];
+
+    expect(() => {
+      throwIfInvalidAnonymization(anonymizationFields);
+    }).not.toThrow();
+  });
+});
--- a/x-pack/solutions/security/plugins/elastic_assistant/server/routes/attack_discovery/post/helpers/throw_if_invalid_anonymization/index.ts
+++ b/x-pack/solutions/security/plugins/elastic_assistant/server/routes/attack_discovery/post/helpers/throw_if_invalid_anonymization/index.ts
@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { AnonymizationFieldResponse } from '@kbn/elastic-assistant-common/impl/schemas/anonymization_fields/bulk_crud_anonymization_fields_route.gen';
+
+import * as i18n from './translations';
+
+export const throwIfInvalidAnonymization = (
+  anonymizationFields: AnonymizationFieldResponse[]
+): void => {
+  const idField = anonymizationFields.find((field) => field.field === '_id');
+
+  // no fields allowed:
+  if (
+    anonymizationFields.length === 0 ||
+    anonymizationFields.every((field) => field.allowed === false)
+  ) {
+    throw new Error(i18n.NO_FIELDS_ALLOWED);
+  }
+
+  // _id field NOT included, or NOT allowed:
+  if (idField == null || idField.allowed === false) {
+    throw new Error(i18n.ID_FIELD_REQUIRED);
+  }
+};
--- a/x-pack/solutions/security/plugins/elastic_assistant/server/routes/attack_discovery/post/helpers/throw_if_invalid_anonymization/translations.ts
+++ b/x-pack/solutions/security/plugins/elastic_assistant/server/routes/attack_discovery/post/helpers/throw_if_invalid_anonymization/translations.ts
@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const NO_FIELDS_ALLOWED = i18n.translate(
+  'xpack.elasticAssistantPlugin.attackDiscovery.defaultAttackDiscoveryGraph.nodes.retriever.helpers.throwIfInvalidAnonymization.noFieldsAllowedErrorMessage',
+  {
+    defaultMessage:
+      'Your Security AI Anonymization settings are configured to not allow any fields. Fields must be allowed to generate Attack discoveries.',
+  }
+);
+
+export const ID_FIELD_REQUIRED = i18n.translate(
+  'xpack.elasticAssistantPlugin.attackDiscovery.defaultAttackDiscoveryGraph.nodes.retriever.helpers.throwIfInvalidAnonymization.idFieldRequiredErrorMessage',
+  {
+    defaultMessage:
+      'Your Security AI Anonymization settings are configured to not allow the _id field. The _id field must be allowed to generate Attack discoveries.',
+  }
+);