get all findings as part of findings API enhancement

src/main/java/org/opensearch/securityanalytics/action/GetFindingsRequest.java

@@ -45,9 +45,9 @@ public GetFindingsRequest(String detectorId, String logType, Table table) {
     @Override
     public ActionRequestValidationException validate() {
         ActionRequestValidationException validationException = null;
-        if ((detectorId == null || detectorId.length() == 0) && logType == null) {
+        if (detectorId != null && detectorId.length() == 0) {
             validationException = addValidationError(String.format(Locale.getDefault(),
-                            "At least one of detector type or detector id needs to be passed", DETECTOR_ID),
+                            "%s is missing", DETECTOR_ID),
                     validationException);
         }
         return validationException;

src/main/java/org/opensearch/securityanalytics/transport/TransportGetFindingsAction.java

@@ -104,65 +104,95 @@
             return;
         }
 
-        if (request.getLogType() == null) {
+        if (request.getLogType() == null && request.getDetectorId() == null) {
+            // Get all the Findings
+            SearchRequest searchRequest = getSearchRequest(request);
+            transportSearchAction(request, actionListener, searchRequest);
+
+        } else if (request.getLogType() == null) {
             findingsService.getFindingsByDetectorId(
                     request.getDetectorId(),
                     request.getTable(),
                     actionListener
                     );
         } else {
             // "detector" is nested type, so we have to use nested query
-            NestedQueryBuilder queryBuilder =
-                    QueryBuilders.nestedQuery(
-                        "detector",
-                        QueryBuilders.boolQuery().must(
-                                QueryBuilders.matchQuery(
-                                    DETECTOR_TYPE_PATH,
-                                    request.getLogType()
+            SearchRequest searchRequest = getSearchRequest(request);
+            transportSearchAction(request, actionListener, searchRequest);
+        }
+    }
+
+    private void transportSearchAction(GetFindingsRequest request, ActionListener<GetFindingsResponse> actionListener, SearchRequest searchRequest) {
+        transportSearchDetectorAction.execute(new SearchDetectorRequest(searchRequest), new ActionListener<>() {
+            @Override
+            public void onResponse(SearchResponse searchResponse) {
+                try {
+                    List<Detector> detectors = DetectorUtils.getDetectors(searchResponse, xContentRegistry);
+                    if (detectors.size() == 0) {
+                        actionListener.onFailure(
+                                SecurityAnalyticsException.wrap(
+                                        new OpenSearchStatusException(
+                                                "No detectors found for provided type", RestStatus.NOT_FOUND
+                                        )
                                 )
-                        ),
-                        ScoreMode.None
-                    );
-            SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
-            searchSourceBuilder.query(queryBuilder);
-            searchSourceBuilder.fetchSource(true);
-            SearchRequest searchRequest = new SearchRequest();
-            searchRequest.indices(Detector.DETECTORS_INDEX);
-            searchRequest.source(searchSourceBuilder);
-            searchRequest.preference(Preference.PRIMARY_FIRST.type());
-
-            transportSearchDetectorAction.execute(new SearchDetectorRequest(searchRequest), new ActionListener<>() {
-                @Override
-                public void onResponse(SearchResponse searchResponse) {
-                    try {
-                        List<Detector> detectors = DetectorUtils.getDetectors(searchResponse, xContentRegistry);
-                        if (detectors.size() == 0) {
-                            actionListener.onFailure(
-                                    SecurityAnalyticsException.wrap(
-                                            new OpenSearchStatusException(
-                                                    "No detectors found for provided type", RestStatus.NOT_FOUND
-                                            )
-                                    )
-                            );
-                            return;
-                        }
-                        findingsService.getFindings(
-                                detectors,
-                                request.getLogType(),
-                                request.getTable(),
-                                actionListener
                         );
-                    } catch (IOException e) {
-                        actionListener.onFailure(e);
+                        return;
                     }
-                }
-
-                @Override
-                public void onFailure(Exception e) {
+                    findingsService.getFindings(
+                            detectors,
+                            request.getLogType() == null ? "*" : request.getLogType(),
+                            request.getTable(),
+                            actionListener
+                    );
+                } catch (IOException e) {
                     actionListener.onFailure(e);
                 }
-            });
+            }
+
+            @Override
+            public void onFailure(Exception e) {
+                actionListener.onFailure(e);
+            }
+        });
+    }
+
+    private static SearchRequest getSearchRequest(GetFindingsRequest request) {
+        NestedQueryBuilder queryBuilder = getNestedQueryBuilder(request);
+        SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
+        searchSourceBuilder.query(queryBuilder);
+        searchSourceBuilder.fetchSource(true);
+        SearchRequest searchRequest = new SearchRequest();
+        searchRequest.indices(Detector.DETECTORS_INDEX);
+        searchRequest.source(searchSourceBuilder);
+        searchRequest.preference(Preference.PRIMARY_FIRST.type());
+        return searchRequest;
+    }
+
+    private static NestedQueryBuilder getNestedQueryBuilder(GetFindingsRequest request) {
+        NestedQueryBuilder queryBuilder;
+        if (request.getLogType() != null) {
+            queryBuilder = QueryBuilders.nestedQuery(
+                            "detector",
+                            QueryBuilders.boolQuery().must(
+                                    QueryBuilders.matchQuery(
+                                            DETECTOR_TYPE_PATH,
+                                            request.getLogType()
+                                    )
+                            ),
+                            ScoreMode.None
+                    );
+        }
+        else {
+            queryBuilder =
+                    QueryBuilders.nestedQuery(
+                            "detector",
+                            QueryBuilders.boolQuery().must(
+                                    QueryBuilders.matchAllQuery()
+                            ),
+                            ScoreMode.None
+                    );
         }
+        return queryBuilder;
     }
 
