[8.12] [Security Solution] Fix rule export for a large number of rules (

#175979) (#176211) # Backport This will backport the following commits from `main` to `8.12`: - [[Security Solution] Fix rule export for a large number of rules (#175979)](#175979)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Maxim Palenov <[email protected]>
elastic · Feb 5, 2024 · 43a6eb6 · 43a6eb6
1 parent c97a4a4
commit 43a6eb6
Show file tree

Hide file tree

Showing 14 changed files with 471 additions and 701 deletions.
diff --git a/...ugins/security_solution/server/lib/detection_engine/routes/__mocks__/request_responses.ts b/...ugins/security_solution/server/lib/detection_engine/routes/__mocks__/request_responses.ts
@@ -352,7 +352,10 @@ export const nonRuleAlert = () => ({
   alertTypeId: 'something',
 });
 
-export const getRuleMock = <T extends RuleParams>(params: T): SanitizedRule<T> => ({
+export const getRuleMock = <T extends RuleParams>(
+  params: T,
+  rewrites?: Partial<SanitizedRule<T>>
+): SanitizedRule<T> => ({
   id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
   name: 'Detect Root/Admin Users',
   tags: [],
@@ -377,6 +380,7 @@ export const getRuleMock = <T extends RuleParams>(params: T): SanitizedRule<T> =
     lastExecutionDate: new Date('2020-08-20T19:23:38Z'),
   },
   revision: 0,
+  ...rewrites,
 });
 
 export const resolveRuleMock = <T extends RuleParams>(params: T): ResolvedSanitizedRule<T> => ({

diff --git a/...rity_solution/server/lib/detection_engine/rule_management/api/rules/bulk_actions/route.ts b/...rity_solution/server/lib/detection_engine/rule_management/api/rules/bulk_actions/route.ts
@@ -492,9 +492,7 @@ export const performBulkActionRoute = (
               const exported = await getExportByObjectIds(
                 rulesClient,
                 exceptionsClient,
-                savedObjectsClient,
-                rules.map(({ params }) => ({ rule_id: params.ruleId })),
-                logger,
+                rules.map(({ params }) => params.ruleId),
                 exporter,
                 request,
                 actionsClient

diff --git a/...rity_solution/server/lib/detection_engine/rule_management/api/rules/export_rules/route.ts b/...rity_solution/server/lib/detection_engine/rule_management/api/rules/export_rules/route.ts
@@ -51,11 +51,7 @@ export const exportRulesRoute = (
         const exceptionsClient = (await context.lists)?.getExceptionListClient();
         const actionsClient = (await context.actions)?.getActionsClient();
 
-        const {
-          getExporter,
-          getClient,
-          client: savedObjectsClient,
-        } = (await context.core).savedObjects;
+        const { getExporter, getClient } = (await context.core).savedObjects;
 
         const client = getClient({ includedHiddenTypes: ['action'] });
         const actionsExporter = getExporter(client);
@@ -83,18 +79,14 @@ export const exportRulesRoute = (
               ? await getExportByObjectIds(
                   rulesClient,
                   exceptionsClient,
-                  savedObjectsClient,
-                  request.body.objects,
-                  logger,
+                  request.body.objects.map((obj) => obj.rule_id),
                   actionsExporter,
                   request,
                   actionsClient
                 )
               : await getExportAll(
                   rulesClient,
                   exceptionsClient,
-                  savedObjectsClient,
-                  logger,
                   actionsExporter,
                   request,
                   actionsClient

diff --git a/...rity_solution/server/lib/detection_engine/rule_management/logic/export/exportable_rule.ts b/...rity_solution/server/lib/detection_engine/rule_management/logic/export/exportable_rule.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RuleResponse } from '../../../../../../common/api/detection_engine/model/rule_schema';
+
+export type ExportableRule = Omit<RuleResponse, 'execution_summary'>;
diff --git a/..._solution/server/lib/detection_engine/rule_management/logic/export/get_export_all.test.ts b/..._solution/server/lib/detection_engine/rule_management/logic/export/get_export_all.test.ts
@@ -9,7 +9,6 @@ import type { FindHit } from '../../../routes/__mocks__/request_responses';
 import {
   getRuleMock,
   getFindResultWithSingleHit,
-  getEmptySavedObjectsResponse,
 } from '../../../routes/__mocks__/request_responses';
 import { rulesClientMock } from '@kbn/alerting-plugin/server/mocks';
 import { getExportAll } from './get_export_all';
@@ -22,8 +21,6 @@ import {
 
