Skip to content

Commit 47b8ba5

Browse files
cnasikascnasikas
authored
[SIEM][CASE] Refactor Connectors - Jira Connector (#63450)
1 parent 16ba937 commit 47b8ba5

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

84 files changed

+5330
-3235
lines changed

‎x-pack/plugins/actions/README.md‎

Lines changed: 56 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ Table of Contents
2828
- [RESTful API](#restful-api)
2929
- [`POST /api/action`: Create action](#post-apiaction-create-action)
3030
- [`DELETE /api/action/{id}`: Delete action](#delete-apiactionid-delete-action)
31-
- [`GET /api/action/_getAll`: Get all actions](#get-apiaction-get-all-actions)
31+
- [`GET /api/action/_getAll`: Get all actions](#get-apiactiongetall-get-all-actions)
3232
- [`GET /api/action/{id}`: Get action](#get-apiactionid-get-action)
3333
- [`GET /api/action/types`: List action types](#get-apiactiontypes-list-action-types)
3434
- [`PUT /api/action/{id}`: Update action](#put-apiactionid-update-action)
@@ -64,6 +64,12 @@ Table of Contents
6464
- [`config`](#config-6)
6565
- [`secrets`](#secrets-6)
6666
- [`params`](#params-6)
67+
- [`subActionParams (pushToService)`](#subactionparams-pushtoservice)
68+
- [Jira](#jira)
69+
- [`config`](#config-7)
70+
- [`secrets`](#secrets-7)
71+
- [`params`](#params-7)
72+
- [`subActionParams (pushToService)`](#subactionparams-pushtoservice-1)
6773
- [Command Line Utility](#command-line-utility)
6874

6975
## Terminology
@@ -143,8 +149,8 @@ This is the primary function for an action type. Whenever the action needs to ex
143149
| actionId | The action saved object id that the action type is executing for. |
144150
| config | The decrypted configuration given to an action. This comes from the action saved object that is partially or fully encrypted within the data store. If you would like to validate the config before being passed to the executor, define `validate.config` within the action type. |
145151
| params | Parameters for the execution. These will be given at execution time by either an alert or manually provided when calling the plugin provided execute function. |
146-
| services.callCluster(path, opts) | Use this to do Elasticsearch queries on the cluster Kibana connects to. This function is the same as any other `callCluster` in Kibana but runs in the context of the user who is calling the action when security is enabled.|
147-
| services.getScopedCallCluster | This function scopes an instance of CallCluster by returning a `callCluster(path, opts)` function that runs in the context of the user who is calling the action when security is enabled. This must only be called with instances of CallCluster provided by core.|
152+
| services.callCluster(path, opts) | Use this to do Elasticsearch queries on the cluster Kibana connects to. This function is the same as any other `callCluster` in Kibana but runs in the context of the user who is calling the action when security is enabled. |
153+
| services.getScopedCallCluster | This function scopes an instance of CallCluster by returning a `callCluster(path, opts)` function that runs in the context of the user who is calling the action when security is enabled. This must only be called with instances of CallCluster provided by core. |
148154
| services.savedObjectsClient | This is an instance of the saved objects client. This provides the ability to do CRUD on any saved objects within the same space the alert lives in.<br><br>The scope of the saved objects client is tied to the user in context calling the execute API or the API key provided to the execute plugin function (only when security isenabled). |
149155
| services.log(tags, [data], [timestamp]) | Use this to create server logs. (This is the same function as server.log) |
150156

@@ -483,13 +489,59 @@ The ServiceNow action uses the [V2 Table API](https://developer.servicenow.com/a
483489

