Skip to content

Commit b9a41a7

Browse files
nnamdifrankiennamdifrankie
committed
EMT-339: absorb master changes
1 parent 45790d0 commit b9a41a7

File tree

7 files changed

+203
-298
lines changed

7 files changed

+203
-298
lines changed

‎x-pack/plugins/endpoint/common/generate_data.ts‎

Lines changed: 78 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import {
1313
HostMetadata,
1414
HostOS,
1515
HostPolicyResponse,
16-
HostPolicyResponseActions,
1716
HostPolicyResponseActionStatus,
1817
PolicyData,
1918
} from './types';
@@ -564,88 +563,108 @@ export class EndpointDocGenerator {
564563
endpoint: {
565564
policy: {
566565
applied: {
567-
actions: {
568-
configure_elasticsearch_connection: {
569-
message: 'elasticsearch communications configured successfully',
566+
actions: [
567+
{
568+
name: 'configure_elasticsearch_connection',
569+
message: 'elasticsearch comes configured successfully',
570570
status: HostPolicyResponseActionStatus.success,
571571
},
572-
configure_kernel: {
572+
{
573+
name: 'configure_kernel',
573574
message: 'Failed to configure kernel',
574575
status: HostPolicyResponseActionStatus.failure,
575576
},
576-
configure_logging: {
577+
{
578+
name: 'configure_logging',
577579
message: 'Successfully configured logging',
578580
status: HostPolicyResponseActionStatus.success,
579581
},
580-
configure_malware: {
582+
{
583+
name: 'configure_malware',
581584
message: 'Unexpected error configuring malware',
582585
status: HostPolicyResponseActionStatus.failure,
583586
},
584-
connect_kernel: {
587+
{
588+
name: 'connect_kernel',
585589
message: 'Successfully initialized minifilter',
586590
status: HostPolicyResponseActionStatus.success,
587591
},
588-
detect_file_open_events: {
592+
{
593+
name: 'detect_file_open_events',
589594
message: 'Successfully stopped file open event reporting',
590595
status: HostPolicyResponseActionStatus.success,
591596
},
592-
detect_file_write_events: {
597+
{
598+
name: 'detect_file_write_events',
593599
message: 'Failed to stop file write event reporting',
594600
status: HostPolicyResponseActionStatus.success,
595601
},
596-
detect_image_load_events: {
602+
{
603+
name: 'detect_image_load_events',
597604
message: 'Successfully started image load event reporting',
598605
status: HostPolicyResponseActionStatus.success,
599606
},
600-
detect_process_events: {
607+
{
608+
name: 'detect_process_events',
601609
message: 'Successfully started process event reporting',
602610
status: HostPolicyResponseActionStatus.success,
603611
},
604-
download_global_artifacts: {
605-
message: 'Succesfully downloaded global artifacts',
612+
{
613+
name: 'download_global_artifacts',
614+
message: 'Failed to download EXE model',
606615
status: HostPolicyResponseActionStatus.success,
607616
},
608-
load_config: {
617+
{
618+
name: 'load_config',
609619
message: 'Successfully parsed configuration',
610620
status: HostPolicyResponseActionStatus.success,
611621
},
612-
load_malware_model: {
613-
message: 'Successfully loaded malware model',
622+
{
623+
name: 'load_malware_mode',
624+
message: 'Error deserializing EXE model; no valid malware model installed',
614625
status: HostPolicyResponseActionStatus.success,
615626
},
616-
read_elasticsearch_config: {
627+
{
628+
name: 'read_elasticsearch_config',
617629
message: 'Successfully read Elasticsearch configuration',
618630
status: HostPolicyResponseActionStatus.success,
619631
},
620-
read_events_config: {
632+
{
633+
name: 'read_events_config',
621634
message: 'Successfully read events configuration',
622635
status: HostPolicyResponseActionStatus.success,
623636
},
624-
read_kernel_config: {
637+
{
638+
name: 'read_kernel_config',
625639
message: 'Succesfully read kernel configuration',
626640
status: HostPolicyResponseActionStatus.success,
627641
},
628-
read_logging_config: {
629-
message: 'field (logging.debugview) not found in config',
642+
{
643+
name: 'read_logging_config',
644+
message: 'Field (logging.debugview) not found in config',
630645
status: HostPolicyResponseActionStatus.success,
631646
},
632-
read_malware_config: {
647+
{
648+
name: 'read_malware_config',
633649
message: 'Successfully read malware detect configuration',
634650
status: HostPolicyResponseActionStatus.success,
635651
},
636-
workflow: {
652+
{
653+
name: 'workflow',
637654
message: 'Failed to apply a portion of the configuration (kernel)',
638655
status: HostPolicyResponseActionStatus.success,
639656
},
640-
download_model: {
657+
{
658+
name: 'download_model',
641659
message: 'Failed to apply a portion of the configuration (kernel)',
642660
status: HostPolicyResponseActionStatus.success,
643661
},
644-
ingest_events_config: {
662+
{
663+
name: 'ingest_events_config',
645664
message: 'Failed to apply a portion of the configuration (kernel)',
646665
status: HostPolicyResponseActionStatus.success,
647666
},
648-
},
667+
],
649668
id: this.commonInfo.endpoint.policy.id,
650669
policy: {
651670
id: this.commonInfo.endpoint.policy.id,
@@ -658,17 +677,37 @@ export class EndpointDocGenerator {
658677
status: status(),
659678
},
660679
logging: {
661-
concerned_actions: this.randomHostPolicyResponseActions(),
680+
concerned_actions: this.randomHostPolicyResponseActionNames(),
662681
status: status(),
663682
},
664683
malware: {
665-
concerned_actions: this.randomHostPolicyResponseActions(),
684+
concerned_actions: this.randomHostPolicyResponseActionNames(),
666685
status: status(),
667686
},
668687
streaming: {
669-
concerned_actions: this.randomHostPolicyResponseActions(),
670-
status: status(),
671-
},
688+
concerned_actions: this.randomHostPolicyResponseActionNames(),
689+
status:status(),
690+
}
691+
},
692+
},
693+
artifacts: {
694+
global: {
695+
version: '1.4.0',
696+
identifiers: [
697+
{
698+
name: 'endpointpe-model',
699+
sha256: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
700+
},
701+
],
702+
},
703+
user: {
704+
version: '1.4.0',
705+
identifiers: [
706+
{
707+
name: 'user-model',
708+
sha256: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
709+
},
710+
],
672711
},
673712
},
674713
status: this.randomHostPolicyResponseActionStatus(),
@@ -679,7 +718,12 @@ export class EndpointDocGenerator {
679718
event: {
680719
created: ts,
681720
id: this.seededUUIDv4(),
682-
kind: 'policy_response',
721+
kind: 'state',
722+
category: 'host',
723+
type: 'change',
724+
module: 'endpoint',
725+
action: 'endpoint_policy_response',
726+
dataset: 'endpoint.policy',
683727
},
684728
};
685729
}
@@ -728,7 +772,7 @@ export class EndpointDocGenerator {
728772
return uuid.v4({ random: [...this.randomNGenerator(255, 16)] });
729773
}
730774

