Skip to content

Commit e4c68f1

Browse files
nnamdifrankiennamdifrankie
authored
[Endpoint]EMT-339: add new policy response schema (#66264)
[Endpoint]EMT-339: add new policy response schema
1 parent 0fbbc78 commit e4c68f1

File tree

7 files changed

+224
-295
lines changed

7 files changed

+224
-295
lines changed

‎x-pack/plugins/endpoint/common/generate_data.ts‎

Lines changed: 76 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import {
1313
HostMetadata,
1414
HostOS,
1515
HostPolicyResponse,
16-
HostPolicyResponseActions,
1716
HostPolicyResponseActionStatus,
1817
PolicyData,
1918
} from './types';
@@ -564,88 +563,108 @@ export class EndpointDocGenerator {
564563
endpoint: {
565564
policy: {
566565
applied: {
567-
actions: {
568-
configure_elasticsearch_connection: {
569-
message: 'elasticsearch communications configured successfully',
566+
actions: [
567+
{
568+
name: 'configure_elasticsearch_connection',
569+
message: 'elasticsearch comes configured successfully',
570570
status: HostPolicyResponseActionStatus.success,
571571
},
572-
configure_kernel: {
572+
{
573+
name: 'configure_kernel',
573574
message: 'Failed to configure kernel',
574575
status: HostPolicyResponseActionStatus.failure,
575576
},
576-
configure_logging: {
577+
{
578+
name: 'configure_logging',
577579
message: 'Successfully configured logging',
578580
status: HostPolicyResponseActionStatus.success,
579581
},
580-
configure_malware: {
582+
{
583+
name: 'configure_malware',
581584
message: 'Unexpected error configuring malware',
582585
status: HostPolicyResponseActionStatus.failure,
583586
},
584-
connect_kernel: {
587+
{
588+
name: 'connect_kernel',
585589
message: 'Successfully initialized minifilter',
586590
status: HostPolicyResponseActionStatus.success,
587591
},
588-
detect_file_open_events: {
592+
{
593+
name: 'detect_file_open_events',
589594
message: 'Successfully stopped file open event reporting',
590595
status: HostPolicyResponseActionStatus.success,
591596
},
592-
detect_file_write_events: {
597+
{
598+
name: 'detect_file_write_events',
593599
message: 'Failed to stop file write event reporting',
594600
status: HostPolicyResponseActionStatus.success,
595601
},
596-
detect_image_load_events: {
602+
{
603+
name: 'detect_image_load_events',
597604
message: 'Successfully started image load event reporting',
598605
status: HostPolicyResponseActionStatus.success,
599606
},
600-
detect_process_events: {
607+
{
608+
name: 'detect_process_events',
601609
message: 'Successfully started process event reporting',
602610
status: HostPolicyResponseActionStatus.success,
603611
},
604-
download_global_artifacts: {
605-
message: 'Succesfully downloaded global artifacts',
612+
{
613+
name: 'download_global_artifacts',
614+
message: 'Failed to download EXE model',
606615
status: HostPolicyResponseActionStatus.success,
607616
},
608-
load_config: {
617+
{
618+
name: 'load_config',
609619
message: 'Successfully parsed configuration',
610620
status: HostPolicyResponseActionStatus.success,
611621
},
612-
load_malware_model: {
613-
message: 'Successfully loaded malware model',
622+
{
623+
name: 'load_malware_mode',
624+
message: 'Error deserializing EXE model; no valid malware model installed',
614625
status: HostPolicyResponseActionStatus.success,
615626
},
616-
read_elasticsearch_config: {
627+
{
628+
name: 'read_elasticsearch_config',
617629
message: 'Successfully read Elasticsearch configuration',
618630
status: HostPolicyResponseActionStatus.success,
619631
},
620-
read_events_config: {
632+
{
633+
name: 'read_events_config',
621634
message: 'Successfully read events configuration',
622635
status: HostPolicyResponseActionStatus.success,
623636
},
624-
read_kernel_config: {
637+
{
638+
name: 'read_kernel_config',
625639
message: 'Succesfully read kernel configuration',
626640
status: HostPolicyResponseActionStatus.success,
627641
},
628-
read_logging_config: {
629-
message: 'field (logging.debugview) not found in config',
642+
{
643+
name: 'read_logging_config',
644+
message: 'Field (logging.debugview) not found in config',
630645
status: HostPolicyResponseActionStatus.success,
631646
},
632-
read_malware_config: {
647+
{
648+
name: 'read_malware_config',
633649
message: 'Successfully read malware detect configuration',
634650
status: HostPolicyResponseActionStatus.success,
635651
},
636-
workflow: {
652+
{
653+
name: 'workflow',
637654
message: 'Failed to apply a portion of the configuration (kernel)',
638655
status: HostPolicyResponseActionStatus.success,
639656
},
640-
download_model: {
657+
{
658+
name: 'download_model',
641659
message: 'Failed to apply a portion of the configuration (kernel)',
642660
status: HostPolicyResponseActionStatus.success,
643661
},
644-
ingest_events_config: {
662+
{
663+
name: 'ingest_events_config',
645664
message: 'Failed to apply a portion of the configuration (kernel)',
646665
status: HostPolicyResponseActionStatus.success,
647666
},
648-
},
667+
],
649668
id: this.commonInfo.endpoint.policy.id,
650669
policy: {
651670
id: this.commonInfo.endpoint.policy.id,
@@ -658,19 +677,39 @@ export class EndpointDocGenerator {
658677
status: status(),
659678
},
660679
logging: {
661-
concerned_actions: this.randomHostPolicyResponseActions(),
680+
concerned_actions: this.randomHostPolicyResponseActionNames(),
662681
status: status(),
663682
},
664683
malware: {
665-
concerned_actions: this.randomHostPolicyResponseActions(),
684+
concerned_actions: this.randomHostPolicyResponseActionNames(),
666685
status: status(),
667686
},
668687
streaming: {
669-
concerned_actions: this.randomHostPolicyResponseActions(),
688+
concerned_actions: this.randomHostPolicyResponseActionNames(),
670689
status: status(),
671690
},
672691
},
673692
},
693+
artifacts: {
694+
global: {
695+
version: '1.4.0',
696+
identifiers: [
697+
{
698+
name: 'endpointpe-model',
699+
sha256: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
700+
},
701+
],
702+
},
703+
user: {
704+
version: '1.4.0',
705+
identifiers: [
706+
{
707+
name: 'user-model',
708+
sha256: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
709+
},
710+
],
711+
},
712+
},
674713
status: this.randomHostPolicyResponseActionStatus(),
675714
version: policyVersion,
676715
},
@@ -679,7 +718,12 @@ export class EndpointDocGenerator {
679718
event: {
680719
created: ts,
681720
id: this.seededUUIDv4(),
682-
kind: 'policy_response',
721+
kind: 'state',
722+
category: 'host',
723+
type: 'change',
724+
module: 'endpoint',
725+
action: 'endpoint_policy_response',
726+
dataset: 'endpoint.policy',
683727
},
684728
};
685729
}
@@ -728,7 +772,7 @@ export class EndpointDocGenerator {
728772
return uuid.v4({ random: [...this.randomNGenerator(255, 16)] });
729773
}
730774

