diff --git a/x-pack/plugins/endpoint/common/alert_constants.ts b/x-pack/plugins/endpoint/common/alert_constants.ts index 85e1643d684f2..66de2b85ef3a7 100644 --- a/x-pack/plugins/endpoint/common/alert_constants.ts +++ b/x-pack/plugins/endpoint/common/alert_constants.ts @@ -13,10 +13,6 @@ export class AlertConstants { * The path for the Alert's Index Pattern API. */ static INDEX_PATTERN_ROUTE = `${AlertConstants.BASE_API_URL}/index_pattern`; - /** - * Alert's Index pattern - */ - static ALERT_INDEX_NAME = 'events-endpoint-1'; /** * A paramter passed to Alert's Index Pattern. */ diff --git a/x-pack/plugins/endpoint/server/routes/alerts/details/handlers.ts b/x-pack/plugins/endpoint/server/routes/alerts/details/handlers.ts index 92f8aacbf26a2..04e3a9e5f5f63 100644 --- a/x-pack/plugins/endpoint/server/routes/alerts/details/handlers.ts +++ b/x-pack/plugins/endpoint/server/routes/alerts/details/handlers.ts @@ -3,10 +3,9 @@ * or more contributor license agreements. Licensed under the Elastic License; * you may not use this file except in compliance with the Elastic License. */ -import { GetResponse } from 'elasticsearch'; +import { SearchResponse } from 'elasticsearch'; import { KibanaRequest, RequestHandler } from 'kibana/server'; import { AlertEvent } from '../../../../common/types'; -import { AlertConstants } from '../../../../common/alert_constants'; import { EndpointAppContext } from '../../../types'; import { AlertDetailsRequestParams } from '../types'; import { AlertDetailsPagination } from './lib'; @@ -20,23 +19,33 @@ export const alertDetailsHandlerWrapper = function( req: KibanaRequest, res ) => { - try { - const alertId = req.params.id; - const response = (await ctx.core.elasticsearch.dataClient.callAsCurrentUser('get', { - index: AlertConstants.ALERT_INDEX_NAME, - id: alertId, - })) as GetResponse; + const logger = endpointAppContext.logFactory.get('alerts'); + try { const indexPattern = await endpointAppContext.service .getIndexPatternRetriever() .getEventIndexPattern(ctx); + const alertId = req.params.id; + const results = (await ctx.core.elasticsearch.dataClient.callAsCurrentUser('search', { + index: indexPattern, + body: { query: { ids: { values: [alertId] } } }, + })) as SearchResponse; + + if (results.hits.hits.length === 0) { + const errMsg = `Unable to find alert id: ${alertId}`; + logger.info(errMsg); + return res.notFound({ body: errMsg }); + } + + const alertResponse = results.hits.hits[0]; + const config = await endpointAppContext.config(); const pagination: AlertDetailsPagination = new AlertDetailsPagination( config, ctx, req.params, - response, + alertResponse._source, indexPattern ); @@ -45,13 +54,13 @@ export const alertDetailsHandlerWrapper = function( endpointAppContext, requestHandlerContext: ctx, }, - response._source.host.id + alertResponse._source.host.id ); return res.ok({ body: { - id: response._id, - ...response._source, + id: alertResponse._id, + ...alertResponse._source, state: { host_metadata: currentHostInfo?.metadata, }, @@ -63,6 +72,7 @@ export const alertDetailsHandlerWrapper = function( if (err.status === 404) { return res.notFound({ body: err }); } + logger.warn(err); return res.internalError({ body: err }); } }; diff --git a/x-pack/plugins/endpoint/server/routes/alerts/details/lib/pagination.ts b/x-pack/plugins/endpoint/server/routes/alerts/details/lib/pagination.ts index 0f69e1bb60c44..4bb3a8126b7ed 100644 --- a/x-pack/plugins/endpoint/server/routes/alerts/details/lib/pagination.ts +++ b/x-pack/plugins/endpoint/server/routes/alerts/details/lib/pagination.ts @@ -4,7 +4,7 @@ * you may not use this file except in compliance with the Elastic License. */ -import { GetResponse, SearchResponse } from 'elasticsearch'; +import { SearchResponse } from 'elasticsearch'; import { AlertEvent, AlertHits, AlertAPIOrdering } from '../../../../../common/types'; import { AlertConstants } from '../../../../../common/alert_constants'; import { EndpointConfigType } from '../../../../config'; @@ -17,15 +17,12 @@ import { Filter } from '../../../../../../../../src/plugins/data/server'; /** * Pagination class for alert details. */ -export class AlertDetailsPagination extends Pagination< - AlertDetailsRequestParams, - GetResponse -> { +export class AlertDetailsPagination extends Pagination { constructor( config: EndpointConfigType, requestContext: RequestHandlerContext, state: AlertDetailsRequestParams, - data: GetResponse, + data: AlertEvent, private readonly indexPattern: string ) { super(config, requestContext, state, data); @@ -69,8 +66,8 @@ export class AlertDetailsPagination extends Pagination< */ async getNextUrl(): Promise { const response = await this.doSearch('asc', [ - this.data._source['@timestamp'].toString(), - this.data._source.event.id, + this.data['@timestamp'].toString(), + this.data.event.id, ]); return this.getUrlFromHits(response.hits.hits); } @@ -80,8 +77,8 @@ export class AlertDetailsPagination extends Pagination< */ async getPrevUrl(): Promise { const response = await this.doSearch('desc', [ - this.data._source['@timestamp'].toString(), - this.data._source.event.id, + this.data['@timestamp'].toString(), + this.data.event.id, ]); return this.getUrlFromHits(response.hits.hits); }