Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[EDR Workflows] Automated Actions in more rule types #191874

Merged
merged 50 commits into from
Sep 18, 2024
Merged

[EDR Workflows] Automated Actions in more rule types #191874

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
50 commits
Select commit Hold shift + click to select a range
5fb4a70
response actions in eql and esql rules
tomsonpl Aug 30, 2024
96c92ed
Merge branch 'main' into automated-in-all-rules
tomsonpl Sep 2, 2024
2b342da
limit to esql and eql
tomsonpl Sep 2, 2024
0db366d
add type
tomsonpl Sep 2, 2024
e9b272c
fix types
tomsonpl Sep 2, 2024
45c6f9a
fix cy test
tomsonpl Sep 2, 2024
a07a932
Merge branch 'main' into automated-in-all-rules
tomsonpl Sep 2, 2024
90990df
[CI] Auto-commit changed files from 'yarn openapi:bundle'
kibanamachine Sep 2, 2024
5c3701b
[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…
kibanamachine Sep 2, 2024
3a983f9
snapshots
tomsonpl Sep 2, 2024
ac7010c
Merge remote-tracking branch 'origin/automated-in-all-rules' into aut…
tomsonpl Sep 2, 2024
62f3045
Merge branch 'main' into automated-in-all-rules
tomsonpl Sep 3, 2024
e3cef1a
fix
tomsonpl Sep 3, 2024
28a93d2
rename type
tomsonpl Sep 3, 2024
f566043
roll back ThresholdRule position
maximpn Sep 3, 2024
e878208
Merge branch 'main' into automated-in-all-rules
tomsonpl Sep 9, 2024
4e3be88
pass response actions to more rules
tomsonpl Sep 9, 2024
4bdb90c
Merge remote-tracking branch 'origin/automated-in-all-rules' into aut…
tomsonpl Sep 9, 2024
9453127
[CI] Auto-commit changed files from 'yarn openapi:bundle'
kibanamachine Sep 9, 2024
a73360b
[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…
kibanamachine Sep 9, 2024
8cd270d
fix tests, remove TypeSpecificFields filter
tomsonpl Sep 9, 2024
f989c37
Merge remote-tracking branch 'origin/automated-in-all-rules' into aut…
tomsonpl Sep 9, 2024
64dffe1
fix e2e
tomsonpl Sep 10, 2024
3e46918
fix header
tomsonpl Sep 10, 2024
3977af5
temporary hide other rule types - intermediate release
tomsonpl Sep 11, 2024
eac4b45
intermediate release - comment out e2e test
tomsonpl Sep 11, 2024
cab1f84
Update form.cy.ts
tomsonpl Sep 11, 2024
618982b
Merge branch 'main' into automated-in-all-rules
tomsonpl Sep 11, 2024
3fc2bcf
feature flag
tomsonpl Sep 12, 2024
708905a
fix
tomsonpl Sep 12, 2024
28e37f2
fixes
tomsonpl Sep 12, 2024
a27a0dd
Merge branch 'main' into automated-in-all-rules
tomsonpl Sep 12, 2024
07a573c
[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…
kibanamachine Sep 12, 2024
16a534c
fix
tomsonpl Sep 12, 2024
2f79a3d
Merge remote-tracking branch 'origin/automated-in-all-rules' into aut…
tomsonpl Sep 13, 2024
6f0e36e
use TypeSpecificCreatePropsInternal instead of TypeSpecificFields
tomsonpl Sep 13, 2024
c1536b9
Merge branch 'main' into automated-in-all-rules
tomsonpl Sep 13, 2024
81fc160
Merge branch 'main' into automated-in-all-rules
tomsonpl Sep 13, 2024
6a39a14
Merge branch 'main' into automated-in-all-rules
tomsonpl Sep 16, 2024
ebf458d
Merge branch 'main' into automated-in-all-rules
tomsonpl Sep 18, 2024
ee68d55
move back response_actions to typespecific rules
tomsonpl Sep 18, 2024
1dc5cf4
move condition logic to scheduleNotificationResponseActionsService
tomsonpl Sep 18, 2024
412e456
Merge remote-tracking branch 'origin/automated-in-all-rules' into aut…
tomsonpl Sep 18, 2024
69d9cd0
tests
tomsonpl Sep 18, 2024
d787d0a
[CI] Auto-commit changed files from 'yarn openapi:bundle'
kibanamachine Sep 18, 2024
e2680e9
fix
tomsonpl Sep 18, 2024
6215ded
Merge remote-tracking branch 'origin/automated-in-all-rules' into aut…
tomsonpl Sep 18, 2024
87c0c8b
fix tests
tomsonpl Sep 18, 2024
2b7c7f4
fix license header again
tomsonpl Sep 18, 2024
ade46fd
remove redundant spaces
tomsonpl Sep 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
144 changes: 128 additions & 16 deletions ...solution/docs/openapi/ess/security_solution_detections_api_2023_10_31.bundled.schema.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2042,10 +2042,6 @@ components:
$ref: '#/components/schemas/RuleFilterArray'
index:
$ref: '#/components/schemas/IndexPatternArray'
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
tiebreaker_field:
$ref: '#/components/schemas/TiebreakerField'
timestamp_field:
Expand Down Expand Up @@ -2128,6 +2124,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -2243,6 +2243,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -2355,6 +2359,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -2450,6 +2458,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -2575,6 +2587,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -2690,6 +2706,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -2733,10 +2753,6 @@ components:
properties:
alert_suppression:
$ref: '#/components/schemas/AlertSuppression'
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
EsqlRulePatchProps:
allOf:
- type: object
Expand Down Expand Up @@ -2800,6 +2816,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -2917,6 +2937,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -3169,6 +3193,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -3284,6 +3312,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -3399,6 +3431,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -3510,6 +3546,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -3711,6 +3751,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -3827,6 +3871,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -3956,6 +4004,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -4076,6 +4128,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -4299,6 +4355,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -4415,6 +4475,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -4471,10 +4535,6 @@ components:
$ref: '#/components/schemas/RuleFilterArray'
index:
$ref: '#/components/schemas/IndexPatternArray'
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
saved_id:
$ref: '#/components/schemas/SavedQueryId'
QueryRulePatchFields:
Expand Down Expand Up @@ -4546,6 +4606,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -4660,6 +4724,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -5330,6 +5398,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -5446,6 +5518,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -5502,10 +5578,6 @@ components:
$ref: '#/components/schemas/IndexPatternArray'
query:
$ref: '#/components/schemas/RuleQuery'
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
SavedQueryRulePatchFields:
allOf:
- type: object
Expand Down Expand Up @@ -5577,6 +5649,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -5691,6 +5767,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -5938,6 +6018,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -6054,6 +6138,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -6197,6 +6285,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -6320,6 +6412,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -6509,6 +6605,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -6625,6 +6725,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -6754,6 +6858,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down Expand Up @@ -6871,6 +6979,10 @@ components:
items:
$ref: '#/components/schemas/RequiredFieldInput'
type: array
response_actions:
items:
$ref: '#/components/schemas/ResponseAction'
type: array
risk_score:
$ref: '#/components/schemas/RiskScore'
risk_score_mapping:
Expand Down
Loading