[Security Solutions][Detection Engine] Adds threat matching API and rule type

x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts

@@ -299,6 +299,7 @@ export const type = t.keyof({
   query: null,
   saved_query: null,
   threshold: null,
+  threat_match: null,
 });
 export type Type = t.TypeOf<typeof type>;
 

x-pack/plugins/security_solution/common/detection_engine/schemas/request/add_prepackaged_rules_schema.ts

@@ -45,6 +45,12 @@ import {
   RiskScoreMapping,
   SeverityMapping,
 } from '../common/schemas';
+import {
+  threat_index,
+  threat_query,
+  threat_filters,
+  threat_mapping,
+} from '../types/threat_mapping';
 
 import {
   DefaultStringArray,
@@ -116,6 +122,10 @@ export const addPrepackagedRulesSchema = t.intersection([
       references: DefaultStringArray, // defaults to empty array of strings if not set during decode
       note, // defaults to "undefined" if not set during decode
       exceptions_list: DefaultListArray, // defaults to empty array if not set during decode
+      threat_filters, // defaults to "undefined" if not set during decode
+      threat_mapping, // defaults to "undefined" if not set during decode
+      threat_query, // defaults to "undefined" if not set during decode
+      threat_index, // defaults to "undefined" if not set during decode
     })
   ),
 ]);

x-pack/plugins/security_solution/common/detection_engine/schemas/request/add_prepackged_rules_schema.test.ts

@@ -1596,5 +1596,84 @@ describe('add prepackaged rules schema', () => {
       };
       expect(message.schema).toEqual(expected);
     });
+
+    describe('threat_mapping', () => {
+      test('You can set a threat query, index, mapping, filters on a pre-packaged rule', () => {
+        const payload: AddPrepackagedRulesSchema = {
+          ...getAddPrepackagedRulesSchemaMock(),
+          threat_query: '*:*',
+          threat_index: 'list-index',
+          threat_mapping: [
+            {
+              entries: [
+                {
+                  field: 'host.name',
+                  value: 'host.name',
+                  type: 'mapping',
+                },
+              ],
+            },
+          ],
+          threat_filters: [
+            {
+              bool: {
+                must: [
+                  {
+                    query_string: {
+                      query: 'host.name: linux',
+                      analyze_wildcard: true,
+                      time_zone: 'Zulu',
+                    },
+                  },
+                ],
+                filter: [],
+                should: [],
+                must_not: [],
+              },
+            },
+          ],
+        };
+
+        const decoded = addPrepackagedRulesSchema.decode(payload);
+        const checked = exactCheck(payload, decoded);
+        const message = pipe(checked, foldLeftRight);
+        expect(getPaths(left(message.errors))).toEqual([]);
+        const expected: AddPrepackagedRulesSchema = {
+          ...getAddPrepackagedRulesSchemaDecodedMock(),
+          threat_query: '*:*',
+          threat_index: 'list-index',
+          threat_mapping: [
+            {
+              entries: [
+                {
+                  field: 'host.name',
+                  value: 'host.name',
+                  type: 'mapping',
+                },
+              ],
+            },
+          ],
+          threat_filters: [
+            {
+              bool: {
+                must: [
+                  {
+                    query_string: {
+                      query: 'host.name: linux',
+                      analyze_wildcard: true,
+                      time_zone: 'Zulu',
+                    },
+                  },
+                ],
+                filter: [],
+                should: [],
+                must_not: [],
+              },
+            },
+          ],
+        };
+        expect(message.schema).toEqual(expected);
+      });
+    });
   });
 });

x-pack/plugins/security_solution/common/detection_engine/schemas/request/create_rules_schema.test.ts

@@ -1660,5 +1660,84 @@ describe('create rules schema', () => {
       };
       expect(message.schema).toEqual(expected);
     });
+
+    describe('threat_mapping', () => {
+      test('You can set a threat query, index, mapping, filters on a pre-packaged rule', () => {
+        const payload: CreateRulesSchema = {
+          ...getCreateRulesSchemaMock(),
+          threat_query: '*:*',
+          threat_index: 'list-index',
+          threat_mapping: [
+            {
+              entries: [
+                {
+                  field: 'host.name',
+                  value: 'host.name',
+                  type: 'mapping',
+                },
+              ],
+            },
+          ],
+          threat_filters: [
+            {
+              bool: {
+                must: [
+                  {
+                    query_string: {
+                      query: 'host.name: linux',
+                      analyze_wildcard: true,
+                      time_zone: 'Zulu',
+                    },
+                  },
+                ],
+                filter: [],
+                should: [],
+                must_not: [],
+              },
+            },
+          ],
+        };
+
+        const decoded = createRulesSchema.decode(payload);
+        const checked = exactCheck(payload, decoded);
+        const message = pipe(checked, foldLeftRight);
+        expect(getPaths(left(message.errors))).toEqual([]);
+        const expected: CreateRulesSchemaDecoded = {
+          ...getCreateRulesSchemaDecodedMock(),
+          threat_query: '*:*',
+          threat_index: 'list-index',
+          threat_mapping: [
+            {
+              entries: [
+                {
+                  field: 'host.name',
+                  value: 'host.name',
+                  type: 'mapping',
+                },
+              ],
+            },
+          ],
+          threat_filters: [
+            {
+              bool: {
+                must: [
+                  {
+                    query_string: {
+                      query: 'host.name: linux',
+                      analyze_wildcard: true,
+                      time_zone: 'Zulu',
+                    },
+                  },
+                ],
+                filter: [],
+                should: [],
+                must_not: [],
+              },
+            },
+          ],
+        };
+        expect(message.schema).toEqual(expected);
+      });
+    });
   });
 });

x-pack/plugins/security_solution/common/detection_engine/schemas/request/create_rules_schema.ts

