github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 17:28:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

[8.x] [SecuritySolution] Add service enrichment to detection engine (#206582) (#207708)

Browse source 
# Backport

This will backport the following commits from `main` to `8.x`:
- [[SecuritySolution] Add service enrichment to detection engine
(#206582)](https://github.com/elastic/kibana/pull/206582)

<!--- Backport version: 9.6.4 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Pablo
Machado","email":"pablo.nevesmachado@elastic.co"},"sourceCommit":{"committedDate":"2025-01-21T16:54:20Z","message":"[SecuritySolution]
Add service enrichment to detection engine (#206582)\n\n## Summary\n\n*
Add alert enrichment for
`service.asset.criticality`,\n`service.risk.calculated_level` and
`service.risk.calculated_score_norm`\nfields\n\n* Add `Service Risk
Level` and `Service Criticality` columns to the\nalerts
table\n\n![Screenshot 2025-01-17 at 11
58\n50](https://github.com/user-attachments/assets/0871dce3-338f-4123-a868-6d23b3a35763)\n\n\n###
How to test?\n* Enable the flag `serviceEntityStoreEnabled `\n* Start an
empty kibana instance\n* Add data using the document generator with the
`yarn start\nentity-store` command.\n * Add a seed when prompted\n*
Assign asset criticality for the service entity you are testing with\n*
Ensure the service entity you are testing with has a risk score. \n *
You can run the engine from the Risk score page if needed.\n* Add more
data using the same seed\n* Force the created rule to run so it
generates new alerts\n* Check if the alerts created for the new batch of
data have the new\nfield populated.\n\n### How does enrichment
work?\nWhen alerts are created, the current asset criticality and risk
score\nare fetched and merged into the alert document. These values
won't get\nupdated if the risk score or asset changes.\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [ ] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"888dd240bdcaa93340767083653521a44c115845","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["v9.0.0","Feature:Detection
Rules","release_note:feature","Theme: entity_analytics","Feature:Entity
Analytics","Team:Entity
Analytics","backport:version","v8.18.0"],"title":"[SecuritySolution] Add
service enrichment to detection
engine","number":206582,"url":"https://github.com/elastic/kibana/pull/206582","mergeCommit":{"message":"[SecuritySolution]
Add service enrichment to detection engine (#206582)\n\n## Summary\n\n*
Add alert enrichment for
`service.asset.criticality`,\n`service.risk.calculated_level` and
`service.risk.calculated_score_norm`\nfields\n\n* Add `Service Risk
Level` and `Service Criticality` columns to the\nalerts
table\n\n![Screenshot 2025-01-17 at 11
58\n50](https://github.com/user-attachments/assets/0871dce3-338f-4123-a868-6d23b3a35763)\n\n\n###
How to test?\n* Enable the flag `serviceEntityStoreEnabled `\n* Start an
empty kibana instance\n* Add data using the document generator with the
`yarn start\nentity-store` command.\n * Add a seed when prompted\n*
Assign asset criticality for the service entity you are testing with\n*
Ensure the service entity you are testing with has a risk score. \n *
You can run the engine from the Risk score page if needed.\n* Add more
data using the same seed\n* Force the created rule to run so it
generates new alerts\n* Check if the alerts created for the new batch of
data have the new\nfield populated.\n\n### How does enrichment
work?\nWhen alerts are created, the current asset criticality and risk
score\nare fetched and merged into the alert document. These values
won't get\nupdated if the risk score or asset changes.\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [ ] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"888dd240bdcaa93340767083653521a44c115845"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/206582","number":206582,"mergeCommit":{"message":"[SecuritySolution]
Add service enrichment to detection engine (#206582)\n\n## Summary\n\n*
Add alert enrichment for
`service.asset.criticality`,\n`service.risk.calculated_level` and
`service.risk.calculated_score_norm`\nfields\n\n* Add `Service Risk
Level` and `Service Criticality` columns to the\nalerts
table\n\n![Screenshot 2025-01-17 at 11
58\n50](https://github.com/user-attachments/assets/0871dce3-338f-4123-a868-6d23b3a35763)\n\n\n###
How to test?\n* Enable the flag `serviceEntityStoreEnabled `\n* Start an
empty kibana instance\n* Add data using the document generator with the
`yarn start\nentity-store` command.\n * Add a seed when prompted\n*
Assign asset criticality for the service entity you are testing with\n*
Ensure the service entity you are testing with has a risk score. \n *
You can run the engine from the Risk score page if needed.\n* Add more
data using the same seed\n* Force the created rule to run so it
generates new alerts\n* Check if the alerts created for the new batch of
data have the new\nfield populated.\n\n### How does enrichment
work?\nWhen alerts are created, the current asset criticality and risk
score\nare fetched and merged into the alert document. These values
won't get\nupdated if the risk score or asset changes.\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [ ] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"888dd240bdcaa93340767083653521a44c115845"}},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->
This commit is contained in:
Pablo Machado 2025-01-22 11:51:57 +01:00 • committed by GitHub
parent c864f54c1a
commit f9bed85a13
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
20 changed files with 500 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/platform/packages/shared/kbn-alerts-as-data-utils/src/schemas/generated/security_schema.ts
View file

