[SIEM] [Detection Engine] Timestamps for rules (#56197) (#56225)

* utilize createdAt and updatedAt from the alerting saved object * revert accidental change to test rule * updatedAt is not a part of savedObject attributes passed back from alerting, it's at the top level
elastic · Jan 28, 2020 · f9d72bb · f9d72bb
1 parent 8fdb64d
commit f9d72bb
Show file tree

Hide file tree

Showing 19 changed files with 85 additions and 32 deletions.
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
@@ -269,8 +269,6 @@ export const getResult = (): RuleAlertType => ({
   alertTypeId: 'siem.signals',
   consumer: 'siem',
   params: {
-    createdAt: '2019-12-13T16:40:33.400Z',
-    updatedAt: '2019-12-13T16:40:33.400Z',
     description: 'Detecting root and admin users',
     ruleId: 'rule-1',
     index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],

diff --git a/...k/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts b/...k/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts
@@ -50,7 +50,6 @@ export const createCreateRulesBulkRoute = (server: ServerFacade): Hapi.ServerRou
       const rules = await Promise.all(
         request.payload.map(async payloadRule => {
           const {
-            created_at: createdAt,
             description,
             enabled,
             false_positives: falsePositives,
@@ -72,7 +71,6 @@ export const createCreateRulesBulkRoute = (server: ServerFacade): Hapi.ServerRou
             threat,
             to,
             type,
-            updated_at: updatedAt,
             references,
             timeline_id: timelineId,
             timeline_title: timelineTitle,
@@ -103,7 +101,6 @@ export const createCreateRulesBulkRoute = (server: ServerFacade): Hapi.ServerRou
             const createdRule = await createRules({
               alertsClient,
               actionsClient,
-              createdAt,
               description,
               enabled,
               falsePositives,
@@ -128,7 +125,6 @@ export const createCreateRulesBulkRoute = (server: ServerFacade): Hapi.ServerRou
               to,
               type,
               threat,
-              updatedAt,
               references,
               version,
             });

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.ts
@@ -34,7 +34,6 @@ export const createCreateRulesRoute = (server: ServerFacade): Hapi.ServerRoute =
     },
     async handler(request: RulesRequest, headers) {
       const {
-        created_at: createdAt,
         description,
         enabled,
         false_positives: falsePositives,
@@ -58,7 +57,6 @@ export const createCreateRulesRoute = (server: ServerFacade): Hapi.ServerRoute =
         threat,
         to,
         type,
-        updated_at: updatedAt,
         references,
       } = request.payload;
       const alertsClient = isFunction(request.getAlertsClient) ? request.getAlertsClient() : null;
@@ -90,7 +88,6 @@ export const createCreateRulesRoute = (server: ServerFacade): Hapi.ServerRoute =
         const createdRule = await createRules({
           alertsClient,
           actionsClient,
-          createdAt,
           description,
           enabled,
           falsePositives,
@@ -115,7 +112,6 @@ export const createCreateRulesRoute = (server: ServerFacade): Hapi.ServerRoute =
           to,
           type,
           threat,
-          updatedAt,
           references,
           version: 1,
         });

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/import_rules_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/import_rules_route.ts
@@ -129,7 +129,6 @@ export const createImportRulesRoute = (server: ServerFacade): Hapi.ServerRoute =
               const createdRule = await createRules({
                 alertsClient,
                 actionsClient,
-                createdAt: new Date().toISOString(),
                 description,
                 enabled,
                 falsePositives,
@@ -154,7 +153,6 @@ export const createImportRulesRoute = (server: ServerFacade): Hapi.ServerRoute =
                 to,
                 type,
                 threat,
-                updatedAt: new Date().toISOString(),
                 references,
                 version,
               });

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts
@@ -81,8 +81,8 @@ export const transformAlertToRule = (
   ruleStatus?: SavedObject<IRuleSavedAttributesSavedObjectAttributes>
 ): Partial<OutputRuleAlertRest> => {
   return pickBy<OutputRuleAlertRest>((value: unknown) => value != null, {
-    created_at: alert.params.createdAt,
-    updated_at: alert.params.updatedAt,
+    created_at: alert.createdAt.toISOString(),
+    updated_at: alert.updatedAt.toISOString(),
     created_by: alert.createdBy,
     description: alert.params.description,
     enabled: alert.enabled,

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/create_rules.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/create_rules.ts
@@ -45,7 +45,6 @@ export const createRules = ({
       alertTypeId: SIGNALS_ID,
       consumer: APP_ID,
       params: {
-        createdAt: new Date().toISOString(),
         description,
         ruleId,
         index,
@@ -66,7 +65,6 @@ export const createRules = ({
         threat,
         to,
         type,
-        updatedAt: new Date().toISOString(),
         references,
         version,
       },

