[Security Solution] [Cases] Swimlane Connector for Cases by stephmilovic · Pull Request #100086 · elastic/kibana

stephmilovic · 2021-05-13T20:56:08Z

Summary

Adapted from an unmerged PR: #95109
Depends on: #101145

Two parter:

New action connector, type of .swimlane
Add .swimlane as a case connector type

Schema

`params`

Property	Description	Type
subAction	The subaction to perform. It can be `pushToService`.	string
subActionParams	The parameters of the subaction.	object

subActionParams (pushToService)

Property	Description	Type
incident	The Swimlane incident.	object
comments	The comments of the case. A comment is of the form `{ commentId: string, version: string, comment: string }`.	object[] (optional)

The following table describes the properties of the incident object.

Property	Description	Type
alertId	The alert id.	string (optional)
ruleName	The rule name.	string (optional)
caseId	The case id of the incident.	string (optional)
caseName	The case name of the incident.	string (optional)
description	The description of the incident.	string (optional)
severity	The severity of the incident.	string (optional)

Cases

'cases-connector-mappings' are saved to map to caseName for title, description for description and comments for comments
Actual field mappings are done at runtime by referencing the action config id values for caseName, description, and comments

Screenshots

List of connectors

Create connector: Instance configuration

Create connector: Mapping configuration

Create connector: Type Alerts

Create connector: Type Cases

Create alert

Error message on cases

Warning message on alerts

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)

…-connector

x-pack/plugins/actions/server/builtin_action_types/servicenow/schema.ts

x-pack/plugins/actions/server/builtin_action_types/jira/schema.ts

x-pack/plugins/actions/server/builtin_action_types/resilient/schema.ts

x-pack/plugins/cases/server/client/configure/get_fields.ts

x-pack/plugins/cases/server/connectors/index.ts

cnasikas · 2021-06-18T23:28:48Z

@elasticmachine merge upstream

cnasikas · 2021-06-21T08:41:37Z

@elasticmachine merge upstream

pmuellr

LGTM - I made a few comments for things that looked like they weren't quite finished, or provide more diagnostic data, and a note about the DX on the SwimlaneMappingConfig type

x-pack/plugins/actions/server/builtin_action_types/swimlane/service.ts

x-pack/plugins/cases/server/client/cases/utils.ts

.../alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/swimlane.ts

x-pack/plugins/cases/public/components/connectors/swimlane/validator.ts

...ins/triggers_actions_ui/public/application/components/builtin_action_types/swimlane/types.ts

…ana into field_mapping_connector

…_connector

jonathan-buttner

Nice work Christos, Steph, and Xavier! I noticed when testing a swimlane connector configured for alerts that it sends over {{rule.name}} and {{alert.id}} (testing through the creation page UI)

The actual values get populated though when a rule runs though:

Mostly just nit comments, and a few questions.

x-pack/plugins/actions/README.md

jonathan-buttner · 2021-06-21T21:13:09Z

x-pack/plugins/actions/server/builtin_action_types/swimlane/helpers.ts

+
+    if (value) {
+      switch (fieldType) {
+        case 'numeric': {


I might have missed them but should we add some tests for this case?

x-pack/plugins/actions/server/builtin_action_types/swimlane/index.ts

x-pack/plugins/actions/server/builtin_action_types/swimlane/service.test.ts

x-pack/plugins/cases/public/components/connectors/swimlane/validator.ts

jonathan-buttner · 2021-06-22T16:47:57Z

x-pack/plugins/cases/public/components/utils.ts

+      validator: ({ value: connectorId }) => {
+        const connector = getConnectorById(connectorId as string, connectors);
+        if (connector != null) {
+          return validators[connector.actionTypeId]?.(connector);


nit: we could probably get rid of this if by doing return validators[connector.actionTypeId]?.(connector); and have connectorValidator handle undefined | null as input.