 import { getQueryRuleParams } from '../../../rule_schema/mocks';
 import { getExceptionListClientMock } from '@kbn/lists-plugin/server/services/exception_lists/exception_list_client.mock';
-import type { loggingSystemMock } from '@kbn/core/server/mocks';
-import { requestContextMock } from '../../../routes/__mocks__/request_context';
 import { savedObjectsExporterMock } from '@kbn/core-saved-objects-import-export-server-mocks';
 import { mockRouter } from '@kbn/core-http-router-server-mocks';
 import { Readable } from 'stream';
@@ -54,13 +51,11 @@ const connectors = [
   },
 ];
 describe('getExportAll', () => {
-  let logger: ReturnType<typeof loggingSystemMock.createLogger>;
-  const { clients } = requestContextMock.createTools();
   const exporterMock = savedObjectsExporterMock.create();
   const requestMock = mockRouter.createKibanaRequest();
   const actionsClient = actionsClientMock.create();
+
   beforeEach(async () => {
-    clients.savedObjectsClient.find.mockResolvedValue(getEmptySavedObjectsResponse());
     actionsClient.getAll.mockImplementation(async () => {
       return connectors;
     });
@@ -85,8 +80,6 @@ describe('getExportAll', () => {
     const exports = await getExportAll(
       rulesClient,
       exceptionsClient,
-      clients.savedObjectsClient,
-      logger,
       exporterMock,
       requestMock,
       actionsClient
@@ -172,8 +165,6 @@ describe('getExportAll', () => {
     const exports = await getExportAll(
       rulesClient,
       exceptionsClient,
-      clients.savedObjectsClient,
-      logger,
       exporterMock,
       requestMock,
       actionsClient
@@ -258,8 +249,6 @@ describe('getExportAll', () => {
     const exports = await getExportAll(
       rulesClient,
       exceptionsClient,
-      clients.savedObjectsClient,
-      logger,
       exporterMockWithConnector as never,
       requestMock,
       actionsClient
@@ -401,8 +390,6 @@ describe('getExportAll', () => {
     const exports = await getExportAll(
       rulesClient,
       exceptionsClient,
-      clients.savedObjectsClient,
-      logger,
       exporterMockWithConnector as never,
       requestMock,
       actionsClient

diff --git a/...urity_solution/server/lib/detection_engine/rule_management/logic/export/get_export_all.ts b/...urity_solution/server/lib/detection_engine/rule_management/logic/export/get_export_all.ts
@@ -7,21 +7,20 @@
 
 import { transformDataToNdjson } from '@kbn/securitysolution-utils';
 
-import type { ISavedObjectsExporter, KibanaRequest, Logger } from '@kbn/core/server';
+import type { ISavedObjectsExporter, KibanaRequest } from '@kbn/core/server';
 import type { ExceptionListClient } from '@kbn/lists-plugin/server';
-import type { RulesClient, RuleExecutorServices } from '@kbn/alerting-plugin/server';
+import type { RulesClient } from '@kbn/alerting-plugin/server';
 import type { ActionsClient } from '@kbn/actions-plugin/server';
 import { getNonPackagedRules } from '../search/get_existing_prepackaged_rules';
 import { getExportDetailsNdjson } from './get_export_details_ndjson';
-import { transformAlertsToRules, transformRuleToExportableFormat } from '../../utils/utils';
+import { transformAlertsToRules } from '../../utils/utils';
 import { getRuleExceptionsForExport } from './get_export_rule_exceptions';
 import { getRuleActionConnectorsForExport } from './get_export_rule_action_connectors';
+import { transformRuleToExportableFormat } from './transform_rule_to_exportable_format';
 
 export const getExportAll = async (
   rulesClient: RulesClient,
   exceptionsClient: ExceptionListClient | undefined,
-  savedObjectsClient: RuleExecutorServices['savedObjectsClient'],
-  logger: Logger,
   actionsExporter: ISavedObjectsExporter,
   request: KibanaRequest,
   actionsClient: ActionsClient