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/install_prepacked_rules.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/install_prepacked_rules.ts
@@ -75,8 +75,6 @@ export const installPrepackagedRules = (
         threat,
         references,
         version,
-        createdAt: new Date().toISOString(),
-        updatedAt: new Date().toISOString(),
       }),
     ];
   }, []);
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.ts
@@ -164,7 +164,6 @@ export const updateRules = async ({
       threat,
       to,
       type,
-      updatedAt: new Date().toISOString(),
       references,
       version: calculatedVersion,
     }

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/__mocks__/es_results.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/__mocks__/es_results.ts
@@ -35,8 +35,6 @@ export const sampleRuleAlertParams = (
   meta: undefined,
   threat: undefined,
   version: 1,
-  updatedAt: '2019-12-17T15:04:25.343Z',
-  createdAt: '2019-12-17T15:04:37.105Z',
 });
 
 export const sampleDocNoSortId = (someUuid: string = sampleIdGuid): SignalSourceHit => ({

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.test.ts
@@ -25,6 +25,8 @@ describe('buildBulkBody', () => {
       ruleParams: sampleParams,
       id: sampleRuleGuid,
       name: 'rule-name',
+      createdAt: '2020-01-28T15:58:34.810Z',
+      updatedAt: '2020-01-28T15:59:14.004Z',
       createdBy: 'elastic',
       updatedBy: 'elastic',
       interval: '5m',
@@ -103,6 +105,8 @@ describe('buildBulkBody', () => {
       ruleParams: sampleParams,
       id: sampleRuleGuid,
       name: 'rule-name',
+      createdAt: '2020-01-28T15:58:34.810Z',
+      updatedAt: '2020-01-28T15:59:14.004Z',
       createdBy: 'elastic',
       updatedBy: 'elastic',
       interval: '5m',
@@ -189,6 +193,8 @@ describe('buildBulkBody', () => {
       ruleParams: sampleParams,
       id: sampleRuleGuid,
       name: 'rule-name',
+      createdAt: '2020-01-28T15:58:34.810Z',
+      updatedAt: '2020-01-28T15:59:14.004Z',
       createdBy: 'elastic',
       updatedBy: 'elastic',
       interval: '5m',
@@ -272,6 +278,8 @@ describe('buildBulkBody', () => {
       ruleParams: sampleParams,
       id: sampleRuleGuid,
       name: 'rule-name',
+      createdAt: '2020-01-28T15:58:34.810Z',
+      updatedAt: '2020-01-28T15:59:14.004Z',
       createdBy: 'elastic',
       updatedBy: 'elastic',
       interval: '5m',

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.ts
@@ -15,7 +15,9 @@ interface BuildBulkBodyParams {
   ruleParams: RuleTypeParams;
   id: string;
   name: string;
+  createdAt: string;
   createdBy: string;
+  updatedAt: string;
   updatedBy: string;
   interval: string;
   enabled: boolean;
@@ -28,7 +30,9 @@ export const buildBulkBody = ({
   ruleParams,
   id,
   name,
+  createdAt,
   createdBy,
+  updatedAt,
   updatedBy,
   interval,
   enabled,
@@ -39,7 +43,9 @@ export const buildBulkBody = ({
     id,
     name,
     enabled,
+    createdAt,
     createdBy,
+    updatedAt,
     updatedBy,
     interval,
     tags,

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.test.ts
@@ -31,6 +31,8 @@ describe('buildRule', () => {
       name: 'some-name',
       id: sampleRuleGuid,
       enabled: false,
+      createdAt: '2020-01-28T15:58:34.810Z',
+      updatedAt: '2020-01-28T15:59:14.004Z',
       createdBy: 'elastic',
       updatedBy: 'elastic',
       interval: 'some interval',
@@ -85,6 +87,8 @@ describe('buildRule', () => {
       name: 'some-name',
       id: sampleRuleGuid,
       enabled: true,
+      createdAt: '2020-01-28T15:58:34.810Z',
+      updatedAt: '2020-01-28T15:59:14.004Z',
       createdBy: 'elastic',
       updatedBy: 'elastic',
       interval: 'some interval',
@@ -128,6 +132,8 @@ describe('buildRule', () => {
       name: 'some-name',
       id: sampleRuleGuid,
       enabled: true,
+      createdAt: '2020-01-28T15:58:34.810Z',
+      updatedAt: '2020-01-28T15:59:14.004Z',
       createdBy: 'elastic',
       updatedBy: 'elastic',
       interval: 'some interval',

