[Security Solution] Auto-bundle Entity Analytics API OpenAPI specs (#188985)

**Addresses**: https://github.com/elastic/kibana/issues/184428

## Summary

This PR adds scripts for automatic bundling of Entity Analytics API OpenAPI specs as a part of PR pipeline. Corresponding result bundles are automatically committed to the Security Solution plugin `x-pack/plugins/osquery` in the `docs/openapi/ess` and `docs/openapi/serverless` folders (similar to https://github.com/elastic/kibana/pull/186384).
This commit is contained in:
Maxim Palenov 2024-07-24 17:24:11 +02:00 committed by GitHub
parent f5fa3f0330
commit dac41c678c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
52 changed files with 964 additions and 294 deletions

View file

@ -9,6 +9,11 @@ echo --- Security Solution OpenAPI Bundling
(cd x-pack/plugins/security_solution && yarn openapi:bundle)
check_for_changed_files "yarn openapi:bundle" true
echo -e "\n[Security Solution OpenAPI Bundling] Entity Analytics API\n"
(cd x-pack/plugins/security_solution && yarn openapi:bundle:entity-analytics)
check_for_changed_files "yarn openapi:bundle:entity-analytics" true
(cd packages/kbn-securitysolution-lists-common && yarn openapi:bundle)
check_for_changed_files "yarn openapi:bundle" true

View file

@ -11,7 +11,7 @@
*
* info:
* title: Asset Criticality Bulk Upsert Schema
* version: 1
* version: 2023-10-31
*/
import { z } from 'zod';

View file

@ -1,14 +1,7 @@
openapi: 3.0.0
info:
version: '1'
version: '2023-10-31'
title: Asset Criticality Bulk Upsert Schema
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/api/asset_criticality/bulk:
post:

View file

@ -11,7 +11,7 @@
*
* info:
* title: Asset Criticality Create Record Schema
* version: 1
* version: 2023-10-31
*/
import { z } from 'zod';
@ -37,23 +37,3 @@ export type CreateAssetCriticalityRecordResponse = z.infer<
typeof CreateAssetCriticalityRecordResponse
>;
export const CreateAssetCriticalityRecordResponse = AssetCriticalityRecord;
export type InternalCreateAssetCriticalityRecordRequestBody = z.infer<
typeof InternalCreateAssetCriticalityRecordRequestBody
>;
export const InternalCreateAssetCriticalityRecordRequestBody = CreateAssetCriticalityRecord.merge(
z.object({
/**
* If 'wait_for' the request will wait for the index refresh.
*/
refresh: z.literal('wait_for').optional(),
})
);
export type InternalCreateAssetCriticalityRecordRequestBodyInput = z.input<
typeof InternalCreateAssetCriticalityRecordRequestBody
>;
export type InternalCreateAssetCriticalityRecordResponse = z.infer<
typeof InternalCreateAssetCriticalityRecordResponse
>;
export const InternalCreateAssetCriticalityRecordResponse = AssetCriticalityRecord;

View file

@ -1,45 +1,8 @@
openapi: 3.0.0
info:
version: '1'
version: '2023-10-31'
title: Asset Criticality Create Record Schema
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/internal/asset_criticality:
post:
x-labels: [ess, serverless]
x-internal: true
x-codegen-enabled: true
operationId: InternalCreateAssetCriticalityRecord
summary: Deprecated Internal Create Criticality Record
deprecated: true
requestBody:
required: true
content:
application/json:
schema:
allOf:
- $ref: './common.schema.yaml#/components/schemas/CreateAssetCriticalityRecord'
- type: object
properties:
refresh:
type: string
enum: [wait_for]
description: If 'wait_for' the request will wait for the index refresh.
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: './common.schema.yaml#/components/schemas/AssetCriticalityRecord'
'400':
description: Invalid request
/api/asset_criticality:
post:
x-labels: [ess, serverless]

View file

@ -11,7 +11,7 @@
*
* info:
* title: Asset Criticality Delete Record Schema
* version: 1
* version: 2023-10-31
*/
import { z } from 'zod';
@ -38,24 +38,3 @@ export const DeleteAssetCriticalityRecordRequestQuery = z.object({
export type DeleteAssetCriticalityRecordRequestQueryInput = z.input<
typeof DeleteAssetCriticalityRecordRequestQuery
>;
export type InternalDeleteAssetCriticalityRecordRequestQuery = z.infer<
typeof InternalDeleteAssetCriticalityRecordRequestQuery
>;
export const InternalDeleteAssetCriticalityRecordRequestQuery = z.object({
/**
* The ID value of the asset.
*/
id_value: z.string(),
/**
* The field representing the ID.
*/
id_field: IdField,
/**
* If 'wait_for' the request will wait for the index refresh.
*/
refresh: z.literal('wait_for').optional(),
});
export type InternalDeleteAssetCriticalityRecordRequestQueryInput = z.input<
typeof InternalDeleteAssetCriticalityRecordRequestQuery
>;

View file

@ -1,49 +1,8 @@
openapi: 3.0.0
info:
version: '1'
version: '2023-10-31'
title: Asset Criticality Delete Record Schema
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/internal/asset_criticality:
delete:
x-labels: [ess, serverless]
x-internal: true
x-codegen-enabled: true
operationId: InternalDeleteAssetCriticalityRecord
summary: Deprecated Internal Delete Criticality Record
deprecated: true
parameters:
- name: id_value
in: query
required: true
schema:
type: string
description: The ID value of the asset.
- name: id_field
in: query
required: true
schema:
$ref: './common.schema.yaml#/components/schemas/IdField'
example: 'host.name'
description: The field representing the ID.
- name: refresh
in: query
required: false
schema:
type: string
enum: [wait_for]
description: If 'wait_for' the request will wait for the index refresh.
responses:
'200':
description: Successful response
'400':
description: Invalid request
/api/asset_criticality:
delete:
x-labels: [ess, serverless]

