[Defend Workflows] Convert filterQuery to kql

x-pack/plugins/osquery/common/api/live_query/find_live_query_route.ts

@@ -9,7 +9,7 @@ import * as t from 'io-ts';
 import { toNumberRt } from '@kbn/io-ts-utils';
 
 export const findLiveQueryRequestQuerySchema = t.type({
-  filterQuery: t.union([t.string, t.undefined]),
+  kuery: t.union([t.string, t.undefined]),
   page: t.union([toNumberRt, t.undefined]),
   pageSize: t.union([toNumberRt, t.undefined]),
   sort: t.union([t.string, t.undefined]),

x-pack/plugins/osquery/common/api/live_query/get_live_query_results_route.ts

@@ -9,7 +9,7 @@ import * as t from 'io-ts';
 import { toNumberRt } from '@kbn/io-ts-utils';
 
 export const getLiveQueryResultsRequestQuerySchema = t.type({
-  filterQuery: t.union([t.string, t.undefined]),
+  kuery: t.union([t.string, t.undefined]),
   page: t.union([toNumberRt, t.undefined]),
   pageSize: t.union([toNumberRt, t.undefined]),
   sort: t.union([t.string, t.undefined]),

x-pack/plugins/osquery/common/search_strategy/osquery/index.ts

@@ -5,9 +5,7 @@
  * 2.0.
  */
 
-import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { IEsSearchRequest } from '@kbn/data-plugin/common';
-import type { ESQuery } from '../../typed_json';
 import type {
   ActionsStrategyResponse,
   ActionsRequestOptions,
@@ -19,7 +17,7 @@ import type {
 import type { AgentsStrategyResponse, AgentsRequestOptions } from './agents';
 import type { ResultsStrategyResponse, ResultsRequestOptions } from './results';
 
-import type { DocValueFields, SortField, PaginationInputPaginated } from '../common';
+import type { SortField, PaginationInputPaginated } from '../common';
 
 export * from './actions';
 export * from './agents';
@@ -36,9 +34,7 @@ export enum OsqueryQueries {
 export type FactoryQueryTypes = OsqueryQueries;
 
 export interface RequestBasicOptions extends IEsSearchRequest {
-  filterQuery: ESQuery | string | undefined;
-  aggregations?: Record<string, estypes.AggregationsAggregationContainer>;
-  docValueFields?: DocValueFields[];
+  kuery?: string;
   factoryQueryType?: FactoryQueryTypes;
   componentTemplateExists?: boolean;
 }

x-pack/plugins/osquery/common/utils/build_query/filters.ts

@@ -5,15 +5,7 @@
  * 2.0.
  */
 
-import { isEmpty, isString } from 'lodash/fp';
 import type { PaginationInputPaginated, Inspect } from '../../search_strategy';
-import type { ESQuery } from '../../typed_json';
-
-export const createQueryFilterClauses = (filterQuery: ESQuery | string | undefined) =>
-  !isEmpty(filterQuery) ? [isString(filterQuery) ? JSON.parse(filterQuery) : filterQuery] : [];
-
-export const createFilter = (filterQuery: ESQuery | string | undefined) =>
-  isString(filterQuery) ? filterQuery : JSON.stringify(filterQuery);
 
 export type InspectResponse = Inspect & { response: string[] };
 

x-pack/plugins/osquery/cypress/e2e/all/cases.cy.ts

@@ -22,6 +22,7 @@ describe('Add to Cases', () => {
     loadLiveQuery({
       agent_all: true,
       query: "SELECT * FROM os_version where name='Ubuntu';",
+      kuery: '',
     }).then((liveQuery) => {
       liveQueryId = liveQuery.action_id;
       liveQueryQuery = liveQuery.queries[0].query;

x-pack/plugins/osquery/cypress/tasks/api_fixtures.ts

@@ -122,6 +122,7 @@ export const loadLiveQuery = (
   payload = {
     agent_all: true,
     query: 'select * from uptime;',
+    kuery: '',
   }
 ) =>
   request<{

x-pack/plugins/osquery/public/action_results/use_action_results.ts

@@ -11,11 +11,7 @@ import { useQuery } from '@tanstack/react-query';
 import { i18n } from '@kbn/i18n';
 import { lastValueFrom } from 'rxjs';
 import type { InspectResponse } from '../common/helpers';
-import {
-  createFilter,
-  getInspectResponse,
-  generateTablePaginationOptions,
-} from '../common/helpers';
+import { getInspectResponse, generateTablePaginationOptions } from '../common/helpers';
 import { useKibana } from '../common/lib/kibana';
 import type {
   ResultEdges,
@@ -24,7 +20,6 @@ import type {
   Direction,
 } from '../../common/search_strategy';
 import { OsqueryQueries } from '../../common/search_strategy';
-import type { ESTermQuery } from '../../common/typed_json';
 import { queryClient } from '../query_client';
 