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.ts
@@ -12,7 +12,9 @@ interface BuildRuleParams {
   name: string;
   id: string;
   enabled: boolean;
+  createdAt: string;
   createdBy: string;
+  updatedAt: string;
   updatedBy: string;
   interval: string;
   tags: string[];
@@ -23,7 +25,9 @@ export const buildRule = ({
   name,
   id,
   enabled,
+  createdAt,
   createdBy,
+  updatedAt,
   updatedBy,
   interval,
   tags,
@@ -58,7 +62,7 @@ export const buildRule = ({
     updated_by: updatedBy,
     threat: ruleParams.threat,
     version: ruleParams.version,
-    created_at: ruleParams.createdAt,
-    updated_at: ruleParams.updatedAt,
+    created_at: createdAt,
+    updated_at: updatedAt,
   });
 };
diff --git a/.../legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.test.ts b/.../legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.test.ts
@@ -40,6 +40,8 @@ describe('searchAfterAndBulkCreate', () => {
       id: sampleRuleGuid,
       signalsIndex: DEFAULT_SIGNALS_INDEX,
       name: 'rule-name',
+      createdAt: '2020-01-28T15:58:34.810Z',
+      updatedAt: '2020-01-28T15:59:14.004Z',
       createdBy: 'elastic',
       updatedBy: 'elastic',
       interval: '5m',
@@ -93,6 +95,8 @@ describe('searchAfterAndBulkCreate', () => {
       id: sampleRuleGuid,
       signalsIndex: DEFAULT_SIGNALS_INDEX,
       name: 'rule-name',
+      createdAt: '2020-01-28T15:58:34.810Z',
+      updatedAt: '2020-01-28T15:59:14.004Z',
       createdBy: 'elastic',
       updatedBy: 'elastic',
       interval: '5m',
@@ -117,6 +121,8 @@ describe('searchAfterAndBulkCreate', () => {
       id: sampleRuleGuid,
       signalsIndex: DEFAULT_SIGNALS_INDEX,
       name: 'rule-name',
+      createdAt: '2020-01-28T15:58:34.810Z',
+      updatedAt: '2020-01-28T15:59:14.004Z',
       createdBy: 'elastic',
       updatedBy: 'elastic',
       interval: '5m',
@@ -148,6 +154,8 @@ describe('searchAfterAndBulkCreate', () => {
       id: sampleRuleGuid,
       signalsIndex: DEFAULT_SIGNALS_INDEX,
       name: 'rule-name',
+      createdAt: '2020-01-28T15:58:34.810Z',
+      updatedAt: '2020-01-28T15:59:14.004Z',
       createdBy: 'elastic',
       updatedBy: 'elastic',
       interval: '5m',
@@ -179,6 +187,8 @@ describe('searchAfterAndBulkCreate', () => {
       id: sampleRuleGuid,
       signalsIndex: DEFAULT_SIGNALS_INDEX,
       name: 'rule-name',
+      createdAt: '2020-01-28T15:58:34.810Z',
+      updatedAt: '2020-01-28T15:59:14.004Z',
       createdBy: 'elastic',
       updatedBy: 'elastic',
       interval: '5m',
@@ -212,6 +222,8 @@ describe('searchAfterAndBulkCreate', () => {
       id: sampleRuleGuid,
       signalsIndex: DEFAULT_SIGNALS_INDEX,
       name: 'rule-name',
+      createdAt: '2020-01-28T15:58:34.810Z',
+      updatedAt: '2020-01-28T15:59:14.004Z',
       createdBy: 'elastic',
       updatedBy: 'elastic',
       interval: '5m',
@@ -245,6 +257,8 @@ describe('searchAfterAndBulkCreate', () => {
       id: sampleRuleGuid,
       signalsIndex: DEFAULT_SIGNALS_INDEX,
       name: 'rule-name',
+      createdAt: '2020-01-28T15:58:34.810Z',
+      updatedAt: '2020-01-28T15:59:14.004Z',
       createdBy: 'elastic',
       updatedBy: 'elastic',
       interval: '5m',
@@ -280,6 +294,8 @@ describe('searchAfterAndBulkCreate', () => {
       id: sampleRuleGuid,
       signalsIndex: DEFAULT_SIGNALS_INDEX,
       name: 'rule-name',
+      createdAt: '2020-01-28T15:58:34.810Z',
+      updatedAt: '2020-01-28T15:59:14.004Z',
       createdBy: 'elastic',
       updatedBy: 'elastic',
       interval: '5m',

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.ts
@@ -19,8 +19,10 @@ interface SearchAfterAndBulkCreateParams {
   id: string;
   signalsIndex: string;
   name: string;
+  createdAt: string;
   createdBy: string;
   updatedBy: string;
+  updatedAt: string;
   interval: string;
   enabled: boolean;
   pageSize: number;
@@ -38,8 +40,10 @@ export const searchAfterAndBulkCreate = async ({
   signalsIndex,
   filter,
   name,
+  createdAt,
   createdBy,
   updatedBy,
+  updatedAt,
   interval,
   enabled,
   pageSize,
@@ -58,7 +62,9 @@ export const searchAfterAndBulkCreate = async ({
     id,
     signalsIndex,
     name,
+    createdAt,
     createdBy,
+    updatedAt,
     updatedBy,
     interval,
     enabled,
@@ -118,7 +124,9 @@ export const searchAfterAndBulkCreate = async ({
         id,
         signalsIndex,
         name,
+        createdAt,
         createdBy,
+        updatedAt,
         updatedBy,
         interval,
         enabled,