View file

@ -11,7 +11,7 @@
*
* info:
* title: Asset Criticality Get Record Schema
* version: 1
* version: 2023-10-31
*/
import { z } from 'zod';

View file

@ -1,47 +1,8 @@
openapi: 3.0.0
info:
version: '1'
version: '2023-10-31'
title: Asset Criticality Get Record Schema
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/internal/asset_criticality:
get:
x-labels: [ess, serverless]
x-internal: true
operationId: InternalGetAssetCriticalityRecord
summary: Deprecated Internal Get Criticality Record
deprecated: true
parameters:
- name: id_value
in: query
required: true
schema:
type: string
description: The ID value of the asset.
- name: id_field
in: query
required: true
schema:
$ref: './common.schema.yaml#/components/schemas/IdField'
example: 'host.name'
description: The field representing the ID.
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: './common.schema.yaml#/components/schemas/AssetCriticalityRecord'
'400':
description: Invalid request
'404':
description: Criticality record not found
/api/asset_criticality:
get:
x-labels: [ess, serverless]

View file

@ -2,13 +2,6 @@ openapi: 3.0.0
info:
title: Get Asset Criticality Privileges Schema
version: '1'
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/internal/asset_criticality/privileges:
get:

View file

@ -2,13 +2,6 @@ openapi: 3.0.0
info:
version: '1'
title: Asset Criticality Status Schema
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/internal/asset_criticality/status:
get:

View file

@ -11,3 +11,9 @@ export * from './get_asset_criticality_privileges.gen';
export * from './bulk_upload_asset_criticality.gen';
export * from './upload_asset_criticality_csv.gen';
export * from './list_asset_criticality.gen';
export * from './create_asset_criticality.gen';
export * from './get_asset_criticality.gen';
export * from './delete_asset_criticality.gen';
export * from './internal_create_asset_criticality.gen';
export * from './internal_get_asset_criticality.gen';
export * from './internal_delete_asset_criticality.gen';

View file

@ -0,0 +1,39 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
/*
* NOTICE: Do not edit this file manually.
* This file is automatically generated by the OpenAPI Generator, @kbn/openapi-generator.
*
* info:
* title: Internal Asset Criticality Create Record Schema
* version: 1
*/
import { z } from 'zod';
import { CreateAssetCriticalityRecord, AssetCriticalityRecord } from './common.gen';
export type InternalCreateAssetCriticalityRecordRequestBody = z.infer<
typeof InternalCreateAssetCriticalityRecordRequestBody
>;
export const InternalCreateAssetCriticalityRecordRequestBody = CreateAssetCriticalityRecord.merge(
z.object({
/**
* If 'wait_for' the request will wait for the index refresh.
*/
refresh: z.literal('wait_for').optional(),
})
);
export type InternalCreateAssetCriticalityRecordRequestBodyInput = z.input<
typeof InternalCreateAssetCriticalityRecordRequestBody
>;
export type InternalCreateAssetCriticalityRecordResponse = z.infer<
typeof InternalCreateAssetCriticalityRecordResponse
>;
export const InternalCreateAssetCriticalityRecordResponse = AssetCriticalityRecord;

View file

@ -0,0 +1,35 @@
openapi: 3.0.0
info:
version: '1'
title: Internal Asset Criticality Create Record Schema
paths:
/internal/asset_criticality:
post:
x-labels: [ess, serverless]
x-internal: true
x-codegen-enabled: true
operationId: InternalCreateAssetCriticalityRecord
summary: Deprecated Internal Create Criticality Record
deprecated: true
requestBody:
required: true
content:
application/json:
schema:
allOf:
- $ref: './common.schema.yaml#/components/schemas/CreateAssetCriticalityRecord'
- type: object
properties:
refresh:
type: string
enum: [wait_for]
description: If 'wait_for' the request will wait for the index refresh.
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: './common.schema.yaml#/components/schemas/AssetCriticalityRecord'
'400':
description: Invalid request

View file

@ -0,0 +1,40 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
/*
* NOTICE: Do not edit this file manually.
* This file is automatically generated by the OpenAPI Generator, @kbn/openapi-generator.
*
* info:
* title: Internal Asset Criticality Delete Record Schema
* version: 1
*/
import { z } from 'zod';
import { IdField } from './common.gen';
export type InternalDeleteAssetCriticalityRecordRequestQuery = z.infer<
typeof InternalDeleteAssetCriticalityRecordRequestQuery
>;
export const InternalDeleteAssetCriticalityRecordRequestQuery = z.object({
/**
* The ID value of the asset.
*/
id_value: z.string(),
/**
* The field representing the ID.
*/
id_field: IdField,
/**
* If 'wait_for' the request will wait for the index refresh.
*/
refresh: z.literal('wait_for').optional(),
});
export type InternalDeleteAssetCriticalityRecordRequestQueryInput = z.input<
typeof InternalDeleteAssetCriticalityRecordRequestQuery
>;

