Skip to content

[Security Solution] Webhook - Case Management Connector Follow Ups #137227

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stephmilovic merged 10 commits into from
Jul 29, 2022
Merged

[Security Solution] Webhook - Case Management Connector Follow Ups #137227

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
6442b11
tests and rm real url
stephmilovic Jul 26, 2022
7054387
Rename incidentViewUrl to viewIncidentUrl
stephmilovic Jul 26, 2022
1c6168b
beta badge all over
stephmilovic Jul 26, 2022
63c4f32
fix big whoops
stephmilovic Jul 27, 2022
751615e
pr fixes
stephmilovic Jul 27, 2022
08722d6
Merge branch 'main' into cases_webhook_followups
kibanamachine Jul 27, 2022
816e553
Merge branch 'main' into cases_webhook_followups
stephmilovic Jul 28, 2022
8fdc154
better badge alignment
stephmilovic Jul 28, 2022
138521e
Improve beta badge alignment
cnasikas Jul 29, 2022
afec087
Remove style
cnasikas Jul 29, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions x-pack/plugins/actions/server/builtin_action_types/cases_webhook/api.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ describe('api', () => {
id: 'incident-1',
title: 'CK-1',
pushedDate: '2020-04-27T10:59:46.202Z',
url: 'https://siem-kibana.atlassian.net/browse/CK-1',
url: 'https://coolsite.net/browse/CK-1',
comments: [
{
commentId: 'case-comment-1',
Expand All @@ -57,7 +57,7 @@ describe('api', () => {
id: 'incident-1',
title: 'CK-1',
pushedDate: '2020-04-27T10:59:46.202Z',
url: 'https://siem-kibana.atlassian.net/browse/CK-1',
url: 'https://coolsite.net/browse/CK-1',
});
});

Expand Down Expand Up @@ -109,7 +109,7 @@ describe('api', () => {
id: 'incident-1',
title: 'CK-1',
pushedDate: '2020-04-27T10:59:46.202Z',
url: 'https://siem-kibana.atlassian.net/browse/CK-1',
url: 'https://coolsite.net/browse/CK-1',
comments: [
{
commentId: 'case-comment-1',
Expand All @@ -135,7 +135,7 @@ describe('api', () => {
id: 'incident-1',
title: 'CK-1',
pushedDate: '2020-04-27T10:59:46.202Z',
url: 'https://siem-kibana.atlassian.net/browse/CK-1',
url: 'https://coolsite.net/browse/CK-1',
});
});

Expand Down
4 changes: 2 additions & 2 deletions x-pack/plugins/actions/server/builtin_action_types/cases_webhook/mock.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,15 +24,15 @@ const createMock = (): jest.Mocked<ExternalService> => {
id: 'incident-1',
title: 'CK-1',
pushedDate: '2020-04-27T10:59:46.202Z',
url: 'https://siem-kibana.atlassian.net/browse/CK-1',
url: 'https://coolsite.net/browse/CK-1',
})
),
updateIncident: jest.fn().mockImplementation(() =>
Promise.resolve({
id: 'incident-1',
title: 'CK-1',
pushedDate: '2020-04-27T10:59:46.202Z',
url: 'https://siem-kibana.atlassian.net/browse/CK-1',
url: 'https://coolsite.net/browse/CK-1',
})
),
createComment: jest.fn(),
Expand Down
2 changes: 1 addition & 1 deletion x-pack/plugins/actions/server/builtin_action_types/cases_webhook/schema.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ export const ExternalIncidentServiceConfiguration = {
getIncidentResponseCreatedDateKey: schema.string(),
getIncidentResponseExternalTitleKey: schema.string(),
getIncidentResponseUpdatedDateKey: schema.string(),
incidentViewUrl: schema.string(),
viewIncidentUrl: schema.string(),
updateIncidentUrl: schema.string(),
updateIncidentMethod: schema.oneOf(
[
Expand Down
33 changes: 16 additions & 17 deletions x-pack/plugins/actions/server/builtin_action_types/cases_webhook/service.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,24 +30,23 @@ const configurationUtilities = actionsConfigMock.create();
const config: CasesWebhookPublicConfigurationType = {
createCommentJson: '{"body":{{{case.comment}}}}',
createCommentMethod: CasesWebhookMethods.POST,
createCommentUrl:
'https://siem-kibana.atlassian.net/rest/api/2/issue/{{{external.system.id}}}/comment',
createCommentUrl: 'https://coolsite.net/issue/{{{external.system.id}}}/comment',
createIncidentJson:
'{"fields":{"title":{{{case.title}}},"description":{{{case.description}}},"tags":{{{case.tags}}},"project":{"key":"ROC"},"issuetype":{"id":"10024"}}}',
createIncidentMethod: CasesWebhookMethods.POST,
createIncidentResponseKey: 'id',
createIncidentUrl: 'https://siem-kibana.atlassian.net/rest/api/2/issue',
createIncidentUrl: 'https://coolsite.net/issue',
getIncidentResponseCreatedDateKey: 'fields.created',
getIncidentResponseExternalTitleKey: 'key',
getIncidentResponseUpdatedDateKey: 'fields.updated',
hasAuth: true,
headers: { ['content-type']: 'application/json' },
incidentViewUrl: 'https://siem-kibana.atlassian.net/browse/{{{external.system.title}}}',
getIncidentUrl: 'https://siem-kibana.atlassian.net/rest/api/2/issue/{{{external.system.id}}}',
viewIncidentUrl: 'https://coolsite.net/browse/{{{external.system.title}}}',
getIncidentUrl: 'https://coolsite.net/issue/{{{external.system.id}}}',
updateIncidentJson:
'{"fields":{"title":{{{case.title}}},"description":{{{case.description}}},"tags":{{{case.tags}}},"project":{"key":"ROC"},"issuetype":{"id":"10024"}}}',
updateIncidentMethod: CasesWebhookMethods.PUT,
updateIncidentUrl: 'https://siem-kibana.atlassian.net/rest/api/2/issue/{{{external.system.id}}}',
updateIncidentUrl: 'https://coolsite.net/issue/{{{external.system.id}}}',
};
const secrets = {
user: 'user',
Expand Down Expand Up @@ -76,7 +75,7 @@ describe('Cases webhook service', () => {
describe('createExternalService', () => {
const requiredUrls = [
'createIncidentUrl',
'incidentViewUrl',
'viewIncidentUrl',
'getIncidentUrl',
'updateIncidentUrl',
];
Expand Down Expand Up @@ -154,7 +153,7 @@ describe('Cases webhook service', () => {
await service.getIncident('1');
expect(requestMock).toHaveBeenCalledWith({
axios,
url: 'https://siem-kibana.atlassian.net/rest/api/2/issue/1',
url: 'https://coolsite.net/issue/1',
logger,
configurationUtilities,
});
Expand Down Expand Up @@ -231,7 +230,7 @@ describe('Cases webhook service', () => {
title: 'CK-1',
id: '1',
pushedDate: '2020-04-27T10:59:46.202Z',
url: 'https://siem-kibana.atlassian.net/browse/CK-1',
url: 'https://coolsite.net/browse/CK-1',
});
});