I think is best to leave the check in a central place. I would like to avoid other developers to wonder what to return if the connector is null. If they return a message it will be a wrong return value.

...ui/public/application/components/builtin_action_types/swimlane/steps/swimlane_connection.tsx

jonathan-buttner · 2021-06-22T16:57:30Z

...ui/public/application/components/builtin_action_types/swimlane/steps/swimlane_connection.tsx

+        fullWidth
+        helpText={
+          <EuiLink
+            href={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/kibana/${docLinks.DOC_LINK_VERSION}/swimlane-action-type.html`}


Just a note, we need to talk to the docs team to create this right?

I assume it will be created automatically from docs/management/connectors/action-types/swimlane.asciidoc that is included in this PR.

jonathan-buttner · 2021-06-22T17:01:36Z

...ons_ui/public/application/components/builtin_action_types/swimlane/steps/swimlane_fields.tsx

+    [editActionConfig, fieldIdMap, mappings]
+  );
+
+  /**


Thanks for the comment!

cnasikas · 2021-06-23T09:19:09Z

I noticed when testing a swimlane connector configured for alerts that it sends over {{rule.name}} and {{alert.id}} (testing through the creation page UI)

Hey @jonathan-buttner! This is the expected behaviour. When you test a connector there is no alert created so that's why you get the mustache variables instead of real values.

…ana into field_mapping_connector

cnasikas · 2021-06-23T16:15:25Z

@elasticmachine merge upstream

kibanamachine · 2021-06-23T18:20:06Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`cases`	255	261	+6
`triggersActionsUi`	372	385	+13
total			+19

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`cases`	507.8KB	516.9KB	+9.1KB
`triggersActionsUi`	1.7MB	1.7MB	+47.0KB
total			+56.1KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`cases`	126.8KB	129.1KB	+2.3KB
`securitySolution`	197.7KB	197.7KB	+12.0B
`triggersActionsUi`	71.3KB	87.5KB	+16.2KB
total			+18.5KB

Unknown metric groups

async chunk count

id	before	after	diff
`cases`	14	15	+1
`triggersActionsUi`	60	64	+4
total			+5

History

💔 Build #133524 failed e16a51d
💚 Build #133316 succeeded c048432
💚 Build #133221 succeeded ae9b807
💔 Build #132584 failed fc46dcf
💔 Build #132505 failed cf9a26e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

…103165) Co-authored-by: Josh <josh.rickard@swimlane.com> Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com> Co-authored-by: Christos Nasikas <christos.nasikas@elastic.co> Co-authored-by: Jonathan Buttner <jonathan.buttner@elastic.co> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Steph Milovic <stephanie.milovic@elastic.co> Co-authored-by: Josh <josh.rickard@swimlane.com> Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com> Co-authored-by: Jonathan Buttner <jonathan.buttner@elastic.co> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

stephmilovic · 2021-06-23T21:51:15Z

yayyyy!!!

joshswimlane and others added 18 commits March 22, 2021 13:04

Adding swimlane connector

85fe84e

Merge branch 'master' of github.com:elastic/kibana into field_mapping…

cf2eb78

…-connector

clean up + rm rejectUnauthorized

3bb04dc

Merge 3bb04dc into 639f829

badc8f3

Merge branch 'master' of github.com:elastic/kibana into field_mapping…

b76f426

…-connector

Merge b76f426 into d111c27

d243b0e

Merge branch 'field_mapping_connector_2' into field_mapping_connector

9a2f02e

wip

9c7ce14

better types

440fa5e

cases maps

9d9662f

fix types

fa1f749

working on fields

796712c

can push case to swimlane

377fd0a

Merge branch 'master' into field_mapping_connector

9384d9f

working well

6e699b3

fixed jest

1acf2fa

fixing

19a2da7

made connector better

e92dd16

stephmilovic added v8.0.0 Feature:Actions Team:Threat Hunting Security Solution Threat Hunting Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Feature:Cases Cases feature v7.14.0 labels May 13, 2021