View file

@ -0,0 +1,39 @@
openapi: 3.0.0
info:
version: '1'
title: Internal Asset Criticality Delete Record Schema
paths:
/internal/asset_criticality:
delete:
x-labels: [ess, serverless]
x-internal: true
x-codegen-enabled: true
operationId: InternalDeleteAssetCriticalityRecord
summary: Deprecated Internal Delete Criticality Record
deprecated: true
parameters:
- name: id_value
in: query
required: true
schema:
type: string
description: The ID value of the asset.
- name: id_field
in: query
required: true
schema:
$ref: './common.schema.yaml#/components/schemas/IdField'
example: 'host.name'
description: The field representing the ID.
- name: refresh
in: query
required: false
schema:
type: string
enum: [wait_for]
description: If 'wait_for' the request will wait for the index refresh.
responses:
'200':
description: Successful response
'400':
description: Invalid request

View file

@ -0,0 +1,41 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
/*
* NOTICE: Do not edit this file manually.
* This file is automatically generated by the OpenAPI Generator, @kbn/openapi-generator.
*
* info:
* title: Internal Asset Criticality Get Record Schema
* version: 1
*/
import { z } from 'zod';
import { IdField, AssetCriticalityRecord } from './common.gen';
export type InternalGetAssetCriticalityRecordRequestQuery = z.infer<
typeof InternalGetAssetCriticalityRecordRequestQuery
>;
export const InternalGetAssetCriticalityRecordRequestQuery = z.object({
/**
* The ID value of the asset.
*/
id_value: z.string(),
/**
* The field representing the ID.
*/
id_field: IdField,
});
export type InternalGetAssetCriticalityRecordRequestQueryInput = z.input<
typeof InternalGetAssetCriticalityRecordRequestQuery
>;
export type InternalGetAssetCriticalityRecordResponse = z.infer<
typeof InternalGetAssetCriticalityRecordResponse
>;
export const InternalGetAssetCriticalityRecordResponse = AssetCriticalityRecord;

View file

@ -0,0 +1,38 @@
openapi: 3.0.0
info:
version: '1'
title: Internal Asset Criticality Get Record Schema
paths:
/internal/asset_criticality:
get:
x-labels: [ess, serverless]
x-internal: true
x-codegen-enabled: true
operationId: InternalGetAssetCriticalityRecord
summary: Deprecated Internal Get Criticality Record
deprecated: true
parameters:
- name: id_value
in: query
required: true
schema:
type: string
description: The ID value of the asset.
- name: id_field
in: query
required: true
schema:
$ref: './common.schema.yaml#/components/schemas/IdField'
example: 'host.name'
description: The field representing the ID.
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: './common.schema.yaml#/components/schemas/AssetCriticalityRecord'
'400':
description: Invalid request
'404':
description: Criticality record not found

View file

@ -11,7 +11,7 @@
*
* info:
* title: Asset Criticality List Schema
* version: 1
* version: 2023-10-31
*/
import { z } from 'zod';

View file

@ -1,14 +1,7 @@
openapi: 3.0.0
info:
version: '1'
version: '2023-10-31'
title: Asset Criticality List Schema
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/api/asset_criticality/list:
post:

View file

@ -2,13 +2,6 @@ openapi: 3.0.0
info:
version: '1'
title: Asset Criticality CSV Upload Schema
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/internal/asset_criticality/upload_csv:
post:

View file

@ -6,4 +6,5 @@
*/
export * from './asset_criticality';
export * from './risk_engine';
export * from './risk_score';

View file

@ -1,18 +1,8 @@
openapi: 3.0.0
info:
version: '1'
title: Risk Scoring API
description: These APIs allow the consumer to manage Entity Risk Scores within Entity Analytics.
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/internal/risk_score/engine/disable:
post:

View file

@ -1,18 +1,8 @@
openapi: 3.0.0
info:
version: '1'
title: Risk Scoring API
description: These APIs allow the consumer to manage Entity Risk Scores within Entity Analytics.
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/internal/risk_score/engine/enable:
post:

View file

@ -3,14 +3,6 @@ info:
version: '1'
title: Risk Scoring API
description: These APIs allow the consumer to manage Entity Risk Scores within Entity Analytics.
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/internal/risk_score/engine/init:
post:

View file

@ -3,14 +3,6 @@ info:
version: '1'
title: Risk Scoring API
description: These APIs allow the consumer to manage Entity Risk Scores within Entity Analytics.
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/internal/risk_score/engine/settings:
get:

View file

@ -3,14 +3,6 @@ info:
version: '1'
title: Risk Scoring API
description: These APIs allow the consumer to manage Entity Risk Scores within Entity Analytics.
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/internal/risk_score/engine/status:
get:

View file

@ -1,18 +1,8 @@
openapi: 3.0.0
info:
version: '1'
title: Risk Scoring API
description: These APIs allow the consumer to manage Entity Risk Scores within Entity Analytics.
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
# TODO delete on a future serverless release
/api/risk_scores/calculation/entity:

View file

@ -6,3 +6,11 @@
*/
export * from './engine_settings_route.gen';
export * from './engine_status_route.gen';
export * from './engine_init_route.gen';
export * from './engine_disable_route.gen';
export * from './engine_enable_route.gen';
export * from './engine_status_route.gen';
export * from './calculation_route.gen';
export * from './preview_route.gen';
export * from './entity_calculation_route.gen';

View file

@ -3,14 +3,6 @@ info:
version: '1'
title: Risk Scoring API
description: These APIs allow the consumer to manage Entity Risk Scores within Entity Analytics.
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/internal/risk_score/preview:
post:

