github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 17:28:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

Fix attachment of wrong enrichments for Indicator Match rule (#133591)

Browse source 
* Add enrichments to signal by id

* [CI] Auto-commit changed files from 'node scripts/precommit_hook.js --ref HEAD~1..HEAD --fix'

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
Khristinin Nikita 2022-06-06 20:49:47 +02:00 • committed by GitHub
parent f6eafdd746
commit f50efa3db5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/enrich_signal_threat_matches.ts
View file

@ -136,13 +136,14 @@ export const enrichSignalThreatMatches = async (
];
const matchedThreats = await getMatchedThreats(matchedThreatIds);
const enrichmentsWithoutAtomic = signalMatches.map((signalMatch) =>
buildEnrichments({
const enrichmentsWithoutAtomic: { [key: string]: ThreatEnrichment[] } = {};
signalMatches.forEach((signalMatch) => {
enrichmentsWithoutAtomic[signalMatch.signalId] = buildEnrichments({
indicatorPath,
queries: signalMatch.queries,
threats: matchedThreats,
})
);
});
});
const enrichedSignals: SignalSourceHit[] = uniqueHits.map((signalHit, i) => {
const threat = get(signalHit._source, 'threat') ?? {};
@ -155,7 +156,7 @@ export const enrichSignalThreatMatches = async (
// new issues.
const existingEnrichmentValue = get(signalHit._source, 'threat.enrichments') ?? [];
const existingEnrichments = [existingEnrichmentValue].flat(); // ensure enrichments is an array
const newEnrichmentsWithoutAtomic = enrichmentsWithoutAtomic[i];
const newEnrichmentsWithoutAtomic = enrichmentsWithoutAtomic[signalHit._id] ?? [];
const newEnrichments = newEnrichmentsWithoutAtomic.map((enrichment) => ({
...enrichment,
matched: {