[Cloud Security] Misconfiguration preview & Refactor CSP Plugin to include new package PHASE 4

x-pack/packages/kbn-cloud-security-posture-common/index.ts

@@ -20,4 +20,8 @@ export type {
 export type { CspFinding } from './types/findings';
 export type { BenchmarksCisId } from './types/benchmark';
 export * from './constants';
-export { extractErrorMessage, buildMutedRulesFilter } from './utils/helpers';
+export {
+  extractErrorMessage,
+  buildMutedRulesFilter,
+  buildMisconfigurationPreviewQuery,
+} from './utils/helpers';

x-pack/packages/kbn-cloud-security-posture-common/utils/helpers.test.ts

@@ -5,7 +5,12 @@
  * 2.0.
  */
 
-import { extractErrorMessage, defaultErrorMessage, buildMutedRulesFilter } from './helpers';
+import {
+  extractErrorMessage,
+  defaultErrorMessage,
+  buildMutedRulesFilter,
+  buildMisconfigurationPreviewQuery,
+} from './helpers';
 
 const fallbackMessage = 'thisIsAFallBackMessage';
 
@@ -138,4 +143,49 @@ describe('test helper methods', () => {
       expect(buildMutedRulesFilter(rulesStates)).toEqual(expectedQuery);
     });
   });
+
+  describe('buildMisconfigurationPreviewQuery Test', () => {
+    it('should return the correct query when given field and query', () => {
+      const field = 'host.name';
+      const query = 'exampleHost';
+      const expectedQuery = {
+        bool: {
+          must: [],
+          filter: [
+            {
+              bool: {
+                should: [{ term: { 'host.name': { value: 'exampleHost' } } }],
+                minimum_should_match: 1,
+              },
+            },
+          ],
+          should: [],
+          must_not: [],
+        },
+      };
+
+      expect(buildMisconfigurationPreviewQuery(field, query)).toEqual(expectedQuery);
+    });
+
+    it('should return the correct query when given field and empty query', () => {
+      const field = 'host.name';
+      const expectedQuery = {
+        bool: {
+          must: [],
+          filter: [
+            {
+              bool: {
+                should: [{ term: { 'host.name': { value: '' } } }],
+                minimum_should_match: 1,
+              },
+            },
+          ],
+          should: [],
+          must_not: [],
+        },
+      };
+
+      expect(buildMisconfigurationPreviewQuery(field)).toEqual(expectedQuery);
+    });
+  });
 });

x-pack/packages/kbn-cloud-security-posture-common/utils/helpers.ts

@@ -41,3 +41,21 @@ export const buildMutedRulesFilter = (
 
   return mutedRulesFilterQuery;
 };
+
+export const buildMisconfigurationPreviewQuery = (field: string, queryValue?: string) => {
+  return {
+    bool: {
+      must: [],
+      filter: [
+        {
+          bool: {
+            should: [{ term: { [field]: { value: `${queryValue || ''}` } } }],
+            minimum_should_match: 1,
+          },
+        },
+      ],
+      should: [],
+      must_not: [],
+    },
+  };
+};

x-pack/packages/kbn-cloud-security-posture/src/hooks/use_misconfiguration_preview.ts

@@ -0,0 +1,135 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { useQuery } from '@tanstack/react-query';
+import { lastValueFrom } from 'rxjs';
+import type { IKibanaSearchResponse, IKibanaSearchRequest } from '@kbn/search-types';
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import {
+  CDR_MISCONFIGURATIONS_INDEX_PATTERN,
+  LATEST_FINDINGS_RETENTION_POLICY,
+  MAX_FINDINGS_TO_LOAD,
+  CspFinding,
+} from '@kbn/cloud-security-posture-common';
+import type { CspBenchmarkRulesStates } from '@kbn/cloud-security-posture-common/schema/rules/latest';
+import { buildMutedRulesFilter } from '@kbn/cloud-security-posture-common';
+import { useKibana } from '@kbn/kibana-react-plugin/public';
+import type { CoreStart } from '@kbn/core/public';
+import { showErrorToast } from '../..';
+import type { CspClientPluginStartDeps } from '../../type';
+import type { FindingsBaseEsQuery } from '../../type';
+import { useGetCspBenchmarkRulesStatesApi } from './use_get_benchmark_rules_state_api';
+
+interface UseFindingsOptions extends FindingsBaseEsQuery {
+  sort: string[][];
+  enabled: boolean;
+  pageSize: number;
+}
+
+type LatestFindingsRequest = IKibanaSearchRequest<estypes.SearchRequest>;
+type LatestFindingsResponse = IKibanaSearchResponse<
+  estypes.SearchResponse<CspFinding, FindingsAggs>
+>;
+
+interface FindingsAggs {
+  count: estypes.AggregationsMultiBucketAggregateBase<estypes.AggregationsStringRareTermsBucketKeys>;
+}
+
+export const getFindingsCountAggQueryMisconfigurationPreview = () => ({
+  count: {
+    filters: {
+      other_bucket_key: 'other_messages',
+      filters: {
+        passed: { match: { 'result.evaluation': 'passed' } },
+        failed: { match: { 'result.evaluation': 'failed' } },
+      },
+    },
+  },
+});
+
+export const getMisconfigurationAggregationCount = (
+  buckets: Array<estypes.AggregationsStringRareTermsBucketKeys | undefined>
+) => {
+  const passed = buckets.find((bucket) => bucket?.key === 'passed');
+  const failed = buckets.find((bucket) => bucket?.key === 'failed');
+  const noStatus = buckets.find((bucket) => bucket?.key === 'other_messages');
+
+  return {
+    passed: passed?.doc_count || 0,
+    failed: failed?.doc_count || 0,
+    no_status: noStatus?.doc_count || 0,
+  };
+};
+
+export const getFindingsQuery = (
+  { query, sort }: UseFindingsOptions,
+  rulesStates: CspBenchmarkRulesStates,
+  pageParam: any
+) => {
+  const mutedRulesFilterQuery = buildMutedRulesFilter(rulesStates);
+
+  return {
+    index: CDR_MISCONFIGURATIONS_INDEX_PATTERN,
+    size: MAX_FINDINGS_TO_LOAD,
+    aggs: getFindingsCountAggQueryMisconfigurationPreview(),
+    ignore_unavailable: false,
+    query: {
+      ...query,
+      bool: {
+        ...query?.bool,
+        filter: [
+          ...(query?.bool?.filter ?? []),
+          {
+            range: {
+              '@timestamp': {
+                gte: `now-${LATEST_FINDINGS_RETENTION_POLICY}`,
+                lte: 'now',
+              },
+            },
+          },
+        ],
+        must_not: [...(query?.bool?.must_not ?? []), ...mutedRulesFilterQuery],
+      },
+    },
+    ...(pageParam ? { from: pageParam } : {}),
+  };
+};
+
+export const useMisconfigurationPreview = (options: UseFindingsOptions) => {
+  const {
+    data,
+    notifications: { toasts },
+  } = useKibana<CoreStart & CspClientPluginStartDeps>().services;
+  const { data: rulesStates } = useGetCspBenchmarkRulesStatesApi();
+
+  return useQuery(
+    ['csp_findings', { params: options }, rulesStates],
+    async ({ pageParam }) => {
+      const {
+        rawResponse: { aggregations },
+      } = await lastValueFrom(
+        data.search.search<LatestFindingsRequest, LatestFindingsResponse>({
+          params: getFindingsQuery(options, rulesStates!, pageParam),
+        })
+      );
+      if (!aggregations) throw new Error('expected aggregations to be defined');
+
+      return {
+        count: getMisconfigurationAggregationCount(
+          Object.entries(aggregations.count.buckets).map(([key, value]) => ({
+            key,
+            doc_count: value.doc_count || 0,
+          }))
+        ),
+      };
+    },
+    {
+      enabled: options.enabled && !!rulesStates,
+      keepPreviousData: true,
+      onError: (err: Error) => showErrorToast(toasts, err),
+    }
+  );
+};

x-pack/packages/kbn-cloud-security-posture/tsconfig.json

@@ -36,5 +36,6 @@
     "@kbn/kibana-react-plugin",
     "@kbn/cloud-security-posture-common",
     "@kbn/i18n",
+    "@kbn/search-types",
   ]
 }

x-pack/plugins/security_solution/public/cloud_security_posture/components/index.tsx

@@ -0,0 +1,57 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiAccordion, EuiSpacer, EuiTitle, useEuiTheme } from '@elastic/eui';
+
+import React from 'react';
+import { css } from '@emotion/react';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { useCspSetupStatusApi } from '@kbn/cloud-security-posture/src/hooks/use_csp_setup_status_api';
+import { MisconfigurationsOverview } from './misconfiguration/misconfiguration_overview';
+
+export const EntityInsight = <T,>({ hostName }: { hostName: string }) => {
+  const { euiTheme } = useEuiTheme();
+  const getSetupStatus = useCspSetupStatusApi();
+  const hasMisconfigurationFindings = getSetupStatus.data?.hasMisconfigurationsFindings;
+
+  return (
+    <>
+      {hasMisconfigurationFindings && (
+        <EuiAccordion
+          initialIsOpen={true}
+          id="observedEntity-accordion"
+          data-test-subj="entityInsightTestSubj"
+          buttonProps={{
+            'data-test-subj': 'observedEntity-accordion-button',
+            css: css`
+              color: ${euiTheme.colors.primary};
+            `,
+          }}
+          buttonContent={
+            <EuiTitle size="xs">
+              <h3>
+                <FormattedMessage
+                  id="xpack.securitySolution.flyout.entityDetails.insightsTitle"
+                  defaultMessage="Insights"
+                />
+              </h3>
+            </EuiTitle>
+          }
+          css={css`
+            .euiAccordion__optionalAction {
+              margin-left: auto;
+            }
+          `}
+        >
+          <EuiSpacer size="m" />
+          <MisconfigurationsOverview hostName={hostName} />
+          <EuiSpacer size="m" />
+        </EuiAccordion>
+      )}
+    </>
+  );
+};

x-pack/plugins/security_solution/public/cloud_security_posture/components/misconfiguration/misconfiguration_overview.test.tsx

@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+// Add stuff here
+import { TestProviders } from '../../../common/mock';
+import { render } from '@testing-library/react';
+import React from 'react';
+import { MisconfigurationsOverview } from './misconfiguration_overview';
+
+const mockProps = {
+  hostName: 'testContextID',
+};
+
+describe('MisconfigurationsOverview', () => {
+  it('renders', () => {
+    const { queryByTestId } = render(<MisconfigurationsOverview {...mockProps} />, {
+      wrapper: TestProviders,
+    });
+    expect(
+      queryByTestId('securitySolutionFlyoutInsightsMisconfigurationsContent')
+    ).toBeInTheDocument();
+    expect(queryByTestId('noFindingsDataTestSubj')).toBeInTheDocument();
+  });
+});