View file

@ -0,0 +1,307 @@
openapi: 3.0.3
info:
description: ''
title: Security Solution Entity Analytics API (Elastic Cloud and self-hosted)
version: '2023-10-31'
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/api/asset_criticality:
delete:
operationId: DeleteAssetCriticalityRecord
parameters:
- description: The ID value of the asset.
in: query
name: id_value
required: true
schema:
type: string
- description: The field representing the ID.
example: host.name
in: query
name: id_field
required: true
schema:
$ref: '#/components/schemas/IdField'
- description: If 'wait_for' the request will wait for the index refresh.
in: query
name: refresh
required: false
schema:
enum:
- wait_for
type: string
responses:
'200':
description: Successful response
'400':
description: Invalid request
summary: Delete Criticality Record
get:
operationId: GetAssetCriticalityRecord
parameters:
- description: The ID value of the asset.
in: query
name: id_value
required: true
schema:
type: string
- description: The field representing the ID.
example: host.name
in: query
name: id_field
required: true
schema:
$ref: '#/components/schemas/IdField'
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/AssetCriticalityRecord'
description: Successful response
'400':
description: Invalid request
'404':
description: Criticality record not found
summary: Get Criticality Record
post:
operationId: CreateAssetCriticalityRecord
requestBody:
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/CreateAssetCriticalityRecord'
- type: object
properties:
refresh:
description: >-
If 'wait_for' the request will wait for the index
refresh.
enum:
- wait_for
type: string
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/AssetCriticalityRecord'
description: Successful response
'400':
description: Invalid request
summary: Create Criticality Record
/api/asset_criticality/bulk:
post:
operationId: BulkUpsertAssetCriticalityRecords
requestBody:
content:
application/json:
schema:
example:
records:
- criticality_level: low_impact
id_field: host.name
id_value: host-1
- criticality_level: medium_impact
id_field: host.name
id_value: host-2
type: object
properties:
records:
items:
$ref: '#/components/schemas/CreateAssetCriticalityRecord'
maxItems: 1000
minItems: 1
type: array
required:
- records
responses:
'200':
content:
application/json:
schema:
example:
errors:
- index: 0
message: Invalid ID field
stats:
failed: 1
successful: 1
total: 2
type: object
properties:
errors:
items:
$ref: '#/components/schemas/AssetCriticalityBulkUploadErrorItem'
type: array
stats:
$ref: '#/components/schemas/AssetCriticalityBulkUploadStats'
required:
- errors
- stats
description: Bulk upload successful
'413':
description: File too large
summary: >-
Bulk upsert asset criticality data, creating or updating records as
needed
/api/asset_criticality/list:
post:
operationId: FindAssetCriticalityRecords
parameters:
- description: The field to sort by.
in: query
name: sort_field
required: false
schema:
enum:
- id_value
- id_field
- criticality_level
- \@timestamp
type: string
- description: The order to sort by.
in: query
name: sort_direction
required: false
schema:
enum:
- asc
- desc
type: string
- description: The page number to return.
in: query
name: page
required: false
schema:
minimum: 1
type: integer
- description: The number of records to return per page.
in: query
name: per_page
required: false
schema:
maximum: 1000
minimum: 1
type: integer
- description: The kuery to filter by.
in: query
name: kuery
required: false
schema:
type: string
responses:
'200':
content:
application/json:
schema:
type: object
properties:
page:
minimum: 1
type: integer
per_page:
maximum: 1000
minimum: 1
type: integer
records:
items:
$ref: '#/components/schemas/AssetCriticalityRecord'
type: array
total:
minimum: 0
type: integer
required:
- records
- page
- per_page
- total
description: Bulk upload successful
summary: 'List asset criticality data, filtering and sorting as needed'
components:
schemas:
AssetCriticalityBulkUploadErrorItem:
type: object
properties:
index:
type: integer
message:
type: string
required:
- message
- index
AssetCriticalityBulkUploadStats:
type: object
properties:
failed:
type: integer
successful:
type: integer
total:
type: integer
required:
- successful
- failed
- total
AssetCriticalityLevel:
description: The criticality level of the asset.
enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
AssetCriticalityRecord:
allOf:
- $ref: '#/components/schemas/CreateAssetCriticalityRecord'
- type: object
properties:
'@timestamp':
description: The time the record was created or updated.
example: '2017-07-21T17:32:28Z'
format: date-time
type: string
required:
- '@timestamp'
AssetCriticalityRecordIdParts:
type: object
properties:
id_field:
$ref: '#/components/schemas/IdField'
description: The field representing the ID.
example: host.name
id_value:
description: The ID value of the asset.
type: string
required:
- id_value
- id_field
CreateAssetCriticalityRecord:
allOf:
- $ref: '#/components/schemas/AssetCriticalityRecordIdParts'
- type: object
properties:
criticality_level:
$ref: '#/components/schemas/AssetCriticalityLevel'
required:
- criticality_level
IdField:
enum:
- host.name
- user.name
type: string
securitySchemes:
BasicAuth:
scheme: basic
type: http
security:
- BasicAuth: []
tags: !<tag:yaml.org,2002:js/undefined> ''