@ -212,6 +212,9 @@ const SecurityAlertOptional = rt.partial({
'kibana.alert.workflow_tags': schemaStringArray,
'kibana.alert.workflow_user': schemaString,
'kibana.version': schemaString,
'service.asset.criticality': schemaString,
'service.risk.calculated_level': schemaString,
'service.risk.calculated_score_norm': schemaNumber,
tags: schemaStringArray,
'user.asset.criticality': schemaString,
});

120
x-pack/platform/plugins/shared/alerting/server/integration_tests/__snapshots__/alert_as_data_fields.test.ts.snap generated
View file

@ -1414,6 +1414,21 @@ Object {
"required": false,
"type": "version",
},
"service.asset.criticality": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_level": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_score_norm": Object {
"array": false,
"required": false,
"type": "float",
},
"signal.ancestors.depth": Object {
"path": "kibana.alert.ancestors.depth",
"required": false,
@ -2517,6 +2532,21 @@ Object {
"required": false,
"type": "version",
},
"service.asset.criticality": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_level": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_score_norm": Object {
"array": false,
"required": false,
"type": "float",
},
"signal.ancestors.depth": Object {
"path": "kibana.alert.ancestors.depth",
"required": false,
@ -3620,6 +3650,21 @@ Object {
"required": false,
"type": "version",
},
"service.asset.criticality": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_level": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_score_norm": Object {
"array": false,
"required": false,
"type": "float",
},
"signal.ancestors.depth": Object {
"path": "kibana.alert.ancestors.depth",
"required": false,
@ -4723,6 +4768,21 @@ Object {
"required": false,
"type": "version",
},
"service.asset.criticality": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_level": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_score_norm": Object {
"array": false,
"required": false,
"type": "float",
},
"signal.ancestors.depth": Object {
"path": "kibana.alert.ancestors.depth",
"required": false,
@ -5826,6 +5886,21 @@ Object {
"required": false,
"type": "version",
},
"service.asset.criticality": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_level": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_score_norm": Object {
"array": false,
"required": false,
"type": "float",
},
"signal.ancestors.depth": Object {
"path": "kibana.alert.ancestors.depth",
"required": false,
@ -6935,6 +7010,21 @@ Object {
"required": false,
"type": "version",
},
"service.asset.criticality": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_level": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_score_norm": Object {
"array": false,
"required": false,
"type": "float",
},
"signal.ancestors.depth": Object {
"path": "kibana.alert.ancestors.depth",
"required": false,
@ -8038,6 +8128,21 @@ Object {
"required": false,
"type": "version",
},
"service.asset.criticality": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_level": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_score_norm": Object {
"array": false,
"required": false,
"type": "float",
},
"signal.ancestors.depth": Object {
"path": "kibana.alert.ancestors.depth",
"required": false,
@ -9141,6 +9246,21 @@ Object {
"required": false,
"type": "version",
},
"service.asset.criticality": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_level": Object {
"array": false,
"required": false,
"type": "keyword",
},
"service.risk.calculated_score_norm": Object {
"array": false,
"required": false,
"type": "float",
},
"signal.ancestors.depth": Object {
"path": "kibana.alert.ancestors.depth",
"required": false,

2
x-pack/solutions/security/plugins/security_solution/common/api/detection_engine/model/alerts/8.13.0/index.ts
View file

@ -40,7 +40,7 @@ export interface BaseFields8130 extends BaseFields8120 {
[ALERT_HOST_CRITICALITY]: string | undefined;
[ALERT_USER_CRITICALITY]: string | undefined;
/**
* Risk scores fields was added aroung 8.5.0, but the fields were not added to the alert schema
* Risk scores fields was added around 8.5.0, but the fields were not added to the alert schema
*/
[ALERT_HOST_RISK_SCORE_CALCULATED_LEVEL]: string | undefined;
[ALERT_HOST_RISK_SCORE_CALCULATED_SCORE_NORM]: number | undefined;

62
x-pack/solutions/security/plugins/security_solution/common/api/detection_engine/model/alerts/8.18.0/index.ts Normal file
View file

