Skip to content

Commit 8a06aa4

Browse files
kibanamachineszaffarano
kibanamachine
and
szaffarano
authored
[8.8] Support new enrichment fields (#157889) (#157961)
# Backport This will backport the following commits from `main` to `8.8`: - [Support new enrichment fields (#157889)](#157889) <!--- Backport version: 8.9.7 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Sebastián Zaffarano","email":"sebastian.zaffarano@elastic.co"},"sourceCommit":{"committedDate":"2023-05-17T07:36:03Z","message":"Support new enrichment fields (#157889)\n\n## Summary\r\n\r\nAdds support for the following Endpoint fields for detection \r\nrules telemetry:\r\n\r\n- process.Ext.effective_parent.name\r\n- process.Ext.effective_parent.executable\r\n- file.Ext.original.name\r\n- process.Ext.api.name\r\n- file.Ext.header_bytes\r\n- process.parent.Ext.real.pid\r\n- dll.Ext.relative_file_creation_time\r\n- dll.Ext.relative_file_name_modify_time\r\n- file.Ext.entropy\r\n- dll.name\r\n- dll.path\r\n- dll.code_signature.trusted\r\n- dll.pe.original_file_name\r\n- file.directory\r\n- dll.hash.sha256\r\n- dll.pe.imphash\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"81bcd4a3bad1e6e057addecf29c5f8d7bdec0aae","branchLabelMapping":{"^v8.9.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["Feature:Telemetry","release_note:skip","Team: SecuritySolution","v8.9.0","v8.8.1"],"number":157889,"url":"https://github.com/elastic/kibana/pull/157889","mergeCommit":{"message":"Support new enrichment fields (#157889)\n\n## Summary\r\n\r\nAdds support for the following Endpoint fields for detection \r\nrules telemetry:\r\n\r\n- process.Ext.effective_parent.name\r\n- process.Ext.effective_parent.executable\r\n- file.Ext.original.name\r\n- process.Ext.api.name\r\n- file.Ext.header_bytes\r\n- process.parent.Ext.real.pid\r\n- dll.Ext.relative_file_creation_time\r\n- dll.Ext.relative_file_name_modify_time\r\n- file.Ext.entropy\r\n- dll.name\r\n- dll.path\r\n- dll.code_signature.trusted\r\n- dll.pe.original_file_name\r\n- file.directory\r\n- dll.hash.sha256\r\n- dll.pe.imphash\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"81bcd4a3bad1e6e057addecf29c5f8d7bdec0aae"}},"sourceBranch":"main","suggestedTargetBranches":["8.8"],"targetPullRequestStates":[{"branch":"main","label":"v8.9.0","labelRegex":"^v8.9.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/157889","number":157889,"mergeCommit":{"message":"Support new enrichment fields (#157889)\n\n## Summary\r\n\r\nAdds support for the following Endpoint fields for detection \r\nrules telemetry:\r\n\r\n- process.Ext.effective_parent.name\r\n- process.Ext.effective_parent.executable\r\n- file.Ext.original.name\r\n- process.Ext.api.name\r\n- file.Ext.header_bytes\r\n- process.parent.Ext.real.pid\r\n- dll.Ext.relative_file_creation_time\r\n- dll.Ext.relative_file_name_modify_time\r\n- file.Ext.entropy\r\n- dll.name\r\n- dll.path\r\n- dll.code_signature.trusted\r\n- dll.pe.original_file_name\r\n- file.directory\r\n- dll.hash.sha256\r\n- dll.pe.imphash\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"81bcd4a3bad1e6e057addecf29c5f8d7bdec0aae"}},{"branch":"8.8","label":"v8.8.1","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Sebastián Zaffarano <sebastian.zaffarano@elastic.co>
1 parent 64af286 commit 8a06aa4

File tree

2 files changed

+96
-12
lines changed

2 files changed

+96
-12
lines changed

‎x-pack/plugins/security_solution/server/lib/telemetry/filterlists/index.test.ts‎

Lines changed: 69 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,30 +6,26 @@
66
*/
77