484490
### `params`
485491

492+
| Property | Description | Type |
493+
| --------------- | ------------------------------------------------------------------------------------ | ------ |
494+
| subAction | The sub action to perform. It can be `pushToService`, `handshake`, and `getIncident` | string |
495+
| subActionParams | The parameters of the sub action | object |
496+
497+
#### `subActionParams (pushToService)`
498+
486499
| Property | Description | Type |
487500
| ----------- | -------------------------------------------------------------------------------------------------------------------------- | --------------------- |
488501
| caseId | The case id | string |
489502
| title | The title of the case | string _(optional)_ |
490503
| description | The description of the case | string _(optional)_ |
491504
| comments | The comments of the case. A comment is of the form `{ commentId: string, version: string, comment: string }` | object[] _(optional)_ |
492-
| incidentID | The id of the incident in ServiceNow . If presented the incident will be update. Otherwise a new incident will be created. | string _(optional)_ |
505+
| externalId | The id of the incident in ServiceNow . If presented the incident will be update. Otherwise a new incident will be created. | string _(optional)_ |
506+
507+
---
508+
509+
## Jira
510+
511+
ID: `.jira`
512+
513+
The Jira action uses the [V2 API](https://developer.atlassian.com/cloud/jira/platform/rest/v2/) to create and update Jira incidents.
514+
515+
### `config`
516+
517+
| Property | Description | Type |
518+
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ |
519+
| apiUrl | ServiceNow instance URL. | string |
520+
| casesConfiguration | Case configuration object. The object should contain an attribute called `mapping`. A `mapping` is an array of objects. Each mapping object should be of the form `{ source: string, target: string, actionType: string }`. `source` is the Case field. `target` is the Jira field where `source` will be mapped to. `actionType` can be one of `nothing`, `overwrite` or `append`. For example the `{ source: 'title', target: 'summary', actionType: 'overwrite' }` record, inside mapping array, means that the title of a case will be mapped to the short description of an incident in ServiceNow and will be overwrite on each update. | object |
521+
522+
### `secrets`
523+
524+
| Property | Description | Type |
525+
| -------- | --------------------------------------- | ------ |
526+
| email | email for HTTP Basic authentication | string |
527+
| apiToken | API token for HTTP Basic authentication | string |
528+
529+
### `params`
530+
531+
| Property | Description | Type |
532+
| --------------- | ------------------------------------------------------------------------------------ | ------ |
533+
| subAction | The sub action to perform. It can be `pushToService`, `handshake`, and `getIncident` | string |
534+
| subActionParams | The parameters of the sub action | object |
535+
536+
#### `subActionParams (pushToService)`
537+
538+
| Property | Description | Type |
539+
| ----------- | ------------------------------------------------------------------------------------------------------------------- | --------------------- |
540+
| caseId | The case id | string |
541+
| title | The title of the case | string _(optional)_ |
542+
| description | The description of the case | string _(optional)_ |
543+
| comments | The comments of the case. A comment is of the form `{ commentId: string, version: string, comment: string }` | object[] _(optional)_ |
544+
| externalId | The id of the incident in Jira. If presented the incident will be update. Otherwise a new incident will be created. | string _(optional)_ |
493545

494546
# Command Line Utility
495547

‎x-pack/plugins/actions/server/builtin_action_types/case/api.ts‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License;
4+
* you may not use this file except in compliance with the Elastic License.
5+
*/
6+
7+
import {
8+
ExternalServiceApi,
9+
ExternalServiceParams,
10+
PushToServiceResponse,
11+
GetIncidentApiHandlerArgs,
12+
HandshakeApiHandlerArgs,
13+
PushToServiceApiHandlerArgs,
14+
} from './types';
15+
import { prepareFieldsForTransformation, transformFields, transformComments } from './utils';
16+
17+
const handshakeHandler = async ({
18+
externalService,
19+
mapping,
20+
params,
21+
}: HandshakeApiHandlerArgs) => {};
22+
const getIncidentHandler = async ({
23+
externalService,
24+
mapping,
25+
params,
26+
}: GetIncidentApiHandlerArgs) => {};
27+
28+
const pushToServiceHandler = async ({
29+
externalService,
30+
mapping,
31+
params,
32+
}: PushToServiceApiHandlerArgs): Promise<PushToServiceResponse> => {
33+
const { externalId, comments } = params;
34+
const updateIncident = externalId ? true : false;
35+
const defaultPipes = updateIncident ? ['informationUpdated'] : ['informationCreated'];
36+
let currentIncident: ExternalServiceParams | undefined;
37+
let res: PushToServiceResponse;
38+
39+
if (externalId) {
40+
currentIncident = await externalService.getIncident(externalId);
41+
}
42+
43+
const fields = prepareFieldsForTransformation({
44+
params,
45+
mapping,
46+
defaultPipes,
47+
});
48+
49+
const incident = transformFields({
50+
params,
51+
fields,
52+
currentIncident,
53+
});
54+
55+
if (updateIncident) {
56+
res = await externalService.updateIncident({ incidentId: externalId, incident });
57+
} else {
58+
res = await externalService.createIncident({ incident });
59+
}
60+
61+
if (
62+
comments &&
63+
Array.isArray(comments) &&
64+
comments.length > 0 &&
65+
mapping.get('comments')?.actionType !== 'nothing'
66+
) {
67+
const commentsTransformed = transformComments(comments, ['informationAdded']);
68+
69+
res.comments = [];
70+
for (const currentComment of commentsTransformed) {
71+
const comment = await externalService.createComment({
72+
incidentId: res.id,
73+
comment: currentComment,
74+
field: mapping.get('comments')?.target ?? 'comments',
75+
});
76+
res.comments = [
77+
...(res.comments ?? []),
78+
{
79+
commentId: comment.commentId,
80+
pushedDate: comment.pushedDate,
81+
},
82+
];
83+
}
84+
}
85+
86+
return res;
87+
};
88+
89+
export const api: ExternalServiceApi = {
90+
handshake: handshakeHandler,
91+
pushToService: pushToServiceHandler,
92+
getIncident: getIncidentHandler,
93+
};