731-
private randomHostPolicyResponseActions(): Array<keyof HostPolicyResponseActions> {
775+
private randomHostPolicyResponseActionNames(): string[] {
732776
return this.randomArray(this.randomN(8), () =>
733777
this.randomChoice([
734778
'load_config',

‎x-pack/plugins/endpoint/common/types.ts‎

Lines changed: 28 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -611,47 +611,27 @@ export enum HostPolicyResponseActionStatus {
611611
}
612612

613613
/**
614-
* The details of a given action
614+
* Host Policy Response Applied Action
615615
*/
616-
export interface HostPolicyResponseActionDetails {
616+
export interface HostPolicyResponseAppliedAction {
617+
name: string;
617618
status: HostPolicyResponseActionStatus;
618619
message: string;
619620
}
620621

621-
/**
622-
* A known list of possible Endpoint actions
623-
*/
624-
export interface HostPolicyResponseActions {
625-
download_model: HostPolicyResponseActionDetails;
626-
ingest_events_config: HostPolicyResponseActionDetails;
627-
workflow: HostPolicyResponseActionDetails;
628-
configure_elasticsearch_connection: HostPolicyResponseActionDetails;
629-
configure_kernel: HostPolicyResponseActionDetails;
630-
configure_logging: HostPolicyResponseActionDetails;
631-
configure_malware: HostPolicyResponseActionDetails;
632-
connect_kernel: HostPolicyResponseActionDetails;
633-
detect_file_open_events: HostPolicyResponseActionDetails;
634-
detect_file_write_events: HostPolicyResponseActionDetails;
635-
detect_image_load_events: HostPolicyResponseActionDetails;
636-
detect_process_events: HostPolicyResponseActionDetails;
637-
download_global_artifacts: HostPolicyResponseActionDetails;
638-
load_config: HostPolicyResponseActionDetails;
639-
load_malware_model: HostPolicyResponseActionDetails;
640-
read_elasticsearch_config: HostPolicyResponseActionDetails;
641-
read_events_config: HostPolicyResponseActionDetails;
642-
read_kernel_config: HostPolicyResponseActionDetails;
643-
read_logging_config: HostPolicyResponseActionDetails;
644-
read_malware_config: HostPolicyResponseActionDetails;
645-
}
646-
647-
/**
648-
* policy configurations returned by the endpoint in response to a user applying a policy
649-
*/
650622
export type HostPolicyResponseConfiguration = HostPolicyResponse['endpoint']['policy']['applied']['response']['configurations'];
651623

