TheHive Connector for Cases

x-pack/plugins/cases/common/types/domain/connector/v1.ts

@@ -21,6 +21,7 @@ export enum ConnectorTypes {
   serviceNowITSM = '.servicenow',
   serviceNowSIR = '.servicenow-sir',
   swimlane = '.swimlane',
+  theHive = '.thehive',
 }
 
 const ConnectorCasesWebhookTypeFieldsRt = rt.strict({
@@ -118,6 +119,21 @@ const ConnectorSwimlaneTypeFieldsRt = rt.strict({
   fields: rt.union([SwimlaneFieldsRt, rt.null]),
 });
 
+/**
+ * Thehive
+ */
+
+export const TheHiveFieldsRt = rt.strict({
+  tlp: rt.union([rt.number, rt.string, rt.null]),
+});
+
+export type TheHiveFieldsType = rt.TypeOf<typeof TheHiveFieldsRt>;
+
+const ConnectorTheHiveTypeFieldsRt = rt.strict({
+  type: rt.literal(ConnectorTypes.theHive),
+  fields: rt.union([TheHiveFieldsRt, rt.null]),
+});
+
 /**
  * None connector
  */
@@ -135,6 +151,7 @@ export const ConnectorTypeFieldsRt = rt.union([
   ConnectorServiceNowITSMTypeFieldsRt,
   ConnectorServiceNowSIRTypeFieldsRt,
   ConnectorSwimlaneTypeFieldsRt,
+  ConnectorTheHiveTypeFieldsRt,
 ]);
 
 /**
@@ -148,6 +165,7 @@ export const CaseUserActionConnectorRt = rt.union([
   rt.intersection([ConnectorServiceNowITSMTypeFieldsRt, rt.strict({ name: rt.string })]),
   rt.intersection([ConnectorServiceNowSIRTypeFieldsRt, rt.strict({ name: rt.string })]),
   rt.intersection([ConnectorSwimlaneTypeFieldsRt, rt.strict({ name: rt.string })]),
+  rt.intersection([ConnectorTheHiveTypeFieldsRt, rt.strict({ name: rt.string })]),
 ]);
 
 export const CaseConnectorRt = rt.intersection([
@@ -205,3 +223,4 @@ export type ConnectorServiceNowITSMTypeFields = rt.TypeOf<
   typeof ConnectorServiceNowITSMTypeFieldsRt
 >;
 export type ConnectorServiceNowSIRTypeFields = rt.TypeOf<typeof ConnectorServiceNowSIRTypeFieldsRt>;
+export type ConnectorTheHiveTypeFields = rt.TypeOf<typeof ConnectorTheHiveTypeFieldsRt>;

x-pack/plugins/cases/public/components/connectors/index.ts

@@ -12,12 +12,14 @@ import { getCaseConnector as getSwimlaneCaseConnector } from './swimlane';
 import { getCaseConnector as getResilientCaseConnector } from './resilient';
 import { getCaseConnector as getCasesWebhookCaseConnector } from './cases_webhook';
 import { getServiceNowITSMCaseConnector, getServiceNowSIRCaseConnector } from './servicenow';
+import { getCaseConnector as getTheHiveCaseConnector } from './thehive';
 import type {
   JiraFieldsType,
   ServiceNowITSMFieldsType,
   ServiceNowSIRFieldsType,
   ResilientFieldsType,
   SwimlaneFieldsType,
+  TheHiveFieldsType,
 } from '../../../common/types/domain';
 
 export * from './types';
@@ -43,6 +45,7 @@ class CaseConnectors {
     this.caseConnectorsRegistry.register<ServiceNowSIRFieldsType>(getServiceNowSIRCaseConnector());
     this.caseConnectorsRegistry.register<SwimlaneFieldsType>(getSwimlaneCaseConnector());
     this.caseConnectorsRegistry.register<null>(getCasesWebhookCaseConnector());
+    this.caseConnectorsRegistry.register<TheHiveFieldsType>(getTheHiveCaseConnector());
   }
 
   registry(): CaseConnectorsRegistry {

x-pack/plugins/cases/public/components/connectors/mock.ts

@@ -35,6 +35,16 @@ export const swimlaneConnector = {
   isSystemAction: false,
 };
 
