forked from elastic/kibana
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Security Solution] - Feat Add
Severity and risk_score to the Sie…
…m migrations (elastic#211202) ## Summary Handles below Features: - elastic/security-team#11837 This PR adds `risk_score` and `severity` based on below 3 rules - `Rule Severity` should be mapped to Splunk's `alert.severity`. - `Rule Severity` values should be mapped as mentioned in below section Mapping Elastic Security Rule's Severity with Splunk's Severity > > |Splunk's Severity| Elastic Rule Severity | > |---|---| > |1- Info|Low| > |2-Low|Low| > |3-Medium|Medium| > |4-High|High| > |5-Critical|Critical| - Elastic Security Rule's `Risk Score` derived from the `Severity` of the Rulet based on below mapping( [Source](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-ui-basic-params) )  ## Desk Testing [splunk_rules_test_severity.json](https://github.com/user-attachments/files/18825855/splunk_rules_test_severity.json) 1. Use the above attached test file which has the `alert.severity` exported from Splunk. 2. Check the Severity of the translated rule should match the mapping given above. Expect results like below : <img width="1474" alt="Screenshot 2025-02-17 at 14 19 23" src="https://github.com/user-attachments/assets/a8459c71-3208-480e-8049-05293a0a3d2a" /> ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 74ef9fc)
- Loading branch information
Showing
22 changed files
with
521 additions
and
35 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
208 changes: 208 additions & 0 deletions
208
...ents/data_input_flyout/steps/rules/sub_steps/rules_file_upload/rules_file_upload.test.tsx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,208 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| import React from 'react'; | ||
| import { act, fireEvent, render, waitFor } from '@testing-library/react'; | ||
| import type { RulesFileUploadProps } from './rules_file_upload'; | ||
| import { RulesFileUpload } from './rules_file_upload'; | ||
| import type { CreateMigration } from '../../../../../../service/hooks/use_create_migration'; | ||
| import { screen } from '@elastic/eui/lib/test/rtl'; | ||
| import { I18nProvider } from '@kbn/i18n-react'; | ||
| // eslint-disable-next-line import/no-nodejs-modules | ||
| import path from 'path'; | ||
| // eslint-disable-next-line import/no-nodejs-modules | ||
| import os from 'os'; | ||
| import { splunkTestRules } from './splunk_rules.test.data'; | ||
| import type { OriginalRule } from '../../../../../../../../../common/siem_migrations/model/rule_migration.gen'; | ||
|
|
||
| const mockCreateMigration: CreateMigration = jest.fn(); | ||
| const mockApiError = 'Some Mock API Error'; | ||
|
|
||
| const defaultProps: RulesFileUploadProps = { | ||
| createMigration: mockCreateMigration, | ||
| apiError: undefined, | ||
| isLoading: false, | ||
| isCreated: false, | ||
| }; | ||
|
|
||
| const renderTestComponent = (props: Partial<RulesFileUploadProps> = {}) => { | ||
| const finalProps = { | ||
| ...defaultProps, | ||
| ...props, | ||
| }; | ||
| render( | ||
| <I18nProvider> | ||
| <RulesFileUpload {...finalProps} /> | ||
| </I18nProvider> | ||
| ); | ||
| }; | ||
|
|
||
| const getTestDir = () => os.tmpdir(); | ||
|
|
||
| const createRulesFileFromRulesData = ( | ||
| data: string, | ||
| destinationDirectory: string, | ||
| fileName: string | ||
| ) => { | ||
| const filePath = path.join(destinationDirectory, fileName); | ||
| const file = new File([data], filePath, { | ||
| type: 'application/x-ndjson', | ||
| }); | ||
| return file; | ||
| }; | ||
|
|
||
| describe('RulesFileUpload', () => { | ||
| afterEach(() => { | ||
| jest.clearAllMocks(); | ||
| }); | ||
|
|
||
| it('should render the upload button', () => { | ||
| renderTestComponent(); | ||
|
|
||
| expect(screen.getByTestId('rulesFilePicker')).toBeInTheDocument(); | ||
| expect(screen.getByTestId('uploadFileButton')).toBeDisabled(); | ||
| }); | ||
|
|
||
| it('should be able to upload correct file type', async () => { | ||
| const fileName = 'splunk_rules.test.data.json'; | ||
