Skip to content

[Cloud Security] handle both rule.references and rule.reference in misconfiguraiton flyout #195932

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maxcold merged 2 commits into from
Oct 14, 2024
Merged

[Cloud Security] handle both rule.references and rule.reference in misconfiguraiton flyout #195932

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
12b4d1c
handle both rule.references and rule.reference in misconfiguraiton fl…
maxcold Oct 11, 2024
f27e68d
Merge branch 'main' into csp-handle-rule-reference
maxcold Oct 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions x-pack/packages/kbn-cloud-security-posture-common/schema/rules/v3.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ export const cspBenchmarkRuleMetadataSchema = schema.object({
profile_applicability: schema.string(),
rationale: schema.string(),
references: schema.maybe(schema.string()),
reference: schema.maybe(schema.string()),
Copy link
Copy Markdown
Contributor

@kfirpeled kfirpeled Oct 12, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a suggestion: maybe it would be simpler to fix it in the ingest pipeline and rely on it here?

Copy link
Copy Markdown
Contributor Author

@maxcold maxcold Oct 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kfirpeled do you mean in the ingest pipeline of cloud_security_posture copy the value of rule.references into rule.reference to be able to remove rule.references completely? We could do that, but as the change to support both is quite small, I thought it would be safer just to support both at first and then depreciate rule.references. Otherwise I need to think how the UI will work out with the older version of the integration, as integration update is not a given when you update the stack version. Am I missing smth?

Copy link
Copy Markdown
Contributor

@kfirpeled kfirpeled Oct 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nope, you are not missing anything.
However, since we do have automatic updates of the integration, after 24 hours all the misconfigurations will have the updated field. so it shortens your migration process.

both ways work

rego_rule_id: schema.string(),
remediation: schema.string(),
section: schema.string(),
Expand Down
194 changes: 99 additions & 95 deletions ...k/plugins/cloud_security_posture/public/pages/configurations/findings_flyout/rule_tab.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,111 +13,115 @@ import type { CspFinding } from '@kbn/cloud-security-posture-common';
import { RulesDetectionRuleCounter } from '../../rules/rules_detection_rule_counter';
import { BenchmarkIcons, CspFlyoutMarkdown, EMPTY_VALUE, RuleNameLink } from './findings_flyout';

const getReferenceFromRule = (rule?: CspFinding['rule']) => {
return rule?.reference || rule?.references;
};

export const getRuleList = (
rule?: CspFinding['rule'],
ruleState = 'unmuted',
ruleFlyoutLink?: string
) => [
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.nameTitle', {
defaultMessage: 'Name',
}),
description: rule?.name ? (
<RuleNameLink ruleFlyoutLink={ruleFlyoutLink} ruleName={rule.name} />
) : (
EMPTY_VALUE
),
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.descriptionTitle', {
defaultMessage: 'Description',
}),
description: rule?.description ? (
<CspFlyoutMarkdown>{rule.description}</CspFlyoutMarkdown>
) : (
EMPTY_VALUE
),
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.AlertsTitle', {
defaultMessage: 'Alerts',
}),
description:
ruleState === 'muted' ? (
<FormattedMessage
id="xpack.csp.findings.findingsFlyout.ruleTab.disabledRuleText"
defaultMessage="Disabled"
/>
) : rule?.benchmark?.name ? (
<RulesDetectionRuleCounter benchmarkRule={rule} />
) => {
const reference = getReferenceFromRule(rule);

return [
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.nameTitle', {
defaultMessage: 'Name',
}),
description: rule?.name ? (
<RuleNameLink ruleFlyoutLink={ruleFlyoutLink} ruleName={rule.name} />
) : (
EMPTY_VALUE
),
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.descriptionTitle', {
defaultMessage: 'Description',
}),
description: rule?.description ? (
<CspFlyoutMarkdown>{rule.description}</CspFlyoutMarkdown>
) : (
EMPTY_VALUE
),
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.tagsTitle', {
defaultMessage: 'Tags',
}),
description: rule?.tags?.length ? (
<>
{rule.tags.map((tag) => (
<EuiBadge key={tag}>{tag}</EuiBadge>
))}
</>
) : (
EMPTY_VALUE
),
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.frameworkSourcesTitle', {
defaultMessage: 'Framework Sources',
}),
description:
rule?.benchmark?.id && rule?.benchmark?.name ? (
<BenchmarkIcons benchmarkId={rule.benchmark.id} benchmarkName={rule.benchmark.name} />
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.AlertsTitle', {
defaultMessage: 'Alerts',
}),
description:
ruleState === 'muted' ? (
<FormattedMessage
id="xpack.csp.findings.findingsFlyout.ruleTab.disabledRuleText"
defaultMessage="Disabled"
/>
) : rule?.benchmark?.name ? (
<RulesDetectionRuleCounter benchmarkRule={rule} />
) : (
EMPTY_VALUE
),
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.tagsTitle', {
defaultMessage: 'Tags',
}),
description: rule?.tags?.length ? (
<>
{rule.tags.map((tag) => (
<EuiBadge key={tag}>{tag}</EuiBadge>
))}
</>
) : (
EMPTY_VALUE
),
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.cisSectionTitle', {
defaultMessage: 'Framework Section',
}),
description: rule?.section || EMPTY_VALUE,
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.profileApplicabilityTitle', {
defaultMessage: 'Profile Applicability',
}),
description: rule?.profile_applicability ? (
<CspFlyoutMarkdown>{rule.profile_applicability}</CspFlyoutMarkdown>
) : (
EMPTY_VALUE
),
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.benchmarkTitle', {
defaultMessage: 'Benchmark',
}),
description: rule?.benchmark?.name || EMPTY_VALUE,
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.auditTitle', {
defaultMessage: 'Audit',
}),
description: rule?.audit ? <CspFlyoutMarkdown>{rule.audit}</CspFlyoutMarkdown> : EMPTY_VALUE,
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.referencesTitle', {
defaultMessage: 'References',
}),
description: rule?.references ? (
<CspFlyoutMarkdown>{rule.references}</CspFlyoutMarkdown>
) : (
EMPTY_VALUE
),
},
];
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.frameworkSourcesTitle', {
defaultMessage: 'Framework Sources',
}),
description:
rule?.benchmark?.id && rule?.benchmark?.name ? (
<BenchmarkIcons benchmarkId={rule.benchmark.id} benchmarkName={rule.benchmark.name} />
) : (
EMPTY_VALUE
),
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.cisSectionTitle', {
defaultMessage: 'Framework Section',
}),
description: rule?.section || EMPTY_VALUE,
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.profileApplicabilityTitle', {
defaultMessage: 'Profile Applicability',
}),
description: rule?.profile_applicability ? (
<CspFlyoutMarkdown>{rule.profile_applicability}</CspFlyoutMarkdown>
) : (
EMPTY_VALUE
),
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.benchmarkTitle', {
defaultMessage: 'Benchmark',
}),
description: rule?.benchmark?.name || EMPTY_VALUE,
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.auditTitle', {
defaultMessage: 'Audit',
}),
description: rule?.audit ? <CspFlyoutMarkdown>{rule.audit}</CspFlyoutMarkdown> : EMPTY_VALUE,
},
{
title: i18n.translate('xpack.csp.findings.findingsFlyout.ruleTab.referencesTitle', {
defaultMessage: 'References',
}),
description: reference ? <CspFlyoutMarkdown>{reference}</CspFlyoutMarkdown> : EMPTY_VALUE,
Copy link
Copy Markdown
Contributor Author

@maxcold maxcold Oct 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the only meaningful change in the returned array is here

},
];
};

export const RuleTab = ({
data,
Expand Down