@ -0,0 +1,62 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import type { AlertWithCommonFields800 } from '@kbn/rule-registry-plugin/common/schemas/8.0.0';
import type {
Ancestor8160,
BaseFields8160,
EqlBuildingBlockFields8160,
EqlShellFields8160,
NewTermsFields8160,
} from '../8.16.0';
import type {
ALERT_SERVICE_CRITICALITY,
ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL,
ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM,
} from '../../../../../field_maps/field_names';
/* DO NOT MODIFY THIS SCHEMA TO ADD NEW FIELDS. These types represent the alerts that shipped in 8.18.0.
Any changes to these types should be bug fixes so the types more accurately represent the alerts from 8.18.0.
If you are adding new fields for a new release of Kibana, create a new sibling folder to this one
for the version to be released and add the field(s) to the schema in that folder.
Then, update `../index.ts` to import from the new folder that has the latest schemas, add the
new schemas to the union of all alert schemas, and re-export the new schemas as the `*Latest` schemas.
*/
export type { Ancestor8160 as Ancestor8180 };
export interface BaseFields8180 extends BaseFields8160 {
[ALERT_SERVICE_CRITICALITY]: string | undefined;
[ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL]: string | undefined;
[ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM]: number | undefined;
}
export interface WrappedFields8180<T extends BaseFields8160> {
_id: string;
_index: string;
_source: T;
}
export type GenericAlert8180 = AlertWithCommonFields800<BaseFields8180>;
export type EqlShellFields8180 = EqlShellFields8160 & BaseFields8180;
export type EqlBuildingBlockFields8180 = EqlBuildingBlockFields8160 & BaseFields8180;
export type NewTermsFields8180 = NewTermsFields8160 & BaseFields8180;
export type NewTermsAlert8180 = NewTermsFields8160 & BaseFields8180;
export type EqlBuildingBlockAlert8180 = AlertWithCommonFields800<EqlBuildingBlockFields8160>;
export type EqlShellAlert8180 = AlertWithCommonFields800<EqlShellFields8180>;
export type DetectionAlert8180 =
| GenericAlert8180
| EqlShellAlert8180
| EqlBuildingBlockAlert8180
| NewTermsAlert8180;

34
x-pack/solutions/security/plugins/security_solution/common/api/detection_engine/model/alerts/index.ts
View file

@ -15,15 +15,16 @@ import type { DetectionAlert890 } from './8.9.0';
import type { DetectionAlert8120 } from './8.12.0';
import type { DetectionAlert8130 } from './8.13.0';
import type { DetectionAlert8160 } from './8.16.0';
import type {
Ancestor8160,
BaseFields8160,
DetectionAlert8160,
EqlBuildingBlockFields8160,
EqlShellFields8160,
NewTermsFields8160,
WrappedFields8160,
} from './8.16.0';
Ancestor8180,
BaseFields8180,
DetectionAlert8180,
EqlBuildingBlockFields8180,
EqlShellFields8180,
NewTermsFields8180,
WrappedFields8180,
} from './8.18.0';
// When new Alert schemas are created for new Kibana versions, add the DetectionAlert type from the new version
// here, e.g. `export type DetectionAlert = DetectionAlert800 | DetectionAlert820` if a new schema is created in 8.2.0
@ -36,14 +37,15 @@ export type DetectionAlert =
| DetectionAlert890
| DetectionAlert8120
| DetectionAlert8130
| DetectionAlert8160;
| DetectionAlert8160
| DetectionAlert8180;
export type {
Ancestor8160 as AncestorLatest,
BaseFields8160 as BaseFieldsLatest,
DetectionAlert8160 as DetectionAlertLatest,
WrappedFields8160 as WrappedFieldsLatest,
EqlBuildingBlockFields8160 as EqlBuildingBlockFieldsLatest,
EqlShellFields8160 as EqlShellFieldsLatest,
NewTermsFields8160 as NewTermsFieldsLatest,
Ancestor8180 as AncestorLatest,
BaseFields8180 as BaseFieldsLatest,
DetectionAlert8180 as DetectionAlertLatest,
WrappedFields8180 as WrappedFieldsLatest,
EqlBuildingBlockFields8180 as EqlBuildingBlockFieldsLatest,
EqlShellFields8180 as EqlShellFieldsLatest,
NewTermsFields8180 as NewTermsFieldsLatest,
};

43
x-pack/solutions/security/plugins/security_solution/common/field_maps/8.18.0/alerts.ts Normal file
View file