88
import { copyAllowlistedFields } from '.';
9+
import { prebuiltRuleAllowlistFields } from './prebuilt_rules_alerts';
10+
import type { AllowlistFields } from './types';
911

1012
describe('Security Telemetry filters', () => {
1113
describe('allowlistEventFields', () => {
12-
const allowlist = {
14+
const testingKeys: AllowlistFields = {
1315
_id: true,
1416
a: true,
1517
b: true,
1618
c: {
1719
d: true,
1820
},
19-
'kibana.alert.ancestors': true,
20-
'kibana.alert.original_event.module': true,
21-
'event.id': true,
22-
'event.ingested': true,
23-
'event.kind': true,
24-
'event.module': true,
25-
'event.outcome': true,
26-
'event.provider': true,
27-
'event.type': true,
28-
'powershell.file.script_block_text': true,
2921
'kubernetes.pod.uid': true,
3022
'kubernetes.pod.name': true,
3123
'kubernetes.pod.ip': true,
32-
package_version: true,
24+
};
25+
26+
const allowlist = {
27+
...prebuiltRuleAllowlistFields,
28+
...testingKeys,
3329
};
3430

3531
it('filters top level', () => {
@@ -47,6 +43,67 @@ describe('Security Telemetry filters', () => {
4743
});
4844
});
4945

46+
it('filters endpoint enrichments', () => {
47+
const expected = {
48+
dll: {
49+
code_signature: {
50+
trusted: '1',
51+
},
52+
Ext: {
53+
relative_file_creation_time: '2',
54+
relative_file_name_modify_time: '3',
55+
},
56+
hash: {
57+
sha256: '4',
58+
},
59+
name: '5',
60+
path: '6',
61+
pe: {
62+
imphash: '7',
63+
original_file_name: '8',
64+
},
65+
},
66+
file: {
67+
directory: '9',
68+
Ext: {
69+
entropy: '10',
70+
header_bytes: '11',
71+
original: {
72+
name: '12',
73+
},
74+
},
75+
},
76+
process: {
77+
Ext: {
78+
api: {
79+
name: '13',
80+
},
81+
effective_parent: {
82+
executable: '14',
83+
name: '15',
84+
},
85+
},
86+
parent: {
87+
Ext: {
88+
real: {
89+
pid: '16',
90+
},
91+
},
92+
},
93+
},
94+
};
95+
96+
const event = {
97+
...expected,
98+
...{
99+
val1: 'unexpected-1',
100+
val2: 'unexpected-2',
101+
},
102+
};
103+
104+
expect(copyAllowlistedFields(allowlist, event)).toStrictEqual(expected);
105+
});
106+
50107
it('filters nested', () => {
51108
const event = {
52109
a: {

‎x-pack/plugins/security_solution/server/lib/telemetry/filterlists/prebuilt_rules_alerts.ts‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,9 +82,23 @@ export const prebuiltRuleAllowlistFields: AllowlistFields = {
8282
port: true,
8383
},
8484
dll: {
85+
Ext: {
86+
relative_file_creation_time: true,
87+
relative_file_name_modify_time: true,
88+
},
8589
code_signature: {
8690
status: true,
8791
subject_name: true,
92+
trusted: true,
93+
},
94+
name: true,
95+
path: true,
96+
pe: {
97+
original_file_name: true,
98+
imphash: true,
99+
},
100+
hash: {
101+
sha256: true,
88102
},
89103
},
90104
dns: {
@@ -129,6 +143,13 @@ export const prebuiltRuleAllowlistFields: AllowlistFields = {
129143
entity_id: true,
130144
executable: true,
131145
Ext: {
146+
api: {
147+
name: true,
148+
},
149+
effective_parent: {
150+
executable: true,
151+
name: true,
152+
},
132153
token: {
133154
integrity_level_name: true,
134155
},
@@ -235,7 +256,13 @@ export const prebuiltRuleAllowlistFields: AllowlistFields = {
235256
},
236257
},
237258
file: {
259+
directory: true,
238260
Ext: {
261+
entropy: true,
262+
header_bytes: true,
263+
original: {
264+
name: true,
265+
},
239266
windows: {
240267
zone_identifier: true,
241268
},

0 commit comments

Comments
 (0)