Expand Down Expand Up @@ -260,7 +259,7 @@ describe('Cases webhook service', () => {

expect(requestMock.mock.calls[0][0]).toEqual({
axios,
url: 'https://siem-kibana.atlassian.net/rest/api/2/issue',
url: 'https://coolsite.net/issue',
logger,
method: CasesWebhookMethods.POST,
configurationUtilities,
Expand Down Expand Up @@ -326,7 +325,7 @@ describe('Cases webhook service', () => {
title: 'CK-1',
id: '1',
pushedDate: '2020-04-27T10:59:46.202Z',
url: 'https://siem-kibana.atlassian.net/browse/CK-1',
url: 'https://coolsite.net/browse/CK-1',
});
});

Expand All @@ -348,7 +347,7 @@ describe('Cases webhook service', () => {
logger,
method: CasesWebhookMethods.PUT,
configurationUtilities,
url: 'https://siem-kibana.atlassian.net/rest/api/2/issue/1',
url: 'https://coolsite.net/issue/1',
data: JSON.stringify({
fields: {
title: 'title',
Expand Down Expand Up @@ -426,7 +425,7 @@ describe('Cases webhook service', () => {
logger,
method: CasesWebhookMethods.POST,
configurationUtilities,
url: 'https://siem-kibana.atlassian.net/rest/api/2/issue/1/comment',
url: 'https://coolsite.net/issue/1/comment',
data: `{"body":"comment"}`,
});
});
Expand Down Expand Up @@ -664,7 +663,7 @@ describe('Cases webhook service', () => {
test('getIncident- escapes url', async () => {
await service.getIncident('../../malicious-app/malicious-endpoint/');
expect(requestMock.mock.calls[0][0].url).toEqual(
'https://siem-kibana.atlassian.net/rest/api/2/issue/..%2F..%2Fmalicious-app%2Fmalicious-endpoint%2F'
'https://coolsite.net/issue/..%2F..%2Fmalicious-app%2Fmalicious-endpoint%2F'
);
});

Expand All @@ -681,7 +680,7 @@ describe('Cases webhook service', () => {
};
const res = await service.createIncident(incident);
expect(res.url).toEqual(
'https://siem-kibana.atlassian.net/browse/..%2F..%2Fmalicious-app%2Fmalicious-endpoint%2F'
'https://coolsite.net/browse/..%2F..%2Fmalicious-app%2Fmalicious-endpoint%2F'
);
});