‎x-pack/plugins/actions/server/builtin_action_types/servicenow/constants.ts‎ renamed to ‎x-pack/plugins/actions/server/builtin_action_types/case/constants.ts‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,4 @@
44
* you may not use this file except in compliance with the Elastic License.
55
*/
66

7-
export const ACTION_TYPE_ID = '.servicenow';
87
export const SUPPORTED_SOURCE_FIELDS = ['title', 'comments', 'description'];

‎x-pack/plugins/actions/server/builtin_action_types/case/schema.ts‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License;
4+
* you may not use this file except in compliance with the Elastic License.
5+
*/
6+
7+
import { schema } from '@kbn/config-schema';
8+
9+
export const MappingActionType = schema.oneOf([
10+
schema.literal('nothing'),
11+
schema.literal('overwrite'),
12+
schema.literal('append'),
13+
]);
14+
15+
export const MapRecordSchema = schema.object({
16+
source: schema.string(),
17+
target: schema.string(),
18+
actionType: MappingActionType,
19+
});
20+
21+
export const CaseConfigurationSchema = schema.object({
22+
mapping: schema.arrayOf(MapRecordSchema),
23+
});
24+
25+
export const ExternalIncidentServiceConfiguration = {
26+
apiUrl: schema.string(),
27+
casesConfiguration: CaseConfigurationSchema,
28+
};
29+
30+
export const ExternalIncidentServiceConfigurationSchema = schema.object(
31+
ExternalIncidentServiceConfiguration
32+
);
33+
34+
export const ExternalIncidentServiceSecretConfiguration = {
35+
password: schema.string(),
36+
username: schema.string(),
37+
};
38+
39+
export const ExternalIncidentServiceSecretConfigurationSchema = schema.object(
40+
ExternalIncidentServiceSecretConfiguration
41+
);
42+
43+
export const UserSchema = schema.object({
44+
fullName: schema.nullable(schema.string()),
45+
username: schema.nullable(schema.string()),
46+
});
47+
48+
const EntityInformation = {
49+
createdAt: schema.string(),
50+
createdBy: UserSchema,
51+
updatedAt: schema.nullable(schema.string()),
52+
updatedBy: schema.nullable(UserSchema),
53+
};
54+
55+
export const EntityInformationSchema = schema.object(EntityInformation);
56+
57+
export const CommentSchema = schema.object({
58+
commentId: schema.string(),
59+
comment: schema.string(),
60+
...EntityInformation,
61+
});
62+
63+
export const ExecutorSubActionSchema = schema.oneOf([
64+
schema.literal('getIncident'),
65+
schema.literal('pushToService'),
66+
schema.literal('handshake'),
67+
]);
68+
69+
export const ExecutorSubActionPushParamsSchema = schema.object({
70+
caseId: schema.string(),
71+
title: schema.string(),
72+
description: schema.nullable(schema.string()),
73+
comments: schema.nullable(schema.arrayOf(CommentSchema)),
74+
externalId: schema.nullable(schema.string()),
75+
...EntityInformation,
76+
});
77+
78+
export const ExecutorSubActionGetIncidentParamsSchema = schema.object({
79+
externalId: schema.string(),
80+
});
81+
82+
// Reserved for future implementation
83+
export const ExecutorSubActionHandshakeParamsSchema = schema.object({});
84+
85+
export const ExecutorParamsSchema = schema.oneOf([
86+
schema.object({
87+
subAction: schema.literal('getIncident'),
88+
subActionParams: ExecutorSubActionGetIncidentParamsSchema,
89+
}),
90+
schema.object({
91+
subAction: schema.literal('handshake'),
92+
subActionParams: ExecutorSubActionHandshakeParamsSchema,
93+
}),
94+
schema.object({
95+
subAction: schema.literal('pushToService'),
96+
subActionParams: ExecutorSubActionPushParamsSchema,
97+
}),
98+
]);

0 commit comments

Comments
 (0)