[SIEM][Detection Engine] REST API Additions #50514

FrankHassanabad · 2019-11-13T18:43:47Z

Summary

Added these to the create and update API:

tags - Array string type (default [])
False positives - Array string type (default [])
immutable - boolean (default -- false)

Added these instructions to the READM.md

Added "brew install jq" for all the scripts to work in the scripts folder in README.md
Added tip for debug logging

Changed these shell scripts:

Removed the delete all api keys from the hard_reset script
Changed the script for converting to rules to use the new immutable flag.

Testing

Added unit tests for new schema types
Added ad-hoc test for scripts
Test ran through the saved searches

Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

~~- [ ] This was checked for cross-browser compatibility, including a check against IE11~~

~~- [ ] Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support~~

~~- [ ] Documentation was added for features that require explanation or tutorials~~

Unit or functional tests were updated or added to match the most common scenarios

~~- [ ] This was checked for keyboard-only and screenreader accessibility~~

For maintainers

~~- [ ] This was checked for breaking API changes and was labeled appropriately~~

~~- [ ] This includes a feature addition or change that requires a release note and was labeled appropriately~~

* Added "brew install jq" for all the scripts to work in the scripts folder in README.md * Removed the delete all api keys from the hard_reset script

elasticmachine · 2019-11-13T18:54:00Z

Pinging @elastic/siem (Team:SIEM)

elasticmachine · 2019-11-13T20:01:20Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: b16e661

elasticmachine · 2019-11-13T21:03:56Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 936e50b

spong · 2019-11-13T22:29:12Z

x-pack/legacy/plugins/siem/server/lib/detection_engine/README.md

+logging.verbose: true
+logging.events:
+  {
+    log: ['siem', 'info', 'warning', 'error', 'fatal'],
+    request: ['info', 'warning', 'error', 'fatal'],
+    error: '*',
+    ops: __no-ops__,
+  }


Thanks for adding this -- has been very helpful in development! 🙂

x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/types.ts

spong

One comment about types, but if no change necessary LGTM! 👍

Thanks for these quick and timely additions @FrankHassanabad -- will start making using of these new fields as soon as it gets merged! 😁

elasticmachine · 2019-11-14T00:13:16Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: d3b92f3

## Summary Added these to the create and update API: * tags - Array string type (default []) * False positives - Array string type (default []) * immutable - boolean (default -- false) Added these instructions to the READM.md * Added "brew install jq" for all the scripts to work in the scripts folder in README.md * Added tip for debug logging Changed these shell scripts: * Removed the delete all api keys from the hard_reset script * Changed the script for converting to rules to use the new immutable flag. Testing * Added unit tests for new schema types * Added ad-hoc test for scripts * Test ran through the saved searches ### Checklist Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR. ~~- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~~ ~~- [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~~ ~~- [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~~ - [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios ~~- [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~~ ### For maintainers ~~- [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~ ~~- [ ] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~

* 'master' of github.com:elastic/kibana: (27 commits) [Rollup] Fix for clone job workflow (elastic#50501) Empty message "No data available" for Labels and User metadata sections missing (elastic#49846) [APM] Duration by Country map doesn't take `transactionName` into account (elastic#50315) Remove react references from core `Notifications` apis (elastic#49573) Updated APM Indices endpoints to use the SavedObjectsClient from the legacy request context, and set the apm-indices schema object to be namspace-agnostic [Metrics UI] Calculate interval based on the dataset's period (elastic#50194) chore(NA): add new platform discovered plugins as entry points to check for dependencies on clean dll tasks (elastic#50610) [Telemetry] change of optin status telemetry (elastic#50158) [SIEM][Detection Engine] REST API Additions (elastic#50514) [DOCS] Removes dashboard-only mode doc (elastic#50441) [Filters] Fix operator overflowing out popover (elastic#50030) Change telemetry optIn to default to true (elastic#50490) [Maps] make grid rectangles the default symbolization for geo grid source (elastic#50169) Allow registered applications to hide Kibana chrome (elastic#49795) Upgrade EUI to v14.9.0 (elastic#49678) [Metrics UI] Convert layouts to use React components (elastic#49134) [Search service] Add support for ES request preference (elastic#49424) [Newsfeed/Lint] fix chained fn lint (elastic#50515) [Monitoring] Fix logstash pipelines page in multi-cluster environment (elastic#50166) [SIEM] Events viewer fixes (elastic#50175) ...

FrankHassanabad added 2 commits November 13, 2019 10:06

* Added jq install instructions to README.md

cf35573

* Added "brew install jq" for all the scripts to work in the scripts folder in README.md * Removed the delete all api keys from the hard_reset script

Added types and tests for the schema and the new types

b4c43a2

FrankHassanabad added the release_note:enhancement label Nov 13, 2019

FrankHassanabad self-assigned this Nov 13, 2019

Removed TODO blocks to prevent linter issues

b16e661

FrankHassanabad added v8.0.0 v7.6.0 Team:SIEM labels Nov 13, 2019

Merge branch 'master' into api-updates

936e50b

spong reviewed Nov 13, 2019

View reviewed changes

x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/types.ts Outdated Show resolved Hide resolved

spong approved these changes Nov 13, 2019

View reviewed changes

FrankHassanabad added 2 commits November 13, 2019 15:44

PR comment fixes

15e0336

Fixed update handler that was incorrect now that types are correct

d3b92f3

FrankHassanabad merged commit 6f7ca4a into elastic:master Nov 14, 2019

FrankHassanabad deleted the api-updates branch November 14, 2019 00:13

FrankHassanabad mentioned this pull request Nov 14, 2019

[7.x] [SIEM][Detection Engine] REST API Additions (#50514) #50584

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SIEM][Detection Engine] REST API Additions #50514

[SIEM][Detection Engine] REST API Additions #50514

FrankHassanabad commented Nov 13, 2019 •

edited

Loading

elasticmachine commented Nov 13, 2019

elasticmachine commented Nov 13, 2019

elasticmachine commented Nov 13, 2019

spong Nov 13, 2019

spong left a comment

elasticmachine commented Nov 14, 2019

[SIEM][Detection Engine] REST API Additions #50514

[SIEM][Detection Engine] REST API Additions #50514

Conversation

FrankHassanabad commented Nov 13, 2019 • edited Loading

Summary

Checklist

For maintainers

elasticmachine commented Nov 13, 2019

elasticmachine commented Nov 13, 2019

💔 Build Failed

elasticmachine commented Nov 13, 2019

💚 Build Succeeded

spong Nov 13, 2019

Choose a reason for hiding this comment

spong left a comment

Choose a reason for hiding this comment

elasticmachine commented Nov 14, 2019

💚 Build Succeeded

FrankHassanabad commented Nov 13, 2019 •

edited

Loading