Expand All @@ -700,7 +699,7 @@ describe('Cases webhook service', () => {

await service.updateIncident(incident);
expect(requestMock.mock.calls[0][0].url).toEqual(
'https://siem-kibana.atlassian.net/rest/api/2/issue/..%2F..%2Fmalicious-app%2Fmalicious-endpoint%2F'
'https://coolsite.net/issue/..%2F..%2Fmalicious-app%2Fmalicious-endpoint%2F'
);
});
test('createComment- escapes url', async () => {
Expand All @@ -714,7 +713,7 @@ describe('Cases webhook service', () => {

await service.createComment(commentReq);
expect(requestMock.mock.calls[0][0].url).toEqual(
'https://siem-kibana.atlassian.net/rest/api/2/issue/..%2F..%2Fmalicious-app%2Fmalicious-endpoint%2F/comment'
'https://coolsite.net/issue/..%2F..%2Fmalicious-app%2Fmalicious-endpoint%2F/comment'
);
});
});
Expand Down
8 changes: 4 additions & 4 deletions x-pack/plugins/actions/server/builtin_action_types/cases_webhook/service.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ export const createExternalService = (
getIncidentUrl,
hasAuth,
headers,
incidentViewUrl,
viewIncidentUrl,
updateIncidentJson,
updateIncidentMethod,
updateIncidentUrl,
Expand All @@ -64,7 +64,7 @@ export const createExternalService = (
if (
!getIncidentUrl ||
!createIncidentUrlConfig ||
!incidentViewUrl ||
!viewIncidentUrl ||
!updateIncidentUrl ||
(hasAuth && (!password || !user))
) {
Expand Down Expand Up @@ -163,7 +163,7 @@ export const createExternalService = (

logger.debug(`response from webhook action "${actionId}": [HTTP ${status}] ${statusText}`);

const viewUrl = renderMustacheStringNoEscape(incidentViewUrl, {
const viewUrl = renderMustacheStringNoEscape(viewIncidentUrl, {
external: {
system: {
id: encodeURIComponent(externalId),
Expand Down Expand Up @@ -233,7 +233,7 @@ export const createExternalService = (
res,
});
const updatedIncident = await getIncident(incidentId as string);
const viewUrl = renderMustacheStringNoEscape(incidentViewUrl, {
const viewUrl = renderMustacheStringNoEscape(viewIncidentUrl, {
external: {
system: {
id: encodeURIComponent(incidentId),
Expand Down
4 changes: 2 additions & 2 deletions x-pack/plugins/actions/server/builtin_action_types/cases_webhook/validators.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,15 +20,15 @@ const validateConfig = (
const {
createCommentUrl,
createIncidentUrl,
incidentViewUrl,
viewIncidentUrl,
getIncidentUrl,
updateIncidentUrl,
} = configObject;

const urls = [
createIncidentUrl,
createCommentUrl,
incidentViewUrl,
viewIncidentUrl,
getIncidentUrl,
updateIncidentUrl,
];
Expand Down
8 changes: 4 additions & 4 deletions x-pack/plugins/actions/server/builtin_action_types/jira/api.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ describe('api', () => {
id: 'incident-1',
title: 'CK-1',
pushedDate: '2020-04-27T10:59:46.202Z',
url: 'https://siem-kibana.atlassian.net/browse/CK-1',
url: 'https://coolsite.net/browse/CK-1',
comments: [
{
commentId: 'case-comment-1',
Expand All @@ -57,7 +57,7 @@ describe('api', () => {
id: 'incident-1',
title: 'CK-1',
pushedDate: '2020-04-27T10:59:46.202Z',
url: 'https://siem-kibana.atlassian.net/browse/CK-1',
url: 'https://coolsite.net/browse/CK-1',
});
});

Expand Down Expand Up @@ -150,7 +150,7 @@ describe('api', () => {
id: 'incident-1',
title: 'CK-1',
pushedDate: '2020-04-27T10:59:46.202Z',
url: 'https://siem-kibana.atlassian.net/browse/CK-1',
url: 'https://coolsite.net/browse/CK-1',
comments: [
{
commentId: 'case-comment-1',
Expand All @@ -176,7 +176,7 @@ describe('api', () => {
id: 'incident-1',
title: 'CK-1',
pushedDate: '2020-04-27T10:59:46.202Z',
url: 'https://siem-kibana.atlassian.net/browse/CK-1',
url: 'https://coolsite.net/browse/CK-1',
});
});

Expand Down
4 changes: 2 additions & 2 deletions x-pack/plugins/actions/server/builtin_action_types/jira/mocks.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,15 +24,15 @@ const createMock = (): jest.Mocked<ExternalService> => {
id: 'incident-1',
title: 'CK-1',
pushedDate: '2020-04-27T10:59:46.202Z',
url: 'https://siem-kibana.atlassian.net/browse/CK-1',
url: 'https://coolsite.net/browse/CK-1',
})
),
updateIncident: jest.fn().mockImplementation(() =>
Promise.resolve({
id: 'incident-1',
title: 'CK-1',
pushedDate: '2020-04-27T10:59:46.202Z',
url: 'https://siem-kibana.atlassian.net/browse/CK-1',
url: 'https://coolsite.net/browse/CK-1',
})
),
createComment: jest.fn(),
Expand Down
Loading