731-
private randomHostPolicyResponseActions(): Array<keyof HostPolicyResponseActions> {
775+
private randomHostPolicyResponseActionNames(): string[] {
732776
return this.randomArray(this.randomN(8), () =>
733777
this.randomChoice([
734778
'load_config',

‎x-pack/plugins/endpoint/common/types.ts‎

Lines changed: 53 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -611,47 +611,53 @@ export enum HostPolicyResponseActionStatus {
611611
}
612612

613613
/**
614-
* The details of a given action
614+
* The name of actions that can be applied during the processing of a policy
615615
*/
616-
export interface HostPolicyResponseActionDetails {
617-
status: HostPolicyResponseActionStatus;
618-
message: string;
619-
}
616+
type HostPolicyActionName =
617+
| 'download_model'
618+
| 'ingest_events_config'
619+
| 'workflow'
620+
| 'configure_elasticsearch_connection'
621+
| 'configure_kernel'
622+
| 'configure_logging'
623+
| 'configure_malware'
624+
| 'connect_kernel'
625+
| 'detect_file_open_events'
626+
| 'detect_file_write_events'
627+
| 'detect_image_load_events'
628+
| 'detect_process_events'
629+
| 'download_global_artifacts'
630+
| 'load_config'
631+
| 'load_malware_model'
632+
| 'read_elasticsearch_config'
633+
| 'read_events_config'
634+
| 'read_kernel_config'
635+
| 'read_logging_config'
636+
| 'read_malware_config'
637+
| string;
620638

621639
/**
622-
* A known list of possible Endpoint actions
640+
* Host Policy Response Applied Action
623641
*/
624-
export interface HostPolicyResponseActions {
625-
download_model: HostPolicyResponseActionDetails;
626-
ingest_events_config: HostPolicyResponseActionDetails;
627-
workflow: HostPolicyResponseActionDetails;
628-
configure_elasticsearch_connection: HostPolicyResponseActionDetails;
629-
configure_kernel: HostPolicyResponseActionDetails;
630-
configure_logging: HostPolicyResponseActionDetails;
631-
configure_malware: HostPolicyResponseActionDetails;
632-
connect_kernel: HostPolicyResponseActionDetails;
633-
detect_file_open_events: HostPolicyResponseActionDetails;
634-
detect_file_write_events: HostPolicyResponseActionDetails;
635-
detect_image_load_events: HostPolicyResponseActionDetails;
636-
detect_process_events: HostPolicyResponseActionDetails;
637-
download_global_artifacts: HostPolicyResponseActionDetails;
638-
load_config: HostPolicyResponseActionDetails;
639-
load_malware_model: HostPolicyResponseActionDetails;
640-
read_elasticsearch_config: HostPolicyResponseActionDetails;
641-
read_events_config: HostPolicyResponseActionDetails;
642-
read_kernel_config: HostPolicyResponseActionDetails;
643-
read_logging_config: HostPolicyResponseActionDetails;
644-
read_malware_config: HostPolicyResponseActionDetails;
642+
export interface HostPolicyResponseAppliedAction {
643+
name: HostPolicyActionName;
644+
status: HostPolicyResponseActionStatus;
645+
message: string;
645646
}
646647