@@ -46,6 +46,12 @@ import {
   RiskScoreMapping,
   SeverityMapping,
 } from '../common/schemas';
+import {
+  threat_index,
+  threat_query,
+  threat_filters,
+  threat_mapping,
+} from '../types/threat_mapping';
 
 import {
   DefaultStringArray,
@@ -112,6 +118,10 @@ export const createRulesSchema = t.intersection([
       note, // defaults to "undefined" if not set during decode
       version: DefaultVersionNumber, // defaults to 1 if not set during decode
       exceptions_list: DefaultListArray, // defaults to empty array if not set during decode
+      threat_mapping, // defaults to "undefined" if not set during decode
+      threat_query, // defaults to "undefined" if not set during decode
+      threat_filters, // defaults to "undefined" if not set during decode
+      threat_index, // defaults to "undefined" if not set during decode
     })
   ),
 ]);

x-pack/plugins/security_solution/common/detection_engine/schemas/request/create_rules_type_dependents.test.ts

@@ -87,4 +87,71 @@ describe('create_rules_type_dependents', () => {
     const errors = createRuleValidateTypeDependents(schema);
     expect(errors).toEqual(['"threshold.value" has to be bigger than 0']);
   });
+
+  test('threat_index, threat_query, and threat_mapping are required when type is "threat_match" and validates with it', () => {
+    const schema: CreateRulesSchema = {
+      ...getCreateRulesSchemaMock(),
+      type: 'threat_match',
+    };
+    const errors = createRuleValidateTypeDependents(schema);
+    expect(errors).toEqual([
+      'when "type" is "threat_match", "threat_index" is required',
+      'when "type" is "threat_match", "threat_query" is required',
+      'when "type" is "threat_match", "threat_mapping" is required',
+    ]);
+  });
+
+  test('validates with threat_index, threat_query, and threat_mapping when type is "threat_match"', () => {
+    const schema: CreateRulesSchema = {
+      ...getCreateRulesSchemaMock(),
+      type: 'threat_match',
+      threat_index: 'index-123',
+      threat_mapping: [{ entries: [{ field: '', type: 'mapping', value: '' }] }],
+      threat_query: '*:*',
+    };
+    const errors = createRuleValidateTypeDependents(schema);
+    expect(errors).toEqual([]);
+  });
+
+  test('does NOT validate when threat_mapping is an empty array', () => {
+    const schema: CreateRulesSchema = {
+      ...getCreateRulesSchemaMock(),
+      type: 'threat_match',
+      threat_index: 'index-123',
+      threat_mapping: [],
+      threat_query: '*:*',
+    };
+    const errors = createRuleValidateTypeDependents(schema);
+    expect(errors).toEqual(['threat_mapping" must have at least one element']);
+  });
+
+  test('validates with threat_index, threat_query, threat_mapping, and an optional threat_filters, when type is "threat_match"', () => {
+    const schema: CreateRulesSchema = {
+      ...getCreateRulesSchemaMock(),
+      type: 'threat_match',
+      threat_index: 'index-123',
+      threat_mapping: [{ entries: [{ field: '', type: 'mapping', value: '' }] }],
+      threat_query: '*:*',
+      threat_filters: [
+        {
+          bool: {
+            must: [
+              {
+                query_string: {
+                  query: 'host.name: linux',
+                  analyze_wildcard: true,
+                  time_zone: 'Zulu',
+                },
+              },
+            ],
+            filter: [],
+            should: [],
+            must_not: [],
+          },
+        },
+      ],
+    };
+    const errors = createRuleValidateTypeDependents(schema);
+    expect(errors).toEqual([]);
+  });
 });

x-pack/plugins/security_solution/common/detection_engine/schemas/request/create_rules_type_dependents.ts

@@ -107,6 +107,24 @@ export const validateThreshold = (rule: CreateRulesSchema): string[] => {
   return [];
 };
 
+export const validateThreatMapping = (rule: CreateRulesSchema): string[] => {
+  let errors: string[] = [];
+  if (rule.type === 'threat_match') {
+    if (!rule.threat_mapping) {
+      errors = ['when "type" is "threat_match", "threat_mapping" is required', ...errors];
+    } else if (rule.threat_mapping.length === 0) {
+      errors = ['threat_mapping" must have at least one element', ...errors];
+    }
+    if (!rule.threat_query) {
+      errors = ['when "type" is "threat_match", "threat_query" is required', ...errors];
+    }
+    if (!rule.threat_index) {
+      errors = ['when "type" is "threat_match", "threat_index" is required', ...errors];
+    }
+  }
+  return errors;
+};
+
 export const createRuleValidateTypeDependents = (schema: CreateRulesSchema): string[] => {
   return [
     ...validateAnomalyThreshold(schema),
@@ -117,5 +135,6 @@ export const createRuleValidateTypeDependents = (schema: CreateRulesSchema): str
     ...validateTimelineId(schema),
     ...validateTimelineTitle(schema),
     ...validateThreshold(schema),
+    ...validateThreatMapping(schema),
   ];
 };