View file

@ -0,0 +1,307 @@
openapi: 3.0.3
info:
description: ''
title: Security Solution Entity Analytics API (Elastic Cloud Serverless)
version: '2023-10-31'
servers:
- url: 'http://{kibana_host}:{port}'
variables:
kibana_host:
default: localhost
port:
default: '5601'
paths:
/api/asset_criticality:
delete:
operationId: DeleteAssetCriticalityRecord
parameters:
- description: The ID value of the asset.
in: query
name: id_value
required: true
schema:
type: string
- description: The field representing the ID.
example: host.name
in: query
name: id_field
required: true
schema:
$ref: '#/components/schemas/IdField'
- description: If 'wait_for' the request will wait for the index refresh.
in: query
name: refresh
required: false
schema:
enum:
- wait_for
type: string
responses:
'200':
description: Successful response
'400':
description: Invalid request
summary: Delete Criticality Record
get:
operationId: GetAssetCriticalityRecord
parameters:
- description: The ID value of the asset.
in: query
name: id_value
required: true
schema:
type: string
- description: The field representing the ID.
example: host.name
in: query
name: id_field
required: true
schema:
$ref: '#/components/schemas/IdField'
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/AssetCriticalityRecord'
description: Successful response
'400':
description: Invalid request
'404':
description: Criticality record not found
summary: Get Criticality Record
post:
operationId: CreateAssetCriticalityRecord
requestBody:
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/CreateAssetCriticalityRecord'
- type: object
properties:
refresh:
description: >-
If 'wait_for' the request will wait for the index
refresh.
enum:
- wait_for
type: string
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/AssetCriticalityRecord'
description: Successful response
'400':
description: Invalid request
summary: Create Criticality Record
/api/asset_criticality/bulk:
post:
operationId: BulkUpsertAssetCriticalityRecords
requestBody:
content:
application/json:
schema:
example:
records:
- criticality_level: low_impact
id_field: host.name
id_value: host-1
- criticality_level: medium_impact
id_field: host.name
id_value: host-2
type: object
properties:
records:
items:
$ref: '#/components/schemas/CreateAssetCriticalityRecord'
maxItems: 1000
minItems: 1
type: array
required:
- records
responses:
'200':
content:
application/json:
schema:
example:
errors:
- index: 0
message: Invalid ID field
stats:
failed: 1
successful: 1
total: 2
type: object
properties:
errors:
items:
$ref: '#/components/schemas/AssetCriticalityBulkUploadErrorItem'
type: array
stats:
$ref: '#/components/schemas/AssetCriticalityBulkUploadStats'
required:
- errors
- stats
description: Bulk upload successful
'413':
description: File too large
summary: >-
Bulk upsert asset criticality data, creating or updating records as
needed
/api/asset_criticality/list:
post:
operationId: FindAssetCriticalityRecords
parameters:
- description: The field to sort by.
in: query
name: sort_field
required: false
schema:
enum:
- id_value
- id_field
- criticality_level
- \@timestamp
type: string
- description: The order to sort by.
in: query
name: sort_direction
required: false
schema:
enum:
- asc
- desc
type: string
- description: The page number to return.
in: query
name: page
required: false
schema:
minimum: 1
type: integer
- description: The number of records to return per page.
in: query
name: per_page
required: false
schema:
maximum: 1000
minimum: 1
type: integer
- description: The kuery to filter by.
in: query
name: kuery
required: false
schema:
type: string
responses:
'200':
content:
application/json:
schema:
type: object
properties:
page:
minimum: 1
type: integer
per_page:
maximum: 1000
minimum: 1
type: integer
records:
items:
$ref: '#/components/schemas/AssetCriticalityRecord'
type: array
total:
minimum: 0
type: integer
required:
- records
- page
- per_page
- total
description: Bulk upload successful
summary: 'List asset criticality data, filtering and sorting as needed'
components:
schemas:
AssetCriticalityBulkUploadErrorItem:
type: object
properties:
index:
type: integer
message:
type: string
required:
- message
- index
AssetCriticalityBulkUploadStats:
type: object
properties:
failed:
type: integer
successful:
type: integer
total:
type: integer
required:
- successful
- failed
- total
AssetCriticalityLevel:
description: The criticality level of the asset.
enum:
- low_impact
- medium_impact
- high_impact
- extreme_impact
type: string
AssetCriticalityRecord:
allOf:
- $ref: '#/components/schemas/CreateAssetCriticalityRecord'
- type: object
properties:
'@timestamp':
description: The time the record was created or updated.
example: '2017-07-21T17:32:28Z'
format: date-time
type: string
required:
- '@timestamp'
AssetCriticalityRecordIdParts:
type: object
properties:
id_field:
$ref: '#/components/schemas/IdField'
description: The field representing the ID.
example: host.name
id_value:
description: The ID value of the asset.
type: string
required:
- id_value
- id_field
CreateAssetCriticalityRecord:
allOf:
- $ref: '#/components/schemas/AssetCriticalityRecordIdParts'
- type: object
properties:
criticality_level:
$ref: '#/components/schemas/AssetCriticalityLevel'
required:
- criticality_level
IdField:
enum:
- host.name
- user.name
type: string
securitySchemes:
BasicAuth:
scheme: basic
type: http
security:
- BasicAuth: []
tags: !<tag:yaml.org,2002:js/undefined> ''

View file

@ -30,6 +30,7 @@
"junit:transform": "node scripts/junit_transformer --pathPattern '../../../target/kibana-security-solution/cypress/results/*.xml' --rootDirectory ../../../ --reportName 'Security Solution Cypress' --writeInPlace",
"openapi:generate": "node scripts/openapi/generate",
"openapi:generate:debug": "node --inspect-brk scripts/openapi/generate",
"openapi:bundle": "node scripts/openapi/bundle"
"openapi:bundle": "node scripts/openapi/bundle",
"openapi:bundle:entity-analytics": "node scripts/openapi/bundle_entity_analytics"
}
}
}

