forked from opensearch-project/OpenSearch-Dashboards
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[SIEM] Add Authentications histogram (#48260) (#49522)
- Loading branch information
1 parent
7b2a586
commit 9f539f1
Showing
22 changed files
with
861 additions
and
161 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
28 changes: 28 additions & 0 deletions
28
x-pack/legacy/plugins/siem/public/components/page/hosts/authentications_over_time/index.tsx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import React from 'react'; | ||
|
|
||
| import * as i18n from './translation'; | ||
| import { getCustomChartData } from './utils'; | ||
| import { MatrixOverTimeHistogram, MatrixOverTimeBasicProps } from '../../../matrix_over_time'; | ||
|
|
||
| export const AuthenticationsOverTimeHistogram = (props: MatrixOverTimeBasicProps) => { | ||
| const dataKey = 'authenticationsOverTime'; | ||
| const { data, ...matrixOverTimeProps } = props; | ||
|
|
||
| const customChartData = getCustomChartData(data); | ||
|
|
||
| return ( | ||
| <MatrixOverTimeHistogram | ||
| title={i18n.AUTHENTICATIONS_COUNT} | ||
| dataKey={dataKey} | ||
| data={data} | ||
| customChartData={customChartData} | ||
| {...matrixOverTimeProps} | ||
| /> | ||
| ); | ||
| }; |
20 changes: 20 additions & 0 deletions
20
...legacy/plugins/siem/public/components/page/hosts/authentications_over_time/translation.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import { i18n } from '@kbn/i18n'; | ||
|
|
||
| export const AUTHENTICATIONS_COUNT = i18n.translate( | ||
| 'xpack.siem.authenticationsOverTime.authenticationCountTitle', | ||
| { | ||
| defaultMessage: 'Authentications count', | ||
| } | ||
| ); | ||
|
|
||
| export const UNIT = (totalCount: number) => | ||
| i18n.translate('xpack.siem.authenticationsOverTime.unit', { | ||
| values: { totalCount }, | ||
| defaultMessage: `{totalCount, plural, =1 {authentication} other {authentications}}`, | ||
| }); |
39 changes: 39 additions & 0 deletions
39
x-pack/legacy/plugins/siem/public/components/page/hosts/authentications_over_time/utils.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import { groupBy, map, toPairs } from 'lodash/fp'; | ||
|
|
||
| import { ChartSeriesData } from '../../../charts/common'; | ||
| import { MatrixOverTimeHistogramData } from '../../../../graphql/types'; | ||
| import { KpiHostsChartColors } from '../kpi_hosts/types'; | ||
|
|
||
| const formatToChartDataItem = ([key, value]: [ | ||
| string, | ||
| MatrixOverTimeHistogramData[] | ||
| ]): ChartSeriesData => ({ | ||
| key, | ||
| value, | ||
| }); | ||
|
|
||
| const addCustomColors = (item: ChartSeriesData) => { | ||
| if (item.key === 'authentication_success') { | ||
| item.color = KpiHostsChartColors.authSuccess; | ||
| } | ||
|
|
||
| if (item.key === 'authentication_failure') { | ||
| item.color = KpiHostsChartColors.authFailure; | ||
| } | ||
|
|
||
| return item; | ||
| }; | ||
|
|
||
| export const getCustomChartData = (data: MatrixOverTimeHistogramData[]): ChartSeriesData[] => { | ||
| const dataGroupedByEvent = groupBy('g', data); | ||
| const dataGroupedEntries = toPairs(dataGroupedByEvent); | ||
| const formattedChartData = map(formatToChartDataItem, dataGroupedEntries); | ||
|
|
||
| return map(addCustomColors, formattedChartData); | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
13 changes: 13 additions & 0 deletions
13
x-pack/legacy/plugins/siem/public/components/page/hosts/kpi_hosts/types.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| export enum KpiHostsChartColors { | ||
| authSuccess = '#00B3A4', | ||
| authFailure = '#920000', | ||
| uniqueSourceIps = '#DB1374', | ||
| uniqueDestinationIps = '#490092', | ||
| hosts = '#3185FC', | ||
| } |
37 changes: 37 additions & 0 deletions
37
...ntainers/authentications/authentications_over_time/authentications_over_time.gql_query.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import gql from 'graphql-tag'; | ||
|
|
||
| export const AuthenticationsOverTimeGqlQuery = gql` | ||
| query GetAuthenticationsOverTimeQuery( | ||
| $sourceId: ID! | ||
| $timerange: TimerangeInput! | ||
| $defaultIndex: [String!]! | ||
| $filterQuery: String | ||
| $inspect: Boolean! | ||
| ) { | ||
| source(id: $sourceId) { | ||
| id | ||
| AuthenticationsOverTime( | ||
| timerange: $timerange | ||
| filterQuery: $filterQuery | ||
| defaultIndex: $defaultIndex | ||
| ) { | ||
| authenticationsOverTime { | ||
| x | ||
| y | ||
| g | ||
| } | ||
| totalCount | ||
| inspect @include(if: $inspect) { | ||
| dsl | ||
| response | ||
| } | ||
| } | ||
| } | ||
| } | ||
| `; |
Oops, something went wrong.