[Osquery] Add support for osquery pack integration assets by patrykkopycinski · Pull Request #128109 · elastic/kibana

patrykkopycinski · 2022-03-18T22:00:15Z

Summary

Add prebuilt packs from https://github.com/osquery/osquery/tree/master/packs
Migrate Filebeat Osquery module dashboard to fit into the new integration data structure
Integration PR elastic/integrations#2851

elasticmachine · 2022-03-18T22:00:18Z

Pinging @elastic/security-asset-management (Team:Asset Management)

elasticmachine · 2022-03-18T22:00:21Z

Pinging @elastic/fleet (Team:Fleet)

Bamieh

Core changes are only 1 file related to testing. LGTM 👍 Thanks for using i18n across the whole PR :)

…nager-prebuilt-packs

james-elastic

🌞 👍

…nager-prebuilt-packs

joshdover

We need to update Fleet's API integration tests to ensure that these asset types are correctly installed. Changes needed:

Add some osquery-pack-asset objects to the "all_assets" test package: x-pack/test/fleet_api_integration/apis/fixtures/test_packages/all_assets
Update the test file with assertions that the expected packs are installed and uninstalled in x-pack/test/fleet_api_integration/apis/epm/install_remove_assets.ts

…nager-prebuilt-packs

…nager-prebuilt-packs # Conflicts: # x-pack/plugins/osquery/public/packs/types.ts

…nager-prebuilt-packs

patrykkopycinski · 2022-03-23T12:15:01Z

@elasticmachine merge upstream

jbudz

kibana-docker LGTM

patrykkopycinski · 2022-03-23T16:05:37Z

@elasticmachine merge upstream

patrykkopycinski · 2022-03-24T11:04:17Z

Thank you for the review @joshdover. Please let me know if I have followed that properly 🙂

joshdover

Thanks for making those changes. I think we still need one more assertion in install_remove_assets.ts. Specifically there should be an assertion that the objects are deleted around here: https://github.com/elastic/kibana/blob/35775c91572ac434f22e9e23d166f48f6f46a7ed/x-pack/test/fleet_api_integration/apis/epm/install_remove_assets.ts#L205

After that this should be good to go.

…nager-prebuilt-packs

patrykkopycinski · 2022-03-24T15:17:16Z

@joshdover 🟢 ? :)

kibana-ci · 2022-03-24T16:34:57Z

💛 Build succeeded, but was flaky

Test Failures

[job] [logs] Default CI Group #18 / apis Machine Learning filters get_filters should return 400 if filterId does not exist

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`osquery`	253	260	+7

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`osquery`	951.8KB	954.9KB	+3.1KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`fleet`	110.2KB	110.4KB	+197.0B

Saved Objects .kibana field count

Every field in each saved object type adds overhead to Elasticsearch. Kibana needs to keep the total field count below Elasticsearch's default limit of 1000 fields. Only specify field mappings for the fields you wish to search on or query. See https://www.elastic.co/guide/en/kibana/master/development-plugin-saved-objects.html#_mappings

id	before	after	diff
`osquery-pack`	14	15	+1
`osquery-pack-asset`	-	10	+10
total			+11

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
`osquery`	121	122	+1

Total ESLint disabled count

id	before	after	diff
`osquery`	126	127	+1

History

💛 Build #33438 was flaky 79f5eb4
💚 Build #33386 succeeded 8c1166e
💔 Build #33297 failed c4e1dd6
💔 Build #33197 failed ebdd893
💔 Build #33131 failed 2094fa7
💔 Build #32997 failed 6aa85d0