@ -0,0 +1,43 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import { alertsFieldMap8160 } from '../8.16.0';
import {
ALERT_SERVICE_CRITICALITY,
ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL,
ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM,
} from '../field_names';
export const alertsFieldMap8180 = {
...alertsFieldMap8160,
/**
* Stores the criticality level for the service, as determined by analysts, in relation to the alert.
* The Criticality level is copied from the asset criticality index.
*/
[ALERT_SERVICE_CRITICALITY]: {
type: 'keyword',
array: false,
required: false,
},
/**
* Stores the risk score level and score_norm level for the service, as determined by the Risk Engine, in relation to the alert.
* The Risk score is copied from the risk score index.
*/
[ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL]: {
type: 'keyword',
array: false,
required: false,
},
[ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM]: {
type: 'float',
array: false,
required: false,
},
} as const;
export type AlertsFieldMap8180 = typeof alertsFieldMap8180;

11
x-pack/solutions/security/plugins/security_solution/common/field_maps/8.18.0/index.ts Normal file
View file

@ -0,0 +1,11 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import type { AlertsFieldMap8180 } from './alerts';
import { alertsFieldMap8180 } from './alerts';
export type { AlertsFieldMap8180 };
export { alertsFieldMap8180 };

4
x-pack/solutions/security/plugins/security_solution/common/field_maps/field_names.ts
View file

@ -28,12 +28,16 @@ export const LEGACY_ALERT_USER_CRITICALITY = `${ALERT_NAMESPACE}.user.criticalit
export const ALERT_HOST_CRITICALITY = `host.asset.criticality` as const;
export const ALERT_USER_CRITICALITY = `user.asset.criticality` as const;
export const ALERT_SERVICE_CRITICALITY = `service.asset.criticality` as const;
export const ALERT_HOST_RISK_SCORE_CALCULATED_LEVEL = `host.risk.calculated_level` as const;
export const ALERT_HOST_RISK_SCORE_CALCULATED_SCORE_NORM =
`host.risk.calculated_score_norm` as const;
export const ALERT_USER_RISK_SCORE_CALCULATED_LEVEL = `user.risk.calculated_level` as const;
export const ALERT_USER_RISK_SCORE_CALCULATED_SCORE_NORM =
`user.risk.calculated_score_norm` as const;
export const ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL = `service.risk.calculated_level` as const;
export const ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM =
`service.risk.calculated_score_norm` as const;
export const ALERT_ORIGINAL_EVENT = `${ALERT_NAMESPACE}.original_event` as const;
export const ALERT_ORIGINAL_EVENT_ACTION = `${ALERT_ORIGINAL_EVENT}.action` as const;

9
x-pack/solutions/security/plugins/security_solution/common/field_maps/index.ts
View file

@ -4,10 +4,9 @@
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import type { AlertsFieldMap8160 } from './8.16.0';
import { alertsFieldMap8160 } from './8.16.0';
import type { AlertsFieldMap8180 } from './8.18.0';
import { alertsFieldMap8180 } from './8.18.0';
import type { RulesFieldMap } from './8.0.0/rules';
import { rulesFieldMap } from './8.0.0/rules';
export type { AlertsFieldMap8160 as AlertsFieldMap, RulesFieldMap };
export { alertsFieldMap8160 as alertsFieldMap, rulesFieldMap };
export type { AlertsFieldMap8180 as AlertsFieldMap, RulesFieldMap };
export { alertsFieldMap8180 as alertsFieldMap, rulesFieldMap };

10
x-pack/solutions/security/plugins/security_solution/public/detections/components/alerts_table/default_config.test.tsx
View file

@ -79,6 +79,11 @@ const platinumBaseColumns = [
id: 'user.risk.calculated_level',
displayAsText: 'User Risk Level',
},
{
columnHeaderType: 'not-filtered',
id: 'service.risk.calculated_level',
displayAsText: 'Service Risk Level',
},
{
columnHeaderType: 'not-filtered',
id: 'host.asset.criticality',
@ -89,6 +94,11 @@ const platinumBaseColumns = [
id: 'user.asset.criticality',
displayAsText: 'User Criticality',
},
{
columnHeaderType: 'not-filtered',
id: 'service.asset.criticality',
displayAsText: 'Service Criticality',
},
{ columnHeaderType: 'not-filtered', id: 'process.name' },
{ columnHeaderType: 'not-filtered', id: 'file.name' },
{ columnHeaderType: 'not-filtered', id: 'source.ip' },

14
x-pack/solutions/security/plugins/security_solution/public/detections/components/alerts_table/translations.ts
View file

