github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 09:48:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

add a custom type for trusted_apps operator

Browse source 
undo changes from list plugin and server/lib/detection_engine

refs 2ac56ee839
refs elastic/security-team/issues/543
This commit is contained in:
Ashokaditya 2021-04-23 16:19:12 +02:00
parent 0a60598cba
commit c3643f0c94
3 changed files with 10 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
x-pack/plugins/lists/common/schemas/common/schemas.ts
View file

@ -276,12 +276,11 @@ export type CursorOrUndefined = t.TypeOf<typeof cursorOrUndefined>;
export const namespace_type = DefaultNamespace;
export const operatorIncluded = t.keyof({ included: null });
export const operator = t.keyof({ excluded: null, included: null, wildcard_caseless: null });
export const operator = t.keyof({ excluded: null, included: null });
export type Operator = t.TypeOf<typeof operator>;
export enum OperatorEnum {
INCLUDED = 'included',
EXCLUDED = 'excluded',
WILDCARD_CASELESS = 'wildcard_caseless',
}
export enum OperatorTypeEnum {

9
x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts
View file

@ -14,6 +14,7 @@ import {
EntryNested,
ExceptionListItemSchema,
NestedEntriesArray,
Operator,
} from '../../../../../lists/common';
import { ENDPOINT_TRUSTED_APPS_LIST_ID } from '../../../../../lists/common/constants';
import {
@ -75,7 +76,13 @@ export const tagsToEffectScope = (tags: string[]): EffectScope => {
}
};
export const entriesToConditionEntriesMap = (entries: EntriesArray): ConditionEntriesMap => {
type TrustedAppsEntriesArray = Omit<EntriesArray, 'operator'> & {
operator: Operator | 'wildcard_caseless';
};
export const entriesToConditionEntriesMap = (
entries: TrustedAppsEntriesArray
): ConditionEntriesMap => {
return entries.reduce((result, entry) => {
if (entry.field.startsWith('process.hash') && entry.type === 'match') {
return {

2
x-pack/plugins/security_solution/server/lib/detection_engine/signals/filters/types.ts
View file

@ -44,6 +44,6 @@ export interface CreateFieldAndSetTuplesOptions<T> {
export interface FieldSet {
field: string;
operator: 'excluded' | 'included' | 'wildcard_caseless';
operator: 'excluded' | 'included';
matchedSet: Set<unknown>;
}