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @patrykkopycinski

[Osquery] Add support for osquery pack integration assets

10a6399

patrykkopycinski added release_note:enhancement Team:Asset Management Security Asset Management Team Feature:Osquery Security Solution Osquery feature v8.2.0 labels Mar 18, 2022

patrykkopycinski requested review from a team as code owners March 18, 2022 22:00

patrykkopycinski self-assigned this Mar 18, 2022

botelastic Bot added the Team:Fleet Team label for Observability Data Collection Fleet team label Mar 18, 2022

fix types

0e1709c

patrykkopycinski requested a review from a team as a code owner March 20, 2022 20:27

patrykkopycinski mentioned this pull request Mar 21, 2022

[Osquery] Add kibana/osquery-pack-asset elastic/package-spec#299

Merged

2 tasks

Bamieh approved these changes Mar 21, 2022

View reviewed changes

juliaElastic approved these changes Mar 21, 2022

View reviewed changes

Merge branch 'main' of github.com:elastic/kibana into feat/osquery-ma…

6385c7d

…nager-prebuilt-packs

james-elastic approved these changes Mar 21, 2022

View reviewed changes

Merge branch 'main' of github.com:elastic/kibana into feat/osquery-ma…

f59839b

…nager-prebuilt-packs

joshdover suggested changes Mar 22, 2022

View reviewed changes

patrykkopycinski added 6 commits March 22, 2022 18:34

Merge branch 'main' of github.com:elastic/kibana into feat/osquery-ma…

63dc6b3

…nager-prebuilt-packs

Merge branch 'main' of github.com:elastic/kibana into feat/osquery-ma…

3ce8e73

…nager-prebuilt-packs # Conflicts: # x-pack/plugins/osquery/public/packs/types.ts

Merge branch 'main' of github.com:elastic/kibana into feat/osquery-ma…

648328a

…nager-prebuilt-packs

update fleet fixtures

c9bcf9a

fix route

04fe523

fix

3b3d1f0

kibanamachine and others added 2 commits March 23, 2022 08:15

Merge branch 'main' into feat/osquery-manager-prebuilt-packs

6aa85d0

fix

19d3808

patrykkopycinski requested a review from a team as a code owner March 23, 2022 15:11

patrykkopycinski requested review from a team as code owners March 23, 2022 15:11

jbudz approved these changes Mar 23, 2022

View reviewed changes

patrykkopycinski force-pushed the feat/osquery-manager-prebuilt-packs branch from 022ae12 to 19d3808 Compare March 23, 2022 15:14

patrykkopycinski removed request for a team March 23, 2022 15:14

kibanamachine and others added 6 commits March 23, 2022 12:40

Merge branch 'main' into feat/osquery-manager-prebuilt-packs

2094fa7

fix

ebdd893

fix

27e58ed

fix

c4e1dd6

fix

ba4d192

fix

8c1166e

joshdover reviewed Mar 24, 2022

View reviewed changes

patrykkopycinski added 4 commits March 24, 2022 12:41

Merge branch 'main' of github.com:elastic/kibana into feat/osquery-ma…

2805e7b

…nager-prebuilt-packs

add uninstall check

79f5eb4

Merge branch 'main' into feat/osquery-manager-prebuilt-packs

f58240b

fix

3e7abc2

joshdover approved these changes Mar 24, 2022

View reviewed changes

patrykkopycinski merged commit 5a3faca into elastic:main Mar 24, 2022

patrykkopycinski deleted the feat/osquery-manager-prebuilt-packs branch March 28, 2022 07:59

Conversation

patrykkopycinski commented Mar 18, 2022

Summary

Uh oh!

elasticmachine commented Mar 18, 2022

Uh oh!

elasticmachine commented Mar 18, 2022

Uh oh!

Bamieh left a comment

Choose a reason for hiding this comment

Uh oh!

james-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

joshdover left a comment

Choose a reason for hiding this comment

Uh oh!

patrykkopycinski commented Mar 23, 2022

Uh oh!

jbudz left a comment

Choose a reason for hiding this comment

Uh oh!

patrykkopycinski commented Mar 23, 2022

Uh oh!

patrykkopycinski commented Mar 24, 2022

Uh oh!

joshdover left a comment

Choose a reason for hiding this comment

Uh oh!

patrykkopycinski commented Mar 24, 2022

Uh oh!

kibana-ci commented Mar 24, 2022

💛 Build succeeded, but was flaky

Test Failures

Metrics [docs]

Module Count

Async chunks

Page load bundle

Saved Objects .kibana field count

ESLint disabled line counts

Total ESLint disabled count

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants