[Entity Analytics] New API endpoint to configure risk engine saved object by abhishekbhatia1710 · Pull Request #194545 · elastic/kibana

abhishekbhatia1710 · 2024-10-01T10:38:59Z

Summary

The changes in the PR includes a new API endpoint to allow user to configure the risk engine saved object themselves.

Unit and integration tests are added considering the spaces as well.

Examples :

Risk Engine enabled for the first time :

024-10-09T14:18:49.302+05:30][INFO ][plugins.securitySolution] [task risk_engine:risk_scoring:default:0.0.1]: Starting Risk Engine with configuration:
[2024-10-09T14:18:49.401+05:30][INFO ][plugins.securitySolution] [task risk_engine:risk_scoring:default:0.0.1]: 

{"dataViewId":".alerts-security.alerts-default","enabled":true,"filter":{},"interval":"1h","pageSize":3500,"range":{"start":"now-30d","end":"now"}}

Risk Engine disabled, SO is updated and risk engine is enabled again :

2024-10-09T14:19:49.404+05:30][INFO ][plugins.securitySolution] [task risk_engine:risk_scoring:default:0.0.1]: Starting Risk Engine with configuration:
[2024-10-09T14:19:49.408+05:30][INFO ][plugins.securitySolution] [task risk_engine:risk_scoring:default:0.0.1]: 

{"dataViewId":".alerts-security.alerts-default","enabled":true,"filter":{},"interval":"1h","pageSize":3500,"range":{"start":"now-30d","end":"now"},"excludeAlertStatuses":["closed"],"excludeAlertTags":["False Positive"]}

Risk Engine disabled, SO is updated and risk engine is enabled again :

[2024-10-09T14:21:44.834+05:30][INFO ][plugins.securitySolution] [task risk_engine:risk_scoring:default:0.0.1]: Starting Risk Engine with configuration:
[2024-10-09T14:21:44.838+05:30][INFO ][plugins.securitySolution] [task risk_engine:risk_scoring:default:0.0.1]: 

{"dataViewId":".alerts-security.alerts-default","enabled":true,"filter":{},"interval":"1h","pageSize":3500,"range":{"start":"now-30d","end":"now"},"excludeAlertStatuses":["closed","open"],"excludeAlertTags":["False Positive"]}

Checklist

Delete any items that are not applicable to this PR.

Unit or functional tests were updated or added to match the most common scenarios
Flaky Test Runner was used on any tests changed

For maintainers

This was checked for breaking API changes and was labeled appropriately

…ine saved object

kibana-ci · 2024-10-01T12:11:13Z

💔 Build Failed

Failed CI Steps

Test Failures

[job] [logs] x-pack/test_serverless/functional/test_suites/security/common_configs/config.group6.ts / discover/esql discover esql view switch modal should not show switch modal when switching to a data view while a saved search is open

Metrics [docs]

✅ unchanged

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @abhishekbhatia1710

…thub.com/abhishekbhatia1710/kibana into ea-new-api-to-allow-user-to-configure-SO

elasticmachine · 2024-10-09T11:51:23Z

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine · 2024-10-09T11:51:25Z

Pinging @elastic/security-entity-analytics (Team:Entity Analytics)

elasticmachine · 2024-10-09T14:29:23Z

💔 Build Failed

Buildkite Build
Commit: 7ead99d

Failed CI Steps

Test Failures

[job] [logs] Jest Tests #12 / RiskEngineDataClient using aliases for alert indices updateSavedObjectConfiguration should update the risk engine saved object configuration in the respective namespace
[job] [logs] Jest Tests #12 / RiskEngineDataClient using aliases for alert indices updateSavedObjectConfiguration should update the risk engine saved object configuration in the respective namespace
[job] [logs] Jest Tests #12 / RiskEngineDataClient using data streams for alert indices updateSavedObjectConfiguration should update the risk engine saved object configuration in the respective namespace
[job] [logs] Jest Tests #12 / RiskEngineDataClient using data streams for alert indices updateSavedObjectConfiguration should update the risk engine saved object configuration in the respective namespace

Metrics [docs]

✅ unchanged

History

💔 Build #240654 failed 82cc11a

cc @abhishekbhatia1710

machadoum · 2024-10-16T13:07:57Z

...ns/security_solution/server/lib/entity_analytics/risk_engine/risk_engine_data_client.test.ts

+        riskEngineDataClient = new RiskEngineDataClient(options);
+        const attributes = {
+          enabled: true,
+          excludeAlertStatuses: ['closed'],
+          excludeAlertTags: ['Duplicate'],
+        };
+        mockSavedObjectClient.find.mockResolvedValueOnce(getSavedObjectConfiguration());
+
+        mockSavedObjectClient.update.mockResolvedValueOnce({
+          attributes,
+        } as unknown as SavedObject<RiskEngineConfiguration>);
+
+        const result = await riskEngineDataClient.updateSavedObjectConfiguration({ attributes });
+        expect(result.attributes).toEqual(attributes);
+
+        // Check for the saved object configuration in the non-default space
+
+        options.namespace = namespaces.custom;
+        const riskEngineDataClient2 = new RiskEngineDataClient(options);
+        const attributes2 = {
+          enabled: true,
+          excludeAlertStatuses: ['open', 'closed'],
+          excludeAlertTags: ['False Positive', 'Duplicate'],
+        };
+        mockSavedObjectClient.find.mockResolvedValueOnce(getSavedObjectConfiguration());
+        mockSavedObjectClient.update.mockResolvedValueOnce({
+          attributes,
+        } as unknown as SavedObject<RiskEngineConfiguration>);
+
+        const result2 = await riskEngineDataClient2.updateSavedObjectConfiguration({
+          attributes: attributes2,
+        });
+        expect(result2.attributes).toEqual(attributes2);


Could you split it into 2 different tests?

machadoum · 2024-10-16T13:12:24Z

...ecurity_solution/server/lib/entity_analytics/risk_engine/utils/saved_object_configuration.ts

+    enabled?: boolean;
+    dataViewId?: string;
+    filter?: object;
+    identifierType?: string;
+    interval?: string;
+    pageSize?: number;
+    alertSampleSizePerShard?: number;
+    range?: {
+      start?: string;
+      end?: string;
+    };
+    excludeAlertStatuses?: Array<'open' | 'closed' | 'in-progress' | 'acknowledged'>;
+    excludeAlertTags?: Array<'Duplicate' | 'False Positive' | 'Futher investigation required'>;


Please reuse the RiskEngineConfiguration type as much as possible so we have a single source of truth.

machadoum · 2024-10-16T13:15:35Z

...est_suites/entity_analytics/risk_engine/trial_license_complete_tier/risk_engine_so_config.ts

+        type: riskEngineConfigurationTypeName,
+        space: spaceName,
+      });
+      if (soId.saved_objects.length !== 0) {
+        await kibanaServer.savedObjects.delete({
+          type: riskEngineConfigurationTypeName,
+          space: spaceName,
+          id: soId.saved_objects[0].id,
+        });
+      }
+      const soId2 = await kibanaServer.savedObjects.find({
+        type: riskEngineConfigurationTypeName,
+      });
+      if (soId2.saved_objects.length !== 0) {
+        await kibanaServer.savedObjects.delete({
+          type: riskEngineConfigurationTypeName,
+          id: soId2.saved_objects[0].id,
+        });
+      }
+      await esArchiver.load('x-pack/test/functional/es_archives/security_solution/ecs_compliant');
+    });
+
+    after(async () => {
+      const soId = await kibanaServer.savedObjects.find({
+        type: riskEngineConfigurationTypeName,
+        space: spaceName,
+      });
+      if (soId.saved_objects.length !== 0) {
+        await kibanaServer.savedObjects.delete({
+          type: riskEngineConfigurationTypeName,
+          space: spaceName,
+          id: soId.saved_objects[0].id,
+        });
+      }
+      const soId2 = await kibanaServer.savedObjects.find({
+        type: riskEngineConfigurationTypeName,
+      });
+      if (soId2.saved_objects.length !== 0) {
+        await kibanaServer.savedObjects.delete({
+          type: riskEngineConfigurationTypeName,
+          id: soId2.saved_objects[0].id,
+        });
+      }


Could you please simplify this duplicated code? Maybe extracting a helper is enough to clarify it.

machadoum · 2024-10-16T13:22:24Z

...est_suites/entity_analytics/risk_engine/trial_license_complete_tier/risk_engine_so_config.ts

+      await riskEngineRoutes.init();
+      await waitForRiskEngineRun;
+
+      const currentSoConfig = await getRiskEngineConfigSO({ kibanaServer });
+
+      expect(currentSoConfig.attributes).to.not.have.property('excludeAlertTags');
+      expect(currentSoConfig.attributes).to.not.have.property('excludeAlertStatuses');
+
+      const updatedSoBody = {
+        excludeAlertTags: ['False Positive'],
+        excludeAlertStatuses: ['open'],
+      };
+
+      await riskEngineRoutes.soConfig(updatedSoBody, 200);
+      const currentSoConfig2 = await getRiskEngineConfigSO({ kibanaServer });
+
+      expect(currentSoConfig2.attributes).to.have.property('excludeAlertTags');
+      expect(currentSoConfig2.attributes).to.have.property('excludeAlertStatuses');
+
+      await riskEngineRoutes.disable();
+      await waitForRiskEngineTaskToBeGone;
+
+      updatedSoBody.excludeAlertStatuses = [];
+
+      await riskEngineRoutes.soConfig(updatedSoBody, 200);
+
+      await riskEngineRoutes.enable();
+      await waitForRiskEngineRun;
+
+      const currentSoConfig3 = await getRiskEngineConfigSO({ kibanaServer });
+      expect(JSON.stringify(currentSoConfig3.attributes.excludeAlertStatuses)).to.equal(
+        JSON.stringify(updatedSoBody.excludeAlertStatuses)


Here, you are doing several tests inside the "it" block, and the test name is generic, which makes It hard to follow.
Could you break it down into several tests?
If you can't break down the test into small logical steps like the GIVEN - WHEN - THEN pattern. Please leave comments explaining the test intention.

Why did you install, disable and then enable the risk engine?

machadoum · 2024-10-16T13:28:02Z

...est_suites/entity_analytics/risk_engine/trial_license_complete_tier/risk_engine_so_config.ts

+
+    it('should include the right keys as per the update', async () => {
+      await riskEngineRoutes.init();
+      await waitForRiskEngineRun;


This doesn't wait because you are calling the function
.

Suggested change

await waitForRiskEngineRun;

await waitForRiskEngineRun({ log, supertest });

CAWilson94

Looking good! Thanks for adding :D

abhishekbhatia1710 · 2024-11-27T06:56:13Z

Closing this as it is a duplicate of : #201344

Adding changes to include a public API endpoint to configure risk eng…

f0e10eb

…ine saved object

abhishekbhatia1710 self-assigned this Oct 1, 2024

Fixes for accepting the right request body

884d0f3

abhishekbhatia1710 changed the title ~~[Entity Analytics] Adding changes to include a public API endpoint to configure risk engine saved object~~ [Entity Analytics] New API endpoint to configure risk engine saved object Oct 7, 2024

abhishekbhatia1710 and others added 5 commits October 8, 2024 13:02

Merge branch 'main' into ea-new-api-to-allow-user-to-configure-SO

368a0db

Adding unit tests

32b6215

Merge branch 'main' into ea-new-api-to-allow-user-to-configure-SO

e8af48f

Merge branch 'ea-new-api-to-allow-user-to-configure-SO' of https://gi…

cf11636

…thub.com/abhishekbhatia1710/kibana into ea-new-api-to-allow-user-to-configure-SO

Adding integration tests

82cc11a

abhishekbhatia1710 added release_note:enhancement backport This PR is a backport of another PR Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Entity Analytics Security Entity Analytics Team labels Oct 9, 2024

abhishekbhatia1710 marked this pull request as ready for review October 9, 2024 11:51

abhishekbhatia1710 requested review from a team as code owners October 9, 2024 11:51

abhishekbhatia1710 requested a review from hop-dev October 9, 2024 11:51

Lint changes

7ead99d

machadoum reviewed Oct 16, 2024

View reviewed changes

CAWilson94 approved these changes Nov 22, 2024

View reviewed changes

abhishekbhatia1710 closed this Nov 27, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Entity Analytics] New API endpoint to configure risk engine saved object#194545

[Entity Analytics] New API endpoint to configure risk engine saved object#194545
abhishekbhatia1710 wants to merge 8 commits intoelastic:mainfrom
abhishekbhatia1710:ea-new-api-to-allow-user-to-configure-SO

abhishekbhatia1710 commented Oct 1, 2024 •

edited

Loading

Uh oh!

kibana-ci commented Oct 1, 2024 •

edited

Loading

Uh oh!

elasticmachine commented Oct 9, 2024

Uh oh!

elasticmachine commented Oct 9, 2024

Uh oh!

elasticmachine commented Oct 9, 2024 •

edited

Loading

Uh oh!

machadoum Oct 16, 2024

Uh oh!

machadoum Oct 16, 2024

Uh oh!

machadoum Oct 16, 2024

Uh oh!

machadoum Oct 16, 2024

Uh oh!

machadoum Oct 16, 2024

Uh oh!

CAWilson94 left a comment

Uh oh!

abhishekbhatia1710 commented Nov 27, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	await waitForRiskEngineRun;
	await waitForRiskEngineRun({ log, supertest });

Conversation

abhishekbhatia1710 commented Oct 1, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

For maintainers

Uh oh!

kibana-ci commented Oct 1, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

History

Uh oh!

elasticmachine commented Oct 9, 2024

Uh oh!

elasticmachine commented Oct 9, 2024

Uh oh!

elasticmachine commented Oct 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

History

Uh oh!

machadoum Oct 16, 2024

Choose a reason for hiding this comment

Uh oh!

machadoum Oct 16, 2024

Choose a reason for hiding this comment

Uh oh!

machadoum Oct 16, 2024

Choose a reason for hiding this comment

Uh oh!

machadoum Oct 16, 2024

Choose a reason for hiding this comment

Uh oh!

machadoum Oct 16, 2024

Choose a reason for hiding this comment

Uh oh!

CAWilson94 left a comment

Choose a reason for hiding this comment

Uh oh!

abhishekbhatia1710 commented Nov 27, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

abhishekbhatia1710 commented Oct 1, 2024 •

edited

Loading

kibana-ci commented Oct 1, 2024 •

edited

Loading

elasticmachine commented Oct 9, 2024 •

edited

Loading