@ -140,6 +140,13 @@ export const ALERTS_HEADERS_HOST_CRITICALITY = i18n.translate(
}
);
export const ALERTS_HEADERS_SERVICE_RISK_LEVEL = i18n.translate(
'xpack.securitySolution.eventsViewer.alerts.defaultHeaders.serviceRiskLevel',
{
defaultMessage: 'Service Risk Level',
}
);
export const ALERTS_HEADERS_USER_CRITICALITY = i18n.translate(
'xpack.securitySolution.eventsViewer.alerts.defaultHeaders.userCriticality',
{
@ -147,6 +154,13 @@ export const ALERTS_HEADERS_USER_CRITICALITY = i18n.translate(
}
);
export const ALERTS_HEADERS_SERVICE_CRITICALITY = i18n.translate(
'xpack.securitySolution.eventsViewer.alerts.defaultHeaders.serviceCriticality',
{
defaultMessage: 'Service Criticality',
}
);
export const ACTION_INVESTIGATE_IN_TIMELINE = i18n.translate(
'xpack.securitySolution.detectionEngine.alerts.actions.investigateInTimelineTitle',
{

16
x-pack/solutions/security/plugins/security_solution/public/detections/configurations/security_solution_detections/columns.ts
View file

@ -11,6 +11,8 @@ import {
ALERT_USER_CRITICALITY,
ALERT_HOST_RISK_SCORE_CALCULATED_LEVEL,
ALERT_USER_RISK_SCORE_CALCULATED_LEVEL,
ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL,
ALERT_SERVICE_CRITICALITY,
} from '../../../../common/field_maps/field_names';
import type { LicenseService } from '../../../../common/license';
import type { ColumnHeaderOptions } from '../../../../common/types';
@ -46,6 +48,12 @@ export const userRiskLevelColumn: ColumnHeaderOptions = {
displayAsText: i18n.ALERTS_HEADERS_USER_RISK_LEVEL,
};
export const serviceRiskLevelColumn: ColumnHeaderOptions = {
columnHeaderType: defaultColumnHeaderType,
id: ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL,
displayAsText: i18n.ALERTS_HEADERS_SERVICE_RISK_LEVEL,
};
const getBaseColumns = (
license?: LicenseService
): Array<
@ -81,6 +89,7 @@ const getBaseColumns = (
},
isPlatinumPlus ? hostRiskLevelColumn : null,
isPlatinumPlus ? userRiskLevelColumn : null,
isPlatinumPlus ? serviceRiskLevelColumn : null,
isPlatinumPlus
? {
columnHeaderType: defaultColumnHeaderType,
@ -95,6 +104,13 @@ const getBaseColumns = (
displayAsText: i18n.ALERTS_HEADERS_USER_CRITICALITY,
}
: null,
isPlatinumPlus
? {
columnHeaderType: defaultColumnHeaderType,
id: ALERT_SERVICE_CRITICALITY,
displayAsText: i18n.ALERTS_HEADERS_SERVICE_CRITICALITY,
}
: null,
{
columnHeaderType: defaultColumnHeaderType,
id: 'process.name',

7
x-pack/solutions/security/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx
View file

@ -17,6 +17,7 @@ import { EntityTypeToIdentifierField } from '../../../../../../common/entity_ana
import { getAgentTypeForAgentIdField } from '../../../../../common/lib/endpoint/utils/get_agent_type_for_agent_id_field';
import {
ALERT_HOST_CRITICALITY,
ALERT_SERVICE_CRITICALITY,
ALERT_USER_CRITICALITY,
} from '../../../../../../common/field_maps/field_names';
import { AgentStatus } from '../../../../../common/components/endpoint/agents/agent_status';
@ -283,7 +284,11 @@ const FormattedFieldValueComponent: React.FC<{
iconSide={isButton ? 'right' : undefined}
/>
);
} else if (fieldName === ALERT_HOST_CRITICALITY || fieldName === ALERT_USER_CRITICALITY) {
} else if (
fieldName === ALERT_HOST_CRITICALITY ||
fieldName === ALERT_USER_CRITICALITY ||
fieldName === ALERT_SERVICE_CRITICALITY
) {
return (
<AssetCriticalityLevel
contextId={contextId}

6
x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/__snapshots__/build_alert.test.ts.snap generated
View file

@ -218,6 +218,9 @@ Object {
"kibana.space_ids": Array [
"default",
],
"service.asset.criticality": undefined,
"service.risk.calculated_level": undefined,
"service.risk.calculated_score_norm": undefined,
"user.asset.criticality": undefined,
"user.risk.calculated_level": undefined,
"user.risk.calculated_score_norm": undefined,
@ -442,6 +445,9 @@ Object {
"kibana.space_ids": Array [
"default",
],
"service.asset.criticality": undefined,
"service.risk.calculated_level": undefined,
"service.risk.calculated_score_norm": undefined,
"user.asset.criticality": undefined,
"user.risk.calculated_level": undefined,
"user.risk.calculated_score_norm": undefined,