View file

@ -0,0 +1,42 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
require('../../../../../src/setup_node_env');
const { bundle } = require('@kbn/openapi-bundler');
const { join, resolve } = require('path');
const ROOT = resolve(__dirname, '../..');
bundle({
sourceGlob: join(ROOT, 'common/api/entity_analytics/**/*.schema.yaml'),
outputFilePath: join(
ROOT,
'docs/openapi/serverless/security_solution_entity_analytics_api_{version}.bundled.schema.yaml'
),
options: {
includeLabels: ['serverless'],
specInfo: {
title: 'Security Solution Entity Analytics API (Elastic Cloud Serverless)',
description: '',
},
},
});
bundle({
sourceGlob: join(ROOT, 'common/api/entity_analytics/**/*.schema.yaml'),
outputFilePath: join(
ROOT,
'docs/openapi/ess/security_solution_entity_analytics_api_{version}.bundled.schema.yaml'
),
options: {
includeLabels: ['ess'],
specInfo: {
title: 'Security Solution Entity Analytics API (Elastic Cloud and self-hosted)',
description: '',
},
},
});

View file

@ -11,7 +11,7 @@ import { buildRouteValidationWithZod } from '@kbn/zod-helpers';
import {
DeleteAssetCriticalityRecordRequestQuery,
InternalDeleteAssetCriticalityRecordRequestQuery,
} from '../../../../../common/api/entity_analytics/asset_criticality/delete_asset_criticality.gen';
} from '../../../../../common/api/entity_analytics';
import type { SecuritySolutionRequestHandlerContext } from '../../../../types';
import {
ASSET_CRITICALITY_PUBLIC_URL,

View file

@ -8,7 +8,7 @@ import type { IKibanaResponse, KibanaResponseFactory, Logger } from '@kbn/core/s
import { buildSiemResponse } from '@kbn/lists-plugin/server/routes/utils';
import { transformError } from '@kbn/securitysolution-es-utils';
import { buildRouteValidationWithZod } from '@kbn/zod-helpers';
import { GetAssetCriticalityRecordRequestQuery } from '../../../../../common/api/entity_analytics/asset_criticality/get_asset_criticality.gen';
import { GetAssetCriticalityRecordRequestQuery } from '../../../../../common/api/entity_analytics';
import type { SecuritySolutionRequestHandlerContext } from '../../../../types';
import {
ASSET_CRITICALITY_INTERNAL_URL,

View file

@ -10,7 +10,7 @@ import { schema } from '@kbn/config-schema';
import Papa from 'papaparse';
import { transformError } from '@kbn/securitysolution-es-utils';
import type internal from 'stream';
import type { UploadAssetCriticalityRecordsResponse } from '../../../../../common/api/entity_analytics/asset_criticality/upload_asset_criticality_csv.gen';
import type { UploadAssetCriticalityRecordsResponse } from '../../../../../common/api/entity_analytics';
import { CRITICALITY_CSV_MAX_SIZE_BYTES_WITH_TOLERANCE } from '../../../../../common/entity_analytics/asset_criticality';
import type { ConfigType } from '../../../../config';
import type { HapiReadableStream, SecuritySolutionRequestHandlerContext } from '../../../../types';

View file

@ -11,7 +11,7 @@ import { buildRouteValidationWithZod } from '@kbn/zod-helpers';
import {
CreateAssetCriticalityRecordRequestBody,
InternalCreateAssetCriticalityRecordRequestBody,
} from '../../../../../common/api/entity_analytics/asset_criticality/create_asset_criticality.gen';
} from '../../../../../common/api/entity_analytics';
import type { SecuritySolutionRequestHandlerContext } from '../../../../types';
import {
ASSET_CRITICALITY_PUBLIC_URL,

View file

@ -8,7 +8,7 @@
import type { Logger, ElasticsearchClient, SavedObjectsClientContract } from '@kbn/core/server';
import type { TaskManagerStartContract } from '@kbn/task-manager-plugin/server';
import type { AuditLogger } from '@kbn/security-plugin-types-server';
import { RiskEngineStatusEnum } from '../../../../common/api/entity_analytics/risk_engine/engine_status_route.gen';
import { RiskEngineStatusEnum } from '../../../../common/api/entity_analytics';
import type { InitRiskEngineResult } from '../../../../common/entity_analytics/risk_engine';
import { MAX_SPACES_COUNT, RiskScoreEntity } from '../../../../common/entity_analytics/risk_engine';
import { removeLegacyTransforms, getLegacyTransforms } from '../utils/transforms';

View file

@ -7,7 +7,7 @@
import { buildSiemResponse } from '@kbn/lists-plugin/server/routes/utils';
import { transformError } from '@kbn/securitysolution-es-utils';
import type { DisableRiskEngineResponse } from '../../../../../common/api/entity_analytics/risk_engine/engine_disable_route.gen';
import type { DisableRiskEngineResponse } from '../../../../../common/api/entity_analytics';
import { RISK_ENGINE_DISABLE_URL, APP_ID } from '../../../../../common/constants';
import { TASK_MANAGER_UNAVAILABLE_ERROR } from './translations';
import { withRiskEnginePrivilegeCheck } from '../risk_engine_privileges';

View file

@ -7,7 +7,7 @@
import { buildSiemResponse } from '@kbn/lists-plugin/server/routes/utils';
import { transformError } from '@kbn/securitysolution-es-utils';
import type { EnableRiskEngineResponse } from '../../../../../common/api/entity_analytics/risk_engine/engine_enable_route.gen';
import type { EnableRiskEngineResponse } from '../../../../../common/api/entity_analytics';
import { RISK_ENGINE_ENABLE_URL, APP_ID } from '../../../../../common/constants';
import { TASK_MANAGER_UNAVAILABLE_ERROR } from './translations';
import { withRiskEnginePrivilegeCheck } from '../risk_engine_privileges';