     private void setFilterByEnabled(boolean filterByEnabled) {

src/test/java/org/opensearch/securityanalytics/findings/FindingIT.java

@@ -12,12 +12,15 @@
 import java.util.Map;
 import java.util.stream.Collectors;
 
+import org.apache.hc.core5.http.HttpHost;
 import org.apache.hc.core5.http.HttpStatus;
 import org.junit.Assert;
 import org.junit.Ignore;
 import org.opensearch.client.Request;
 import org.opensearch.client.Response;
 import org.opensearch.client.ResponseException;
+import org.opensearch.client.RestClient;
+import org.opensearch.commons.rest.SecureRestClientBuilder;
 import org.opensearch.core.rest.RestStatus;
 import org.opensearch.search.SearchHit;
 import org.opensearch.securityanalytics.SecurityAnalyticsPlugin;
@@ -265,6 +268,111 @@ public void testGetFindings_byDetectorType_success() throws IOException {
         Assert.assertEquals(1, getFindingsBody.get("total_findings"));
     }
 
+    public void testGetAllFindings_success() throws IOException {
+        String index1 = createTestIndex(randomIndex(), windowsIndexMapping());
+
+        // Execute CreateMappingsAction to add alias mapping for index
+        Request createMappingRequest = new Request("POST", SecurityAnalyticsPlugin.MAPPER_BASE_URI);
+        // both req params and req body are supported
+        createMappingRequest.setJsonEntity(
+                "{ \"index_name\":\"" + index1 + "\"," +
+                        "  \"rule_topic\":\"" + randomDetectorType() + "\", " +
+                        "  \"partial\":true" +
+                        "}"
+        );
+
+        Response response = client().performRequest(createMappingRequest);
+        assertEquals(HttpStatus.SC_OK, response.getStatusLine().getStatusCode());
+
+        // index 2
+        String index2 = createTestIndex("netflow_test", netFlowMappings());
+
+        // Execute CreateMappingsAction to add alias mapping for index
+        createMappingRequest = new Request("POST", SecurityAnalyticsPlugin.MAPPER_BASE_URI);
+        // both req params and req body are supported
+        createMappingRequest.setJsonEntity(
+                "{ \"index_name\":\"" + index2 + "\"," +
+                        "  \"rule_topic\":\"netflow\", " +
+                        "  \"partial\":true" +
+                        "}"
+        );
+
+        response = client().performRequest(createMappingRequest);
+        assertEquals(HttpStatus.SC_OK, response.getStatusLine().getStatusCode());
+        // Detector 1 - WINDOWS
+        Detector detector1 = randomDetectorWithTriggers(getRandomPrePackagedRules(), List.of(new DetectorTrigger(null, "test-trigger", "1", List.of(randomDetectorType()), List.of(), List.of(), List.of(), List.of(), List.of())));
+        Response createResponse = makeRequest(client(), "POST", SecurityAnalyticsPlugin.DETECTOR_BASE_URI, Collections.emptyMap(), toHttpEntity(detector1));
+        Assert.assertEquals("Create detector failed", RestStatus.CREATED, restStatus(createResponse));
+
+        Map<String, Object> responseBody = asMap(createResponse);
+
+        String createdId = responseBody.get("_id").toString();
+
+        String request = "{\n" +
+                "   \"query\" : {\n" +
+                "     \"match\":{\n" +
+                "        \"_id\": \"" + createdId + "\"\n" +
+                "     }\n" +
+                "   }\n" +