647-
/**
648-
* policy configurations returned by the endpoint in response to a user applying a policy
649-
*/
650648
export type HostPolicyResponseConfiguration = HostPolicyResponse['endpoint']['policy']['applied']['response']['configurations'];
651649

652650
interface HostPolicyResponseConfigurationStatus {
653651
status: HostPolicyResponseActionStatus;
654-
concerned_actions: Array<keyof HostPolicyResponseActions>;
652+
concerned_actions: HostPolicyActionName[];
653+
}
654+
655+
/**
656+
* Host Policy Response Applied Artifact
657+
*/
658+
interface HostPolicyResponseAppliedArtifact {
659+
name: string;
660+
sha256: string;
655661
}
656662

657663
/**
@@ -674,6 +680,11 @@ export interface HostPolicyResponse {
674680
created: number;
675681
kind: string;
676682
id: string;
683+
category: string;
684+
type: string;
685+
module: string;
686+
action: string;
687+
dataset: string;
677688
};
678689
agent: {
679690
version: string;
@@ -685,7 +696,7 @@ export interface HostPolicyResponse {
685696
version: string;
686697
id: string;
687698
status: HostPolicyResponseActionStatus;
688-
actions: Partial<HostPolicyResponseActions>;
699+
actions: HostPolicyResponseAppliedAction[];
689700
policy: {
690701
id: string;
691702
version: string;
@@ -698,6 +709,16 @@ export interface HostPolicyResponse {
698709
streaming: HostPolicyResponseConfigurationStatus;
699710
};
700711
};
712+
artifacts: {
713+
global: {
714+
version: string;
715+
identifiers: HostPolicyResponseAppliedArtifact[];
716+
};
717+
user: {
718+
version: string;
719+
identifiers: HostPolicyResponseAppliedArtifact[];
720+
};
721+
};
701722
};
702723
};
703724
};

‎x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/selectors.ts‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import querystring from 'querystring';
77
import { createSelector } from 'reselect';
88
import {
99
Immutable,
10-
HostPolicyResponseActions,
10+
HostPolicyResponseAppliedAction,
1111
HostPolicyResponseConfiguration,
1212
HostPolicyResponseActionStatus,
1313
} from '../../../../../common/types';
@@ -62,7 +62,8 @@ export const policyResponseFailedOrWarningActionCount: (
6262
Object.entries(applied.response.configurations).map(([key, val]) => {
6363
let count = 0;
6464
for (const action of val.concerned_actions) {
65-
const actionStatus = applied.actions[action]?.status;
65+
const actionStatus = applied.actions.find(policyActions => policyActions.name === action)
66+
?.status;
6667
if (
6768
actionStatus === HostPolicyResponseActionStatus.failure ||
6869
actionStatus === HostPolicyResponseActionStatus.warning
@@ -81,7 +82,7 @@ export const policyResponseFailedOrWarningActionCount: (
8182
*/
8283
export const policyResponseActions: (
8384
state: Immutable<HostState>
84-
) => undefined | Partial<HostPolicyResponseActions> = createSelector(
85+
) => undefined | Immutable<HostPolicyResponseAppliedAction[]> = createSelector(
8586
detailsPolicyAppliedResponse,
8687
applied => {
8788
return applied?.actions;

‎x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/details/index.tsx‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ const PolicyResponseFlyoutPanel = memo<{
109109
}>(({ hostMeta }) => {
110110
const { show, ...queryParams } = useHostSelector(uiQueryParams);
111111
const responseConfig = useHostSelector(policyResponseConfigurations);
112-
const responseActionStatus = useHostSelector(policyResponseActions);
112+
const responseActions = useHostSelector(policyResponseActions);
113113
const responseAttentionCount = useHostSelector(policyResponseFailedOrWarningActionCount);
114114
const loading = useHostSelector(policyResponseLoading);
115115
const error = useHostSelector(policyResponseError);
@@ -158,11 +158,10 @@ const PolicyResponseFlyoutPanel = memo<{
158158
/>
159159
)}
160160
{loading && <EuiLoadingContent lines={3} />}
161-
162-
{responseConfig !== undefined && responseActionStatus !== undefined && (
161+
{responseConfig !== undefined && responseActions !== undefined && (
163162
<PolicyResponse
164163
responseConfig={responseConfig}
165-
responseActionStatus={responseActionStatus}
164+
responseActions={responseActions}
166165
responseAttentionCount={responseAttentionCount}
167166
/>
168167
)}

0 commit comments

Comments
 (0)