 import { useErrorToast } from '../common/hooks/use_error_toast';
@@ -43,7 +38,7 @@ export interface UseActionResults {
   direction: Direction;
   limit: number;
   sortField: string;
-  filterQuery?: ESTermQuery | string;
+  kuery?: string;
   skip?: boolean;
   isLive?: boolean;
 }
@@ -55,7 +50,7 @@ export const useActionResults = ({
   direction,
   limit,
   sortField,
-  filterQuery,
+  kuery,
   skip = false,
   isLive = false,
 }: UseActionResults) => {
@@ -70,7 +65,7 @@ export const useActionResults = ({
           {
             actionId,
             factoryQueryType: OsqueryQueries.actionResults,
-            filterQuery: createFilter(filterQuery),
+            kuery,
             pagination: generateTablePaginationOptions(activePage, limit),
             sort: {
               direction,

x-pack/plugins/osquery/public/actions/actions_table.tsx

@@ -62,11 +62,7 @@ const ActionsTableComponent = () => {
   const { data: actionsData } = useAllLiveQueries({
     activePage: pageIndex,
     limit: pageSize,
-    filterQuery: {
-      exists: {
-        field: 'user_id',
-      },
-    },
+    kuery: 'user_id: *',
   });
 
   const onTableChange = useCallback(({ page = {} }) => {

x-pack/plugins/osquery/public/actions/use_all_live_queries.ts

@@ -9,10 +9,8 @@ import { useQuery } from '@tanstack/react-query';
 
 import { i18n } from '@kbn/i18n';
 import { API_VERSIONS } from '../../common/constants';
-import { createFilter } from '../common/helpers';
 import { useKibana } from '../common/lib/kibana';
 import type { ActionEdges, ActionsStrategyResponse } from '../../common/search_strategy';
-import type { ESTermQuery, ESExistsQuery } from '../../common/typed_json';
 
 import { useErrorToast } from '../common/hooks/use_error_toast';
 import { Direction } from '../../common/search_strategy';
@@ -22,7 +20,7 @@ export interface UseAllLiveQueriesConfig {
   direction?: Direction;
   limit?: number;
   sortField?: string;
-  filterQuery?: ESTermQuery | ESExistsQuery | string;
+  kuery?: string;
   skip?: boolean;
   alertId?: string;
 }
@@ -35,7 +33,7 @@ export const useAllLiveQueries = ({
   direction = Direction.desc,
   limit = 100,
   sortField = '@timestamp',
-  filterQuery,
+  kuery,
   skip = false,
   alertId,
 }: UseAllLiveQueriesConfig) => {
@@ -53,7 +51,7 @@ export const useAllLiveQueries = ({
         {
           version: API_VERSIONS.public.v1,
           query: {
-            filterQuery: createFilter(filterQuery),
+            kuery,
             page: activePage,
             pageSize: limit,
             sort: sortField,

x-pack/plugins/osquery/public/actions/use_live_query_details.ts

@@ -12,13 +12,12 @@ import { filter } from 'lodash';
 import type { ECSMapping } from '@kbn/osquery-io-ts-types';
 import { API_VERSIONS } from '../../common/constants';
 import { useKibana } from '../common/lib/kibana';
-import type { ESTermQuery } from '../../common/typed_json';
 import { useErrorToast } from '../common/hooks/use_error_toast';
 
 interface UseLiveQueryDetails {
   actionId?: string;
   isLive?: boolean;
-  filterQuery?: ESTermQuery | string;
+  kuery?: string;
   skip?: boolean;
   queryIds?: string[];
 }
@@ -54,7 +53,7 @@ export interface LiveQueryDetailsItem {
 
 export const useLiveQueryDetails = ({
   actionId,
-  filterQuery,
+  kuery,
   isLive = false,
   skip = false,
   queryIds, // enable finding out specific queries only, eg. in cases
@@ -63,7 +62,7 @@ export const useLiveQueryDetails = ({
   const setErrorToast = useErrorToast();
 
   return useQuery<{ data: LiveQueryDetailsItem }, Error, LiveQueryDetailsItem>(
-    ['liveQueries', { actionId, filterQuery, queryIds }],
+    ['liveQueries', { actionId, kuery, queryIds }],
     () => http.get(`/api/osquery/live_queries/${actionId}`, { version: API_VERSIONS.public.v1 }),
     {
       enabled: !skip && !!actionId,