6
x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.ts
View file

@ -88,6 +88,9 @@ import {
ALERT_HOST_RISK_SCORE_CALCULATED_SCORE_NORM,
ALERT_USER_RISK_SCORE_CALCULATED_LEVEL,
ALERT_USER_RISK_SCORE_CALCULATED_SCORE_NORM,
ALERT_SERVICE_CRITICALITY,
ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL,
ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM,
} from '../../../../../../common/field_maps/field_names';
import type { CompleteRule, RuleParams } from '../../../rule_schema';
import { commonParamsCamelToSnake, typeSpecificCamelToSnake } from '../../../rule_management';
@ -288,10 +291,13 @@ export const buildAlertFields = ({
[LEGACY_ALERT_USER_CRITICALITY]: undefined,
[ALERT_HOST_CRITICALITY]: undefined,
[ALERT_USER_CRITICALITY]: undefined,
[ALERT_SERVICE_CRITICALITY]: undefined,
[ALERT_HOST_RISK_SCORE_CALCULATED_LEVEL]: undefined,
[ALERT_HOST_RISK_SCORE_CALCULATED_SCORE_NORM]: undefined,
[ALERT_USER_RISK_SCORE_CALCULATED_LEVEL]: undefined,
[ALERT_USER_RISK_SCORE_CALCULATED_SCORE_NORM]: undefined,
[ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL]: undefined,
[ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM]: undefined,
[ALERT_INTENDED_TIMESTAMP]: intendedTimestamp ? intendedTimestamp.toISOString() : timestamp,
[ALERT_RULE_EXECUTION_TYPE]: intendedTimestamp
? RULE_EXECUTION_TYPE.MANUAL

6
x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_types/utils/enrichments/__mocks__/alerts.ts
View file

@ -78,6 +78,9 @@ import {
ALERT_HOST_RISK_SCORE_CALCULATED_SCORE_NORM,
ALERT_USER_RISK_SCORE_CALCULATED_LEVEL,
ALERT_USER_RISK_SCORE_CALCULATED_SCORE_NORM,
ALERT_SERVICE_CRITICALITY,
ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL,
ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM,
} from '../../../../../../../common/field_maps/field_names';
export const createAlert = (
@ -214,6 +217,9 @@ export const createAlert = (
[ALERT_USER_RISK_SCORE_CALCULATED_SCORE_NORM]: undefined,
[ALERT_INTENDED_TIMESTAMP]: '2020-04-20T21:27:45+0000',
[ALERT_RULE_EXECUTION_TYPE]: 'scheduled',
[ALERT_SERVICE_CRITICALITY]: undefined,
[ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL]: undefined,
[ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM]: undefined,
...data,
},
});

28
x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_types/utils/enrichments/enrichment_by_type/asset_criticality.ts
View file

@ -8,6 +8,7 @@
import { cloneDeep } from 'lodash';
import {
ALERT_HOST_CRITICALITY,
ALERT_SERVICE_CRITICALITY,
ALERT_USER_CRITICALITY,
} from '../../../../../../../common/field_maps/field_names';
import { createSingleFieldMatchEnrichment } from '../create_single_field_match_enrichment';
@ -29,7 +30,10 @@ const getExtraFiltersForEnrichment = (field: string) => [
const createEnrichmentFactoryFunction =
(
alertField: typeof ALERT_HOST_CRITICALITY | typeof ALERT_USER_CRITICALITY
alertField:
| typeof ALERT_HOST_CRITICALITY
| typeof ALERT_USER_CRITICALITY
| typeof ALERT_SERVICE_CRITICALITY
): CreateEnrichmentFunction =>
(enrichment) =>
(event) => {
@ -88,3 +92,25 @@ export const createUserAssetCriticalityEnrichments: CreateCriticalityEnrichment
createEnrichmentFunction: createEnrichmentFactoryFunction(ALERT_USER_CRITICALITY),
});
};
export const createServiceAssetCriticalityEnrichments: CreateCriticalityEnrichment = async ({
services,
logger,
events,
spaceId,
}) => {
return createSingleFieldMatchEnrichment({
name: 'Service Asset Criticality',
index: [getAssetCriticalityIndex(spaceId)],
services,
logger,
events,
mappingField: {
eventField: 'service.name',
enrichmentField: 'id_value',
},
enrichmentResponseFields,
extraFilters: getExtraFiltersForEnrichment('service.name'),
createEnrichmentFunction: createEnrichmentFactoryFunction(ALERT_SERVICE_CRITICALITY),
});
};