View file

@ -10,7 +10,7 @@ import { transformError } from '@kbn/securitysolution-es-utils';
import type {
InitRiskEngineResponse,
InitRiskEngineResult,
} from '../../../../../common/api/entity_analytics/risk_engine/engine_init_route.gen';
} from '../../../../../common/api/entity_analytics';
import { RISK_ENGINE_INIT_URL, APP_ID } from '../../../../../common/constants';
import { TASK_MANAGER_UNAVAILABLE_ERROR } from './translations';
import type { EntityAnalyticsRoutesDeps } from '../../types';

View file

@ -7,7 +7,7 @@
import { buildSiemResponse } from '@kbn/lists-plugin/server/routes/utils';
import { transformError } from '@kbn/securitysolution-es-utils';
import type { RiskEngineStatusResponse } from '../../../../../common/api/entity_analytics/risk_engine/engine_status_route.gen';
import type { RiskEngineStatusResponse } from '../../../../../common/api/entity_analytics';
import { RISK_ENGINE_STATUS_URL, APP_ID } from '../../../../../common/constants';
import type { EntityAnalyticsRoutesDeps } from '../../types';

View file

@ -5,7 +5,7 @@
* 2.0.
*/
import type { RiskScoresCalculationResponse } from '../../../../common/api/entity_analytics/risk_engine/calculation_route.gen';
import type { RiskScoresCalculationResponse } from '../../../../common/api/entity_analytics';
const buildResponseMock = (
overrides: Partial<RiskScoresCalculationResponse> = {}

View file

@ -7,7 +7,7 @@
import type { ElasticsearchClient, Logger } from '@kbn/core/server';
import type { RiskScoresCalculationResponse } from '../../../../common/api/entity_analytics/risk_engine/calculation_route.gen';
import type { RiskScoresCalculationResponse } from '../../../../common/api/entity_analytics';
import type { RiskScoreDataClient } from './risk_score_data_client';
import type { AssetCriticalityService } from '../asset_criticality/asset_criticality_service';
import { calculateRiskScores } from './calculate_risk_scores';

View file

@ -7,7 +7,7 @@
import { RiskCategories } from '../../../../common/entity_analytics/risk_engine';
import type { CalculateRiskScoreAggregations, RiskScoreBucket } from '../types';
import type { RiskScoresCalculationResponse } from '../../../../common/api/entity_analytics/risk_engine/calculation_route.gen';
import type { RiskScoresCalculationResponse } from '../../../../common/api/entity_analytics';
import type { EntityRiskScoreRecord } from '../../../../common/api/entity_analytics/common';
import { EntityRiskLevelsEnum } from '../../../../common/api/entity_analytics/common';

View file

@ -15,7 +15,10 @@ import {
ALERT_RISK_SCORE,
ALERT_WORKFLOW_STATUS,
} from '@kbn/rule-registry-plugin/common/technical_rule_data_field_names';
import type { RiskScoresPreviewResponse } from '../../../../common/api/entity_analytics/risk_engine/preview_route.gen';
import type {
AssetCriticalityRecord,
RiskScoresPreviewResponse,
} from '../../../../common/api/entity_analytics';
import type {
AfterKeys,
EntityRiskScoreRecord,
@ -28,7 +31,6 @@ import {
RiskWeightTypes,
} from '../../../../common/entity_analytics/risk_engine';
import { withSecuritySpan } from '../../../utils/with_security_span';
import type { AssetCriticalityRecord } from '../../../../common/api/entity_analytics';
import type { AssetCriticalityService } from '../asset_criticality/asset_criticality_service';
import { applyCriticalityToScore, getCriticalityModifier } from '../asset_criticality/helpers';
import { getAfterKeyForIdentifierType, getFieldForIdentifier } from './helpers';

View file

@ -5,7 +5,7 @@
* 2.0.
*/
import type { RiskScoresCalculationResponse } from '../../../../common/api/entity_analytics/risk_engine/calculation_route.gen';
import type { RiskScoresCalculationResponse } from '../../../../common/api/entity_analytics';
import type { AfterKeys, EntityAfterKey } from '../../../../common/api/entity_analytics/common';
import type { IdentifierType } from '../../../../common/entity_analytics/risk_engine';

View file

@ -6,8 +6,10 @@
*/
import type { ElasticsearchClient, Logger } from '@kbn/core/server';
import type { RiskScoresCalculationResponse } from '../../../../common/api/entity_analytics/risk_engine/calculation_route.gen';
import type { RiskScoresPreviewResponse } from '../../../../common/api/entity_analytics/risk_engine/preview_route.gen';
import type {
RiskScoresCalculationResponse,
RiskScoresPreviewResponse,
} from '../../../../common/api/entity_analytics';
import type {
CalculateAndPersistScoresParams,
CalculateScoresParams,

View file

@ -16,9 +16,9 @@ import { buildSiemResponse } from '@kbn/lists-plugin/server/routes/utils';
import { transformError } from '@kbn/securitysolution-es-utils';
import { buildRouteValidationWithZod } from '@kbn/zod-helpers';
import type { SecuritySolutionRequestHandlerContext } from '../../../../types';
import type { RiskScoresCalculationResponse } from '../../../../../common/api/entity_analytics/risk_engine/calculation_route.gen';
import type { RiskScoresCalculationResponse } from '../../../../../common/api/entity_analytics';
import type { AfterKeys } from '../../../../../common/api/entity_analytics/common';
import { RiskScoresEntityCalculationRequest } from '../../../../../common/api/entity_analytics/risk_engine/entity_calculation_route.gen';
import { RiskScoresEntityCalculationRequest } from '../../../../../common/api/entity_analytics';
import { APP_ID, RISK_SCORE_ENTITY_CALCULATION_URL } from '../../../../../common/constants';
import { getRiskInputsIndex } from '../get_risk_inputs_index';
import type { EntityAnalyticsRoutesDeps } from '../../types';

