Skip to content

Migrates security solution usage collector es client from legacy to new #86853

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Jan 4, 2021
Merged

Migrates security solution usage collector es client from legacy to new #86853

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
218b2b1
Refactors usage collector to use the new elasticsearch client rather …
TinaHeiligers Dec 22, 2020
09bfdf0
Merge branch 'master' into security-solution-migrate-fetch-esclient
kibanamachine Dec 27, 2020
ae5325d
Merge branch 'master' into security-solution-migrate-fetch-esclient
kibanamachine Dec 31, 2020
a571842
Merge branch 'master' into security-solution-migrate-fetch-esclient
kibanamachine Jan 1, 2021
ac17fb7
updates NOTICE.txt
TinaHeiligers Jan 1, 2021
b566502
Merge branch 'master' into security-solution-migrate-fetch-esclient
kibanamachine Jan 4, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions x-pack/plugins/security_solution/server/usage/collector.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,12 +78,12 @@ export const registerCollector: RegisterCollector = ({
},
},
isReady: () => kibanaIndex.length > 0,
fetch: async ({ callCluster }: CollectorFetchContext): Promise<UsageData> => {
fetch: async ({ esClient }: CollectorFetchContext): Promise<UsageData> => {
const savedObjectsClient = await getInternalSavedObjectsClient(core);
const [detections, endpoints] = await Promise.allSettled([
fetchDetectionsUsage(
kibanaIndex,
callCluster,
esClient,
ml,
(savedObjectsClient as unknown) as SavedObjectsClientContract
),
Expand Down
30 changes: 8 additions & 22 deletions x-pack/plugins/security_solution/server/usage/detections/detections.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* you may not use this file except in compliance with the Elastic License.
*/

import { LegacyAPICaller, SavedObjectsClientContract } from '../../../../../../src/core/server';
import { ElasticsearchClient, SavedObjectsClientContract } from '../../../../../../src/core/server';
import { elasticsearchServiceMock } from '../../../../../../src/core/server/mocks';
import { mlServicesMock } from '../../lib/machine_learning/mocks';
import {
Expand All @@ -16,22 +16,17 @@ import { fetchDetectionsUsage } from './index';

describe('Detections Usage', () => {
describe('fetchDetectionsUsage()', () => {
let callClusterMock: jest.Mocked<LegacyAPICaller>;
let esClientMock: jest.Mocked<ElasticsearchClient>;
let savedObjectsClientMock: jest.Mocked<SavedObjectsClientContract>;
let mlMock: ReturnType<typeof mlServicesMock.create>;

beforeEach(() => {
callClusterMock = elasticsearchServiceMock.createLegacyClusterClient().callAsInternalUser;
esClientMock = elasticsearchServiceMock.createClusterClient().asInternalUser;
mlMock = mlServicesMock.create();
});

it('returns zeroed counts if both calls are empty', async () => {
const result = await fetchDetectionsUsage(
'',
callClusterMock,
mlMock,
savedObjectsClientMock
);
const result = await fetchDetectionsUsage('', esClientMock, mlMock, savedObjectsClientMock);

expect(result).toEqual({
detection_rules: {
Expand All @@ -58,13 +53,9 @@ describe('Detections Usage', () => {
});

it('tallies rules data given rules results', async () => {
(callClusterMock as jest.Mock).mockResolvedValue(getMockRulesResponse());
const result = await fetchDetectionsUsage(
'',
callClusterMock,
mlMock,
savedObjectsClientMock
);
(esClientMock.search as jest.Mock).mockResolvedValue({ body: getMockRulesResponse() });

const result = await fetchDetectionsUsage('', esClientMock, mlMock, savedObjectsClientMock);

expect(result).toEqual(
expect.objectContaining({
Expand Down Expand Up @@ -92,12 +83,7 @@ describe('Detections Usage', () => {
jobsSummary: mockJobSummary,
});

const result = await fetchDetectionsUsage(
'',
callClusterMock,
mlMock,
savedObjectsClientMock
);
const result = await fetchDetectionsUsage('', esClientMock, mlMock, savedObjectsClientMock);

expect(result).toEqual(
expect.objectContaining({
Expand Down
32 changes: 25 additions & 7 deletions x-pack/plugins/security_solution/server/usage/detections/detections_helpers.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,11 @@
* you may not use this file except in compliance with the Elastic License.
*/

import { SearchParams } from 'elasticsearch';
Copy link
Contributor

@michaelolo24 michaelolo24 Jan 4, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Guessing this was an accidental import @rylnd?

