github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

[Security Solution][Endpoint] Search responses without a specific namespace to show pending actions (#123741)

Browse source 
* search responses without a specific namespace to show pending actions

fixes elastic/kibana/issues/123707

* search over all endpoint response indices irrespective of namespace suffix

fixes elastic/kibana/issues/123707

* match namespace suffixes for endpoint action and response indices

fixes elastic/kibana/issues/123707
This commit is contained in:
Ashokaditya 2022-01-25 23:22:33 +01:00 • committed by GitHub
parent 7f7dbbb3cc
commit dfd8bfbd90
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 10 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
x-pack/plugins/security_solution/common/endpoint/constants.ts
View file

@ -11,6 +11,8 @@ export const ENDPOINT_ACTIONS_DS = '.logs-endpoint.actions';
export const ENDPOINT_ACTIONS_INDEX = `${ENDPOINT_ACTIONS_DS}-default`;
export const ENDPOINT_ACTION_RESPONSES_DS = '.logs-endpoint.action.responses';
export const ENDPOINT_ACTION_RESPONSES_INDEX = `${ENDPOINT_ACTION_RESPONSES_DS}-default`;
// search in all namespaces and not only in default
export const ENDPOINT_ACTION_RESPONSES_INDEX_PATTERN = `${ENDPOINT_ACTION_RESPONSES_DS}-*`;
export const eventsIndexPattern = 'logs-endpoint.events.*';
export const alertsIndexPattern = 'logs-endpoint.alerts-*';

4
x-pack/plugins/security_solution/server/endpoint/services/actions.ts
View file

@ -9,7 +9,7 @@ import { ElasticsearchClient, Logger } from 'kibana/server';
import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
import { TransportResult } from '@elastic/elasticsearch';
import { AGENT_ACTIONS_INDEX, AGENT_ACTIONS_RESULTS_INDEX } from '../../../../fleet/common';
import { ENDPOINT_ACTION_RESPONSES_INDEX } from '../../../common/endpoint/constants';
import { ENDPOINT_ACTION_RESPONSES_INDEX_PATTERN } from '../../../common/endpoint/constants';
import { SecuritySolutionRequestHandlerContext } from '../../types';
import {
ActivityLog,
@ -293,7 +293,7 @@ const hasEndpointResponseDoc = async ({
const response = await esClient
.search<LogsEndpointActionResponse>(
{
index: ENDPOINT_ACTION_RESPONSES_INDEX,
index: ENDPOINT_ACTION_RESPONSES_INDEX_PATTERN,
size: 10000,
body: {
query: {

10
x-pack/plugins/security_solution/server/endpoint/utils/audit_log_helpers.ts
View file

@ -12,7 +12,7 @@ import { TransportResult } from '@elastic/elasticsearch';
import { AGENT_ACTIONS_INDEX, AGENT_ACTIONS_RESULTS_INDEX } from '../../../../fleet/common';
import {
ENDPOINT_ACTIONS_INDEX,
ENDPOINT_ACTION_RESPONSES_INDEX,
ENDPOINT_ACTION_RESPONSES_INDEX_PATTERN,
failedFleetActionErrorCode,
} from '../../../common/endpoint/constants';
import { SecuritySolutionRequestHandlerContext } from '../../types';
@ -32,10 +32,12 @@ import {
import { doesLogsEndpointActionsIndexExist } from '../utils';
const actionsIndices = [AGENT_ACTIONS_INDEX, ENDPOINT_ACTIONS_INDEX];
const responseIndices = [AGENT_ACTIONS_RESULTS_INDEX, ENDPOINT_ACTION_RESPONSES_INDEX];
// search all responses indices irrelevant of namespace
const responseIndices = [AGENT_ACTIONS_RESULTS_INDEX, ENDPOINT_ACTION_RESPONSES_INDEX_PATTERN];
export const logsEndpointActionsRegex = new RegExp(`(^\.ds-\.logs-endpoint\.actions-default-).+`);
// matches index names like .ds-.logs-endpoint.action.responses-name_space---suffix-2022.01.25-000001
export const logsEndpointResponsesRegex = new RegExp(
`(^\.ds-\.logs-endpoint\.action\.responses-default-).+`
`(^\.ds-\.logs-endpoint\.action\.responses-\\w+-).+`
);
const queryOptions = {
headers: {
@ -231,7 +233,7 @@ export const getActionResponsesResult = async ({
const hasLogsEndpointActionResponsesIndex = await doesLogsEndpointActionsIndexExist({
context,
logger,
indexName: ENDPOINT_ACTION_RESPONSES_INDEX,
indexName: ENDPOINT_ACTION_RESPONSES_INDEX_PATTERN,
});
const responsesSearchQuery: SearchRequest = {