View file

@ -9,7 +9,7 @@ import type { Logger } from '@kbn/core/server';
import { buildSiemResponse } from '@kbn/lists-plugin/server/routes/utils';
import { transformError } from '@kbn/securitysolution-es-utils';
import { buildRouteValidationWithZod } from '@kbn/zod-helpers';
import { RiskScoresPreviewRequest } from '../../../../../common/api/entity_analytics/risk_engine/preview_route.gen';
import { RiskScoresPreviewRequest } from '../../../../../common/api/entity_analytics';
import {
APP_ID,
DEFAULT_RISK_SCORE_PAGE_SIZE,

View file

@ -64,8 +64,9 @@ import {
GetRuleExecutionResultsRequestParamsInput,
} from '@kbn/security-solution-plugin/common/api/detection_engine/rule_monitoring/rule_execution_logs/get_rule_execution_results/get_rule_execution_results_route.gen';
import { ImportRulesRequestQueryInput } from '@kbn/security-solution-plugin/common/api/detection_engine/rule_management/import_rules/import_rules_route.gen';
import { InternalCreateAssetCriticalityRecordRequestBodyInput } from '@kbn/security-solution-plugin/common/api/entity_analytics/asset_criticality/create_asset_criticality.gen';
import { InternalDeleteAssetCriticalityRecordRequestQueryInput } from '@kbn/security-solution-plugin/common/api/entity_analytics/asset_criticality/delete_asset_criticality.gen';
import { InternalCreateAssetCriticalityRecordRequestBodyInput } from '@kbn/security-solution-plugin/common/api/entity_analytics/asset_criticality/internal_create_asset_criticality.gen';
import { InternalDeleteAssetCriticalityRecordRequestQueryInput } from '@kbn/security-solution-plugin/common/api/entity_analytics/asset_criticality/internal_delete_asset_criticality.gen';
import { InternalGetAssetCriticalityRecordRequestQueryInput } from '@kbn/security-solution-plugin/common/api/entity_analytics/asset_criticality/internal_get_asset_criticality.gen';
import { ManageAlertTagsRequestBodyInput } from '@kbn/security-solution-plugin/common/api/detection_engine/alert_tags/set_alert_tags/set_alert_tags.gen';
import { PatchRuleRequestBodyInput } from '@kbn/security-solution-plugin/common/api/detection_engine/rule_management/crud/patch_rule/patch_rule_route.gen';
import {
@ -167,7 +168,7 @@ after 30 days. It also deletes other artifacts specific to the migration impleme
return supertest
.post('/api/asset_criticality/bulk')
.set('kbn-xsrf', 'true')
.set(ELASTIC_HTTP_VERSION_HEADER, '1')
.set(ELASTIC_HTTP_VERSION_HEADER, '2023-10-31')
.set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana')
.send(props.body as object);
},
@ -195,7 +196,7 @@ Migrations are initiated per index. While the process is neither destructive nor
return supertest
.post('/api/asset_criticality')
.set('kbn-xsrf', 'true')
.set(ELASTIC_HTTP_VERSION_HEADER, '1')
.set(ELASTIC_HTTP_VERSION_HEADER, '2023-10-31')
.set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana')
.send(props.body as object);
},
@ -231,7 +232,7 @@ Migrations are initiated per index. While the process is neither destructive nor
return supertest
.delete('/api/asset_criticality')
.set('kbn-xsrf', 'true')
.set(ELASTIC_HTTP_VERSION_HEADER, '1')
.set(ELASTIC_HTTP_VERSION_HEADER, '2023-10-31')
.set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana')
.query(props.query);
},
@ -322,7 +323,7 @@ finalize it.
return supertest
.post('/api/asset_criticality/list')
.set('kbn-xsrf', 'true')
.set(ELASTIC_HTTP_VERSION_HEADER, '1')
.set(ELASTIC_HTTP_VERSION_HEADER, '2023-10-31')
.set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana')
.query(props.query);
},
@ -367,7 +368,7 @@ finalize it.
return supertest
.get('/api/asset_criticality')
.set('kbn-xsrf', 'true')
.set(ELASTIC_HTTP_VERSION_HEADER, '1')
.set(ELASTIC_HTTP_VERSION_HEADER, '2023-10-31')
.set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana')
.query(props.query);
},
@ -507,6 +508,14 @@ detection engine rules.
.set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana')
.query(props.query);
},
internalGetAssetCriticalityRecord(props: InternalGetAssetCriticalityRecordProps) {
return supertest
.get('/internal/asset_criticality')
.set('kbn-xsrf', 'true')
.set(ELASTIC_HTTP_VERSION_HEADER, '1')
.set(X_ELASTIC_INTERNAL_ORIGIN_REQUEST, 'kibana')
.query(props.query);
},
internalUploadAssetCriticalityRecords() {
return supertest
.post('/internal/asset_criticality/upload_csv')
@ -778,6 +787,9 @@ export interface InternalCreateAssetCriticalityRecordProps {
export interface InternalDeleteAssetCriticalityRecordProps {
query: InternalDeleteAssetCriticalityRecordRequestQueryInput;
}
export interface InternalGetAssetCriticalityRecordProps {
query: InternalGetAssetCriticalityRecordRequestQueryInput;
}
export interface ManageAlertTagsProps {
body: ManageAlertTagsRequestBodyInput;
}