Copy link
Contributor

@rylnd rylnd Jan 4, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Its use was replaced by the custom RuleSearchParams below!


import {
LegacyAPICaller,
ElasticsearchClient,
SavedObjectsClientContract,
KibanaRequest,
SearchResponse,
} from '../../../../../../src/core/server';
import { MlPluginSetup } from '../../../../ml/server';
import { SIGNALS_ID, INTERNAL_IMMUTABLE_KEY } from '../../../common/constants';
Expand All @@ -22,6 +21,26 @@ interface DetectionsMetric {
isEnabled: boolean;
}

interface RuleSearchBody {
query: {
bool: {
filter: {
term: { [key: string]: string };
};
};
};
}
interface RuleSearchParams {
Copy link
Contributor

@rylnd rylnd Jan 4, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: since ruleSearchOptions is an internal variable and its type is already constrained by its usage I would be inclined to make its type implicit and remove RuleSearchParams. However, there's nothing wrong with the explicit interface here, either.

Copy link
Contributor Author

@TinaHeiligers TinaHeiligers Jan 4, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll keep it explicit for now and leave it up to your team to remove if that's what you prefer.

body: RuleSearchBody;
filterPath: string[];
ignoreUnavailable: boolean;
index: string;
size: number;
}
interface RuleSearchResult {
alert: { enabled: boolean; tags: string[] };
}

const isElasticRule = (tags: string[]) => tags.includes(`${INTERNAL_IMMUTABLE_KEY}:true`);

/**
Expand Down Expand Up @@ -135,10 +154,10 @@ const updateMlJobsUsage = (jobMetric: DetectionsMetric, usage: MlJobsUsage): MlJ

export const getRulesUsage = async (
index: string,
callCluster: LegacyAPICaller
esClient: ElasticsearchClient
): Promise<DetectionRulesUsage> => {
let rulesUsage: DetectionRulesUsage = initialRulesUsage;
const ruleSearchOptions: SearchParams = {
const ruleSearchOptions: RuleSearchParams = {
body: { query: { bool: { filter: { term: { 'alert.alertTypeId': SIGNALS_ID } } } } },
filterPath: ['hits.hits._source.alert.enabled', 'hits.hits._source.alert.tags'],
ignoreUnavailable: true,
Expand All @@ -147,8 +166,7 @@ export const getRulesUsage = async (
};

try {
const ruleResults = await callCluster<{ alert: { enabled: boolean; tags: string[] } }>(
'search',
const { body: ruleResults } = await esClient.search<SearchResponse<RuleSearchResult>>(
ruleSearchOptions
);

Expand Down
6 changes: 3 additions & 3 deletions x-pack/plugins/security_solution/server/usage/detections/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* you may not use this file except in compliance with the Elastic License.
*/

import { LegacyAPICaller, SavedObjectsClientContract } from '../../../../../../src/core/server';
import { ElasticsearchClient, SavedObjectsClientContract } from '../../../../../../src/core/server';
import {
getMlJobsUsage,
getRulesUsage,
Expand Down Expand Up @@ -40,12 +40,12 @@ export const defaultDetectionsUsage = {

export const fetchDetectionsUsage = async (
kibanaIndex: string,
callCluster: LegacyAPICaller,
esClient: ElasticsearchClient,
ml: MlPluginSetup | undefined,
savedObjectClient: SavedObjectsClientContract
): Promise<DetectionsUsage> => {
const [rulesUsage, mlJobsUsage] = await Promise.allSettled([
getRulesUsage(kibanaIndex, callCluster),
getRulesUsage(kibanaIndex, esClient),
getMlJobsUsage(ml, savedObjectClient),
]);

Expand Down