56
x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_types/utils/enrichments/enrichment_by_type/service_risk.ts Normal file
View file

@ -0,0 +1,56 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import { set } from '@kbn/safer-lodash-set';
import { cloneDeep } from 'lodash';
import {
ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL,
ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM,
} from '../../../../../../../common/field_maps/field_names';
import { getRiskIndex } from '../../../../../../../common/search_strategy/security_solution/risk_score/common';
import { RiskScoreFields } from '../../../../../../../common/search_strategy/security_solution/risk_score/all';
import { createSingleFieldMatchEnrichment } from '../create_single_field_match_enrichment';
import type { CreateRiskEnrichment } from '../types';
import { getFieldValue } from '../utils/events';
export const createServiceRiskEnrichments: CreateRiskEnrichment = async ({
services,
logger,
events,
spaceId,
}) => {
return createSingleFieldMatchEnrichment({
name: 'Service Risk',
index: [getRiskIndex(spaceId, true)],
services,
logger,
events,
mappingField: {
eventField: 'service.name',
enrichmentField: RiskScoreFields.serviceName,
},
enrichmentResponseFields: [
RiskScoreFields.serviceName,
RiskScoreFields.serviceRisk,
RiskScoreFields.serviceRiskScore,
],
createEnrichmentFunction: (enrichment) => (event) => {
const riskLevel = getFieldValue(enrichment, RiskScoreFields.serviceRisk);
const riskScore = getFieldValue(enrichment, RiskScoreFields.serviceRiskScore);
if (!riskLevel && !riskScore) {
return event;
}
const newEvent = cloneDeep(event);
if (riskLevel) {
set(newEvent, `_source.${ALERT_SERVICE_RISK_SCORE_CALCULATED_LEVEL}`, riskLevel);
}
if (riskScore) {
set(newEvent, `_source.${ALERT_SERVICE_RISK_SCORE_CALCULATED_SCORE_NORM}`, riskScore);
}
return newEvent;
},
});
};

52
x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_types/utils/enrichments/index.test.ts
View file

@ -60,6 +60,23 @@ const userEnrichmentResponse = [
},
];
const serviceEnrichmentResponse = [
{
fields: {
'service.name': ['service name 1'],
'service.risk.calculated_level': ['Moderate'],
'service.risk.calculated_score_norm': [50],
},
},
{
fields: {
'service.name': ['service name 2'],
'service.risk.calculated_level': ['Critical'],
'service.risk.calculated_score_norm': [90],
},
},
];
const assetCriticalityUserResponse = [
{
fields: {
@ -84,6 +101,15 @@ const assetCriticalityHostResponse = [
},
];
const assetCriticalityServiceResponse = [
{
fields: {
id_value: ['service name 1'],
criticality_level: ['high'],
},
},
];
describe('enrichEvents', () => {
let ruleExecutionLogger: ReturnType<typeof ruleExecutionLogMock.forExecutors.create>;
let alertServices: RuleExecutorServicesMock;
@ -132,7 +158,8 @@ describe('enrichEvents', () => {
it('return enriched events with risk score', async () => {
mockSearchEnrichments
.mockReturnValueOnce(hostEnrichmentResponse)
.mockReturnValueOnce(userEnrichmentResponse);
.mockReturnValueOnce(userEnrichmentResponse)
.mockReturnValueOnce(serviceEnrichmentResponse);
mockIsIndexExist.mockImplementation(() => true);
const enrichedEvents = await enrichEvents({
@ -142,8 +169,9 @@ describe('enrichEvents', () => {
createAlert('1', {
...createEntity('host', 'host name 1'),
...createEntity('user', 'user name 1'),
...createEntity('service', 'service name 1'),
}),
createAlert('2', createEntity('user', 'user name 2')),
createAlert('2', createEntity('service', 'service name 2')),
],
spaceId: 'default',
});
@ -164,10 +192,17 @@ describe('enrichEvents', () => {
calculated_score_norm: 50,
},
},
service: {
name: 'service name 1',
risk: {
calculated_level: 'Moderate',
calculated_score_norm: 50,
},
},
}),
createAlert('2', {
user: {
name: 'user name 2',
service: {
name: 'service name 2',
risk: {
calculated_level: 'Critical',
calculated_score_norm: 90,
@ -180,12 +215,14 @@ describe('enrichEvents', () => {
it('return enriched events with asset criticality', async () => {
mockSearchEnrichments
.mockReturnValueOnce(assetCriticalityUserResponse)
.mockReturnValueOnce(assetCriticalityHostResponse);
.mockReturnValueOnce(assetCriticalityHostResponse)
.mockReturnValueOnce(assetCriticalityServiceResponse);
// disable risk score enrichments
mockIsIndexExist.mockImplementationOnce(() => false);
mockIsIndexExist.mockImplementationOnce(() => false);
mockIsIndexExist.mockImplementationOnce(() => false);
mockIsIndexExist.mockImplementationOnce(() => false);
// enable for asset criticality
mockIsIndexExist.mockImplementation(() => true);
@ -196,6 +233,7 @@ describe('enrichEvents', () => {
createAlert('1', {
...createEntity('host', 'host name 1'),
...createEntity('user', 'user name 1'),
...createEntity('service', 'service name 1'),
}),
createAlert('2', createEntity('host', 'user name 1')),
],
@ -207,9 +245,10 @@ describe('enrichEvents', () => {
createAlert('1', {
...createEntity('user', 'user name 1'),
...createEntity('host', 'host name 1'),
...createEntity('service', 'service name 1'),
'host.asset.criticality': 'low',
'user.asset.criticality': 'important',
'service.asset.criticality': 'high',
}),
createAlert('2', {
...createEntity('host', 'user name 1'),
@ -224,7 +263,6 @@ describe('enrichEvents', () => {
})
.mockImplementationOnce(() => userEnrichmentResponse);
mockIsIndexExist.mockImplementation(() => true);
mockIsIndexExist.mockImplementation(() => true);
const enrichedEvents = await enrichEvents({
logger: ruleExecutionLogger,