+export const theHiveConnector = {
+  id: '123',
+  name: 'My connector',
+  actionTypeId: '.thehive',
+  config: {},
+  isPreconfigured: false,
+  isDeprecated: false,
+  isSystemAction: false,
+};
+
 export const issues = [
   { id: 'personId', title: 'Person Task', key: 'personKey' },
   { id: 'womanId', title: 'Woman Task', key: 'womanKey' },

x-pack/plugins/cases/public/components/connectors/thehive/case_fields.test.tsx

@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import userEvent from '@testing-library/user-event';
+import { screen } from '@testing-library/react';
+import Fields from './case_fields';
+import { theHiveConnector as connector } from '../mock';
+import { MockFormWrapperComponent } from '../test_utils';
+import type { AppMockRenderer } from '../../../common/mock';
+import { createAppMockRenderer } from '../../../common/mock';
+import { TheHiveTLP } from './types';
+
+describe('TheHive Cases Fields', () => {
+  const fields = {
+    TLP: '1',
+  };
+
+  let appMockRenderer: AppMockRenderer;
+
+  beforeEach(() => {
+    appMockRenderer = createAppMockRenderer();
+    jest.clearAllMocks();
+  });
+
+  it('all params fields are rendered', () => {
+    appMockRenderer.render(
+      <MockFormWrapperComponent fields={fields}>
+        <Fields connector={connector} />
+      </MockFormWrapperComponent>
+    );
+
+    expect(screen.getByText('TLP')).toBeInTheDocument();
+  });
+
+  it('sets TLP correctly', async () => {
+    appMockRenderer.render(
+      <MockFormWrapperComponent fields={fields}>
+        <Fields connector={connector} />
+      </MockFormWrapperComponent>
+    );
+
+    userEvent.selectOptions(screen.getByTestId('tlp-field'), '4');
+    expect(await screen.findByTestId('tlp-field')).toHaveValue(TheHiveTLP.RED);
+  });
+});

x-pack/plugins/cases/public/components/connectors/thehive/case_fields.tsx

@@ -0,0 +1,71 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { SelectField } from '@kbn/es-ui-shared-plugin/static/forms/components';
+import { UseField } from '@kbn/es-ui-shared-plugin/static/forms/hook_form_lib';
+import { fieldValidators } from '@kbn/es-ui-shared-plugin/static/forms/helpers';
+import type { ConnectorFieldsProps } from '../types';
+import * as i18n from './translations';
+import { TheHiveTLP } from './types';
+
+const { emptyField } = fieldValidators;
+
+const tlpOptions: Array<{ text: string; value: string }> = [
+  {
+    text: 'CLEAR',
+    value: TheHiveTLP.CLEAR,
+  },
+  {
+    text: 'GREEN',
+    value: TheHiveTLP.GREEN,
+  },
+  {
+    text: 'AMBER',
+    value: TheHiveTLP.AMBER,
+  },
+  {
+    text: 'AMBER+STRICT',
+    value: TheHiveTLP.AMBER_STRICT,
+  },
+  {
+    text: 'RED',
+    value: TheHiveTLP.RED,
+  },
+];
+
+const TheHiveFieldsComponent: React.FunctionComponent<ConnectorFieldsProps> = () => {
+  return (
+    <div data-test-subj={'connector-fields-Thehive'}>
+      <UseField
+        path="fields.tlp"
+        component={SelectField}
+        config={{
+          label: i18n.TLP_LABEL,
+          validations: [
+            {
+              validator: emptyField(i18n.TLP_REQUIRED),
+            },
+          ],
+        }}
+        componentProps={{
+          euiFieldProps: {
+            'data-test-subj': 'tlp-field',
+            options: tlpOptions,
+            fullWidth: true,
+            hasNoInitialSelection: true,
+          },
+        }}
+      />
+    </div>
+  );
+};
+
+TheHiveFieldsComponent.displayName = 'ThehiveFields';
+
+// eslint-disable-next-line import/no-default-export
+export { TheHiveFieldsComponent as default };

x-pack/plugins/cases/public/components/connectors/thehive/case_fields_preview.test.tsx