652624
interface HostPolicyResponseConfigurationStatus {
653625
status: HostPolicyResponseActionStatus;
654-
concerned_actions: Array<keyof HostPolicyResponseActions>;
626+
concerned_actions: string[];
627+
}
628+
629+
/**
630+
* Host Policy Response Applied Artifact
631+
*/
632+
interface HostPolicyResponseAppliedArtifact {
633+
name: string;
634+
sha256: string;
655635
}
656636

657637
/**
@@ -674,6 +654,11 @@ export interface HostPolicyResponse {
674654
created: number;
675655
kind: string;
676656
id: string;
657+
category: string;
658+
type: string;
659+
module: string;
660+
action: string;
661+
dataset: string;
677662
};
678663
agent: {
679664
version: string;
@@ -685,7 +670,7 @@ export interface HostPolicyResponse {
685670
version: string;
686671
id: string;
687672
status: HostPolicyResponseActionStatus;
688-
actions: Partial<HostPolicyResponseActions>;
673+
actions: HostPolicyResponseAppliedAction[];
689674
policy: {
690675
id: string;
691676
version: string;
@@ -698,6 +683,16 @@ export interface HostPolicyResponse {
698683
streaming: HostPolicyResponseConfigurationStatus;
699684
};
700685
};
686+
artifacts: {
687+
global: {
688+
version: string;
689+
identifiers: HostPolicyResponseAppliedArtifact[];
690+
};
691+
user: {
692+
version: string;
693+
identifiers: HostPolicyResponseAppliedArtifact[];
694+
};
695+
};
701696
};
702697
};
703698
};

‎x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/selectors.ts‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,10 @@ import querystring from 'querystring';
77
import { createSelector } from 'reselect';
88
import {
99
Immutable,
10-
HostPolicyResponseActions,
10+
HostPolicyResponseAppliedAction,
1111
HostPolicyResponseConfiguration,
1212
HostPolicyResponseActionStatus,
13+
ImmutableArray,
1314
} from '../../../../../common/types';
1415
import { HostState, HostIndexUIQueryParams } from '../../types';
1516

@@ -62,7 +63,8 @@ export const policyResponseFailedOrWarningActionCount: (
6263
Object.entries(applied.response.configurations).map(([key, val]) => {
6364
let count = 0;
6465
for (const action of val.concerned_actions) {
65-
const actionStatus = applied.actions[action]?.status;
66+
const actionStatus = applied.actions.find(policyActions => policyActions.name === action)
67+
?.status;
6668
if (
6769
actionStatus === HostPolicyResponseActionStatus.failure ||
6870
actionStatus === HostPolicyResponseActionStatus.warning
@@ -81,7 +83,7 @@ export const policyResponseFailedOrWarningActionCount: (
8183
*/
8284
export const policyResponseActions: (
8385
state: Immutable<HostState>
84-
) => undefined | Partial<HostPolicyResponseActions> = createSelector(
86+
) => undefined | ImmutableArray<HostPolicyResponseAppliedAction> = createSelector(
8587
detailsPolicyAppliedResponse,
8688
applied => {
8789
return applied?.actions;

‎x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/details/index.tsx‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ const PolicyResponseFlyoutPanel = memo<{
109109
}>(({ hostMeta }) => {
110110
const { show, ...queryParams } = useHostSelector(uiQueryParams);
111111
const responseConfig = useHostSelector(policyResponseConfigurations);
112-
const responseActionStatus = useHostSelector(policyResponseActions);
112+
const responseActions = useHostSelector(policyResponseActions);
113113
const responseAttentionCount = useHostSelector(policyResponseFailedOrWarningActionCount);
114114
const loading = useHostSelector(policyResponseLoading);
115115
const error = useHostSelector(policyResponseError);
@@ -158,11 +158,10 @@ const PolicyResponseFlyoutPanel = memo<{
158158
/>
159159
)}
160160
{loading && <EuiLoadingContent lines={3} />}
161-
162-
{responseConfig !== undefined && responseActionStatus !== undefined && (
161+
{responseConfig !== undefined && responseActions !== undefined && (
163162
<PolicyResponse
164163
responseConfig={responseConfig}
165-
responseActionStatus={responseActionStatus}
164+
responseActions={responseActions}
166165
responseAttentionCount={responseAttentionCount}
167166
/>
168167
)}

0 commit comments

Comments
 (0)