| const ndJSONString = splunkTestRules.map((obj) => JSON.stringify(obj)).join('\n'); | ||
| const testFile = createRulesFileFromRulesData(ndJSONString, getTestDir(), fileName); | ||
|
|
||
| renderTestComponent(); | ||
|
|
||
| const filePicker = screen.getByTestId('rulesFilePicker'); | ||
|
|
||
| act(() => { | ||
| fireEvent.change(filePicker, { | ||
| target: { | ||
| files: [testFile], | ||
| }, | ||
| }); | ||
| }); | ||
|
|
||
| await waitFor(() => { | ||
| expect(filePicker).toHaveAttribute('data-loading', 'true'); | ||
| }); | ||
|
|
||
| await waitFor(() => { | ||
| expect(filePicker).toHaveAttribute('data-loading', 'false'); | ||
| }); | ||
|
|
||
| await act(async () => { | ||
| fireEvent.click(screen.getByTestId('uploadFileButton')); | ||
| }); | ||
|
|
||
| await waitFor(() => { | ||
| expect(mockCreateMigration).toHaveBeenCalled(); | ||
| }); | ||
|
|
||
| const rulesToExpect: OriginalRule[] = splunkTestRules.map(({ result: rule }) => ({ | ||
| id: rule.id, | ||
| vendor: 'splunk', | ||
| title: rule.title, | ||
| query: rule.search, | ||
| query_language: 'spl', | ||
| description: rule.description, | ||
| severity: rule['alert.severity'] as OriginalRule['severity'], | ||
| })); | ||
|
|
||
| expect(mockCreateMigration).toHaveBeenNthCalledWith(1, rulesToExpect); | ||
| }); | ||
|
|
||
| describe('Error Handling', () => { | ||
| const scenarios = [ | ||
| { | ||
| subject: 'Non Object Entries', | ||
| fileContent: '["asdadsada"]', | ||
| errorMessage: 'The file contains non-object entries', | ||
| }, | ||
| { | ||
| subject: 'Non parsable JSON or ND-JSON', | ||
| fileContent: '[{"testArray"}])', | ||
| errorMessage: 'Cannot parse the file as either a JSON file or NDJSON file', | ||
| }, | ||
| { | ||
| subject: 'Empty File', | ||
| fileContent: '', | ||
| errorMessage: 'The file is empty', | ||
| }, | ||
| ]; | ||
|
|
||
| it('should not be able to upload on API Error', async () => { | ||
| renderTestComponent({ | ||
| apiError: mockApiError, | ||
| }); | ||
|
|
||
| const fileName = 'splunk_rules.test.data.json'; | ||
| const ndJSONString = splunkTestRules.map((obj) => JSON.stringify(obj)).join('\n'); | ||
| const testFile = createRulesFileFromRulesData(ndJSONString, getTestDir(), fileName); | ||
|
|
||
| const filePicker = screen.getByTestId('rulesFilePicker'); | ||
|
|
||
| act(() => { | ||
| fireEvent.change(filePicker, { | ||
| target: { | ||
| files: [testFile], | ||
| }, | ||
| }); | ||
| }); | ||
|
|
||
| await waitFor(() => { | ||
| expect(filePicker).toHaveAttribute('data-loading', 'true'); | ||
| }); | ||
|
|
||
| await waitFor(() => { | ||
| expect(filePicker).toHaveAttribute('data-loading', 'false'); | ||
| }); | ||
|
|
||
| await act(async () => { | ||
| fireEvent.click(screen.getByTestId('uploadFileButton')); | ||
| }); | ||
|
|
||
| await waitFor(() => { | ||
| expect(screen.getByText(mockApiError)).toBeVisible(); | ||
| expect(screen.getByTestId('uploadFileButton')).toBeDisabled(); | ||
| }); | ||
| }); | ||
| scenarios.forEach((scenario, _idx) => { | ||
| it(`should not be able to upload when file has - ${scenario.subject}`, async () => { | ||
| const fileName = 'invalid_rule_file.json'; | ||
| const testFile = createRulesFileFromRulesData(scenario.fileContent, getTestDir(), fileName); | ||
|
|
||
| renderTestComponent({ | ||
| apiError: undefined, | ||
| }); | ||
|
|
||
| const filePicker = screen.getByTestId('rulesFilePicker'); | ||
|
|
||
| act(() => { | ||
| fireEvent.change(filePicker, { | ||
| target: { | ||
| files: [testFile], | ||
| }, | ||
| }); | ||
| }); | ||
|
|
||
| await waitFor(() => { | ||
| expect(filePicker).toHaveAttribute('data-loading', 'true'); | ||
| }); | ||
|
|
||
| await waitFor(() => { | ||
| expect(filePicker).toHaveAttribute('data-loading', 'false'); | ||
| }); | ||
|
|
||
| await waitFor(() => { | ||
| expect(screen.getByText(scenario.errorMessage)).toBeVisible(); | ||
| }); | ||
|
|
||
| await waitFor(() => { | ||
| expect(screen.getByTestId('uploadFileButton')).toBeDisabled(); | ||
| }); | ||
| }); | ||
| }); | ||
| }); | ||
| }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.