@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { screen } from '@testing-library/react';
+import FieldsPreview from './case_fields_preview';
+import type { AppMockRenderer } from '../../../common/mock';
+import { theHiveConnector } from '../mock';
+import { createAppMockRenderer } from '../../../common/mock';
+import { createQueryWithMarkup } from '../../../common/test_utils';
+
+describe('TheHive Fields: Preview', () => {
+  const fields = {
+    tlp: '1',
+  };
+
+  let appMockRenderer: AppMockRenderer;
+
+  beforeEach(() => {
+    appMockRenderer = createAppMockRenderer();
+    jest.clearAllMocks();
+  });
+
+  it('renders all fields correctly', () => {
+    appMockRenderer.render(<FieldsPreview connector={theHiveConnector} fields={fields} />);
+
+    const getByText = createQueryWithMarkup(screen.getByText);
+    expect(getByText('TLP: GREEN')).toBeInTheDocument();
+  });
+});

x-pack/plugins/cases/public/components/connectors/thehive/case_fields_preview.tsx

@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useMemo } from 'react';
+
+import type { TheHiveFieldsType } from '../../../../common/types/domain';
+import { ConnectorTypes } from '../../../../common/types/domain';
+import type { ConnectorFieldsPreviewProps } from '../types';
+import { ConnectorCard } from '../card';
+import * as i18n from './translations';
+
+const mapTLP = (tlpValue: number | string): string => {
+  switch (tlpValue) {
+    case '0':
+      return 'CLEAR';
+    case '1':
+      return 'GREEN';
+    case '2':
+      return 'AMBER';
+    case '3':
+      return 'AMBER+STRICT';
+    case '4':
+      return 'RED';
+    default:
+      return 'AMBER';
+  }
+};
+
+const TheHiveFieldsPreviewComponent: React.FunctionComponent<
+  ConnectorFieldsPreviewProps<TheHiveFieldsType>
+> = ({ fields, connector }) => {
+  const { tlp } = fields ?? {};
+
+  const listItems = useMemo(
+    () => [
+      ...(tlp !== null
+        ? [
+            {
+              title: i18n.TLP_LABEL,
+              description: mapTLP(tlp),
+            },
+          ]
+        : []),
+    ],
+    [tlp]
+  );
+
+  return (
+    <ConnectorCard
+      connectorType={ConnectorTypes.theHive}
+      isLoading={false}
+      listItems={listItems}
+      title={connector.name}
+    />
+  );
+};
+
+TheHiveFieldsPreviewComponent.displayName = 'TheHiveFieldsPreview';
+
+// eslint-disable-next-line import/no-default-export
+export { TheHiveFieldsPreviewComponent as default };

x-pack/plugins/cases/public/components/connectors/thehive/index.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { lazy } from 'react';
+
+import type { CaseConnector } from '../types';
+import type { TheHiveFieldsType } from '../../../../common/types/domain';
+import { ConnectorTypes } from '../../../../common/types/domain';
+
+export * from './types';
+
+export const getCaseConnector = (): CaseConnector<TheHiveFieldsType> => ({
+  id: ConnectorTypes.theHive,
+  fieldsComponent: lazy(() => import('./case_fields')),
+  previewComponent: lazy(() => import('./case_fields_preview')),
+});

x-pack/plugins/cases/public/components/connectors/thehive/translations.ts

@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+
+export const TLP_LABEL = i18n.translate(
+  'xpack.cases.connectors.thehive.tlpLable',
+  {
+    defaultMessage: 'TLP',
+  }
+);
+
+export const TLP_REQUIRED = i18n.translate(
+  'xpack.cases.connectors.thehive.tlpLableRequired',
+  {
+    defaultMessage: 'TLP is required',
+  }
+);

x-pack/plugins/cases/public/components/connectors/thehive/types.ts

@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export enum TheHiveTLP {
+  CLEAR = "0",
+  GREEN = "1",
+  AMBER = "2",
+  AMBER_STRICT = "3",
+  RED = "4" 
+}