56
x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_types/utils/enrichments/index.ts
View file

@ -5,13 +5,16 @@
* 2.0.
*/
import { getHostRiskIndex, getUserRiskIndex } from '../../../../../../common/search_strategy';
import {
getHostRiskIndex,
getRiskIndex,
getUserRiskIndex,
} from '../../../../../../common/search_strategy';
import { createHostRiskEnrichments } from './enrichment_by_type/host_risk';
import { createUserRiskEnrichments } from './enrichment_by_type/user_risk';
import {
createHostAssetCriticalityEnrichments,
createServiceAssetCriticalityEnrichments,
createUserAssetCriticalityEnrichments,
} from './enrichment_by_type/asset_criticality';
import { getAssetCriticalityIndex } from '../../../../../../common/entity_analytics/asset_criticality';
@ -22,6 +25,7 @@ import type {
} from './types';
import { applyEnrichmentsToEvents } from './utils/transforms';
import { isIndexExist } from './utils/is_index_exist';
import { createServiceRiskEnrichments } from './enrichment_by_type/service_risk';
export const enrichEvents: EnrichEventsFunction = async ({
services,
@ -44,16 +48,21 @@ export const enrichEvents: EnrichEventsFunction = async ({
});
}
const [isHostRiskScoreIndexExist, isUserRiskScoreIndexExist] = await Promise.all([
isIndexExist({
services,
index: getHostRiskIndex(spaceId, true, isNewRiskScoreModuleInstalled),
}),
isIndexExist({
services,
index: getUserRiskIndex(spaceId, true, isNewRiskScoreModuleInstalled),
}),
]);
const [isHostRiskScoreIndexExist, isUserRiskScoreIndexExist, isServiceRiskScoreIndexExist] =
await Promise.all([
isIndexExist({
services,
index: getHostRiskIndex(spaceId, true, isNewRiskScoreModuleInstalled),
}),
isIndexExist({
services,
index: getUserRiskIndex(spaceId, true, isNewRiskScoreModuleInstalled),
}),
isIndexExist({
services,
index: getRiskIndex(spaceId, true),
}),
]);
if (isHostRiskScoreIndexExist) {
enrichments.push(
@ -66,7 +75,6 @@ export const enrichEvents: EnrichEventsFunction = async ({
})
);
}
if (isUserRiskScoreIndexExist) {
enrichments.push(
createUserRiskEnrichments({
@ -79,6 +87,18 @@ export const enrichEvents: EnrichEventsFunction = async ({
);
}
if (isServiceRiskScoreIndexExist) {
enrichments.push(
createServiceRiskEnrichments({
services,
logger,
events,
spaceId,
isNewRiskScoreModuleInstalled,
})
);
}
const assetCriticalityIndexExist = await isIndexExist({
services,
index: getAssetCriticalityIndex(spaceId),
@ -100,6 +120,14 @@ export const enrichEvents: EnrichEventsFunction = async ({
spaceId,
})
);
enrichments.push(
createServiceAssetCriticalityEnrichments({
services,
logger,
events,
spaceId,
})
);
}
const allEnrichmentsResults = await Promise.allSettled(enrichments);