x-pack/plugins/osquery/public/agents/use_agent_groups.ts

@@ -35,30 +35,13 @@ export const useAgentGroups = () => {
   >(
     ['agentGroups'],
     async () => {
+      const policiesQuery = osqueryPolicies?.reduce((acc, policy) => `${acc} OR ${policy}`);
+
       const responseData = await lastValueFrom(
         data.search.search<AgentsRequestOptions, AgentsStrategyResponse>(
           {
-            filterQuery: { terms: { policy_id: osqueryPolicies } },
+            kuery: `policy_id: ( ${policiesQuery} )`,
             factoryQueryType: OsqueryQueries.agents,
-            aggregations: {
-              platforms: {
-                terms: {
-                  field: 'local_metadata.os.platform',
-                },
-                aggs: {
-                  policies: {
-                    terms: {
-                      field: 'policy_id',
-                    },
-                  },
-                },
-              },
-              policies: {
-                terms: {
-                  field: 'policy_id',
-                },
-              },
-            },
             pagination: generateTablePaginationOptions(0, 9000),
             sort: {
               direction: 'asc',

x-pack/plugins/osquery/public/common/helpers.ts

@@ -5,20 +5,13 @@
  * 2.0.
  */
 
-import { isString } from 'lodash/fp';
-
 import type {
   PaginationInputPaginated,
   FactoryQueryTypes,
   StrategyResponseType,
   Inspect,
 } from '../../common/search_strategy';
 
-import type { ESQuery } from '../../common/typed_json';
-
-export const createFilter = (filterQuery: ESQuery | string | undefined) =>
-  isString(filterQuery) ? filterQuery : JSON.stringify(filterQuery);
-
 export type InspectResponse = Inspect & { response: string[] };
 
 export const generateTablePaginationOptions = (

x-pack/plugins/osquery/public/results/use_all_results.ts

@@ -10,11 +10,7 @@ import { useQuery } from '@tanstack/react-query';
 import { i18n } from '@kbn/i18n';
 import { lastValueFrom } from 'rxjs';
 import type { InspectResponse } from '../common/helpers';
-import {
-  createFilter,
-  generateTablePaginationOptions,
-  getInspectResponse,
-} from '../common/helpers';
+import { generateTablePaginationOptions, getInspectResponse } from '../common/helpers';
 import { useKibana } from '../common/lib/kibana';
 import type {
   ResultEdges,
@@ -23,7 +19,6 @@ import type {
   Direction,
 } from '../../common/search_strategy';
 import { OsqueryQueries } from '../../common/search_strategy';
-import type { ESTermQuery } from '../../common/typed_json';
 
 import { useErrorToast } from '../common/hooks/use_error_toast';
 
@@ -40,7 +35,7 @@ interface UseAllResults {
   activePage: number;
   limit: number;
   sort: Array<{ field: string; direction: Direction }>;
-  filterQuery?: ESTermQuery | string;
+  kuery?: string;
   skip?: boolean;
   isLive?: boolean;
 }
@@ -50,7 +45,7 @@ export const useAllResults = ({
   activePage,
   limit,
   sort,
-  filterQuery,
+  kuery,
   skip = false,
   isLive = false,
 }: UseAllResults) => {
@@ -65,7 +60,7 @@ export const useAllResults = ({
           {
             actionId,
             factoryQueryType: OsqueryQueries.results,
-            filterQuery: createFilter(filterQuery),
+            kuery,
             pagination: generateTablePaginationOptions(activePage, limit),
             sort,
           },

x-pack/plugins/osquery/server/routes/live_query/find_live_query_route.ts

@@ -21,8 +21,8 @@ import type {
   Direction,
 } from '../../../common/search_strategy';
 import { OsqueryQueries } from '../../../common/search_strategy';
-import { createFilter, generateTablePaginationOptions } from '../../../common/utils/build_query';
 import { findLiveQueryRequestQuerySchema } from '../../../common/api';
+import { generateTablePaginationOptions } from '../../../common/utils/build_query';
 
 export const findLiveQueryRoute = (router: IRouter<DataRequestHandlerContext>) => {
   router.versioned
@@ -52,7 +52,7 @@ export const findLiveQueryRoute = (router: IRouter<DataRequestHandlerContext>) =
             search.search<ActionsRequestOptions, ActionsStrategyResponse>(
               {
                 factoryQueryType: OsqueryQueries.actions,
-                filterQuery: createFilter(request.query.filterQuery),
+                kuery: request.query.kuery,
                 pagination: generateTablePaginationOptions(
                   request.query.page ?? 0,
                   request.query.pageSize ?? 100

x-pack/plugins/osquery/server/routes/live_query/get_live_query_details_route.ts

@@ -61,7 +61,6 @@ export const getLiveQueryDetailsRoute = (router: IRouter<DataRequestHandlerConte
             search.search<ActionDetailsRequestOptions, ActionDetailsStrategyResponse>(
               {
                 actionId: request.params.id,
-                filterQuery: {},
                 factoryQueryType: OsqueryQueries.actionDetails,
               },
               { abortSignal, strategy: 'osquerySearchStrategy' }