Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution][Detection Engine] adds backend implementation for IM alert suppression #175032

Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
44 commits
Select commit Hold shift + click to select a range
c5586d0
initial commit
vitaliidm Jan 10, 2024
55c8262
cover code branches
vitaliidm Jan 10, 2024
ff21f56
Merge branch 'security/alert-suppression-im-eql' into suppression/add…
vitaliidm Jan 10, 2024
7623305
Update mappings.json
vitaliidm Jan 10, 2024
42cd3b7
Update mappings.json
vitaliidm Jan 10, 2024
3dfd64c
deduplication test
vitaliidm Jan 15, 2024
52392c5
Update indicator_match_alert_suppression.ts
vitaliidm Jan 15, 2024
c1f22b5
Merge branch 'security/alert-suppression-im-eql' into suppression/add…
vitaliidm Jan 15, 2024
672978b
Update indicator_match_alert_suppression.ts
vitaliidm Jan 17, 2024
ea0426b
Merge branch 'security/alert-suppression-im-eql' into suppression/add…
vitaliidm Jan 17, 2024
52d4517
Merge branch 'security/alert-suppression-im-eql' into suppression/add…
vitaliidm Jan 17, 2024
6287048
[Security Solution][Detection Engine] adds backend implementation for…
vitaliidm Jan 17, 2024
eecd793
Merge branch 'security/alert-suppression-im-eql' into suppression/im-…
vitaliidm Jan 17, 2024
c076394
[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…
kibanamachine Jan 17, 2024
938a69f
fix tests
vitaliidm Jan 17, 2024
d5bb020
Merge branch 'suppression/im-backend' of https://github.com/vitaliidm…
vitaliidm Jan 17, 2024
19096a7
remove .only
vitaliidm Jan 17, 2024
5ed5e53
fix typos
vitaliidm Jan 18, 2024
78597d9
push array tests
vitaliidm Jan 18, 2024
892c579
implement second code execution branch
vitaliidm Jan 18, 2024
14302ba
add license && FF checks
vitaliidm Jan 22, 2024
60be017
Merge branch 'security/alert-suppression-im-eql' into suppression/im-…
vitaliidm Jan 22, 2024
3482ff6
suppressed alerts count
vitaliidm Jan 23, 2024
7a337d5
Merge branch 'suppression/im-backend' of https://github.com/vitaliidm…
vitaliidm Jan 23, 2024
71ba362
Merge branch 'security/alert-suppression-im-eql' into suppression/im-…
vitaliidm Jan 23, 2024
0a20b4c
Merge branch 'security/alert-suppression-im-eql' into suppression/im-…
vitaliidm Jan 24, 2024
df605ca
attempt to fix tests
vitaliidm Jan 24, 2024
bacdce1
fixes
vitaliidm Jan 24, 2024
b9f2708
fix lints
vitaliidm Jan 24, 2024
02bc8eb
Merge branch 'security/alert-suppression-im-eql' into suppression/im-…
vitaliidm Jan 25, 2024
af9cb7b
corner cases fixes
vitaliidm Jan 25, 2024
6b77483
Merge branch 'suppression/im-backend' of https://github.com/vitaliidm…
vitaliidm Jan 25, 2024
81c94c6
amend single rule execution
vitaliidm Jan 25, 2024
d346dcf
fixe more corner cases
vitaliidm Jan 25, 2024
debf162
fix serverless rule executions
vitaliidm Jan 25, 2024
240b52e
fix even more corner cases
vitaliidm Jan 25, 2024
002c564
fix 9,000 case
vitaliidm Jan 25, 2024
95aa197
remove .only
vitaliidm Jan 26, 2024
2e33138
fix broken tests
vitaliidm Jan 26, 2024
f944321
fix corner cases
vitaliidm Jan 26, 2024
0852428
fixes
vitaliidm Jan 26, 2024
2f08c53
Merge branch 'security/alert-suppression-im-eql' into suppression/im-…
vitaliidm Jan 26, 2024
7af14cf
refactor search after
vitaliidm Jan 26, 2024
bd1b891
add tests
vitaliidm Jan 26, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions x-pack/plugins/rule_registry/common/schemas/8.13.0/index.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/

import { ALERT_SUPPRESSION_TERMS } from '@kbn/rule-data-utils';
import { AlertWithCommonFields880 } from '../8.8.0';

import { SuppressionFields870 } from '../8.7.0';

/* DO NOT MODIFY THIS SCHEMA TO ADD NEW FIELDS. These types represent the alerts that shipped in 8.7.0.
Any changes to these types should be bug fixes so the types more accurately represent the alerts from 8.7.0.

If you are adding new fields for a new release of Kibana, create a new sibling folder to this one
for the version to be released and add the field(s) to the schema in that folder.

Then, update `../index.ts` to import from the new folder that has the latest schemas, add the
new schemas to the union of all alert schemas, and re-export the new schemas as the `*Latest` schemas.
*/

export interface SuppressionFields8130
extends Omit<SuppressionFields870, typeof ALERT_SUPPRESSION_TERMS> {
[ALERT_SUPPRESSION_TERMS]: Array<{
field: string;
value: string | number | null | string[] | number[];
}>;
}

export type AlertWithSuppressionFields8130<T> = AlertWithCommonFields880<T> & SuppressionFields8130;
12 changes: 5 additions & 7 deletions x-pack/plugins/rule_registry/common/schemas/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -5,21 +5,19 @@
* 2.0.
*/

import type {
AlertWithSuppressionFields870,
SuppressionFields870,
CommonAlertIdFieldName870,
} from './8.7.0';
import type { CommonAlertIdFieldName870 } from './8.7.0';

import type {
AlertWithCommonFields880,
CommonAlertFieldName880,
CommonAlertFields880,
} from './8.8.0';

import type { AlertWithSuppressionFields8130, SuppressionFields8130 } from './8.13.0';

export type {
AlertWithSuppressionFields870 as AlertWithSuppressionFieldsLatest,
SuppressionFields870 as SuppressionFieldsLatest,
AlertWithSuppressionFields8130 as AlertWithSuppressionFieldsLatest,
SuppressionFields8130 as SuppressionFieldsLatest,
CommonAlertFieldName880 as CommonAlertFieldNameLatest,
CommonAlertIdFieldName870 as CommonAlertIdFieldNameLatest,
CommonAlertFields880 as CommonAlertFieldsLatest,
Expand Down
Loading