+                "}";
+        List<SearchHit> hits = executeSearch(Detector.DETECTORS_INDEX, request);
+        SearchHit hit = hits.get(0);
+        String monitorId1 = ((List<String>) ((Map<String, Object>) hit.getSourceAsMap().get("detector")).get("monitor_id")).get(0);
+        // Detector 2 - NETWORK
+        DetectorInput inputNetflow = new DetectorInput("windows detector for security analytics", List.of("netflow_test"), Collections.emptyList(),
+                getPrePackagedRules("network").stream().map(DetectorRule::new).collect(Collectors.toList()));
+        Detector detector2 = randomDetectorWithTriggers(
+                getPrePackagedRules("network"),
+                List.of(new DetectorTrigger(null, "test-trigger", "1", List.of("network"), List.of(), List.of(), List.of(), List.of(), List.of())),
+                "network",
+                inputNetflow
+        );
+
+        createResponse = makeRequest(client(), "POST", SecurityAnalyticsPlugin.DETECTOR_BASE_URI, Collections.emptyMap(), toHttpEntity(detector2));
+        Assert.assertEquals("Create detector failed", RestStatus.CREATED, restStatus(createResponse));
+
+        responseBody = asMap(createResponse);
+
+        createdId = responseBody.get("_id").toString();
+
+        request = "{\n" +
+                "   \"query\" : {\n" +
+                "     \"match\":{\n" +
+                "        \"_id\": \"" + createdId + "\"\n" +
+                "     }\n" +
+                "   }\n" +
+                "}";
+        hits = executeSearch(Detector.DETECTORS_INDEX, request);
+        hit = hits.get(0);
+        String monitorId2 = ((List<String>) ((Map<String, Object>) hit.getSourceAsMap().get("detector")).get("monitor_id")).get(0);
+
+        indexDoc(index1, "1", randomDoc());
+        indexDoc(index2, "1", randomDoc());
+        // execute monitor 1
+        Response executeResponse = executeAlertingMonitor(monitorId1, Collections.emptyMap());
+        Map<String, Object> executeResults = entityAsMap(executeResponse);
+
+        int noOfSigmaRuleMatches = ((List<Map<String, Object>>) ((Map<String, Object>) executeResults.get("input_results")).get("results")).get(0).size();
+        Assert.assertEquals(5, noOfSigmaRuleMatches);
+
+        // execute monitor 2
+        executeResponse = executeAlertingMonitor(monitorId2, Collections.emptyMap());
+        executeResults = entityAsMap(executeResponse);
+
+        noOfSigmaRuleMatches = ((List<Map<String, Object>>) ((Map<String, Object>) executeResults.get("input_results")).get("results")).get(0).size();
+        Assert.assertEquals(1, noOfSigmaRuleMatches);
+
+        client().performRequest(new Request("POST", "_refresh"));
+
+        // Call GetFindings API for all the detectors
+        Map<String, String> params = new HashMap<>();
+        Response getFindingsResponse = makeRequest(client(), "GET", SecurityAnalyticsPlugin.FINDINGS_BASE_URI + "/_search", params, null);
+        Map<String, Object> getFindingsBody = entityAsMap(getFindingsResponse);
+        Assert.assertEquals(2, getFindingsBody.get("total_findings"));
+        // Call GetFindings API for second detector
+        params.clear();
+    }
+
     public void testGetFindings_rolloverByMaxAge_success() throws IOException, InterruptedException {
 
         updateClusterSetting(FINDING_HISTORY_ROLLOVER_PERIOD.getKey(), "1s");